@ultimat3/admin 24.0.0 → 25.1.0

package/src/mcp-tools.ts

@@ -5,12 +5,12 @@
 // Tool descriptions are literal English on purpose: they are protocol payload read by a
 // model, not UI copy read by a person, so they are not `t()` keys.
 
-import { decideAction, permissionsForAction } from './action-gate';
+import { adminPermissionForAction, decideAction, permissionsForAction } from './action-gate';
 import type { AdminApp } from './admin';
 import { type AdminDecision, decideAll } from './authz';
 import { type CrudCtx, decideOperation, permissionsForOperation } from './crud';
 import type { AdminFieldType } from './fields';
-import type { AdminOperation } from './permissions';
+import { type AdminOperation, type AdminPermission, adminPermissionFor } from './permissions';
 import type { AdminAction } from './registry';
 import type { AdminResource } from './resource';
 
@@ -32,6 +32,12 @@ export interface AdminMcpTool {
   readonly entity: string | null;
   readonly action: string | null;
   readonly permissions: readonly string[];
+  /**
+   * The MCP scope a token must carry to call it: the admin-level permission it needs — `admin:read`
+   * for a read and a `readonly` action, `admin:write` for a write, `admin:destroy` for a delete or a
+   * destructive action. The connection's gate, checked before the actor's own policy.
+   */
+  readonly scope: AdminPermission;
   /** Destructive tools require the confirmation token; agents must read before they delete. */
   readonly destructive: boolean;
   readonly input: readonly AdminToolField[];
@@ -110,6 +116,7 @@ function toolFor(resource: AdminResource, op: AdminOperation): AdminMcpTool | nu
         entity: resource.name,
         action: null,
         permissions: permissionsForOperation(resource.permission, 'list'),
+        scope: adminPermissionFor('list'),
         destructive: false,
         input: [
           CURSOR_FIELD,
@@ -126,6 +133,7 @@ function toolFor(resource: AdminResource, op: AdminOperation): AdminMcpTool | nu
         entity: resource.name,
         action: null,
         permissions: permissionsForOperation(resource.permission, 'detail'),
+        scope: adminPermissionFor('detail'),
         destructive: false,
         input: [ID_FIELD],
       };
@@ -137,6 +145,7 @@ function toolFor(resource: AdminResource, op: AdminOperation): AdminMcpTool | nu
         entity: resource.name,
         action: null,
         permissions: permissionsForOperation(resource.permission, 'create'),
+        scope: adminPermissionFor('create'),
         destructive: false,
         input: formFields(resource),
       };
@@ -148,6 +157,7 @@ function toolFor(resource: AdminResource, op: AdminOperation): AdminMcpTool | nu
         entity: resource.name,
         action: null,
         permissions: permissionsForOperation(resource.permission, 'update'),
+        scope: adminPermissionFor('update'),
         destructive: false,
         input: [ID_FIELD, ...formFields(resource)],
       };
@@ -159,6 +169,7 @@ function toolFor(resource: AdminResource, op: AdminOperation): AdminMcpTool | nu
         entity: resource.name,
         action: null,
         permissions: permissionsForOperation(resource.permission, 'delete'),
+        scope: adminPermissionFor('delete'),
         destructive: true,
         input: [ID_FIELD, { name: 'confirmation', type: 'text', required: true }],
       };
@@ -202,6 +213,7 @@ function toolGates(app: AdminApp): readonly ToolGate[] {
           entity: action.entity ?? null,
           action: action.name,
           permissions: permissionsForAction(action),
+          scope: adminPermissionForAction(action),
           destructive: action.destructive === true,
           input: actionEnvelope(action),
         },
@@ -220,6 +232,7 @@ function toolGates(app: AdminApp): readonly ToolGate[] {
       entity: null,
       action: null,
       permissions: permissionsForOperation('admin', 'search'),
+      scope: adminPermissionFor('search'),
       destructive: false,
       input: [{ name: 'term', type: 'text', required: true }],
     },
@@ -237,6 +250,7 @@ function toolGates(app: AdminApp): readonly ToolGate[] {
         entity: null,
         action: action.name,
         permissions: permissionsForAction(action),
+        scope: adminPermissionForAction(action),
         destructive: action.destructive === true,
         input: actionEnvelope(action),
       },

package/src/mcp.ts

@@ -3,13 +3,7 @@
 // confirmation rules as the buttons — this file adds a transport, not a second back door.
 
