portal-mojo 0.2.19 → 0.2.21

package/src/admin/dns/shared-validation-data.ts

@@ -0,0 +1,106 @@
+/** Internal public-metadata boundary. Raw responses never become component/cache state. */
+export class SharedValidationError extends Error {
+    constructor(public kind: 'unsupported' | 'access' | 'unavailable' | 'invalid' | 'reauth' | 'prerequisite', public readiness: Readiness | null = null, public code: string | null = null) {
+        super({ unsupported: 'Shared validation needs a compatible backend. Ordinary DNS and legacy certificates remain available.', access: 'Shared validation is unavailable with this session or allocation.', unavailable: 'Shared validation could not be refreshed. Check the deployment and try Refresh.', invalid: 'Shared validation returned an incompatible response. Refresh after checking the backend.', reauth: 'Authenticate again, then Refresh and deliberately repeat the action.', prerequisite: 'The backend refused this action. Review the refreshed validation state.' }[kind]);
+    }
+}
+export type SetupTarget = { domain: number } | { group: number; name: string };
+export interface ConnectionRequest { version: 1; consumer_project_uuid: string; client_ref: string; domain: string; allocation_ref: string }
+export interface Readiness {
+    version: 1; checked_at: string;
+    domain: { id: number | null; name: string; provider: string | null; group: { id: number; name: string } | null };
+    profile: { name: 'apex_wildcard'; names: string[] };
+    hub: { state: string; protocol_version: number | null; consumer_project_uuid: string | null };
+    connection: { id: number; mode: 'shared' | 'allocated'; state: string; client_ref: string; allocation_ref: string | null; participant_ref: string | null; verified_at: string | null } | null;
+    trust: { state: string; can_publish: boolean; can_withdraw: boolean };
+    alias: { state: string; source: string; target: string | null; observed_target: string | null; one_hop: boolean | null; checked_at: string | null };
+    certificate: { id: number; state: string; names: string[]; not_after: string | null; renew_after: string | null; serving_valid: boolean | null; material_state: string } | null;
+    renewal: { state: string; next_attempt_at: string | null; attempts: number; error_code: string | null; cleanup_pending: boolean; job: { id: string; state: string } | null; worker_version: string | null };
+    capabilities: { group_choices: boolean; can_connect: boolean; can_restart: boolean; can_check: boolean; can_request: boolean };
+    next_action: { code: string; actor: string };
+    connection_request: ConnectionRequest | null;
+    operation: { action: string; outcome: string; changed: boolean };
+}
+export interface HubCapabilities { version: 2; shared_validation: boolean; consumer_project_uuid: string | null; can_consume: boolean; can_manage_trust: boolean; trust_scope: 'apex_and_wildcard' }
+export interface Allocation { allocation_ref: string; domain: string; source: string; target: string; owner_project_uuid: string; can_manage_trust: boolean }
+export interface Participant { allocation_ref: string; participant_ref: string; client_ref: string; domain: string; source: string; target: string; role: 'owner' | 'trusted'; trust_state: 'active' | 'revoked'; scope: string[]; can_publish: boolean; can_withdraw: boolean; revoked_at: string | null; consumer_project_uuid: string; consumer_label: string }
+export interface Recipient { consumer_project_uuid: string; label: string; active: boolean }
+export interface Page<T> { items: T[]; next_cursor: string | null }
+const invalid = (): never => { throw new SharedValidationError('invalid'); };
+export function record(value: unknown): Record<string, unknown> { return value != null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : invalid(); }
+export function text(value: unknown, max = 200): string { return typeof value === 'string' && value.length <= max && !/[\x00-\x1f]|-----BEGIN|Bearer\s|:\/\//i.test(value) ? value : invalid(); }
+export function positive(value: unknown): number { return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : invalid(); }
+const integer = (value: unknown) => Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : invalid();
+const bool = (value: unknown): boolean => typeof value === 'boolean' ? value : invalid();
+const nullable = <T>(value: unknown, parse: (v: unknown) => T): T | null => value === null ? null : parse(value);
+const choice = <T extends string>(value: unknown, values: readonly T[]): T => values.includes(value as T) ? value as T : invalid();
+export function hostname(value: unknown): string {
+    const name = text(value, 253);
+    return name === name.toLowerCase() && name.includes('.') && name.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) ? name : invalid();
+}
+export function normalizeHostname(value: string): string { return hostname(value.trim().toLowerCase().replace(/\.+$/, '')); }
+export function uuid(value: unknown): string { const v = text(value, 36); return /^(?:[a-f0-9]{32}|[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})$/.test(v) ? v : invalid(); }
+/** Group project identities may retain the existing 16-character format. */
+export function projectIdentity(value: unknown): string { return typeof value === 'string' && /^[a-f0-9]{16}$/.test(value) ? value : uuid(value); }
+const date = (v: unknown) => { const s = text(v, 40); return Number.isFinite(Date.parse(s)) ? s : invalid(); };
+const token = (v: unknown) => { const s = text(v, 64); return /^[a-z0-9_.-]+$/.test(s) ? s : invalid(); };
+function scope(v: unknown, domain: string): string[] { if (!Array.isArray(v) || v.length !== 2 || v[0] !== domain || v[1] !== `*.${domain}`) invalid(); return [domain, `*.${domain}`]; }
+function names(v: unknown): string[] { if (!Array.isArray(v) || v.length < 1 || v.length > 100) return invalid(); return v.map((n) => typeof n === 'string' && n.startsWith('*.') ? `*.${hostname(n.slice(2))}` : hostname(n)); }
+export function parseConnectionRequest(value: unknown): ConnectionRequest {
+    const r = record(value);
+    if (Object.keys(r).sort().join(',') !== 'allocation_ref,client_ref,consumer_project_uuid,domain,version' || r.version !== 1) invalid();
+    return { version: 1, consumer_project_uuid: projectIdentity(r.consumer_project_uuid), client_ref: uuid(r.client_ref), domain: hostname(r.domain), allocation_ref: hostname(r.allocation_ref) };
+}
+export const CONNECTION_REQUEST_MAX_BYTES = 2048;
+export function parseConnectionRequestText(value: string): ConnectionRequest {
+    if (!value || new TextEncoder().encode(value).byteLength > CONNECTION_REQUEST_MAX_BYTES) return invalid();
+    try { return parseConnectionRequest(JSON.parse(value)); } catch { return invalid(); }
+}
+export function serializeConnectionRequest(value: ConnectionRequest): string {
+    const result = JSON.stringify(parseConnectionRequest(value));
+    parseConnectionRequestText(result);
+    return result;
+}
+export function parseReadiness(value: unknown, target?: SetupTarget, allocation?: string): Readiness {
+    const r = record(value); if (r.version !== 1) throw new SharedValidationError('unsupported');
+    const d = record(r.domain), h = record(r.hub), t = record(r.trust), a = record(r.alias), n = record(r.renewal), c = record(r.capabilities), next = record(r.next_action), op = record(r.operation), p = record(r.profile);
+    const domain = { id: nullable(d.id, positive), name: hostname(d.name), provider: nullable(d.provider, token), group: d.group === null ? null : { id: positive(record(d.group).id), name: text(record(d.group).name) } };
