portal-mojo 0.2.19 → 0.2.21

package/src/admin/fleet-configuration/SharedValidationConnectionPanel.tsx

@@ -0,0 +1,166 @@
+import { useEffect, useRef, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { requestFreshAuth } from '../../client/runtime';
+import { FlatRow, fmt, modal } from '../../ui';
+import { applyConnection, connectionAuthority, connectionOperationFinished as operationFinished, connectionVerified, enableHub, nodeVerified, OperatorError, previewConnection, publishConnection, readConnection, readConnectionHistory, readConnectionOperation, readHubStatus, usePrivateOperator, type ConnectionInput, type ConnectionOperation, type ConnectionState, type HubStatus, type Preview, type SafeHistory } from './shared-validation-data';
+import { legacyDestination, readOperatorDestinations, type OperatorDestinations } from './operator-destinations';
+
+const layout = { display: 'grid', gap: 16, minWidth: 0, overflowWrap: 'anywhere' as const };
+export function SharedValidationConnectionPage() {
+    const owner = usePrivateOperator();
+    if (!owner.allowed) return <div className="panel panel-pad">Shared validation connection requires an interactive deployment operator.</div>;
+    return <div className="page" style={layout}><header><div className="eyebrow">Operations · Fleet Configuration</div><h1>Shared validation</h1><p className="dim">Share DNS validation while each issuer keeps its own certificates and private keys.</p></header><SharedValidationConnectionPanel key={owner.key} /></div>;
+}
+export function SharedValidationConnectionPanel({ pollInterval = 3000, pollLimit = 120 }: { pollInterval?: number; pollLimit?: number }) {
+    const owner = usePrivateOperator();
+    return owner.allowed ? <ConnectionContent key={owner.key} pollInterval={pollInterval} pollLimit={pollLimit} /> : <p>Deployment operator access is unavailable.</p>;
+}
+function ConnectionContent({ pollInterval, pollLimit }: { pollInterval: number; pollLimit: number }) {
+    const owner = usePrivateOperator();
+    const [state, setState] = useState<ConnectionState | null>(null), [history, setHistory] = useState<SafeHistory | null>(null);
+    const [destinations, setDestinations] = useState<OperatorDestinations | null>(null), [destinationError, setDestinationError] = useState('');
+    const [profileId, setProfileId] = useState(''), [keyAction, setKeyAction] = useState<ConnectionInput['key_action']>('keep');
+    const input = useRef<HTMLInputElement>(null), draft = useRef<ConnectionInput | null>(null);
+    const [preview, setPreview] = useState<Preview | null>(null), [operation, setOperation] = useState<ConnectionOperation | null>(null);
+    const [error, setError] = useState(''), [notice, setNotice] = useState(''), [busy, setBusy] = useState(false), [loading, setLoading] = useState(false), [blocked, setBlocked] = useState(true), [timedOut, setTimedOut] = useState(false);
+    const flight = useRef(false), generation = useRef(0), ticks = useRef(0), previewEpoch = useRef(0), observationEpoch = useRef(0), authority = useRef<string | null>(null);
+    const clearDraft = () => { previewEpoch.current++; draft.current = null; setPreview(null); if (input.current) input.current.value = ''; };
+    useEffect(() => () => { draft.current = null; if (input.current) input.current.value = ''; }, [owner.key]);
+    const failure = async (reason: unknown) => {
+        const safe = reason instanceof OperatorError ? reason : new OperatorError('unavailable'); setError(safe.message); setBlocked(true); clearDraft();
+        if (safe.kind === 'fresh') await requestFreshAuth();
+    };
+    const refresh = async (clear = true) => {
+        if (!owner.allowed) return false;
+        const fence = owner.fence(), run = ++generation.current, tracked = clear ? operation : null; if (clear) observationEpoch.current++; if (clear) clearDraft(); setLoading(true);
+        try {
+            const results = await Promise.allSettled([readConnection(fence), readConnectionHistory(fence), readOperatorDestinations(fence), tracked ? readConnectionOperation(tracked.operation_id, fence, tracked.revision) : Promise.resolve(null)]);
+            fence.beforeSend(); if (generation.current !== run) return false;
+            const main = results[0]; if (main.status === 'rejected') throw main.reason;
+            if (tracked && results[3].status === 'rejected') throw results[3].reason;
+            const nextAuthority = connectionAuthority(main.value);
+            if (authority.current !== null && authority.current !== nextAuthority) { clearDraft(); setNotice('Configuration authority changed. Preview again before publication.'); }
+            authority.current = nextAuthority;
+            if (clear) { if (tracked) setOperation(main.value.revision === tracked.revision && results[3].status === 'fulfilled' ? results[3].value : null); ticks.current = 0; setTimedOut(false); }
+            setState(main.value); setProfileId((old) => main.value.profiles.some((p) => p.id === old) ? old : main.value.selected_profile_id ?? main.value.profiles[0]?.id ?? '');
+            setHistory(results[1].status === 'fulfilled' ? results[1].value : null);
+            setDestinations(results[2].status === 'fulfilled' ? results[2].value : null);
+            setDestinationError(results[2].status === 'rejected' ? 'Existing Admin destinations could not be verified. Refresh before opening them.' : '');
+            setBlocked(false); setError(''); return true;
+        } catch (reason) { if (!fence.signal?.aborted && generation.current === run) await failure(reason); return false; }
+        finally { if (!fence.signal?.aborted && generation.current === run) setLoading(false); }
+    };
+    useEffect(() => { void refresh(); return () => { generation.current++; }; }, [owner.key]); // owner identity owns all state
+    useEffect(() => {
+        if (!operation || operationFinished(operation) || busy || loading || blocked || !owner.allowed || ticks.current >= pollLimit) return;
+        const timer = setTimeout(() => {
+            ticks.current++; const fence = owner.fence(), epoch = observationEpoch.current;
+            void readConnectionOperation(operation.operation_id, fence, operation.revision).then(async (next) => {
+                fence.beforeSend(); if (observationEpoch.current !== epoch) return; setOperation(next); await refresh(false); if (observationEpoch.current !== epoch) return; if (ticks.current >= pollLimit && !operationFinished(next)) setTimedOut(true);
+            }).catch((reason) => { if (!fence.signal?.aborted && observationEpoch.current === epoch) void failure(reason); });
+        }, pollInterval);
+        return () => clearTimeout(timer);
+    }, [operation, busy, loading, blocked, owner.key, pollInterval, pollLimit]);
+    const selected = state?.profiles.find((p) => p.id === profileId);
+    const change = () => { previewEpoch.current++; draft.current = null; setPreview(null); setNotice(''); };
+    const run = async (action: 'preview' | 'publish' | 'apply') => {
+        if (flight.current || !owner.allowed || !state?.available || blocked || loading) return;
+        const fence = owner.fence(); const opener = document.activeElement instanceof HTMLElement ? document.activeElement : null; const current = state; observationEpoch.current++; flight.current = true; setBusy(true); setError(''); setNotice(''); let attempted = false;
+        try {
+            fence.beforeSend();
+            if (action === 'preview') {
+                if (!current.catalog_revision || !selected) throw new OperatorError('invalid');
+                const candidate: ConnectionInput = { expected_revision: current.revision, expected_catalog_revision: current.catalog_revision, profile_id: selected.id, key_action: keyAction, ...(keyAction === 'replace' ? { replacement_key: input.current?.value ?? '' } : {}) };
+                const epoch = previewEpoch.current, expectedAuthority = authority.current;
+                const result = await previewConnection(candidate, keyAction === 'clear' ? null : selected, fence); fence.beforeSend(); if (previewEpoch.current !== epoch || authority.current !== expectedAuthority) throw new OperatorError('conflict'); draft.current = candidate; setPreview(result);
+                setNotice('Preview checked the candidate identity. Nothing was saved or applied.');
+            } else {
+                if (action === 'publish' && (!preview?.can_publish || !draft.current)) return;
+                if (action === 'apply' && !current.revision) return;
+                const frozen = draft.current;
+                const confirmed = await modal.open<boolean>((close) => <div className="modal-pad"><h2 className="modal-title">{action === 'publish' ? 'Publish shared validation connection?' : 'Apply configuration to every expected node?'}</h2><div className="modal-message"><p>{action === 'publish' ? `Profile: ${preview?.profile_id ?? 'Disabled connection'}` : `Published revision: ${current.revision}`}</p><p>Expected project: {preview?.expected_identity?.consumer_label ?? current.expected_identity?.consumer_label ?? 'Disabled'} · <code>{preview?.expected_identity?.consumer_project_uuid ?? current.expected_identity?.consumer_project_uuid ?? '—'}</code></p><p>{action === 'publish' ? 'Publish the reviewed connection bundle. Config-sync may restart services; node activation must be verified separately. This does not grant allocation trust, retire a key or activate hub sharing.' : 'Ask every expected node to sync this exact revision. Application and worker processes may restart. Missing nodes remain unconfirmed; existing release holds are unchanged.'}</p>{action === 'publish' && keyAction === 'clear' && <p className="text-warn">Disable the whole connection and mask base credentials. This does not delete base keys or revoke remote trust. Existing identity rows can refuse this operation.</p>}</div><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Cancel</button><button className="btn btn-primary" onClick={() => close(true)}>{action === 'publish' ? 'Publish connection' : 'Apply now'}</button></div></div>, { size: 'md', signal: fence.signal });