 import type { Actor } from '@ultimat3/core';
-import {
-  agentActor,
-  createContext,
-  hasContext,
-  runWithContext,
-  withChildContext,
-} from '@ultimat3/core';
+import { agentActor, ctxOf, hasContext, runWithContext, withChildContext } from '@ultimat3/core';
 import {
   type AnyMcpTool,
   type AppMcp,
@@ -39,6 +33,7 @@ import {
 import { AdminFilterInvalidError } from './errors';
 import type { AdminFieldType } from './fields';
 import { type AskedFilter, checkedFilter } from './list-filters';
+import { adminTokenScopes, adminToolScopes } from './mcp-scopes';
 import { type AdminMcpTool, adminMcpTools, adminToolCatalog } from './mcp-tools';
 import type { AdminAction, AdminRow } from './registry';
 import { adminSearch } from './search';
@@ -241,10 +236,22 @@ function crudResult(result: CrudResult<AdminRow>): AdminToolResult {
   return invalidIssues(result.issues);
 }
 
+/**
+ * What a session token resolves to: the actor, and optionally the admin scopes the TOKEN was
+ * issued for — narrower than the actor, never wider (the actor's policy still decides each tool).
+ * `['admin:read']` is a read-only token: list, read, search and `readonly` actions. Absent: the
+ * token is as strong as its actor (`adminTokenScopes`). Named `tokenScopes`, not `scopes`, because
+ * core's `Actor.scopes` is a different thing (framework capabilities) and an actor handed straight
+ * through must not have its `[]` read as "this token may do nothing".
+ */
+export interface AdminMcpActor extends AdminActor {
+  readonly tokenScopes?: readonly string[];
+}
+
 export interface AdminMcpOptions {
   readonly app: AdminApp;
   /** Resolve the MCP session's actor. The same hook the HTTP surface uses, never a bypass. */
-  actor(session: { readonly token?: string }): Promise<AdminActor | null> | AdminActor | null;
+  actor(session: { readonly token?: string }): Promise<AdminMcpActor | null> | AdminMcpActor | null;
   readonly requestId?: () => string;
 }
 
@@ -374,7 +381,7 @@ function allowedToolNames(
 const asCaller = <T>(actor: Actor, requestId: string, run: () => Promise<T>): Promise<T> =>
   hasContext()
     ? withChildContext({ actor }, run)
-    : runWithContext(createContext({ actor, requestId }), run);
+    : runWithContext(ctxOf({ actor, requestId }), run);
 
 function toMcpTool(opts: AdminMcpOptions, requestId: () => string, tool: AdminMcpTool): AnyMcpTool {
   return {
@@ -425,10 +432,15 @@ function toMcpTool(opts: AdminMcpOptions, requestId: () => string, tool: AdminMc
  */
 export function adminMcp(opts: AdminMcpOptions): AppMcp {
   const requestId = opts.requestId ?? ((): string => crypto.randomUUID());
+  const catalog = adminToolCatalog(opts.app);
 