+    if (target && ('domain' in target ? domain.id !== target.domain : domain.group?.id !== target.group || domain.name !== target.name)) invalid();
+    const connection = r.connection === null ? null : (() => { const v = record(r.connection); return { id: positive(v.id), mode: choice(v.mode, ['shared', 'allocated'] as const), state: choice(v.state, ['pending', 'verified', 'broken', 'retired']), client_ref: uuid(v.client_ref), allocation_ref: nullable(v.allocation_ref, hostname), participant_ref: nullable(v.participant_ref, uuid), verified_at: nullable(v.verified_at, date) }; })();
+    const result: Readiness = {
+        version: 1, checked_at: date(r.checked_at), domain,
+        profile: { name: choice(p.name, ['apex_wildcard']), names: scope(p.names, domain.name) },
+        hub: { state: choice(h.state, ['unconfigured', 'misconfigured', 'unavailable', 'unauthorized', 'unsupported', 'ready']), protocol_version: nullable(h.protocol_version, positive), consumer_project_uuid: nullable(h.consumer_project_uuid, projectIdentity) },
+        connection, trust: { state: choice(t.state, ['unknown', 'not_requested', 'missing', 'active', 'revoked', 'identity_changed']), can_publish: bool(t.can_publish), can_withdraw: bool(t.can_withdraw) },
+        alias: { state: choice(a.state, ['unknown', 'match', 'mismatch', 'lookup_failed']), source: text(a.source, 270), target: nullable(a.target, hostname), observed_target: nullable(a.observed_target, hostname), one_hop: nullable(a.one_hop, bool), checked_at: nullable(a.checked_at, date) },
+        certificate: r.certificate === null ? null : (() => { const v = record(r.certificate); return { id: positive(v.id), state: choice(v.state, ['pending', 'issuing', 'active', 'failed', 'revoked', 'expired', 'unknown']), names: names(v.names), not_after: nullable(v.not_after, date), renew_after: nullable(v.renew_after, date), serving_valid: nullable(v.serving_valid, bool), material_state: choice(v.material_state, ['available', 'missing', 'unavailable']) }; })(),
+        renewal: { state: choice(n.state, ['not_requested', 'scheduled', 'queued', 'issuing', 'retrying', 'blocked', 'failed', 'expired', 'unknown']), next_attempt_at: nullable(n.next_attempt_at, date), attempts: integer(n.attempts), error_code: nullable(n.error_code, token), cleanup_pending: bool(n.cleanup_pending), job: n.job === null ? null : { id: text(record(n.job).id, 128), state: choice(record(n.job).state, ['pending', 'running', 'completed', 'failed', 'canceled', 'expired', 'unknown']) }, worker_version: nullable(n.worker_version, (v) => text(v, 64)) },
+        capabilities: { group_choices: bool(c.group_choices), can_connect: bool(c.can_connect), can_restart: bool(c.can_restart), can_check: bool(c.can_check), can_request: bool(c.can_request) },
+        next_action: { code: choice(next.code, ['configure_hub', 'upgrade_hub', 'repair_hub_access', 'retry_hub', 'choose_allocation', 'prepare_connection', 'grant_trust', 'restart_connection', 'connect', 'repair_alias', 'check', 'request', 'wait_for_job', 'repair_worker', 'restore_custody', 'inspect_failure', 'unsupported_domain_scope', 'none']), actor: choice(next.actor, ['deployment_operator', 'allocation_controller', 'domain_owner', 'project_operator', 'none']) },
+        connection_request: r.connection_request === null ? null : parseConnectionRequest(r.connection_request),
+        operation: { action: choice(op.action, ['plan', 'connect', 'check', 'request']), outcome: choice(op.outcome, ['observed', 'awaiting_trust', 'connected', 'verified', 'queued', 'already_current', 'already_queued', 'custody_unavailable', 'job_held']), changed: bool(op.changed) },
+    };
+    if (result.alias.source !== `_acme-challenge.${domain.name}` || (allocation && result.alias.target !== allocation) || (connection?.allocation_ref && result.alias.target !== connection.allocation_ref)) invalid();
+    if (result.certificate && [...result.certificate.names].sort().join(',') !== [...result.profile.names].sort().join(',')) invalid();
+    if (result.trust.state === 'identity_changed' || result.hub.state !== 'ready' || !result.hub.consumer_project_uuid) result.connection_request = null;
+    const descriptor = result.connection_request;
+    if (descriptor && (descriptor.domain !== domain.name || descriptor.allocation_ref !== result.alias.target || descriptor.client_ref !== connection?.client_ref || (result.hub.consumer_project_uuid && descriptor.consumer_project_uuid !== result.hub.consumer_project_uuid))) invalid();
+    if (!domain.group && (result.next_action.code !== 'unsupported_domain_scope' || Object.values(result.capabilities).some(Boolean) || descriptor)) invalid();
+    if (result.capabilities.can_request && (result.hub.state !== 'ready' || !result.hub.consumer_project_uuid || connection?.mode !== 'shared' || connection.state !== 'verified' || result.trust.state !== 'active' || result.alias.state !== 'match' || !result.alias.one_hop)) invalid();
+    return result;
+}
+export function parseHubCapabilities(value: unknown): HubCapabilities {
+    const r = record(value); if (r.version !== 2) throw new SharedValidationError('unsupported');
+    return { version: 2, shared_validation: bool(r.shared_validation), consumer_project_uuid: nullable(r.consumer_project_uuid, projectIdentity), can_consume: bool(r.can_consume), can_manage_trust: bool(r.can_manage_trust), trust_scope: choice(r.trust_scope, ['apex_and_wildcard']) };
+}
+export function parseAllocation(value: unknown, domain: string): Allocation {
+    const r = record(value); const out = { allocation_ref: hostname(r.allocation_ref), domain: hostname(r.domain), source: text(r.source, 270), target: hostname(r.target), owner_project_uuid: projectIdentity(r.owner_project_uuid), can_manage_trust: bool(r.can_manage_trust) };
+    if (out.domain !== domain || out.source !== `_acme-challenge.${domain}` || out.target !== out.allocation_ref) invalid(); return out;
+}
+export function parseParticipant(value: unknown, allocation: Allocation): Participant {
+    const r = record(value); const base = parseAllocation({ ...r, owner_project_uuid: allocation.owner_project_uuid, can_manage_trust: allocation.can_manage_trust }, allocation.domain); const out: Participant = { allocation_ref: base.allocation_ref, domain: base.domain, source: base.source, target: base.target, participant_ref: uuid(r.participant_ref), client_ref: uuid(r.client_ref), role: choice(r.role, ['owner', 'trusted']), trust_state: choice(r.trust_state, ['active', 'revoked']), scope: scope(r.scope, allocation.domain), can_publish: bool(r.can_publish), can_withdraw: bool(r.can_withdraw), revoked_at: nullable(r.revoked_at, date), consumer_project_uuid: projectIdentity(r.consumer_project_uuid), consumer_label: text(r.consumer_label) };
+    if (out.allocation_ref !== allocation.allocation_ref || (out.trust_state === 'revoked') !== (out.revoked_at !== null)) invalid(); return out;
+}
+export function parsePage<T>(value: unknown, parse: (v: unknown) => T): Page<T> { const r = record(value); if (!Array.isArray(r.items) || r.items.length > 20) invalid(); return { items: (r.items as unknown[]).map(parse), next_cursor: nullable(r.next_cursor, (v) => { const s = text(v, 20); return /^[1-9]\d*$/.test(s) ? s : invalid(); }) }; }
+export function parseRecipient(value: unknown, expected: string): Recipient { const r = record(value); const out = { consumer_project_uuid: projectIdentity(r.consumer_project_uuid), label: text(r.label), active: bool(r.active) }; if (out.consumer_project_uuid !== expected || !out.active) invalid(); return out; }
+export const pendingReadiness = (r: Readiness) => ['queued', 'issuing'].includes(r.renewal.state) || ['pending', 'issuing'].includes(r.certificate?.state ?? '');