+                if (!confirmed) return; fence.beforeSend();
+                if (action === 'publish' && frozen !== draft.current) throw new OperatorError('conflict');
+                attempted = true;
+                if (action === 'publish') { await publishConnection(frozen!, fence); fence.beforeSend(); setOperation(null); setNotice('Published. Apply and verify every expected node separately. The old key is still active.'); }
+                else { const result = await applyConnection(current.revision!, fence); fence.beforeSend(); setOperation(result); ticks.current = 0; setTimedOut(false); setNotice('Apply requested. Waiting for revision-bound process and identity proof.'); }
+                clearDraft(); await refresh(false);
+            }
+        } catch (reason) {
+            if (!fence.signal?.aborted) {
+                if (attempted) { clearDraft(); await refresh(false); }
+                await failure(reason);
+            }
+        } finally { if (!fence.signal?.aborted) { setBusy(false); requestAnimationFrame(() => { try { fence.beforeSend(); if (opener?.isConnected) opener.focus(); } catch { /* Former owner cannot regain focus. */ } }); } flight.current = false; }
+    };
+    if (!owner.allowed) return <p>Deployment operator access is no longer available.</p>;
+    const report = operation?.revision === state?.revision ? operation : state?.fleet;
+    const currentReport = !blocked && !loading;
+    return <div className="shared-validation-operator" style={layout}>
+        <HubSharing key={owner.key} />
+        <section className="panel panel-pad" aria-label="Shared validation connection" style={layout}>
+            <h2>Protected connection</h2>
+            <p>Use a protected ACME consumer key issued for the original hub project. The approved profile fixes the hub origin and project identity.</p>
+            <div><button className="btn" disabled={busy || loading} onClick={() => void refresh()}>Refresh connection status</button>{loading && <span role="status"> Checking current state…</span>}</div>
+            {error && <p className="form-alert" role="alert">{error}{state && ' Earlier observations are not current confirmation.'}</p>}{notice && <p role="status">{notice}</p>}
+            {state && <><FlatRow label="Published revision"><code>{state.revision ?? 'Not published'}</code></FlatRow><FlatRow label="This process loaded"><code>{state.loaded_revision ?? 'Not reported'}</code></FlatRow><FlatRow label="Credential">{state.credential.configured ? 'Configured (hidden)' : 'Not configured'} · {state.credential.source}</FlatRow><FlatRow label="Loaded identity">{state.loaded_identity?.state ?? 'Unavailable'} · <code>{state.loaded_identity?.observed_project_uuid ?? 'Not observed'}</code></FlatRow><FlatRow label="Identity checked">{state.loaded_identity?.checked_at ? fmt.datetime(state.loaded_identity.checked_at) : 'Not observed'}</FlatRow>
+                {state.loaded_identity?.state === 'verified' && !state.loaded_identity.sharing_ready && <p className="dns-warning">The connection identity is verified. Enable sharing on the approved hub, then refresh this connection.</p>}
+                {!state.available && <div className="dns-blocked"><strong>Connection setup unavailable</strong><ul>{state.unavailable_reasons.map((reason) => <li key={reason}>{reason.replaceAll('_', ' ')}</li>)}</ul><p>Use the permitted System Setup destination below to inspect publisher, schema, delegation and node enrollment. An empty profile catalog cannot be filled in this form.</p></div>}
+                <fieldset disabled={busy || loading || blocked || !state.available} style={{ border: 0, padding: 0, ...layout }}>
+                    <label className="field"><span className="field-label">Approved hub profile</span><select className="input" value={profileId} onChange={(e) => { change(); setProfileId(e.target.value); }}><option value="">Choose an approved profile</option>{state.profiles.map((profile) => <option key={profile.id} value={profile.id}>{profile.label}</option>)}</select></label>
+                    {selected && <><FlatRow label="Approved hub"><code>{selected.origin}</code></FlatRow><FlatRow label="Expected original hub project">{selected.consumer_label} · <code>{selected.consumer_project_uuid}</code></FlatRow></>}
+                    <label className="field"><span className="field-label">Protected key action</span><select className="input" value={keyAction} onChange={(e) => { change(); if (input.current) input.current.value = ''; setKeyAction(e.target.value as ConnectionInput['key_action']); }}><option value="keep">Keep current key</option><option value="replace">Replace key</option><option value="clear">Disable connection</option></select></label>
+                    {keyAction === 'replace' && <label className="field"><span className="field-label">Replacement protected key</span><input className="input" type="password" ref={input} autoComplete="off" spellCheck={false} maxLength={4096} onChange={change} /><span className="field-help">Write only. Blank preserves the existing key. The value remains only in this mounted form until the attempt completes.</span></label>}
+                    {keyAction === 'clear' && <p className="text-warn">Disable the whole bundle and mask base credentials; remote trust and base keys remain. Retained shared identities can make disabling ineligible.</p>}
+                    <div><button className="btn" disabled={!selected} onClick={() => void run('preview')}>Preview connection</button></div>
+                    {preview && <div className="dns-shared-request"><h3>Revision and identity preview</h3><FlatRow label="Current revision"><code>{preview.revision ?? 'Unpublished'}</code></FlatRow><FlatRow label="Observed project"><code>{preview.identity.observed_project_uuid ?? 'Disabled'}</code></FlatRow><FlatRow label="Identity">{preview.identity.state} · {preview.identity.checked_at ? fmt.datetime(preview.identity.checked_at) : 'Not applicable'}</FlatRow><p>{preview.identity.sharing_ready ? 'Hub reports sharing ready.' : 'Hub sharing activation is not established by this preview.'}</p><p>Credential changes: {preview.credential_changed ? 'Yes' : 'No'}. Apply and every-node verification remain separate. Retiring the old key is a later explicit action.</p><button className="btn btn-primary" disabled={!preview.can_publish} onClick={() => void run('publish')}>Review publication</button></div>}
+                </fieldset>
+                <div><button className="btn btn-primary" disabled={busy || loading || blocked || !state.available || !state.revision || !!operation && !operationFinished(operation)} onClick={() => void run('apply')}>Review apply to nodes</button></div>
+            </>}
+        </section>
+        {state && report && <section className="panel panel-pad" aria-label="Every expected node" style={layout}><h2>Every expected node</h2><p role="status" className={currentReport && connectionVerified(state, report) ? 'text-ok' : 'text-warn'}>{currentReport && connectionVerified(state, report) ? 'Connection applied and verified on every expected node' : 'Not confirmed on every expected node'} · {report.status}</p><p className="dim">Combined proof covers the request service where enabled, job engine and scheduler at the target revision. Worker-only exemption is server-owned. Offline nodes stay in the denominator; a completed dispatch job is not process proof.</p>{!report.nodes.length && <p>No expected-node evidence is available.</p>}{report.nodes.map((node) => <article className="dns-shared-request" key={node.hostname}><h3>{node.hostname}</h3><FlatRow label="Revision"><code>{node.revision}</code></FlatRow><FlatRow label="Publication / installation">{node.published ? 'Published' : 'Unconfirmed'} · {node.installed ? 'Installed' : 'Not installed'}</FlatRow><FlatRow label="Restart">{node.restarted ? 'Reported restarted' : node.restart_requested ? 'Requested' : 'Unconfirmed'}</FlatRow><FlatRow label="Request + engine + scheduler proof">{currentReport && nodeVerified(node, report, state.revision, state.profiles.find((p) => p.id === state.selected_profile_id)) ? 'Confirmed at target revision and identity' : 'Unconfirmed'}</FlatRow><FlatRow label="Observed hub project"><code>{node.shared_validation?.observed_project_uuid ?? 'Unavailable'}</code></FlatRow><FlatRow label="Identity check">{node.shared_validation?.checked_at ? fmt.datetime(node.shared_validation.checked_at) : 'Unavailable'} · {node.shared_validation?.sharing_ready ? 'Sharing ready' : 'Sharing readiness not established'}</FlatRow><p>{node.error_code ?? node.status}</p></article>)}{timedOut && <p className="text-warn">Automatic observations reached their limit. Refresh explicitly for current status.</p>}</section>}
+        <section className="panel panel-pad" style={layout}><h2>Existing deployment controls</h2><p>Update every expected node through the existing deployment controls before enabling sharing. Each control keeps its own confirmation and release permissions.</p>{destinationError && <p role="alert">{destinationError}</p>}{destinations?.external && <p>External infrastructure mode: existing controls retain their IaC restrictions.</p>}<div style={{ display: 'flex', gap: 8, flexWrap: 'wrap' }}>{(['setup', 'deployments', 'topology', 'capacity'] as const).map((kind) => { const href = destinations && legacyDestination(destinations, kind); return href ? <a key={kind} className="btn" href={href}>{({ setup: 'Open System Setup', deployments: 'Open Deployments and framework policy', topology: 'Open expected topology', capacity: 'Open Fleet Scaling' })[kind]}</a> : <span key={kind} className="dim">{kind}: destination unavailable</span>; })}</div></section>