   return defineAppMcp({
     name: 'admin',
-    tools: adminToolCatalog(opts.app).map((tool) => toMcpTool(opts, requestId, tool)),
+    tools: catalog.map((tool) => toMcpTool(opts, requestId, tool)),
+    // The connection gate: each tool needs its admin-level permission as a token scope, checked
+    // by the registry BEFORE the actor's policy. A stdio host builds its caller's scopes with
+    // `adminTokenScopes`, as `resolveToken` does below.
+    scopes: adminToolScopes(catalog),
     async resolveToken(token: string): Promise<ResolvedToken | null> {
       const actor = await opts.actor({ token });
       // `kind: 'agent'` — the same actor shape an agent gets everywhere else, so a policy
@@ -442,7 +454,7 @@ export function adminMcp(opts: AdminMcpOptions): AppMcp {
         ? null
         : {
             actor: agentActor({ id: actor.id, roles: actor.roles ?? [], orgId: actor.orgId }),
-            scopes: new Set(),
+            scopes: adminTokenScopes(actor.tokenScopes),
           };
     },
   });

package/src/pagination.ts

@@ -3,7 +3,8 @@
 // otherwise skip and repeat rows, and every page would re-scan everything before it.
 // The position itself is encoded by `@ultimat3/core` — one signed cursor format, framework-wide.
 
-import { decodeCursor, encodeCursor, isUltimateError } from '@ultimat3/core';
+import type { Page } from '@ultimat3/core';
+import { decodeCursor, encodeCursor, isUltimateError, pageOf } from '@ultimat3/core';
 import type { AdminFilter, AdminListQuery, AdminRow, AdminSort } from './registry';
 import { rowId } from './registry';
 import { type AdminResource, repoOf } from './resource';
@@ -66,15 +67,16 @@ export interface PageRequest {
   readonly where?: readonly AdminFilter[];
 }
 
-export interface AdminPage<Row extends AdminRow> {
-  readonly rows: readonly Row[];
+/**
+ * `@ultimat3/core`'s `Page` — `hasMore` (a page exists AFTER this one, what the Next control is
+ * enabled by, in both directions) and `nextCursor` (`null` exactly when it is false) — plus what
+ * only a screen pages by: the sort, the size, and the cursor that walks BACK.
+ */
+export type AdminPage<Row extends AdminRow> = Page<Row> & {
   readonly sort: AdminSort;
   readonly pageSize: number;
-  readonly nextCursor: string | null;
   readonly prevCursor: string | null;
-  /** A page exists AFTER this one — what the Next control is enabled by, in both directions. */
-  readonly hasMore: boolean;
-}
+};
 
 /** The repo query for one page. Asks for `limit + 1` to learn whether a next page exists. */
 export function listQuery<Row extends AdminRow>(
@@ -147,20 +149,22 @@ export function pageFrom<Row extends AdminRow>(
   const hasMore = backwards ? true : overflow;
   const hasPrevious = backwards ? overflow : incoming !== null;
 
-  return {
+  // `pageOf` derives `hasMore` from the cursor, so Next is enabled exactly when it leads somewhere.
+  const next = pageOf(
     rows,
+    hasMore && last !== undefined
+      ? encodeAdminCursor(resource, {
+          direction: 'after',
+          field: sort.field,
+          value: cursorValue(last, sort.field),
+          id: rowId(last, resource.idField),
+        })
+      : null,
+  );
+  return {
+    ...next,
     sort,
     pageSize,
-    hasMore,
-    nextCursor:
-      hasMore && last !== undefined
-        ? encodeAdminCursor(resource, {
-            direction: 'after',
-            field: sort.field,
-            value: cursorValue(last, sort.field),
-            id: rowId(last, resource.idField),
-          })
-        : null,
     prevCursor:
       hasPrevious && first !== undefined
         ? encodeAdminCursor(resource, {

package/src/policy-bridge.ts

@@ -17,8 +17,8 @@ import {
   type AdminAuthz,
   type AdminDecision,
   type AdminSubject,
-  allowed,
-  denied,
+  adminAllowed,
+  adminDenied,
   impliersOf,
 } from './authz';
 import { ADMIN_PERMISSIONS } from './permissions';
@@ -52,7 +52,7 @@ function readDecision(permission: string, result: unknown): AdminDecision {
   const verdict = result === true || bag.allowed === true;
   const reason = typeof inner.reason === 'string' ? inner.reason : 'admin.policy.evaluated';
   const trace = Array.isArray(bag.trace) ? bag.trace.map((line) => String(line)) : [];
-  return verdict ? allowed(permission, reason, trace) : denied(permission, reason, trace);
+  return verdict ? adminAllowed(permission, reason, trace) : adminDenied(permission, reason, trace);
 }
 