package/src/admin/domains/assistant.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { ASSISTANT_PERMISSIONS } from '../assistant/permissions';
 
@@ -5,10 +6,10 @@ export { ASSISTANT_PERMISSIONS } from '../assistant/permissions';
 export const ASSISTANT_ADMIN_SECTION: AdminSection = {
     id: 'assistant', basePath: 'assistant', title: 'Assistant', icon: 'bi-stars', navigationGroup: 'assistant', permissions: ASSISTANT_PERMISSIONS,
     routes: [
-        { path: 'setup', label: 'Setup', requireSuperuser: true, loadComponent: () => import('../assistant/AssistantSetupPage').then(({ AssistantSetupPage }) => ({ default: AssistantSetupPage })) },
-        { path: 'conversations', label: 'Conversations', loadComponent: () => import('../assistant/pages').then(({ ConversationsPage }) => ({ default: ConversationsPage })), permissions: ASSISTANT_PERMISSIONS },
-        { path: 'skills', label: 'Skills', loadComponent: () => import('../assistant/pages').then(({ SkillsPage }) => ({ default: SkillsPage })), permissions: ASSISTANT_PERMISSIONS },
-        { path: 'memories', label: 'Memory', loadComponent: () => import('../assistant/pages').then(({ MemoriesPage }) => ({ default: MemoriesPage })), permissions: ['sys.assistant'] },
+        { path: 'setup', label: 'Setup', requireSuperuser: true, loadComponent: () => import('../assistant/AssistantSetupPage').then(namedPage('AssistantSetupPage')) },
+        { path: 'conversations', label: 'Conversations', loadComponent: () => import('../assistant/pages').then(namedPage('ConversationsPage')), permissions: ASSISTANT_PERMISSIONS },
+        { path: 'skills', label: 'Skills', loadComponent: () => import('../assistant/pages').then(namedPage('SkillsPage')), permissions: ASSISTANT_PERMISSIONS },
+        { path: 'memories', label: 'Memory', loadComponent: () => import('../assistant/pages').then(namedPage('MemoriesPage')), permissions: ['sys.assistant'] },
     ],
 };
 export const ASSISTANT_ADMIN_SECTIONS = [ASSISTANT_ADMIN_SECTION] as const;

package/src/admin/domains/communications.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { EMAIL_ADMIN_PERMISSIONS, PUBLIC_MESSAGE_VIEW_PERMISSIONS } from '../messaging/models';
 import { PUSH_ADMIN_PERMISSIONS } from '../messaging/push/models';
@@ -7,29 +8,29 @@ import { SHORTLINK_MANAGE_PERMISSIONS } from '../shortlinks/models';
 export const SHORTLINKS_ADMIN_SECTION: AdminSection = {
     id: 'shortlinks', basePath: 'shortlinks', title: 'Shortlinks', icon: 'bi-link-45deg', navigationGroup: 'communications', permissions: SHORTLINK_MANAGE_PERMISSIONS,
     routes: [
-        { path: 'links', label: 'Links', loadComponent: () => import('../shortlinks/ShortlinksPage').then(({ ShortlinksPage }) => ({ default: ShortlinksPage })), permissions: SHORTLINK_MANAGE_PERMISSIONS },
-        { path: 'history', label: 'Click history', loadComponent: () => import('../shortlinks/ShortlinkHistoryPage').then(({ ShortlinkHistoryPage }) => ({ default: ShortlinkHistoryPage })), permissions: SHORTLINK_MANAGE_PERMISSIONS },
+        { path: 'links', label: 'Links', loadComponent: () => import('../shortlinks/ShortlinksPage').then(namedPage('ShortlinksPage')), permissions: SHORTLINK_MANAGE_PERMISSIONS },
+        { path: 'history', label: 'Click history', loadComponent: () => import('../shortlinks/ShortlinkHistoryPage').then(namedPage('ShortlinkHistoryPage')), permissions: SHORTLINK_MANAGE_PERMISSIONS },
     ],
 };
 export const EMAIL_ADMIN_SECTION: AdminSection = {
     id: 'email', basePath: 'email', title: 'Email', icon: 'bi-envelope-at', navigationGroup: 'communications', permissions: EMAIL_ADMIN_PERMISSIONS,
     routes: [
-        { path: 'domains', label: 'Email Domains', loadComponent: () => import('../messaging/EmailDomainsPage').then(({ EmailDomainsPage }) => ({ default: EmailDomainsPage })), permissions: EMAIL_ADMIN_PERMISSIONS },
-        { path: 'mailboxes', label: 'Mailboxes', loadComponent: () => import('../messaging/MailboxesPage').then(({ MailboxesPage }) => ({ default: MailboxesPage })), permissions: EMAIL_ADMIN_PERMISSIONS },
-        { path: 'sent', label: 'Sent Messages', loadComponent: () => import('../messaging/SentMessagesPage').then(({ SentMessagesPage }) => ({ default: SentMessagesPage })), permissions: EMAIL_ADMIN_PERMISSIONS },
-        { path: 'templates', label: 'Email Templates', loadComponent: () => import('../messaging/EmailTemplatesPage').then(({ EmailTemplatesPage }) => ({ default: EmailTemplatesPage })), permissions: EMAIL_ADMIN_PERMISSIONS },
+        { path: 'domains', label: 'Email Domains', loadComponent: () => import('../messaging/EmailDomainsPage').then(namedPage('EmailDomainsPage')), permissions: EMAIL_ADMIN_PERMISSIONS },
+        { path: 'mailboxes', label: 'Mailboxes', loadComponent: () => import('../messaging/MailboxesPage').then(namedPage('MailboxesPage')), permissions: EMAIL_ADMIN_PERMISSIONS },
+        { path: 'sent', label: 'Sent Messages', loadComponent: () => import('../messaging/SentMessagesPage').then(namedPage('SentMessagesPage')), permissions: EMAIL_ADMIN_PERMISSIONS },
+        { path: 'templates', label: 'Email Templates', loadComponent: () => import('../messaging/EmailTemplatesPage').then(namedPage('EmailTemplatesPage')), permissions: EMAIL_ADMIN_PERMISSIONS },
     ],
 };
 export const PUBLIC_MESSAGES_ADMIN_SECTION: AdminSection = {
     id: 'public-messages', basePath: 'messaging', title: 'Contact Messages', icon: 'bi-chat-left-text', navigationGroup: 'communications', permissions: PUBLIC_MESSAGE_VIEW_PERMISSIONS,
-    routes: [{ path: 'public-messages', label: 'Contact Messages', loadComponent: () => import('../messaging/PublicMessagesPage').then(({ PublicMessagesPage }) => ({ default: PublicMessagesPage })), permissions: PUBLIC_MESSAGE_VIEW_PERMISSIONS }],
+    routes: [{ path: 'public-messages', label: 'Contact Messages', loadComponent: () => import('../messaging/PublicMessagesPage').then(namedPage('PublicMessagesPage')), permissions: PUBLIC_MESSAGE_VIEW_PERMISSIONS }],
 };
 export const PUSH_ADMIN_SECTION: AdminSection = {
     id: 'push', basePath: 'push', title: 'Push Notifications', icon: 'bi-bell', navigationGroup: 'communications', permissions: PUSH_ADMIN_PERMISSIONS,
-    routes: [{ path: '', label: 'Push Notifications', loadComponent: () => import('../messaging/push/PushPage').then(({ PushPage }) => ({ default: PushPage })), permissions: PUSH_ADMIN_PERMISSIONS }],
+    routes: [{ path: '', label: 'Push Notifications', loadComponent: () => import('../messaging/push/PushPage').then(namedPage('PushPage')), permissions: PUSH_ADMIN_PERMISSIONS }],
 };
 export const PHONE_HUB_ADMIN_SECTION: AdminSection = {
     id: 'phonehub', basePath: 'phonehub', title: 'Phone Hub', icon: 'bi-phone', navigationGroup: 'communications', permissions: PHONE_HUB_ADMIN_PERMISSIONS,
-    routes: [{ path: '', label: 'Phone Hub', loadComponent: () => import('../phonehub/PhoneHubPage').then(({ PhoneHubPage }) => ({ default: PhoneHubPage })), permissions: PHONE_HUB_ADMIN_PERMISSIONS }],
+    routes: [{ path: '', label: 'Phone Hub', loadComponent: () => import('../phonehub/PhoneHubPage').then(namedPage('PhoneHubPage')), permissions: PHONE_HUB_ADMIN_PERMISSIONS }],
 };
 export const COMMUNICATIONS_ADMIN_SECTIONS = [SHORTLINKS_ADMIN_SECTION, EMAIL_ADMIN_SECTION, PUBLIC_MESSAGES_ADMIN_SECTION, PUSH_ADMIN_SECTION, PHONE_HUB_ADMIN_SECTION] as const;

package/src/admin/domains/identity.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { GLOBAL_CREDENTIAL_PERMS } from '../credentials/models';
 import { MEMBER_READ_PERMISSIONS } from '../identity/members/models';
@@ -7,35 +8,35 @@ import { GROUP_VIEW_PERMS } from '../identity/groups/group-permissions';
 