+        <section className="panel panel-pad" style={layout}><h2>Replace first, retire later</h2><p>On the approved hub, use Group API Keys → Create ACME consumer key for the exact original project. Enter the replacement here, Preview and Publish, then Apply and verify every expected node. Only then explicitly review/deactivate the old key in the hub inventory. No key is retired automatically.</p><p>Existing audited Token reveal can recover an issued key. In-place rotation invalidates the previous token immediately and is not this staged rollout.</p><Link className="btn" to="../../api-keys" relative="path">Open this deployment’s Group API Keys</Link><p className="dim">This local inventory is not a claim that this deployment is the approved hub or that it observed another deployment’s nodes.</p></section>
+        <section className="panel panel-pad"><h2>Version history</h2>{history ? <>{history.versions.map((version) => <p key={version.version_id}><code>{version.version_id}</code> · {version.published_at ? fmt.datetime(version.published_at) : 'Time unavailable'}{version.current ? ' · current' : ''}</p>)}{history.truncated && <p>Only recent versions are shown.</p>}</> : <p>History unavailable. Use Refresh; secrets are never displayed here.</p>}</section>
+    </div>;
+}
+
+const hubMessages: Record<NonNullable<HubStatus['reason']>, string> = {
+    hub_unconfigured: 'This deployment is not a validation hub. Configure its connection below; enable sharing on the approved hub.',
+    hub_unavailable: 'Hub status is unavailable. Refresh to try again.',
+    deployment_required: 'Deploy the compatible framework to every expected node first.',
+    deployment_in_progress: 'Wait for the current deployment to finish, then refresh.',
+    deployment_not_converged: 'Finish the deployment on every expected node, then refresh.',
+    deployment_proof_unavailable: 'Some nodes have not confirmed the deployed framework. Check Deployments, then refresh.',
+    framework_upgrade_required: 'Update every expected node to a compatible framework release, then refresh.',
+};
+function HubSharing() {
+    const owner = usePrivateOperator();
+    const [state, setState] = useState<HubStatus | null>(null), [error, setError] = useState(''), [busy, setBusy] = useState(false), [loading, setLoading] = useState(true);
+    const flight = useRef(false), generation = useRef(0);
+    const refresh = async () => {
+        const fence = owner.fence(), current = ++generation.current; setLoading(true);
+        try { const next = await readHubStatus(fence); fence.beforeSend(); if (current === generation.current) { setState(next); setError(''); } }
+        catch (reason) { if (!fence.signal?.aborted && current === generation.current) setError((reason instanceof OperatorError ? reason : new OperatorError('unavailable')).message); }
+        finally { if (!fence.signal?.aborted && current === generation.current) setLoading(false); }
+    };
+    useEffect(() => { void refresh(); return () => { generation.current++; }; }, [owner.key]);
+    const enable = async () => {
+        if (flight.current || loading || error || !state?.can_enable || !state.deployment_uuid) return;
+        const fence = owner.fence(), deployment = state.deployment_uuid, opener = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+        flight.current = true; setBusy(true);
+        try {
+            fence.beforeSend();
+            const confirmed = await modal.open<boolean>(close => <div className="modal-pad"><h2 className="modal-title">Enable shared validation?</h2><div className="modal-message"><p>Enable this hub after the verified deployment <code>{deployment}</code>.</p><p>Trusted projects can share DNS validation. Each issuer keeps its own certificates, accounts and private keys. Allocation trust still requires explicit approval.</p><p>Keep the compatible framework installed on every node after enabling sharing.</p></div><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Cancel</button><button className="btn btn-primary" onClick={() => close(true)}>Enable sharing</button></div></div>, { size: 'md', signal: fence.signal });
+            if (!confirmed) return; fence.beforeSend();
+            const next = await enableHub(deployment, fence); fence.beforeSend(); setState(next); setError('');
+        } catch (reason) {
+            if (!fence.signal?.aborted) {
+                const safe = reason instanceof OperatorError ? reason : new OperatorError('unavailable');
+                await refresh(); try { fence.beforeSend(); } catch { return; } setError(`${safe.message} Refresh hub status before trying again.`);
+                if (safe.kind === 'fresh') await requestFreshAuth();
+            }
+        } finally { flight.current = false; if (!fence.signal?.aborted) { setBusy(false); requestAnimationFrame(() => { try { fence.beforeSend(); if (opener?.isConnected) opener.focus(); } catch { /* The former session no longer owns focus. */ } }); } }
+    };
+    return <section className="panel panel-pad" aria-label="Validation hub" style={layout}><h2>Validation hub</h2><p>Enable sharing once after updating every node through the existing deployment controls. Configured issuers renew automatically.</p><p role="status">{loading ? 'Checking hub status…' : error ? 'Current hub status is unavailable.' : state?.enabled ? 'Sharing is enabled.' : state?.reason ? hubMessages[state.reason] : 'Ready to enable sharing.'}</p>{state?.enabled && !state.configured && <p className="text-warn">Hub DNS configuration is unavailable. Check System Setup, then refresh.</p>}{error && <p className="form-alert" role="alert">{error}</p>}<div style={{ display: 'flex', flexWrap: 'wrap', gap: 8 }}><button className="btn" disabled={busy || loading} onClick={() => void refresh()}>Refresh hub status</button>{!state?.enabled && <button className="btn btn-primary" disabled={busy || loading || !!error || !state?.can_enable} onClick={() => void enable()}>Enable shared validation</button>}</div></section>;
+}

package/src/admin/fleet-configuration/data.ts

@@ -87,3 +87,7 @@ export async function readFleetOperation(id: string): Promise<FleetOperation> {
 export async function writeFleet<T>(body: Record<string, unknown>): Promise<T> {
     return withFreshAuth(async () => (await mojoCall(FLEET_ENDPOINT, { method: 'POST', body })).data as T);
 }
+
+/** Managed bundle fields are edited together in their dedicated operator topic. */
+export const MANAGED_CONNECTION_KEYS = ['DNSMAN_ACME_HUB_PROFILE_ID', 'DNSMAN_ACME_HUB_URL', 'DNSMAN_ACME_HUB_API_KEY'] as const;
+export const isManagedConnectionKey = (key: string) => (MANAGED_CONNECTION_KEYS as readonly string[]).includes(key);

package/src/admin/fleet-configuration/operator-destinations.ts

@@ -0,0 +1,20 @@
+import { apiOrigin } from '../../client/client';
+import { flag, object, OperatorError, privateCall, type PrivateScope } from './shared-validation-data';
+export interface OperatorDestinations { admin_path: string; setup: boolean; deployments: boolean; topology: boolean; capacity: boolean; external: boolean }
+export function parseDestinations(v: unknown): OperatorDestinations {
+    const r = object(v), c = object(r.capabilities), f = object(r.features), platform = object(f.platform), pc = object(platform.capabilities), settings = object(f.settings), sc = object(settings.capabilities);
+    if (typeof r.admin_path !== 'string' || !/^\/[A-Za-z0-9_-]+\/$/.test(r.admin_path)) throw new OperatorError('invalid');
+    return { admin_path: r.admin_path, setup: flag(platform.enabled) && flag(pc.setup) && flag(c.setup), deployments: flag(platform.enabled) && flag(pc.view), topology: flag(settings.enabled) && flag(sc.owner_edit), capacity: flag(platform.enabled) && flag(pc.capacity), external: object(r.infrastructure).mode === 'external' };
+}
+export const readOperatorDestinations = async (scope?: PrivateScope) => parseDestinations(await privateCall('/api/account/admin/bootstrap', null, scope));
+/** The backend capacity hint is semantic; the actual legacy route is fleet. */
+export function legacyDestination(d: OperatorDestinations, kind: 'setup' | 'deployments' | 'topology' | 'capacity'): string | null {
+    if (!d[kind]) return null;
+    const base = new URL(apiOrigin() || '/', window.location.origin);
+    if (base.origin !== window.location.origin) return null;
+    return `${d.admin_path}#/${{ setup: 'setup', deployments: 'deployments', topology: 'settings?focus=topology', capacity: 'fleet' }[kind]}`;
+}
+export function fleetConnectionRoute(pathname: string): string {
+    const marker = pathname.lastIndexOf('/dns'); const fleet = pathname.lastIndexOf('/fleet-configuration');
+    return `${marker >= 0 ? pathname.slice(0, marker) : fleet >= 0 ? pathname.slice(0, fleet) : ''}/fleet-configuration/shared-validation`;
+}

package/src/admin/fleet-configuration/shared-validation-data.ts

@@ -0,0 +1,143 @@
+/** Private operator boundary. Credential-bearing requests never use Query/Mutation or replay. */
+import { useEffect, useRef } from 'react';
+import { apiOrigin, usingMockTransport } from '../../client/client';
+import { getAuthSessionRevision, getAuthSnapshot, mojoCall, MojoError, useAuthSnapshot, useMe, type Params } from '../../client/runtime';
+// This private protocol boundary does not import the generic replaying writer.