 /** `resource:verb` — the only shape `can()` takes. Anything else is denied, never thrown. */
@@ -104,7 +104,7 @@ export function roleAuthz(): AdminAuthz {
       // Asked BEFORE `can()`, which throws on a name the registry lacks: a decision is an answer,
       // and an undeclared permission is a refusal with its fix, never a 500 out of a nav render.
       if (!isPermission(permission) || !isKnownPermission(permission)) {
-        return denied(permission, 'admin.policy.missing', [
+        return adminDenied(permission, 'admin.policy.missing', [
           `"${permission}" is not a declared resource:verb permission`,
           `fix: definePermissions(['${permission}']), then grant it to a role in defineRoles()`,
         ]);
@@ -118,7 +118,7 @@ export function roleAuthz(): AdminAuthz {
       for (const implier of impliersOf(permission)) {
         const carried = evaluated(implier, can(implier as KnownPermission), actor, subject);
         if (carried.allowed) {
-          return allowed(permission, carried.reason, [
+          return adminAllowed(permission, carried.reason, [
             ...carried.trace,
             `${permission} is implied by ${implier}`,
           ]);
@@ -157,7 +157,7 @@ export function policyAuthz(input: PolicyAuthzInput): AdminAuthz {
     decide({ permission, actor, subject }): AdminDecision {
       const policy = input.policies[permission];
       if (policy === undefined) {
-        return denied(permission, 'admin.policy.missing', [
+        return adminDenied(permission, 'admin.policy.missing', [
           `no policy registered for "${permission}"`,
           `fix: definePermissions({ '${permission}': … }) or can('${permission}') on the action`,
         ]);

package/src/registry.ts

@@ -247,6 +247,13 @@ export interface AdminAction<Input = Readonly<Record<string, unknown>>, Output =
   /** The entity the button belongs to. Absent = a global action in the toolbar. */
   readonly entity?: string;
   readonly destructive?: boolean;
+  /**
+   * The action changes nothing — an export, a verification, a recount — so its admin-level gate is
+   * `admin:read` rather than `admin:write`, and a read-only staff role (or an `admin:read` MCP
+   * token) may run it. `destructive` and `matching` (a set-based write) win over it: the stricter
+   * gate is the one that applies.
+   */
+  readonly readonly?: boolean;
   /** Absent: `admin.action.<name>` — `actionLabelKey`, the one spelling every screen reads. */
   readonly labelKey?: string;
   /** Mirrors the action's own `mcp` block; the admin MCP surface honours `expose`. */

package/src/related.ts

@@ -2,7 +2,7 @@
 // related resource's own list — its gate, its row scope, its columns — narrowed to the rows that
 // point at this one. No second table is declared anywhere: the related resource already is one.
 
-import { relationsFor as entityRelationsFor } from '@ultimat3/entity';
+import { relationsFor } from '@ultimat3/entity';
 import { adminList, type CrudCtx, canOperate } from './crud';
 import { AdminFieldUnsupportedError } from './errors';
 import type { AdminPage } from './pagination';
@@ -36,7 +36,7 @@ export function relatedOf(
   if (resource.related.length === 0) return [];
   // The one read of `@ultimat3/entity`'s relations in this package: the FK already written IS
   // the relation, so the admin derives nothing of its own and names nothing twice.
-  const relations = entityRelationsFor(resource.name);
+  const relations = relationsFor(resource.name);
   const offered = Object.values(relations)
     .filter((relation) => relation.kind === 'hasMany')
     .map((relation) => relation.name);