 export const USERS_ADMIN_SECTION: AdminSection = {
     id: 'users', basePath: '', title: 'Users', icon: 'bi-people', navigationGroup: 'identity-access', permissions: USER_VIEW_PERMISSIONS,
-    routes: [{ path: 'users', label: 'Users', loadComponent: () => import('../identity/users/UsersPage').then(({ UsersPage }) => ({ default: UsersPage })), permissions: USER_VIEW_PERMISSIONS }],
+    routes: [{ path: 'users', label: 'Users', loadComponent: () => import('../identity/users/UsersPage').then(namedPage('UsersPage')), permissions: USER_VIEW_PERMISSIONS }],
 };
 
 export const MEMBERS_ADMIN_SECTION: AdminSection = {
     id: 'members', basePath: '', title: 'Members', icon: 'bi-person-badge', navigationGroup: 'identity-access', permissions: MEMBER_READ_PERMISSIONS,
-    routes: [{ path: 'members', label: 'Members', loadComponent: () => import('../identity/members/MembersPage').then(({ MembersPage }) => ({ default: MembersPage })), permissions: MEMBER_READ_PERMISSIONS }],
+    routes: [{ path: 'members', label: 'Members', loadComponent: () => import('../identity/members/MembersPage').then(namedPage('MembersPage')), permissions: MEMBER_READ_PERMISSIONS }],
 };
 
 export const CREDENTIALS_ADMIN_SECTION: AdminSection = {
     id: 'credentials', basePath: '', title: 'Credentials', icon: 'bi-key', navigationGroup: 'identity-access', permissions: GLOBAL_CREDENTIAL_PERMS,
     routes: [
-        { path: 'api-keys', label: 'Group API Keys', loadComponent: () => import('../credentials/group-api-keys').then(({ GroupApiKeysPage }) => ({ default: GroupApiKeysPage })), permissions: GLOBAL_CREDENTIAL_PERMS },
-        { path: 'webhook-subscriptions', label: 'Webhooks', loadComponent: () => import('../credentials/webhook-subscriptions').then(({ WebhookSubscriptionsPage }) => ({ default: WebhookSubscriptionsPage })), permissions: GLOBAL_CREDENTIAL_PERMS },
+        { path: 'api-keys', label: 'Group API Keys', loadComponent: () => import('../credentials/group-api-keys').then(namedPage('GroupApiKeysPage')), permissions: GLOBAL_CREDENTIAL_PERMS },
+        { path: 'webhook-subscriptions', label: 'Webhooks', loadComponent: () => import('../credentials/webhook-subscriptions').then(namedPage('WebhookSubscriptionsPage')), permissions: GLOBAL_CREDENTIAL_PERMS },
     ],
 };
 
 export const SIGNIN_ADMIN_SECTION: AdminSection = {
     id: 'signin', basePath: 'system/sign-in', title: 'Sign-in', icon: 'bi-box-arrow-in-right', navigationGroup: 'identity-access', permissions: SIGNIN_ADMIN_PERMISSIONS,
-    routes: [{ path: '', loadComponent: () => import('../signin/SigninPage').then(({ SigninPage }) => ({ default: SigninPage })), permissions: SIGNIN_ADMIN_PERMISSIONS }],
+    routes: [{ path: '', loadComponent: () => import('../signin/SigninPage').then(namedPage('SigninPage')), permissions: SIGNIN_ADMIN_PERMISSIONS }],
 };
 
 export const GROUPS_ADMIN_SECTION: AdminSection = {
     id: 'groups', basePath: '', title: 'Groups', icon: 'bi-diagram-3', navigationGroup: 'identity-access', permissions: GROUP_VIEW_PERMS,
-    routes: [{ path: 'groups', label: 'Groups', loadComponent: () => import('../identity/groups/GroupsPage').then(({ GroupsPage }) => ({ default: GroupsPage })), permissions: GROUP_VIEW_PERMS }],
+    routes: [{ path: 'groups', label: 'Groups', loadComponent: () => import('../identity/groups/GroupsPage').then(namedPage('GroupsPage')), permissions: GROUP_VIEW_PERMS }],
 };
 
 export const PERSONAL_API_KEYS_ADMIN_SECTION: AdminSection = {
     id: 'personal-api-keys', basePath: '', title: 'Personal API Keys', icon: 'bi-key', navigationGroup: 'identity-access', permissions: USER_VIEW_PERMISSIONS,
-    routes: [{ path: 'apikeys', label: 'Personal API Keys', loadComponent: () => import('../identity/users/PersonalApiKeysPage').then(({ PersonalApiKeysPage }) => ({ default: PersonalApiKeysPage })) }],
+    routes: [{ path: 'apikeys', label: 'Personal API Keys', loadComponent: () => import('../identity/users/PersonalApiKeysPage').then(namedPage('PersonalApiKeysPage')) }],
 };
 