+const FLEET_ENDPOINT = '/api/account/admin/fleet';
+const FLEET_HEALTH_SCOPE = 'request_service_jobs_and_dependencies';
+
+export const CONNECTION_ENDPOINT = `${FLEET_ENDPOINT}/shared-validation`;
+export interface PrivateScope { signal?: AbortSignal; beforeSend?: () => void }
+export class OperatorError extends Error {
+    constructor(public kind: 'invalid' | 'recipient' | 'unsupported' | 'denied' | 'fresh' | 'conflict' | 'busy' | 'unavailable' | 'uncertain', public code: string | null = null) {
+        super({ recipient: 'The original hub recipient Group is unavailable or inactive. Resolve the current Group before continuing.', invalid: 'The operator service returned an incompatible response. Refresh before continuing.', unsupported: 'This backend does not support shared-validation configuration. Existing settings remain available.', denied: 'This action requires a current interactive deployment operator.', fresh: 'Authenticate again, Refresh and deliberately repeat the action. Nothing is replayed.', conflict: 'The profile, recipient or publication changed. Refresh and review again before continuing.', busy: 'Configuration is busy. Refresh and deliberately retry after the other operation finishes.', unavailable: 'The operator service is unavailable. Refresh to check its current prerequisites.', uncertain: 'The operation may have persisted. Refresh authoritative status or key inventory before another attempt.' }[kind]);
+    }
+}
+const invalid = (): never => { throw new OperatorError('invalid'); };
+export const object = (v: unknown): Record<string, unknown> => v != null && typeof v === 'object' && !Array.isArray(v) ? v as Record<string, unknown> : invalid();
+export const label = (v: unknown, max = 200): string => typeof v === 'string' && v.length <= max && !/[\x00-\x1f\x7f]/.test(v) ? v : invalid();
+export const flag = (v: unknown): boolean => typeof v === 'boolean' ? v : invalid();
+export const nullable = <T>(v: unknown, parse: (x: unknown) => T): T | null => v === null ? null : parse(v);
+export const choice = <T extends string>(v: unknown, values: readonly T[]): T => values.includes(v as T) ? v as T : invalid();
+export const uuid = (v: unknown): string => typeof v === 'string' && /^[a-f0-9]{32}$/.test(v) ? v : invalid();
+/** Only project identities accept legacy Group IDs; revision/operation UUIDs stay strict. */
+export const projectIdentity = (v: unknown): string => typeof v === 'string' && /^[a-f0-9]{16}$/.test(v) ? v : uuid(v);
+const profileId = (v: unknown): string => typeof v === 'string' && /^[a-z][a-z0-9_-]{0,63}$/.test(v) ? v : invalid();
+export const token = (v: unknown): string => typeof v === 'string' && /^[a-z0-9_.-]{1,80}$/.test(v) ? v : invalid();
+const catalog = (v: unknown): string => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v) ? v : invalid();
+export const timestamp = (v: unknown): string => { const s = label(v, 40); return /^\d{4}-\d\d-\d\dT/.test(s) && Number.isFinite(Date.parse(s)) ? s : invalid(); };
+export const positive = (v: unknown): number => Number.isSafeInteger(v) && Number(v) > 0 ? Number(v) : invalid();
+const bounded = (v: unknown, max: number): unknown[] => Array.isArray(v) && v.length <= max ? v : invalid();
+function origin(v: unknown): string { const s = label(v, 512); try { const u = new URL(s); return !u.username && !u.password && u.origin === s && (u.protocol === 'https:' || u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)) ? s : invalid(); } catch { return invalid(); } }
+export interface Identity { consumer_project_uuid: string; consumer_label: string }
+export interface HubProfile extends Identity { id: string; label: string; origin: string }
+export interface Observation { state: 'disabled' | 'verified' | 'unavailable'; profile_id: string | null; observed_project_uuid: string | null; checked_at: string | null; error_code: string | null; sharing_ready: boolean }
+export interface ConnectionNode { hostname: string; revision: string; published: boolean; installed: boolean; restart_requested: boolean; restarted: boolean; healthy: boolean; status: string; error_code: string | null; shared_validation: Observation | null }
+export interface ConnectionReport { status: string; nodes: ConnectionNode[]; healthy_everywhere: boolean; health_scope?: string; observed_at?: string; error_code?: string }
+export interface ConnectionState { schema_version: 1; available: boolean; unavailable_reasons: string[]; catalog_revision: string | null; profiles: HubProfile[]; selected_profile_id: string | null; expected_identity: Identity | null; loaded_identity: Observation | null; credential: { configured: boolean; source: 'published' | 'static' | 'none' | 'unknown'; overridden: boolean }; revision: string | null; loaded_revision: string | null; pending_restart: boolean; fleet: ConnectionReport }
+export interface ConnectionInput { expected_revision: string | null; expected_catalog_revision: string; profile_id: string; key_action: 'keep' | 'replace' | 'clear'; replacement_key?: string }
+export interface Preview { can_publish: boolean; revision: string | null; catalog_revision: string; profile_id: string | null; expected_identity: Identity | null; identity: Observation; credential_changed: boolean; consequences: string[] }
+export interface Publication { published: true; revision: string; version_id: string | null; pending_restart: true; applied: false }
+export interface ConnectionOperation extends ConnectionReport { operation_id: string; revision: string; job_status?: string }
+/** Private observation stops on terminal operation or failed dispatch, never completed dispatch alone. */
+export const connectionOperationFinished = (operation: ConnectionOperation) => ['healthy', 'failed', 'expired', 'canceled', 'superseded', 'timed_out'].includes(operation.status) || ['failed', 'expired', 'canceled'].includes(operation.job_status ?? '');
+export interface SafeHistory { versions: { version_id: string; current: boolean; published_at: string | null }[]; truncated: boolean }
+const identity = (v: unknown): Identity => { const r = object(v); return { consumer_project_uuid: projectIdentity(r.consumer_project_uuid), consumer_label: label(r.consumer_label) }; };
+export function parseObservation(v: unknown): Observation {
+    const r = object(v); const out: Observation = { state: choice(r.state, ['disabled', 'verified', 'unavailable']), profile_id: r.profile_id == null ? null : profileId(r.profile_id), observed_project_uuid: nullable(r.observed_project_uuid, projectIdentity), checked_at: r.checked_at == null ? null : timestamp(r.checked_at), error_code: r.error_code == null ? null : token(r.error_code), sharing_ready: flag(r.sharing_ready) };
+    if (out.state === 'verified' && (!out.observed_project_uuid || !out.checked_at || out.error_code) || out.state === 'disabled' && (out.observed_project_uuid || out.sharing_ready)) invalid();
+    return out;
+}
+export function parseReport(v: unknown): ConnectionReport {
+    const r = object(v); const nodes = bounded(r.nodes, 128).map((value): ConnectionNode => {
+        const n = object(value), hostname = label(n.hostname, 253); if (!/^[a-z0-9][a-z0-9_.-]*$/.test(hostname)) invalid();
+        return { hostname, revision: uuid(n.revision), published: flag(n.published), installed: flag(n.installed), restart_requested: flag(n.restart_requested), restarted: flag(n.restarted), healthy: flag(n.healthy), status: choice(n.status, ['unknown', 'draining', 'healthy', 'restarted', 'restart_requested', 'downloaded', 'pending', 'failed']), error_code: n.error_code == null ? null : token(n.error_code), shared_validation: n.shared_validation == null ? null : parseObservation(n.shared_validation) };
+    });
+    if (new Set(nodes.map((n) => n.hostname)).size !== nodes.length) invalid();
+    return { status: choice(r.status, ['unpublished', 'unconfigured', 'queued', 'dispatched', 'pending', 'healthy', 'unknown', 'failed', 'expired', 'canceled', 'superseded', 'timed_out']), nodes, healthy_everywhere: flag(r.healthy_everywhere), health_scope: r.health_scope == null ? undefined : token(r.health_scope), observed_at: r.observed_at == null ? undefined : timestamp(r.observed_at), error_code: r.error_code == null ? undefined : token(r.error_code) };
+}
+export function parseConnectionState(v: unknown): ConnectionState {
+    const r = object(v); if (r.schema_version !== 1) throw new OperatorError('unsupported');