package/src/relations.ts

@@ -196,7 +196,7 @@ async function relationOf(
  * per target — two for a picked target too large for a `<select>` — whatever the page's row count
  * and however many columns point at the same target.
  */
-export async function relationsFor(
+export async function relationDataFor(
   resources: readonly AdminResource[],
   ctx: CrudCtx,
   needs: ReadonlyMap<string, RelationNeed>,

package/src/resource.ts

@@ -69,6 +69,13 @@ export interface AdminResourceOptions<Row extends AdminRow = AdminRow> {
    * At most one `default: true`; `count: true` is one extra query per tab that asks for it.
    */
   readonly scopes?: Readonly<Record<string, AdminScopeOptions>>;
+  /**
+   * Show this resource's row count on the `/admin` home. Opt-in, as a scope tab's `count` is: the
+   * figure is one full `count()` over the actor's rows on EVERY visit to the front page, so on a
+   * big table any operator reloading it is a load generator. Absent: no tile, the resource is still
+   * listed in the permission matrix.
+   */
+  readonly count?: boolean;
   /**
    * The rows this ACTOR may see at all. Applied to every read of the resource — list, search,
    * detail, lookup, labels, MCP — so it is the one place a second audience is declared.
@@ -134,6 +141,8 @@ export interface AdminResource<Row extends AdminRow = AdminRow> {
   readonly columns: readonly AdminComputedColumn[];
   /** Declared scopes, in tab order. Empty for a resource that declares none. */
   readonly scopes: readonly AdminScope[];
+  /** The `/admin` home counts this resource — `count: true` declared. */
+  readonly count: boolean;
   /** `rows`, validated per call. Absent for a resource every permitted actor sees whole. */
   readonly rowScope?: AdminRowScope;
   /** The detail page's groups. Always at least one: undeclared fields have a default section. */
@@ -309,6 +318,7 @@ export function adminResource<Row extends AdminRow = AdminRow>(
     searchFields: fields.filter((field) => field.searchable),
     columns: computedColumnsOf(declared, opts.columns),
     scopes: scopesOf(declared, opts.scopes, opts.repo),
+    count: opts.count === true,
     ...(rowScope === undefined ? {} : { rowScope }),
     sections: layoutOf(
       {