 export const IDENTITY_ADMIN_SECTIONS = [

package/src/admin/domains/infrastructure.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { DNS_MANAGE_PERMISSIONS, DNS_VIEW_PERMISSIONS } from '../dns/models';
 import { BUCKET_MANAGE_PERMS, STORAGE_VIEW_PERMS } from '../storage/permissions';
@@ -6,29 +7,34 @@ import { SETTINGS_PERMISSIONS } from '../settings/model';
 export const DNS_ADMIN_SECTION: AdminSection = {
     id: 'dns', title: 'DNS', icon: 'bi-globe2', navigationGroup: 'infrastructure', basePath: 'dns', permissions: DNS_VIEW_PERMISSIONS,
     routes: [
-        { path: 'domains', label: 'Domains', loadComponent: () => import('../dns/DomainsPage').then(({ DomainsPage }) => ({ default: DomainsPage })), permissions: DNS_VIEW_PERMISSIONS },
-        { path: 'records', label: 'DNS Records', loadComponent: () => import('../dns/DnsRecordsPage').then(({ DnsRecordsPage }) => ({ default: DnsRecordsPage })), permissions: DNS_VIEW_PERMISSIONS },
-        { path: 'certificates', label: 'Certificates', loadComponent: () => import('../dns/CertificatesPage').then(({ CertificatesPage }) => ({ default: CertificatesPage })), permissions: DNS_VIEW_PERMISSIONS },
-        { path: 'purchases', label: 'Domain Purchases', loadComponent: () => import('../dns/DomainPurchasesPage').then(({ DomainPurchasesPage }) => ({ default: DomainPurchasesPage })), permissions: DNS_VIEW_PERMISSIONS },
-        { path: 'registrant', label: 'Registrant Contact', loadComponent: () => import('../dns/RegistrantContactPage').then(({ RegistrantContactPage }) => ({ default: RegistrantContactPage })), permissions: DNS_MANAGE_PERMISSIONS },
-        { path: 'credentials', label: 'Provider Credentials', loadComponent: () => import('../dns/ProviderCredentialsPage').then(({ ProviderCredentialsPage }) => ({ default: ProviderCredentialsPage })), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'domains', label: 'Domains', loadComponent: () => import('../dns/DomainsPage').then(namedPage('DomainsPage')), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'records', label: 'DNS Records', loadComponent: () => import('../dns/DnsRecordsPage').then(namedPage('DnsRecordsPage')), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'certificates', label: 'Certificates', loadComponent: () => import('../dns/CertificatesPage').then(namedPage('CertificatesPage')), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'purchases', label: 'Domain Purchases', loadComponent: () => import('../dns/DomainPurchasesPage').then(namedPage('DomainPurchasesPage')), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'registrant', label: 'Registrant Contact', loadComponent: () => import('../dns/RegistrantContactPage').then(namedPage('RegistrantContactPage')), permissions: DNS_MANAGE_PERMISSIONS },
+        { path: 'credentials', label: 'Provider Credentials', loadComponent: () => import('../dns/ProviderCredentialsPage').then(namedPage('ProviderCredentialsPage')), permissions: DNS_VIEW_PERMISSIONS },
     ],
 };
 export const STORAGE_ADMIN_SECTION: AdminSection = {
     id: 'storage', basePath: 'storage', title: 'Storage', icon: 'bi-hdd-stack', navigationGroup: 'infrastructure', permissions: ['sys.view_fileman', 'sys.manage_files', 'sys.manage_aws', 'sys.files', ...SETTINGS_PERMISSIONS],
     routes: [
-        { path: 'buckets', label: 'Buckets', loadComponent: () => import('../storage/BucketsPage').then(({ BucketsPage }) => ({ default: BucketsPage })), permissions: BUCKET_MANAGE_PERMS },
-        { path: 'backends', label: 'Backends', loadComponent: () => import('../storage/BackendsPage').then(({ BackendsPage }) => ({ default: BackendsPage })), permissions: STORAGE_VIEW_PERMS },
-        { path: 'files', label: 'Files', loadComponent: () => import('../storage/FilesPage').then(({ FilesPage }) => ({ default: FilesPage })), permissions: STORAGE_VIEW_PERMS },
+        { path: 'buckets', label: 'Buckets', loadComponent: () => import('../storage/BucketsPage').then(namedPage('BucketsPage')), permissions: BUCKET_MANAGE_PERMS },
+        { path: 'backends', label: 'Backends', loadComponent: () => import('../storage/BackendsPage').then(namedPage('BackendsPage')), permissions: STORAGE_VIEW_PERMS },
+        { path: 'files', label: 'Files', loadComponent: () => import('../storage/FilesPage').then(namedPage('FilesPage')), permissions: STORAGE_VIEW_PERMS },
         // Media rendering edits three Setting rows, so it carries the Settings page's gate, not the storage one.
-        { path: 'rendering', label: 'Media rendering', loadComponent: () => import('../storage/MediaRenderingPage').then(({ MediaRenderingPage }) => ({ default: MediaRenderingPage })), permissions: SETTINGS_PERMISSIONS },
+        { path: 'rendering', label: 'Media rendering', loadComponent: () => import('../storage/MediaRenderingPage').then(namedPage('MediaRenderingPage')), permissions: SETTINGS_PERMISSIONS },
     ],
 };
 export const EDGE_ADMIN_SECTION: AdminSection = {
     id: 'edge', basePath: 'edge', title: 'Edge', icon: 'bi-hdd-network', navigationGroup: 'infrastructure', permissions: DNS_VIEW_PERMISSIONS,
     routes: [
-        { path: 'vhosts', label: 'Vhosts', loadComponent: () => import('../edge/VhostsPage').then(({ VhostsPage }) => ({ default: VhostsPage })), permissions: DNS_VIEW_PERMISSIONS },
-        { path: 'upstreams', label: 'Upstreams', loadComponent: () => import('../edge/UpstreamsPage').then(({ UpstreamsPage }) => ({ default: UpstreamsPage })), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'vhosts', label: 'Serving', loadComponent: () => import('../edge/VhostsPage').then(namedPage('VhostsPage')), permissions: DNS_VIEW_PERMISSIONS },
+        { path: 'upstreams', label: 'Upstreams', loadComponent: () => import('../edge/UpstreamsPage').then(namedPage('UpstreamsPage')), permissions: DNS_VIEW_PERMISSIONS },
     ],
 };
-export const INFRASTRUCTURE_ADMIN_SECTIONS = [DNS_ADMIN_SECTION, STORAGE_ADMIN_SECTION, EDGE_ADMIN_SECTION] as const;
+export const FLEET_ADMIN_SECTION: AdminSection = {
+    id: 'fleet', title: 'Fleet', icon: 'bi-cloud', navigationGroup: 'operations',
+    permissions: ['sys.view_admin', 'sys.manage_users', 'sys.manage_settings', 'sys.admin', 'sys.manage_aws'],
+    routes: [{ path: '', label: 'Fleet', loadComponent: () => import('../fleet/FleetPage').then(namedPage('FleetPage')) }],
+};
+export const INFRASTRUCTURE_ADMIN_SECTIONS = [FLEET_ADMIN_SECTION, DNS_ADMIN_SECTION, STORAGE_ADMIN_SECTION, EDGE_ADMIN_SECTION] as const;

package/src/admin/domains/lazy-page.ts

@@ -0,0 +1,6 @@
+import type { ComponentType } from 'react';
+
+/** Adapt an explicit named page export; every route keeps its literal lazy import. */
+export function namedPage<TName extends string>(name: TName) {
+    return <TModule extends Record<TName, ComponentType>>(module: TModule) => ({ default: module[name] });
+}

package/src/admin/domains/observability.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { CLOUDWATCH_PERMISSIONS } from '../cloudwatch/data';
 import { DASHBOARD_METRIC_PERMISSIONS } from '../dashboard/data';
@@ -10,19 +11,19 @@ import { SECURITY_VIEW_PERMS } from '../security-permissions';
 export const ADMIN_DASHBOARD_PERMISSIONS = [...new Set([...DASHBOARD_METRIC_PERMISSIONS, ...SECURITY_VIEW_PERMS, ...JOBS_VIEW_PERMS, ...EMAIL_ADMIN_PERMISSIONS, ...LOGIN_SUMMARY_PERMS])];
 export const DASHBOARD_ADMIN_SECTION: AdminSection = {
     id: 'dashboard', basePath: '', title: 'Dashboard', icon: 'bi-grid-1x2', navigationGroup: null, permissions: ADMIN_DASHBOARD_PERMISSIONS,
-    routes: [{ path: '', label: 'Dashboard', loadComponent: () => import('../dashboard/AdminDashboardPage').then(({ AdminDashboardPage }) => ({ default: AdminDashboardPage })), permissions: ADMIN_DASHBOARD_PERMISSIONS, fallbackToFirstVisible: true }],
+    routes: [{ path: '', label: 'Dashboard', loadComponent: () => import('../dashboard/AdminDashboardPage').then(namedPage('AdminDashboardPage')), permissions: ADMIN_DASHBOARD_PERMISSIONS, fallbackToFirstVisible: true }],
 };
 export const MONITORING_ADMIN_SECTION: AdminSection = {
     id: 'monitoring', basePath: '', title: 'Monitoring', icon: 'bi-activity', navigationGroup: 'observability',
     permissions: [...new Set([...LOGS_ADMIN_PERMISSIONS, ...METRICS_EXPLORER_PERMISSIONS, ...METRICS_PERMISSIONS_ADMIN_PERMISSIONS])],
     routes: [
-        { path: 'logs', label: 'Logs', loadComponent: () => import('../monitoring/LogsPage').then(({ LogsPage }) => ({ default: LogsPage })), permissions: LOGS_ADMIN_PERMISSIONS },
-        { path: 'metrics/explorer', label: 'Metrics Explorer', loadComponent: () => import('../monitoring/MetricsExplorerPage').then(({ MetricsExplorerPage }) => ({ default: MetricsExplorerPage })), permissions: METRICS_EXPLORER_PERMISSIONS },
-        { path: 'metrics/permissions', label: 'Metrics Permissions', loadComponent: () => import('../monitoring/MetricsPermissionsPage').then(({ MetricsPermissionsPage }) => ({ default: MetricsPermissionsPage })), permissions: METRICS_PERMISSIONS_ADMIN_PERMISSIONS },
+        { path: 'logs', label: 'Logs', loadComponent: () => import('../monitoring/LogsPage').then(namedPage('LogsPage')), permissions: LOGS_ADMIN_PERMISSIONS },
+        { path: 'metrics/explorer', label: 'Metrics Explorer', loadComponent: () => import('../monitoring/MetricsExplorerPage').then(namedPage('MetricsExplorerPage')), permissions: METRICS_EXPLORER_PERMISSIONS },
+        { path: 'metrics/permissions', label: 'Metrics Permissions', loadComponent: () => import('../monitoring/MetricsPermissionsPage').then(namedPage('MetricsPermissionsPage')), permissions: METRICS_PERMISSIONS_ADMIN_PERMISSIONS },
     ],
 };
 export const CLOUDWATCH_ADMIN_SECTION: AdminSection = {
     id: 'cloudwatch', title: 'CloudWatch', icon: 'bi-clouds', navigationGroup: 'observability', permissions: CLOUDWATCH_PERMISSIONS,
-    routes: [{ path: '', label: 'CloudWatch', loadComponent: () => import('../cloudwatch/CloudWatchDashboardPage').then(({ CloudWatchDashboardPage }) => ({ default: CloudWatchDashboardPage })), permissions: CLOUDWATCH_PERMISSIONS }],
+    routes: [{ path: '', label: 'CloudWatch', loadComponent: () => import('../cloudwatch/CloudWatchDashboardPage').then(namedPage('CloudWatchDashboardPage')), permissions: CLOUDWATCH_PERMISSIONS }],
 };
 export const OBSERVABILITY_ADMIN_SECTIONS = [DASHBOARD_ADMIN_SECTION, MONITORING_ADMIN_SECTION, CLOUDWATCH_ADMIN_SECTION] as const;

package/src/admin/domains/operations.ts

@@ -1,25 +1,42 @@
+import { namedPage } from './lazy-page';
 import type { AdminSection } from '../core';
 import { JOBS_VIEW_PERMS, SCHEDULED_TASK_VIEW_PERMS } from '../jobs/models';
 import { SETTINGS_PERMISSIONS } from '../settings/model';
 