+    const c = object(r.credential), destination = object(r.setup_destination);
+    if (destination.route !== 'setup' || destination.section !== 'aws' || destination.capacity_route !== 'capacity' || destination.actor !== 'deployment_operator' || destination.adoption_item !== 8903) invalid();
+    const profiles = bounded(r.profiles, 64).map((value) => { const p = object(value); return { id: profileId(p.id), label: label(p.label), origin: origin(p.origin), ...identity(p) }; });
+    if (new Set(profiles.map((p) => p.id)).size !== profiles.length) invalid();
+    const out: ConnectionState = { schema_version: 1, available: flag(r.available), unavailable_reasons: bounded(r.unavailable_reasons, 20).map(token), catalog_revision: nullable(r.catalog_revision, catalog), profiles, selected_profile_id: nullable(r.selected_profile_id, profileId), expected_identity: nullable(r.expected_identity, identity), loaded_identity: nullable(r.loaded_identity, parseObservation), credential: { configured: flag(c.configured), source: choice(c.source, ['published', 'static', 'none', 'unknown']), overridden: flag(c.overridden) }, revision: nullable(r.revision, uuid), loaded_revision: nullable(r.loaded_revision, uuid), pending_restart: flag(r.pending_restart), fleet: parseReport(r.fleet) };
+    const selected = profiles.find((p) => p.id === out.selected_profile_id);
+    if (out.selected_profile_id && (!selected || selected.consumer_project_uuid !== out.expected_identity?.consumer_project_uuid) || out.available && (!out.catalog_revision || !profiles.length || out.unavailable_reasons.length)) invalid();
+    return out;
+}
+export const connectionAuthority = (s: ConnectionState) => JSON.stringify([s.available, s.unavailable_reasons, s.revision, s.catalog_revision, s.selected_profile_id, s.expected_identity, s.profiles, s.credential]);
+export function validateInput(v: ConnectionInput): void {
+    nullable(v.expected_revision, uuid); catalog(v.expected_catalog_revision); profileId(v.profile_id); choice(v.key_action, ['keep', 'replace', 'clear']);
+    if (Object.keys(v).some((k) => !['expected_revision', 'expected_catalog_revision', 'profile_id', 'key_action', 'replacement_key'].includes(k)) || v.replacement_key !== undefined && (v.key_action !== 'replace' || typeof v.replacement_key !== 'string' || v.replacement_key.length > 4096 || /\s/.test(v.replacement_key))) invalid();
+}
+export function parsePreview(v: unknown, input: ConnectionInput, expected: Identity | null): Preview {
+    const r = object(v); const out: Preview = { can_publish: flag(r.can_publish), revision: nullable(r.revision, uuid), catalog_revision: catalog(r.catalog_revision), profile_id: nullable(r.profile_id, profileId), expected_identity: nullable(r.expected_identity, identity), identity: parseObservation(r.identity), credential_changed: flag(r.credential_changed), consequences: bounded(r.consequences, 8).map((c) => choice(c, ['connection_disabled', 'restart_required', 'apply_and_verify_every_expected_node', 'old_key_retirement_is_separate'])) };
+    if (out.revision !== input.expected_revision || out.catalog_revision !== input.expected_catalog_revision || (input.key_action === 'clear' ? out.profile_id !== null || out.identity.state !== 'disabled' : out.profile_id !== input.profile_id || out.expected_identity?.consumer_project_uuid !== expected?.consumer_project_uuid || out.identity.state !== 'verified' || out.identity.observed_project_uuid !== expected?.consumer_project_uuid)) invalid();
+    return out;
+}
+export function nodeVerified(n: ConnectionNode, report: ConnectionReport, revision: string | null, profile: HubProfile | undefined): boolean {
+    return report.status === 'healthy' && !report.error_code && n.status === 'healthy' && report.health_scope === FLEET_HEALTH_SCOPE && !!revision && n.revision === revision && n.published && n.installed && n.restarted && n.healthy && !n.error_code && !!profile && n.shared_validation?.state === 'verified' && n.shared_validation.profile_id === profile.id && n.shared_validation.observed_project_uuid === profile.consumer_project_uuid;
+}
+export const connectionVerified = (s: ConnectionState, r = s.fleet) => r.status === 'healthy' && !r.error_code && !['failed', 'expired', 'canceled'].includes((r as Partial<ConnectionOperation>).job_status ?? '') && r.healthy_everywhere && r.nodes.length > 0 && r.nodes.every((n) => nodeVerified(n, r, s.revision, s.profiles.find((p) => p.id === s.selected_profile_id)));
+export function operatorOrigin(): void { if (!usingMockTransport() && new URL(apiOrigin(), window.location.origin).origin !== window.location.origin) throw new OperatorError('denied'); }
+export async function privateCall(path: string, body: Record<string, unknown> | null, scope: PrivateScope = {}, params?: Params): Promise<unknown> {
+    try {
+        if (body) operatorOrigin();
+        return (await mojoCall(path, { ...(body ? { method: 'POST', body } : { params }), signal: scope.signal, beforeSend: () => { if (body) operatorOrigin(); scope.beforeSend?.(); } })).data;
+    } catch (e) {
+        if (e instanceof OperatorError) throw e;
+        if (scope.signal?.aborted) throw new OperatorError('denied');
+        if (e instanceof MojoError) {
+            if (e.status === 440) throw new OperatorError('fresh');
+            if ([401, 403].includes(e.status)) throw new OperatorError('denied');
+            if (e.status === 404 && e.errorCode === 'recipient_unavailable') throw new OperatorError('recipient');
+            if ([404, 405].includes(e.status)) throw new OperatorError('unsupported');
+            if (e.errorCode === 'configuration_busy') throw new OperatorError('busy', 'configuration_busy');
+            if (e.errorCode === 'publication_uncertain') throw new OperatorError('uncertain');
+            if (e.status === 409) throw new OperatorError('conflict');
+            if (e.status === 400) throw new OperatorError('invalid');
+            if (e.status === 503) throw new OperatorError('unavailable');
+        }
+        throw new OperatorError(body ? 'uncertain' : 'unavailable');
+    }
+}
+export const readConnection = async (scope?: PrivateScope) => parseConnectionState(await privateCall(CONNECTION_ENDPOINT, null, scope));
+const HUB_ENDPOINT = `${CONNECTION_ENDPOINT}/hub`;
+const hubReasons = ['hub_unconfigured', 'hub_unavailable', 'deployment_required', 'deployment_in_progress', 'deployment_not_converged', 'deployment_proof_unavailable', 'framework_upgrade_required'] as const;
+export interface HubStatus { version: 1; enabled: boolean; configured: boolean; deployment_uuid: string | null; can_enable: boolean; reason: typeof hubReasons[number] | null }
+const deploymentId = (v: unknown): string => typeof v === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v) ? v : invalid();
+export function parseHubStatus(value: unknown): HubStatus {
+    const r = object(value); if (r.version !== 1) throw new OperatorError('unsupported');
+    const result: HubStatus = { version: 1, enabled: flag(r.enabled), configured: flag(r.configured), deployment_uuid: nullable(r.deployment_uuid, deploymentId), can_enable: flag(r.can_enable), reason: nullable(r.reason, v => choice(v, hubReasons)) };
+    if (result.enabled ? result.can_enable || result.reason !== null : result.can_enable ? !result.configured || !result.deployment_uuid || result.reason !== null : result.reason === null) invalid();
+    return result;
+}
+export const readHubStatus = async (scope?: PrivateScope) => parseHubStatus(await privateCall(HUB_ENDPOINT, null, scope));
+export async function enableHub(deployment: string, scope?: PrivateScope) {
+    const result = parseHubStatus(await privateCall(HUB_ENDPOINT, { deployment_uuid: deploymentId(deployment) }, scope));
+    if (!result.enabled || result.deployment_uuid !== deployment) invalid();
+    return result;
+}
+export const previewConnection = async (input: ConnectionInput, expected: Identity | null, scope?: PrivateScope) => { validateInput(input); return parsePreview(await privateCall(CONNECTION_ENDPOINT, { action: 'preview', ...input }, scope), input, expected); };
+export async function publishConnection(input: ConnectionInput, scope?: PrivateScope): Promise<Publication> {
+    validateInput(input); const r = object(await privateCall(CONNECTION_ENDPOINT, { action: 'publish', ...input }, scope));
+    if (r.published !== true || r.applied !== false || r.pending_restart !== true) invalid();