package/src/screen-home-access.tsx

@@ -0,0 +1,117 @@
+// The `/admin` home's "Access" half: per resource the actor may open, the decision behind every
+// operation it offers — the same decision the call obeys. Data-second on the page, so each matrix is
+// a native `<details>`, closed, its summary the resource and how many of its operations are allowed.
+
+import { t } from '@ultimat3/i18n';
+import { Badge } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import styles from './admin.module.scss';
+import type { CrudCtx } from './crud';
+import { decideOperation, permissionsForOperation } from './crud';
+import { ADMIN_OPERATIONS, type AdminOperation } from './permissions';
+import type { AdminResource } from './resource';
+import homeStyles from './screen-home.module.scss';
+
+/** One row of an operation matrix: the decision the dashboard renders AND the call obeys. */
+export interface OperationDecision {
+  readonly operation: AdminOperation;
+  readonly allowed: boolean;
+  readonly permissions: readonly string[];
+  readonly reason: string;
+}
+
+/**
+ * Every operation the resource OFFERS, with its decision. This IS the view-only proof, rendered
+ * rather than asserted. One it does not offer has no row: "denied" would read as a missing grant
+ * the operator should ask for, when no grant opens it.
+ */
+export const operationMatrix = (
+  resource: AdminResource,
+  ctx: CrudCtx,
+): readonly OperationDecision[] =>
+  ADMIN_OPERATIONS.filter((operation) => resource.operations.includes(operation)).map(
+    (operation) => {
+      const decision = decideOperation(resource, operation, ctx);
+      return {
+        operation,
+        allowed: decision.allowed,
+        permissions: permissionsForOperation(resource.permission, operation),
+        reason: decision.reason,
+      };
+    },
+  );
+
+/**
+ * The permission matrix, rendered. A reader can see that `create`, `update` and `delete` are
+ * refused and WHICH permission refused them — the same decision the call obeys, not a note about
+ * a button that was left out.
+ */
+export function OperationMatrix(props: {
+  readonly rows: readonly OperationDecision[];
+}): JSX.Element {
+  return (
+    <table class={styles['matrix']}>
+      <thead>
+        <tr>
+          <th>{t('admin.matrix.operation')}</th>
+          <th>{t('admin.matrix.permissions')}</th>
+          <th>{t('admin.matrix.verdict')}</th>
+        </tr>
+      </thead>
+      <tbody>
+        {props.rows.map((row) => (
+          <tr class={row.allowed ? styles['allowed'] : styles['denied']}>
+            <td>{t(`admin.operation.${row.operation}`)}</td>
+            <td class={styles['mono']}>{row.permissions.join(' + ')}</td>
+            <td>
+              {row.allowed
+                ? t('admin.matrix.allowed')
+                : `${t('admin.matrix.deniedBy')} ${row.reason}`}
+            </td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+export interface HomeAccessProps {
+  readonly basePath: string;
+  readonly entries: readonly {
+    readonly resource: AdminResource;
+    readonly rows: readonly OperationDecision[];
+  }[];
+}
+
+/**
+ * Every matrix is in the document — closed is a presentation, never a withheld fact — and the
+ * summary's badge says at a glance whether the actor holds the whole resource or only part of it.
+ */
+export function HomeAccess(props: HomeAccessProps): JSX.Element {
+  return (
+    <section class={homeStyles['access']} aria-labelledby="admin-home-access">
+      <h2 id="admin-home-access" class={homeStyles['heading']}>
+        {t('admin.dashboard.access.title')}
+      </h2>
+      {props.entries.map(({ resource, rows }) => {
+        const allowed = rows.filter((row) => row.allowed).length;
+        return (
+          <details class={homeStyles['resource']}>
+            <summary class={homeStyles['summary']}>
+              <span class={homeStyles['name']}>{t(resource.titleKey)}</span>
+              <Badge tone={allowed === rows.length ? 'success' : 'neutral'} size="sm">
+                {t('admin.dashboard.access.allowed', { allowed, total: rows.length })}
+              </Badge>
+            </summary>
+            <div class={homeStyles['body']}>
+              <a href={`${props.basePath}${resource.path}`}>{t('admin.dashboard.access.open')}</a>
+              <div class={homeStyles['matrixScroll']}>
+                <OperationMatrix rows={rows} />
+              </div>
+            </div>
+          </details>
+        );
+      })}
+    </section>
+  );
+}