+const navigationGroup = 'operations';
+
 export const SETTINGS_ADMIN_SECTION: AdminSection = {
-    id: 'settings', title: 'Settings', icon: 'bi-gear', navigationGroup: 'operations', permissions: SETTINGS_PERMISSIONS,
-    routes: [{ path: '', loadComponent: () => import('../settings/SettingsPage').then(({ SettingsPage }) => ({ default: SettingsPage })), permissions: SETTINGS_PERMISSIONS }],
+    id: 'settings', title: 'Settings', icon: 'bi-gear', navigationGroup, permissions: SETTINGS_PERMISSIONS,
+    routes: [{ path: '', loadComponent: () => import('../settings/SettingsPage').then(namedPage('SettingsPage')), permissions: SETTINGS_PERMISSIONS }],
 };
 // Empty any-of permissions admit only the existing literal-superuser bypass.
 // A global admin permission alone must not expose this configuration surface.
 export const FLEET_CONFIGURATION_ADMIN_SECTION: AdminSection = {
     id: 'fleet-configuration', title: 'Fleet Configuration', icon: 'bi-hdd-network',
-    navigationGroup: 'operations', permissions: [],
-    routes: [{ path: '', loadComponent: () => import('../fleet-configuration/FleetConfigurationPage').then(({ FleetConfigurationPage }) => ({ default: FleetConfigurationPage })) }],
+    navigationGroup, permissions: [],
+    routes: ['', 'shared-validation'].map((path) => ({ path, requireSuperuser: true, loadComponent: () => import('../fleet-configuration/FleetConfigurationPage').then(namedPage('FleetConfigurationPage')) })),
 };
 export const JOBS_ADMIN_SECTION: AdminSection = {
-    id: 'jobs', title: 'Jobs', icon: 'bi-cpu', navigationGroup: 'operations', permissions: [...new Set([...JOBS_VIEW_PERMS, ...SCHEDULED_TASK_VIEW_PERMS])],
+    id: 'jobs', title: 'Jobs', icon: 'bi-cpu', navigationGroup, permissions: [...new Set([...JOBS_VIEW_PERMS, ...SCHEDULED_TASK_VIEW_PERMS])],
     routes: [
-        { path: '', label: 'Dashboard', loadComponent: () => import('../jobs/JobDashboardPage').then(({ JobDashboardPage }) => ({ default: JobDashboardPage })), permissions: JOBS_VIEW_PERMS },
-        { path: 'runners', label: 'Runners', loadComponent: () => import('../jobs/JobRunnersPage').then(({ JobRunnersPage }) => ({ default: JobRunnersPage })), permissions: JOBS_VIEW_PERMS },
-        { path: 'list', label: 'Jobs', loadComponent: () => import('../jobs/JobsTablePage').then(({ JobsTablePage }) => ({ default: JobsTablePage })), permissions: JOBS_VIEW_PERMS },
-        { path: 'scheduled-tasks', label: 'Scheduled Tasks', loadComponent: () => import('../jobs/ScheduledTasksPage').then(({ ScheduledTasksPage }) => ({ default: ScheduledTasksPage })), permissions: SCHEDULED_TASK_VIEW_PERMS },
+        { path: '', label: 'Dashboard', loadComponent: () => import('../jobs/JobDashboardPage').then(namedPage('JobDashboardPage')), permissions: JOBS_VIEW_PERMS },
+        { path: 'runners', label: 'Runners', loadComponent: () => import('../jobs/JobRunnersPage').then(namedPage('JobRunnersPage')), permissions: JOBS_VIEW_PERMS },
+        { path: 'list', label: 'Jobs', loadComponent: () => import('../jobs/JobsTablePage').then(namedPage('JobsTablePage')), permissions: JOBS_VIEW_PERMS },
+        { path: 'scheduled-tasks', label: 'Scheduled Tasks', loadComponent: () => import('../jobs/ScheduledTasksPage').then(namedPage('ScheduledTasksPage')), permissions: SCHEDULED_TASK_VIEW_PERMS },
     ],
 };
-export const OPERATIONS_ADMIN_SECTIONS = [SETTINGS_ADMIN_SECTION, FLEET_CONFIGURATION_ADMIN_SECTION, JOBS_ADMIN_SECTION] as const;
+export const DEPLOYMENTS_ADMIN_SECTION: AdminSection = {
+    id: 'deployments', title: 'Deployments', icon: 'bi-rocket', navigationGroup,
+    permissions: ['sys.view_platform', 'sys.manage_platform', 'sys.admin', 'sys.view_dns', 'sys.manage_dns', 'sys.security'],
+    routes: [{ path: '', label: 'Deployments', loadComponent: () => import('../deployments/DeploymentsPage').then(namedPage('DeploymentsPage')) }],
+};
+export const MAINTENANCE_ADMIN_SECTION: AdminSection = {
+    id: 'maintenance', title: 'Maintenance', icon: 'bi-tools', navigationGroup,
+    permissions: ['sys.manage_aws', 'sys.view_platform', 'sys.manage_platform', 'sys.admin'],
+    routes: [{ path: '', label: 'Maintenance', loadComponent: () => import('../maintenance/MaintenancePage').then(namedPage('MaintenancePage')) }],
+};
+export const GEOLOCATION_ADMIN_SECTION: AdminSection = {
+    id: 'geolocation', title: 'GeoLocation', icon: 'bi-geo-alt', navigationGroup, permissions: [],
+    routes: [{ path: '', label: 'GeoLocation', requireSuperuser: true, loadComponent: () => import('../geolocation/GeoLocationPage').then(namedPage('GeoLocationPage')) }],
+};
+export const OPERATIONS_ADMIN_SECTIONS = [SETTINGS_ADMIN_SECTION, FLEET_CONFIGURATION_ADMIN_SECTION, JOBS_ADMIN_SECTION, MAINTENANCE_ADMIN_SECTION, DEPLOYMENTS_ADMIN_SECTION, GEOLOCATION_ADMIN_SECTION] as const;

package/src/admin/domains/security.ts

@@ -1,3 +1,4 @@
+import { namedPage } from './lazy-page';
 import type { AdminRoute, AdminSection } from '../core';
 import { BOUNCER_VIEW_PERMS } from '../bouncer/models';
 import { EDGE_BLOCKLIST_VIEW_PERMS } from '../edge/permissions';
@@ -9,48 +10,48 @@ import { GEOFENCE_VIEW_PERMS } from '../network/geofence/permissions';
 import { IPSET_VIEW_PERMS } from '../network/permissions';
 
 export const INCIDENTS_ADMIN_ROUTES: AdminRoute[] = [
-    { path: 'incidents', label: 'Incidents', loadComponent: () => import('../incidents/IncidentsPage').then(({ IncidentsPage }) => ({ default: IncidentsPage })), permissions: SECURITY_VIEW_PERMS },
-    { path: 'events', label: 'Events', loadComponent: () => import('../incidents/EventsPage').then(({ EventsPage }) => ({ default: EventsPage })), permissions: SECURITY_VIEW_PERMS },
+    { path: 'incidents', label: 'Incidents', loadComponent: () => import('../incidents/IncidentsPage').then(namedPage('IncidentsPage')), permissions: SECURITY_VIEW_PERMS },
+    { path: 'events', label: 'Events', loadComponent: () => import('../incidents/EventsPage').then(namedPage('EventsPage')), permissions: SECURITY_VIEW_PERMS },
 ];
 export const RULES_ADMIN_ROUTES: AdminRoute[] = [
-    { path: 'rules', label: 'Rule Engine', loadComponent: () => import('../rules/RuleSetsPage').then(({ RuleSetsPage }) => ({ default: RuleSetsPage })), permissions: SECURITY_VIEW_PERMS },
+    { path: 'rules', label: 'Rule Engine', loadComponent: () => import('../rules/RuleSetsPage').then(namedPage('RuleSetsPage')), permissions: SECURITY_VIEW_PERMS },
 ];
 