+    return { published: true, revision: uuid(r.revision), version_id: nullable(r.version_id, (v) => label(v, 1024)), pending_restart: true, applied: false };
+}
+export function parseOperation(v: unknown): ConnectionOperation { const r = object(v); return { ...parseReport(r), operation_id: uuid(r.operation_id), revision: uuid(r.revision), job_status: r.job_status == null ? undefined : choice(r.job_status, ['pending', 'running', 'completed', 'failed', 'expired', 'canceled']) }; }
+export const applyConnection = async (revision: string, scope?: PrivateScope) => { const result = parseOperation(await privateCall(FLEET_ENDPOINT, { action: 'apply', expected_revision: uuid(revision) }, scope)); if (result.revision !== revision) invalid(); return result; };
+export const readConnectionOperation = async (id: string, scope?: PrivateScope, revision?: string) => { const result = parseOperation(await privateCall(`${FLEET_ENDPOINT}/operation/${uuid(id)}`, null, scope)); if (result.operation_id !== id || revision !== undefined && result.revision !== revision) invalid(); return result; };
+export async function readConnectionHistory(scope?: PrivateScope): Promise<SafeHistory> { const r = object(await privateCall(`${FLEET_ENDPOINT}/history`, null, scope)); return { versions: bounded(r.versions, 100).map((v) => { const row = object(v); return { version_id: label(row.version_id, 1024), current: flag(row.current), published_at: nullable(row.published_at, timestamp) }; }), truncated: flag(r.truncated) }; }
+
+/** Local owner fence shared only by the two private operator forms. */
+export function usePrivateOperator() {
+    const auth = useAuthSnapshot(), { data: me } = useMe(); const revision = getAuthSessionRevision();
+    const allowed = auth.authenticated && me?.is_superuser === true;
+    const key = `${auth.uid}:${revision}:${allowed}`; const latest = useRef(key); latest.current = key;
+    const owner = useRef(new AbortController());
+    useEffect(() => { const current = new AbortController(); owner.current = current; return () => current.abort(); }, [key]);
+    const fence = (): PrivateScope & { beforeSend: () => void } => { const current = owner.current; return { signal: current.signal, beforeSend: () => { if (!allowed || current.signal.aborted || latest.current !== key || getAuthSnapshot().uid !== auth.uid || getAuthSessionRevision() !== revision) throw new OperatorError('denied'); } }; };
+    return { allowed, key, fence };
+}

package/src/admin/geolocation/GeoLocationPage.tsx

@@ -0,0 +1,171 @@
+import { useCallback, useEffect, useId, useRef, useState, type ReactNode } from 'react';
+import { Link, useLocation, useNavigate } from 'react-router-dom';
+import { requestFreshAuth, useMe } from '../../client/runtime';
+import { modal } from '../../ui';
+import { Popover } from '../../ui/Popover';
+import { OperatorError, usePrivateOperator } from '../fleet-configuration/shared-validation-data';
+import { GeoLocationError, geoDraft, geoFleetRoute, geoProviderLabel, geoProviderOptions, geoTestBlock, geoWriteBlock, readGeoLocation, saveGeoLocation, testGeoLocation, type GeoDraft, type GeoKeyEdit, type GeoLocationState, type GeoVerdict } from './data';
+
+// The hosted MojoVerify service has one fixed origin; only its key is editable.
+const mojoverifyDraft = (value: GeoDraft): GeoDraft => ({ ...geoDraft(value), GEOIP_MOJO_PROVIDER_URL: 'https://api.mojoverify.com' });
+
+function GeoHelp({ label, children }: { label: string; children: ReactNode }) {
+    const anchor = useRef<HTMLButtonElement>(null), id = useId();
+    const [open, setOpen] = useState(false);
+    return <><button ref={anchor} type="button" className="ops-help" aria-label={`About ${label}`} aria-expanded={open} aria-controls={open ? id : undefined} onClick={event => { event.preventDefault(); setOpen(value => !value); }}><svg width="16" height="16" viewBox="0 0 20 20" fill="none" stroke="currentColor" strokeWidth="1.5" aria-hidden="true"><circle cx="10" cy="10" r="8" /><path d="M10 9v5" /><circle cx="10" cy="6" r=".8" fill="currentColor" stroke="none" /></svg></button><Popover anchorRef={anchor} open={open} onClose={() => setOpen(false)} id={id} aria-label={`About ${label}`} className="ops-help-content">{children}</Popover></>;
+}
+
+export function GeoLocationPage({ fleetConfigurationPath }: { fleetConfigurationPath?: string } = {}) {
+    const owner = usePrivateOperator(), { data: me } = useMe();
+    if (me?.is_superuser !== true || !owner.allowed) return <div className="panel panel-pad"><h1>GeoLocation</h1><p>GeoLocation requires a superuser account with an interactive session.</p></div>;
+    return <GeoLocationContent key={owner.key} fleetConfigurationPath={fleetConfigurationPath} />;
+}
+function GeoLocationContent({ fleetConfigurationPath }: { fleetConfigurationPath?: string }) {
+    const owner = usePrivateOperator(), location = useLocation(), navigate = useNavigate();
+    const [state, setState] = useState<GeoLocationState | null>(null), [draft, setDraft] = useState<GeoDraft | null>(null);
+    const [keyMode, setKeyMode] = useState<GeoKeyEdit['mode']>('untouched'), [keyChanged, setKeyChanged] = useState(false);
+    const [verdict, setVerdict] = useState<GeoVerdict | null>(null), [error, setError] = useState(''), [notice, setNotice] = useState('');
+    const [loading, setLoading] = useState(true), [busy, setBusy] = useState(false), [blocked, setBlocked] = useState(true);
+    const input = useRef<HTMLInputElement>(null), flight = useRef(false), generation = useRef(0), draftEpoch = useRef(0);
+    const keyRef = useCallback((node: HTMLInputElement | null) => {
+        if (input.current && input.current !== node) input.current.value = '';
+        input.current = node;
+    }, []);
+    const clearKey = () => { if (input.current) input.current.value = ''; setKeyMode('untouched'); setKeyChanged(false); };
+    const invalidate = () => { draftEpoch.current++; setVerdict(null); setNotice(''); };
+    useEffect(() => () => { generation.current++; draftEpoch.current++; if (input.current) input.current.value = ''; }, [owner.key]);
+    const failure = async (reason: unknown, forceBlock = false) => {
+        const safe = reason instanceof GeoLocationError ? reason : new GeoLocationError(reason instanceof OperatorError && reason.kind === 'denied' ? 'denied' : 'unavailable');
+        setError(safe.message);
+        if (forceBlock || ['invalid', 'unsupported', 'denied', 'fresh', 'conflict', 'uncertain', 'unavailable'].includes(safe.kind)) setBlocked(true);
+        if (safe.kind === 'fresh' || safe.kind === 'denied') { clearKey(); invalidate(); }
+        if (safe.kind === 'fresh') await requestFreshAuth();
+    };
+    const refresh = async () => {
+        if (flight.current || !owner.allowed) return;
+        const fence = owner.fence(), run = ++generation.current;
+        invalidate(); clearKey(); setLoading(true); setBlocked(true); setError('');
+        try {
+            const next = await readGeoLocation(fence); fence.beforeSend();
+            if (run !== generation.current) return;
+            setState(next); setDraft(mojoverifyDraft(next.geoip)); setBlocked(false);
+        } catch (reason) { if (!fence.signal?.aborted && run === generation.current) await failure(reason, true); }
+        finally { if (!fence.signal?.aborted && run === generation.current) setLoading(false); }
+    };
+    useEffect(() => { void refresh(); }, [owner.key]);
+    const dirty = !!state && !!draft && (JSON.stringify(draft) !== JSON.stringify(mojoverifyDraft(state.geoip)) || keyMode === 'clear' || keyChanged);
+    const change = <K extends keyof GeoDraft>(key: K, value: GeoDraft[K]) => { invalidate(); setDraft(old => old ? { ...old, [key]: value } : old); };
+    const discard = () => { invalidate(); clearKey(); if (state) setDraft(mojoverifyDraft(state.geoip)); setError(''); };
+    const confirmDiscard = async (destination: 'refresh' | 'fleet') => {
+        flight.current = true; setBusy(true); const fence = owner.fence();
+        try {
+            const confirmed = await modal.open<boolean>(close => <div className="modal-pad"><h2 className="modal-title">Discard unsaved changes?</h2><p className="modal-message">{destination === 'refresh' ? 'Refreshing replaces this draft and clears any entered API key.' : 'Opening Fleet Configuration discards this draft and clears any entered API key.'}</p><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Keep editing</button><button className="btn btn-danger" onClick={() => close(true)}>{destination === 'refresh' ? 'Discard and refresh' : 'Discard and continue'}</button></div></div>, { size: 'md', signal: fence.signal });