package/src/screen-home-counts.ts

@@ -0,0 +1,42 @@
+// The `/admin` home's figures: how many rows of each resource this actor could open. One
+// `AdminRepo.count` per resource that declared `count: true`, over its row scope and nothing else
+// — `rowWhere`, the predicate every list read starts from — so a tile never counts a hidden row.
+
+import type { AdminActor } from './authz';
+import { rowWhere } from './list-scope';
+import type { AdminResource } from './resource';
+
+export interface ResourceCount {
+  readonly resource: AdminResource;
+  readonly count: number;
+}
+
+/**
+ * The count of every resource handed in that declared `count: true`, in the order handed in. The caller hands in only what the
+ * actor may LIST (`canOperate(…, 'list', …)`): a size is a fact about a table, and a resource the
+ * actor may not open must not leak one. A repo with no `count()` — a hand-written one may leave it
+ * out — has no figure, so it is left out rather than shown as a zero it never measured.
+ *
+ * In parallel: these are independent reads, and the home page is the front door. A count the
+ * store refuses — a tenant-scoped table asked by an actor with no org is `X_TENANCY_UNSCOPED` —
+ * costs that resource its figure and nothing else, the way search lists a resource whose repo threw
+ * as skipped rather than answering 500 for the rest. The list behind the tile still reports it.
+ */
+export async function resourceCounts(
+  resources: readonly AdminResource[],
+  actor: AdminActor,
+): Promise<readonly ResourceCount[]> {
+  const countable = resources.flatMap((resource) => {
+    // Only a resource that asked: a home visit is otherwise one full count per table, every time.
+    if (!resource.count) return [];
+    const count = resource.repo?.count;
+    return count === undefined ? [] : [{ resource, count: count.bind(resource.repo) }];
+  });
+  const totals = await Promise.allSettled(
+    countable.map(({ resource, count }) => count(rowWhere(resource, actor))),
+  );
+  return countable.flatMap(({ resource }, index) => {
+    const total = totals[index];
+    return total?.status === 'fulfilled' ? [{ resource, count: total.value }] : [];
+  });
+}

package/src/screen-home-kpis.tsx

@@ -0,0 +1,64 @@
+// The `/admin` home's top band: one figure tile per resource the actor may open, each a link into
+// the list it counts, and the same figures as a ring of shares. Server markup only — the admin
+// ships no script — and a pure function of the counts it is handed.
+
+import { currentLocale, t } from '@ultimat3/i18n';
+import { Card, DonutChart, StatTile } from '@ultimat3/ui';
+import type { JSX } from 'solid-js';
+import styles from './screen-home.module.scss';
+import type { ResourceCount } from './screen-home-counts';
+
+export interface HomeKpisProps {
+  readonly basePath: string;
+  readonly counts: readonly ResourceCount[];
+}
+
+/** `data-stat` for a resource's tile: the stable hook a test or a live check reads it through. */
+export const countStat = (entity: string): string => `admin-count-${entity}`;
+
+export function HomeKpis(props: HomeKpisProps): JSX.Element {
+  // The figure follows the page's locale: `Intl.NumberFormat` needs no time zone.
+  const count = new Intl.NumberFormat(currentLocale());
+  // Largest first, so the ring reads clockwise from the biggest share and the legend agrees. An
+  // empty table is no share of anything: its tile says 0, and a legend of "0 · 0%" rows is noise.
+  const ranked = props.counts
+    .filter((entry) => entry.count > 0)
+    .sort((left, right) => right.count - left.count);
+  return (
+    <section class={styles['band']} aria-labelledby="admin-home-records">
+      <h2 id="admin-home-records" class={styles['heading']}>
+        {t('admin.dashboard.records.title')}
+      </h2>
+      <ul class={styles['kpis']}>
+        {props.counts.map(({ resource, count: total }) => (
+          <li>
+            <a class={styles['kpi']} href={`${props.basePath}${resource.path}`}>
+              <StatTile
+                label={t(resource.titleKey)}
+                value={count.format(total)}
+                stat={countStat(resource.name)}
+              />
+            </a>
+          </li>
+        ))}
+      </ul>
+      {/* One non-empty resource is a whole with one part: a ring of 100% says nothing new. */}
+      {ranked.length < 2 ? null : (
+        <Card class={styles['share']}>
+          <DonutChart
+            label={t('admin.dashboard.records.label')}
+            showCaption
+            segments={ranked.map(({ resource, count: total }) => ({
+              label: t(resource.titleKey),
+              value: total,
+            }))}
+            centreLabel={t('admin.dashboard.records.total')}
+            keyLabel={t('admin.dashboard.records.resource')}
+            valueLabel={t('admin.dashboard.records.title')}
+            format={(value: number) => count.format(value)}
+          />
+        </Card>
+      )}
+    </section>
+  );
+}