 export const SECURITY_OPERATIONS_ADMIN_SECTION: AdminSection = {
     id: 'security-operations', basePath: 'security', title: 'Security Operations', icon: 'bi-shield-check', navigationGroup: 'security', permissions: SECURITY_VIEW_PERMS,
     routes: [
-        { path: 'tickets', label: 'Tickets', loadComponent: () => import('../security/tickets').then(({ TicketsPage }) => ({ default: TicketsPage })), permissions: SECURITY_VIEW_PERMS },
+        { path: 'tickets', label: 'Tickets', loadComponent: () => import('../security/tickets').then(namedPage('TicketsPage')), permissions: SECURITY_VIEW_PERMS },
         ...INCIDENTS_ADMIN_ROUTES, ...RULES_ADMIN_ROUTES,
     ],
 };
 export const BOUNCER_ADMIN_SECTION: AdminSection = {
     id: 'bouncer', basePath: 'security/bouncer', title: 'Bouncer', icon: 'bi-shield-check', navigationGroup: 'security', permissions: BOUNCER_VIEW_PERMS,
     routes: [
-        { path: 'signals', label: 'Signal Decisions', loadComponent: () => import('../bouncer/signals').then(({ BouncerSignalsPage }) => ({ default: BouncerSignalsPage })), permissions: BOUNCER_VIEW_PERMS },
-        { path: 'devices', label: 'Device Reputation', loadComponent: () => import('../bouncer/devices').then(({ BouncerDevicesPage }) => ({ default: BouncerDevicesPage })), permissions: BOUNCER_VIEW_PERMS },
-        { path: 'signatures', label: 'Bot Signatures', loadComponent: () => import('../bouncer/signatures').then(({ BotSignaturesPage }) => ({ default: BotSignaturesPage })), permissions: BOUNCER_VIEW_PERMS },
+        { path: 'signals', label: 'Signal Decisions', loadComponent: () => import('../bouncer/signals').then(namedPage('BouncerSignalsPage')), permissions: BOUNCER_VIEW_PERMS },
+        { path: 'devices', label: 'Device Reputation', loadComponent: () => import('../bouncer/devices').then(namedPage('BouncerDevicesPage')), permissions: BOUNCER_VIEW_PERMS },
+        { path: 'signatures', label: 'Bot Signatures', loadComponent: () => import('../bouncer/signatures').then(namedPage('BotSignaturesPage')), permissions: BOUNCER_VIEW_PERMS },
     ],
 };
 export const DEVICE_INTEL_ADMIN_SECTION: AdminSection = {
     id: 'device-intel', basePath: 'security/devices', title: 'Devices & Logins', icon: 'bi-laptop', navigationGroup: 'security', permissions: [...new Set([...USER_DEVICE_VIEW_PERMS, ...LOGIN_EVENT_VIEW_PERMS])],
     routes: [
-        { path: 'user-devices', label: 'User Devices', loadComponent: () => import('../security/devices/UserDevicesPage').then(({ UserDevicesPage }) => ({ default: UserDevicesPage })), permissions: USER_DEVICE_VIEW_PERMS },
-        { path: 'login-locations', label: 'Login Locations', loadComponent: () => import('../security/devices/LoginLocationsPage').then(({ LoginLocationsPage }) => ({ default: LoginLocationsPage })), permissions: LOGIN_EVENT_VIEW_PERMS },
+        { path: 'user-devices', label: 'User Devices', loadComponent: () => import('../security/devices/UserDevicesPage').then(namedPage('UserDevicesPage')), permissions: USER_DEVICE_VIEW_PERMS },
+        { path: 'login-locations', label: 'Login Locations', loadComponent: () => import('../security/devices/LoginLocationsPage').then(namedPage('LoginLocationsPage')), permissions: LOGIN_EVENT_VIEW_PERMS },
     ],
 };
 export const GEOIP_ADMIN_SECTION: AdminSection = {
     id: 'geoip', basePath: 'security/geoip', title: 'IP Intelligence', icon: 'bi-globe2', navigationGroup: 'security', permissions: GEOIP_VIEW_PERMS,
-    routes: [{ path: 'cache', label: 'GeoIP Cache', loadComponent: () => import('../security/geoip/GeoIpCachePage').then(({ GeoIpCachePage }) => ({ default: GeoIpCachePage })), permissions: GEOIP_VIEW_PERMS }],
+    routes: [{ path: 'cache', label: 'GeoIP Cache', loadComponent: () => import('../security/geoip/GeoIpCachePage').then(namedPage('GeoIpCachePage')), permissions: GEOIP_VIEW_PERMS }],
 };
 export const NETWORK_SECURITY_ADMIN_SECTION: AdminSection = {
     id: 'network-security', basePath: 'security/network', title: 'Network Security', icon: 'bi-hdd-network', navigationGroup: 'security',
     permissions: [...new Set([...GEOIP_VIEW_PERMS, ...LOGS_ADMIN_PERMISSIONS, ...IPSET_VIEW_PERMS, ...GEOFENCE_VIEW_PERMS, ...EDGE_BLOCKLIST_VIEW_PERMS])],
     routes: [
-        { path: 'blocked-ips', label: 'Blocked IPs', loadComponent: () => import('../network/BlockedIPsPage').then(({ BlockedIPsPage }) => ({ default: BlockedIPsPage })), permissions: GEOIP_VIEW_PERMS },
-        { path: 'firewall-log', label: 'Firewall Log', loadComponent: () => import('../network/FirewallLogPage').then(({ FirewallLogPage }) => ({ default: FirewallLogPage })), permissions: LOGS_ADMIN_PERMISSIONS },
-        { path: 'ip-sets', label: 'IP Sets', loadComponent: () => import('../network/IPSetsPage').then(({ IPSetsPage }) => ({ default: IPSetsPage })), permissions: IPSET_VIEW_PERMS },
-        { path: 'geofencing', label: 'Geofencing', loadComponent: () => import('../network/geofence/GeofencingPage').then(({ GeofencingPage }) => ({ default: GeofencingPage })), permissions: GEOFENCE_VIEW_PERMS },
-        { path: 'edge-blocklist', label: 'Edge Blocklist', loadComponent: () => import('../edge/BlocklistPage').then(({ BlocklistPage }) => ({ default: BlocklistPage })), permissions: EDGE_BLOCKLIST_VIEW_PERMS },
+        { path: 'blocked-ips', label: 'Blocked IPs', loadComponent: () => import('../network/BlockedIPsPage').then(namedPage('BlockedIPsPage')), permissions: GEOIP_VIEW_PERMS },
+        { path: 'firewall-log', label: 'Firewall Log', loadComponent: () => import('../network/FirewallLogPage').then(namedPage('FirewallLogPage')), permissions: LOGS_ADMIN_PERMISSIONS },
+        { path: 'ip-sets', label: 'IP Sets', loadComponent: () => import('../network/IPSetsPage').then(namedPage('IPSetsPage')), permissions: IPSET_VIEW_PERMS },
+        { path: 'geofencing', label: 'Geofencing', loadComponent: () => import('../network/geofence/GeofencingPage').then(namedPage('GeofencingPage')), permissions: GEOFENCE_VIEW_PERMS },
+        { path: 'edge-blocklist', label: 'Edge Blocklist', loadComponent: () => import('../edge/BlocklistPage').then(namedPage('BlocklistPage')), permissions: EDGE_BLOCKLIST_VIEW_PERMS },
     ],
 };
 