+            fence.beforeSend();
+            return confirmed === true;
+        } catch (reason) { if (!fence.signal?.aborted) await failure(reason); return false; }
+        finally { flight.current = false; if (!fence.signal?.aborted) setBusy(false); }
+    };
+    const requestRefresh = async () => {
+        if (flight.current || loading) return;
+        if (dirty && !await confirmDiscard('refresh')) return;
+        await refresh();
+    };
+    const openFleet = async () => {
+        if (flight.current || loading || !owner.allowed) return;
+        if (dirty && !await confirmDiscard('fleet')) return;
+        discard();
+        navigate(fleetConfigurationPath ?? geoFleetRoute(location.pathname));
+    };
+    const chooseKeyMode = async (mode: GeoKeyEdit['mode']) => {
+        if (flight.current || loading || blocked || !state) return;
+        if (mode === 'clear') {
+            flight.current = true; setBusy(true); const fence = owner.fence();
+            try {
+                const confirmed = await modal.open<boolean>(close => <div className="modal-pad"><h2 className="modal-title">Remove the stored MojoVerify key?</h2><p className="modal-message">Saving will remove the key. MojoVerify lookups and threat-signal sharing may stop. This does not revoke the key at the service.</p><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Cancel</button><button className="btn btn-danger" onClick={() => close(true)}>Confirm key removal</button></div></div>, { size: 'md', signal: fence.signal });
+                fence.beforeSend(); if (confirmed) { invalidate(); clearKey(); setKeyMode('clear'); }
+            } catch (reason) { if (!fence.signal?.aborted) await failure(reason); }
+            finally { flight.current = false; if (!fence.signal?.aborted) setBusy(false); }
+        } else { invalidate(); clearKey(); setKeyMode(mode); }
+    };
+    const run = async (action: 'test' | 'save') => {
+        if (flight.current || !owner.allowed || blocked || loading || !state || !draft || (action === 'save' ? !dirty || geoWriteBlock(state) : geoTestBlock(state) || keyMode === 'clear')) return;
+        flight.current = true; setBusy(true); setError(''); setNotice('');
+        const fence = owner.fence(), epoch = draftEpoch.current, runGeneration = generation.current, base = state;
+        const saving = action === 'save';
+        try {
+            fence.beforeSend();
+            const edit: GeoKeyEdit = keyMode === 'replace' ? { mode: 'replace', value: input.current?.value ?? '' } : keyMode === 'clear' ? { mode: 'clear', confirmed: true } : { mode: 'untouched' };
+            if (action === 'test') {
+                const next = await testGeoLocation(base.configuration_revision, draft, edit, fence); fence.beforeSend();
+                if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                setVerdict(next);
+                try {
+                    const observed = await readGeoLocation(fence); fence.beforeSend();
+                    if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                    // Refresh observations/prerequisites without rebasing a changed revision or the draft.
+                    if (observed.configuration_revision !== base.configuration_revision || geoTestBlock(observed)) {
+                        setBlocked(true); setError('Authoritative configuration changed or became unavailable. Refresh and review before continuing.');
+                    } else setState(observed);
+                } catch (reason) { if (!fence.signal?.aborted) await failure(reason, true); }
+            } else {
+                clearKey();
+                const result = await saveGeoLocation(base.configuration_revision, draft, edit, fence); fence.beforeSend();
+                if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                invalidate(); setBlocked(true);
+                setNotice(result.published ? 'Saved and published. Apply the pending configuration in Fleet Configuration.' : 'Saved. Published provider values were unchanged; the stored credential may have changed.');
+                const authoritative = await readGeoLocation(fence); fence.beforeSend();
+                if (runGeneration !== generation.current) return;
+                setState(authoritative); setDraft(mojoverifyDraft(authoritative.geoip)); setBlocked(false);
+            }
+        } catch (reason) {
+            if (!fence.signal?.aborted && runGeneration === generation.current) {
+                if (saving) clearKey();
+                await failure(reason, saving && !(reason instanceof GeoLocationError && reason.kind === 'validation'));
+            }
+        } finally { flight.current = false; if (!fence.signal?.aborted && runGeneration === generation.current) setBusy(false); }
+    };
+    const block = state ? geoWriteBlock(state) : null, diagnosticBlock = state ? geoTestBlock(state) : null;
+    const disabled = busy || loading || blocked, options = state && draft ? geoProviderOptions(state, draft) : [];
+    const additionalOptions = draft ? options.filter(p => p !== draft.GEOIP_PRIMARY_PROVIDER && p !== draft.GEOIP_FALLBACK_PROVIDER && !draft.GEOIP_ADDITIONAL_PROVIDERS.includes(p)) : [];
+    const meta = (key: keyof GeoDraft) => state?.fleet_fields.find(f => f.key === key);
+    const help = (label: string, content: ReactNode) => <GeoHelp label={label}>{content}</GeoHelp>;
+    const providerSelect = (key: 'GEOIP_PRIMARY_PROVIDER' | 'GEOIP_FALLBACK_PROVIDER', label: string) => <label className="field"><span className="field-label">{label} {help(label, <>{meta(key)?.description} Each provider is queried only once at runtime, even if it appears in more than one position. Other provider credentials are managed in deployment settings.</>)}</span><select className="input" aria-label={label} value={draft?.[key] ?? ''} onChange={e => change(key, e.target.value)}>{options.map(p => <option key={p} value={p}>{geoProviderLabel(p)}{state?.geoip_providers.includes(p) ? '' : ' (configured; unavailable)'}</option>)}</select></label>;
+    const move = (index: number, offset: number) => { if (!draft) return; const next = [...draft.GEOIP_ADDITIONAL_PROVIDERS], target = index + offset; [next[index], next[target]] = [next[target]!, next[index]!]; change('GEOIP_ADDITIONAL_PROVIDERS', next); };
+    const stored = state?.verify_state.geoip, storedDate = stored?.at && Number.isFinite(Date.parse(stored.at)) ? new Date(stored.at) : null;
+    const details = () => {
+        if (!state) return;
+        void modal.open(close => <div className="modal-pad geo-admin-dialog"><h2 className="modal-title">Configuration information</h2><dl>{[['Published revision', state.published_revision ?? 'Not published'], ['This request node loaded', state.loaded_revision ?? 'Not reported'], ['Configuration revision', state.configuration_revision ?? 'Not published'], ['Published version', state.published_version ?? 'Not reported'], ['Remote configuration', state.remote_error ?? 'No read error reported']].map(([label, value]) => <div key={label}><dt>{label}</dt><dd><code>{value}</code></dd></div>)}</dl><p className="dim">A key check does not prove that the provider chain or every Fleet node is healthy. Stored checks are historical observations, separate from this draft.</p>{stored && <p>{stored.message}{stored.code && <> · <code>{stored.code}</code></>}</p>}<div className="modal-actions"><button className="btn" onClick={() => close(undefined)}>Close</button></div></div>, { size: 'md', signal: owner.fence().signal });
+    };
+    return <div className="page geo-admin"><header className="page-header"><div><div className="eyebrow">Operations</div><h1>GeoLocation</h1><p className="dim">Set up your IP location providers.</p></div><button className="btn" disabled={busy || loading} onClick={() => void requestRefresh()}>Refresh</button></header>
+        {loading && <p role="status">Loading GeoLocation configuration…</p>}
+        {error && <p className="form-alert" role="alert">{error}</p>}{notice && <p className="geo-admin-notice" role="status">{notice}</p>}
+        {block && <div className="geo-admin-notice" role="alert"><strong>Publishing unavailable</strong><p>{block}</p><span>You can review a local draft{!diagnosticBlock && ' and test the MojoVerify key'}.</span></div>}
+        {state && draft && <><section className="panel geo-admin-setup" aria-label="GeoLocation provider setup">
+            <div className="geo-admin-form"><fieldset disabled={disabled} className="geo-admin-fields">
+                <div className="geo-admin-provider-fields">
+                    {providerSelect('GEOIP_PRIMARY_PROVIDER', 'Primary provider')}
+                    {providerSelect('GEOIP_FALLBACK_PROVIDER', 'Fallback provider')}
+                </div>
+                <div className="field"><span className="field-label">Additional providers {help('additional providers', <>{meta('GEOIP_ADDITIONAL_PROVIDERS')?.description} Tried in the order shown after the primary and fallback providers. Other provider credentials are managed in deployment settings.</>)}</span>
+                    <ol className="geo-admin-provider-list">{draft.GEOIP_ADDITIONAL_PROVIDERS.map((provider, index) => <li key={provider}><span><span className="dim">{index + 1}.</span> {geoProviderLabel(provider)}{!state.geoip_providers.includes(provider) && <small className="dim"> Configured; unavailable</small>}</span><div className="geo-admin-actions"><button className="btn" aria-label={`Move ${geoProviderLabel(provider)} up`} disabled={disabled || index === 0} onClick={() => move(index, -1)}>↑</button><button className="btn" aria-label={`Move ${geoProviderLabel(provider)} down`} disabled={disabled || index === draft.GEOIP_ADDITIONAL_PROVIDERS.length - 1} onClick={() => move(index, 1)}>↓</button><button className="btn" aria-label={`Remove ${geoProviderLabel(provider)}`} onClick={() => change('GEOIP_ADDITIONAL_PROVIDERS', draft.GEOIP_ADDITIONAL_PROVIDERS.filter(p => p !== provider))}>Remove</button></div></li>)}</ol>
+                    {!draft.GEOIP_ADDITIONAL_PROVIDERS.length && <p className="field-help">No additional providers.</p>}
+                    <select className="input" aria-label="Add provider" value="" disabled={disabled || !additionalOptions.length || draft.GEOIP_ADDITIONAL_PROVIDERS.length >= 16} onChange={e => { if (e.target.value) change('GEOIP_ADDITIONAL_PROVIDERS', [...draft.GEOIP_ADDITIONAL_PROVIDERS, e.target.value]); }}><option value="">{additionalOptions.length ? 'Add provider…' : 'All providers added'}</option>{additionalOptions.map(p => <option value={p} key={p}>{geoProviderLabel(p)}</option>)}</select>
+                </div>
+                <div className="geo-admin-key"><div className="geo-admin-key-heading"><span className="field-label">MojoVerify API key</span>{help('MojoVerify API key', 'Write only. Tests check only MojoVerify. Saving also checks MojoVerify, even when another provider is primary, unless you explicitly remove its key. Other provider credentials are managed in deployment settings.')}</div>
+                    <p className="dim">{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? <>Key set{state.geoip.GEOIP_API_KEY_MOJO_HINT && <> · <span aria-label="Stored key suffix">••••{state.geoip.GEOIP_API_KEY_MOJO_HINT}</span></>}</> : 'No stored key'}</p>
+                    <div className="geo-admin-actions"><button className="btn" aria-pressed={keyMode === 'replace'} onClick={() => void chooseKeyMode('replace')}>{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? 'Replace key' : 'Add key'}</button>{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && <button className="btn" onClick={() => void chooseKeyMode('clear')}>Remove key</button>}<button className="btn" disabled={disabled || !!diagnosticBlock || keyMode === 'clear'} onClick={() => void run('test')}>Test key</button>{keyMode !== 'untouched' && <button className="btn" onClick={() => void chooseKeyMode('untouched')}>Cancel key change</button>}</div>
+                    {/* Retained while editing; the raw value lives only in this uncontrolled DOM input. */}
+                    <label className="field" hidden={keyMode !== 'replace'}><span className="field-label">{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? 'Replacement key' : 'New key'}</span><input className="input" ref={keyRef} type="password" aria-label="MojoVerify API key" autoComplete="new-password" spellCheck={false} maxLength={4096} onChange={event => { invalidate(); setKeyChanged(event.currentTarget.value !== ''); }} /><span className="field-help">Leave blank to keep the stored key.</span></label>
+                    {keyMode === 'clear' && <p className="text-warn">Save changes to remove the stored key. Key removal is not a connection test.</p>}
+                    {draft.GEOIP_MOJO_PROVIDER_URL.replace(/\/$/, '') !== state.geoip.GEOIP_MOJO_PROVIDER_URL.replace(/\/$/, '') && <p className="text-warn">Switching to MojoVerify requires a replacement key. The stored key will not be sent to a different service.</p>}
+                </div>
+                <div className="geo-admin-sharing"><label><input type="checkbox" checked={draft.GEOIP_MOJO_SYNC_ENABLED} onChange={e => change('GEOIP_MOJO_SYNC_ENABLED', e.target.checked)} /> Share threat signals with MojoVerify</label>{help('threat-signal sharing', <>{meta('GEOIP_MOJO_SYNC_ENABLED')?.description} The remote key needs the geoip_sync permission. Sharing uses MojoVerify regardless of the primary provider.</>)}</div>
+            </fieldset></div>
+            {options.some(p => !state.geoip_providers.includes(p)) && <p className="geo-admin-context dim">Unavailable provider IDs are retained from your configuration. They cannot be verified against the current registry; review them before saving.</p>}
+            {verdict && <div className={`geo-admin-result ${verdict.success && verdict.code !== 'clear_requested' ? 'text-ok' : 'text-warn'}`} role="status" aria-label="Draft MojoVerify key test"><strong>{verdict.success && verdict.code !== 'clear_requested' ? 'Draft MojoVerify key verified' : 'Draft MojoVerify key not verified'}</strong><p>{verdict.message}</p>{verdict.code && <code>{verdict.code}</code>}{!verdict.success && <p>Supply a replacement key, or apply pending configuration in Fleet Configuration and refresh here.</p>}</div>}
+            {keyMode !== 'clear' && <p className={`geo-admin-context ${draft.GEOIP_PRIMARY_PROVIDER !== 'mojo' && !state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && !keyChanged ? 'text-warn' : 'dim'}`}>{draft.GEOIP_PRIMARY_PROVIDER !== 'mojo' && !state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && !keyChanged ? 'Saving also checks MojoVerify. Add its key before saving, or the backend may reject this change.' : 'Saving also checks the MojoVerify key.'}</p>}
+            <footer className="geo-admin-footer"><span className="dim" role="status">{dirty ? 'Unsaved changes' : 'No unsaved changes'}</span><div className="geo-admin-actions"><button className="btn" disabled={busy || loading || !dirty} onClick={discard}>Discard changes</button><button className="btn btn-primary" disabled={disabled || !!block || !dirty} onClick={() => void run('save')}>{busy ? 'Working…' : 'Save changes'}</button></div></footer>
+        </section>
+        <section className="panel geo-admin-status" aria-label="Stored configuration status"><div className="geo-admin-status-heading"><div className="geo-admin-key-heading"><h2>Last stored check</h2>{help('last stored check', 'This historical MojoVerify result is separate from your current draft and Fleet activation. A successful key check does not prove the provider chain or every node is healthy.')}</div><button className="btn" onClick={details}>Configuration information</button></div><p><strong>MojoVerify:</strong> {stored ? stored.ok && stored.code !== 'clear_requested' ? 'Verified' : stored.code === 'clear_requested' ? 'Key removal requested; not tested' : 'Failed' : 'Not checked'}{storedDate && <> · <time dateTime={storedDate.toISOString()}>{storedDate.toLocaleString()}</time></>}</p>{(blocked || loading) && <p className="text-warn">Earlier observations are not current confirmation. Refresh to check the configuration.</p>}<div className="geo-admin-activation">{state.pending_restart ? <span className="text-warn">Activation pending on this request node.</span> : <span className="dim">Review application and node health in Fleet.</span>}<Link to={fleetConfigurationPath ?? geoFleetRoute(location.pathname)} aria-disabled={busy || loading} onClick={event => { if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return; event.preventDefault(); void openFleet(); }}>Open Fleet Configuration</Link></div></section></>}
+    </div>;
+}