package/src/admin/edge/EdgeHelp.tsx

@@ -0,0 +1,10 @@
+import { useId, useRef, useState, type ReactNode } from 'react';
+import { Popover } from '../../ui';
+
+/** Short, keyboard-accessible help, including inside native dialogs. */
+export function EdgeHelp({ label, children }: { label: string; children: ReactNode }) {
+    const anchor = useRef<HTMLButtonElement>(null);
+    const [open, setOpen] = useState(false);
+    const id = useId();
+    return <span className="edge-help"><button ref={anchor} type="button" className="btn-icon" aria-label={label} aria-expanded={open} aria-controls={open ? id : undefined} onClick={() => setOpen(value => !value)}><i className="bi bi-info-circle" aria-hidden="true" /></button><Popover id={id} anchorRef={anchor} open={open} onClose={() => setOpen(false)} className="edge-help-popover" aria-label={label}>{children}</Popover></span>;
+}

package/src/admin/edge/ServingReadiness.tsx

@@ -0,0 +1,54 @@
+import { useEffect, useRef, useState } from 'react';
+import { getAuthSessionRevision, getAuthSnapshot, useAuthSnapshot, useMe } from '../../client/runtime';
+import { Badge, FlatRow, modal } from '../../ui';
+import { EdgeHelp } from './EdgeHelp';
+import { datetime } from '../../ui/format';
+import { backendGlobalCan, FLEET_DASHBOARD_GRANTS } from '../fleet/access';
+import { readHostingReadiness, readServingBootstrap, type HostingReadiness, type ServingBootstrap } from './serving-data';
+
+/** Read-only evidence, deliberately outside Query: raw bootstrap never enters a cache. */
+export function ServingReadiness({ refreshRevision = 0 }: { refreshRevision?: number }) {
+    const auth = useAuthSnapshot(), { data: me } = useMe();
+    const scope = auth.authenticated && auth.uid && me?.id === Number(auth.uid) ? `${auth.uid}:${getAuthSessionRevision()}` : null;
+    const admitted = !!scope && backendGlobalCan(me, ['view_dns', 'manage_dns', 'security']);
+    const bootstrapAllowed = admitted && backendGlobalCan(me, FLEET_DASHBOARD_GRANTS);
+    const [refresh, setRefresh] = useState(0);
+    const [state, setState] = useState<{ scope: string | null; busy: boolean; bootstrap?: ServingBootstrap; report?: HostingReadiness; error?: string; reportError?: string }>({ scope: null, busy: false });
+    const flight = useRef(0);
+    const owner = useRef<AbortController | null>(null);
+    const evidenceAuthority = `${scope}:${admitted}:${bootstrapAllowed}:${me?.is_superuser === true}:${state.scope === scope && state.bootstrap?.user.is_superuser === true}:${state.scope === scope && state.bootstrap?.capabilities.setup === true}`;
+    useEffect(() => { const controller = new AbortController(); owner.current = controller; return () => controller.abort(); }, [evidenceAuthority]);
+    useEffect(() => {
+        const serial = ++flight.current, controller = new AbortController();
+        const current = () => !controller.signal.aborted && flight.current === serial && getAuthSnapshot().authenticated && `${getAuthSnapshot().uid}:${getAuthSessionRevision()}` === scope;
+        setState({ scope, busy: bootstrapAllowed });
+        if (!bootstrapAllowed || !me || !scope) return () => controller.abort();
+        const userId = me.id, superuser = me.is_superuser === true;
+        void (async () => {
+            try {
+                const bootstrap = await readServingBootstrap(userId, controller.signal);
+                if (!current()) return;
+                setState({ scope, busy: superuser && bootstrap.user.is_superuser && bootstrap.capabilities.setup, bootstrap });
+                if (superuser && bootstrap.user.is_superuser && bootstrap.capabilities.setup === true) {
+                    try {
+                        const report = await readHostingReadiness(controller.signal);
+                        if (current()) setState({ scope, busy: false, bootstrap, report });
+                    } catch (error) {
+                        if (current()) setState({ scope, busy: false, bootstrap, reportError: error instanceof Error ? error.message : 'Readiness observation failed.' });
+                    }
+                }
+            } catch (error) {
+                if (current()) setState({ scope, busy: false, error: error instanceof Error ? error.message : 'Node posture observation failed.' });
+            }
+        })();
+        return () => controller.abort();
+    }, [scope, bootstrapAllowed, me?.id, me?.is_superuser, refresh, refreshRevision]);
+    if (!bootstrapAllowed) return null;
+    const visible: typeof state = state.scope === scope ? state : { scope, busy: false };
+    const edge = visible.bootstrap?.edge, report = visible.report, selected = report?.sections.find(section => section.code === 'hosting_vhosts');
+    const unavailable = visible.error;
+    const showDetails = () => modal.open(close => <div className="modal-pad edge-check-dialog"><h2 className="modal-title">Serving configuration checks</h2><div className="edge-check-body"><FlatRow label="Public HTTP">{edge?.available && edge.http_enabled !== null ? edge.http_enabled ? 'Enabled' : 'Disabled' : 'Unknown'}</FlatRow><FlatRow label="Certificate issuance">{edge?.available && edge.dnsman_issuance === 'dns-01' ? 'DNS-01' : 'Unknown'}</FlatRow>{unavailable && <p role="status">Unavailable: {unavailable}</p>}
+        {selected && report ? <><FlatRow label="Generated"><time dateTime={report.generated_at}>{datetime(report.generated_at)}</time></FlatRow><FlatRow label="Coverage">{selected.coverage.returned} of {selected.coverage.total} checks · {selected.coverage.omitted} omitted</FlatRow><FlatRow label="Report status">{report.overall} · {report.summary.pass} pass · {report.summary.warn} warn · {report.summary.fail} fail · {report.summary.pending} pending</FlatRow>{(report.truncated || selected.coverage.omitted > 0 || report.coverage.checks.omitted > 0 || report.coverage.sections.omitted > 0) && <p className="text-warn">Partial report · some checks are omitted.</p>}{selected.checks.map((check, index) => <div key={`${check.code}:${index}`} className="edge-serving-check"><b>{check.status} · {check.code}</b><p>{check.explanation}</p>{check.remediation && <p>{check.remediation}</p>}{check.details && Object.entries(check.details).map(([key, value]) => <p key={key}>{key}: {String(value)}</p>)}</div>)}</> : <p role="status">{visible.busy ? 'Loading observation…' : `Unavailable: ${visible.reportError ?? unavailable ?? 'Requires a literal superuser and successful same-identity bootstrap with setup capability.'}`}</p>}
+        <p className="dim">These checks inspect domain and certificate configuration. They do not prove certificate expiry, coverage, installed material, fleet convergence, expected nodes or the running generation. HTTP is a file rendering setting; DNS-01 identifies the issuance method. A hostname absent from this bounded report has no individual verdict.</p></div><div className="modal-actions"><button type="button" className="btn" onClick={() => close(null)}>Close</button></div></div>, { size: 'md', signal: owner.current?.signal });
+    return <section className="edge-serving-evidence" aria-label="Serving evidence"><div className="edge-check-summary"><div className="edge-check-status"><i className="bi bi-shield-check" aria-hidden="true" /><strong>Configuration checks</strong><Badge tone={selected?.status === 'fail' ? 'danger' : 'muted'}>{visible.busy ? 'Checking…' : selected?.status ?? 'Unavailable'}</Badge><EdgeHelp label="About configuration checks">Checks saved domain and certificate configuration. Fleet application and live serving remain unverified.</EdgeHelp></div><div className="edge-row-actions"><button type="button" className="btn btn-compact" onClick={() => void showDetails()}>Check details</button><button type="button" className="btn-icon" aria-label="Refresh serving evidence" title="Refresh" disabled={visible.busy} onClick={() => setRefresh(value => value + 1)}><i className={`bi bi-arrow-repeat${visible.busy ? ' spin' : ''}`} /></button></div></div>{report && <small className="dim">As of <time dateTime={report.generated_at}>{datetime(report.generated_at)}</time>{report.truncated || selected?.coverage.omitted || report.coverage.checks.omitted || report.coverage.sections.omitted ? ' · Partial report' : ''}</small>}{(visible.error || visible.reportError) && <p className="text-warn" role="status">Configuration check unavailable. Open Check details for the reason.</p>}</section>;
+}