One declaration serves it. defineAdmin({ entities, db }) is a list, a detail and a form for every entity at /admin/<entity> — the app writes no page, no screen glue and no repo adapter. As of 2026-10.

// apps/admin/app/admin/admin.ts — the whole dashboard
import { db } from '@app/db';
import { adminEntitiesOf, defineAdmin } from '@ultimat3/admin';

export const admin = defineAdmin({ entities: adminEntitiesOf(db), db });

x dev and the container mount every admin the app declared: one catch-all under its base path, GET and POST. x new scaffolds the declaration; x g entity adds an entity to the handle and it is a screen on the next boot.

A refusal is a 403 document naming the permission, and an audit entry. Anonymous is the pipeline's own 401 (or the app's sign-in redirect). Every admin document is noindex, nofollow and carries no og:* / twitter:* tag. A row action lands on its row (303); a batch answers a page of counts (200).

A resource is counted on /admin only when it declares count: true. As of 2026-10. A tile is one full AdminRepo.count() over the actor's rows scope on every visit, so an operator reloading the front page over a big table was a load generator — the same reason a scope tab's count is opt-in.

resources: { posts: { count: true } },

A count reads no row, so it is not audited. Upgrading from a release that counted every listable resource: add count: true to each resource whose tile you want back.

As of 2026-10. Everything on a list page is derived from the entity or declared once on the resource.

An unknown field, operator, sort, scope or parameter — or a value that is not the column's type (a number is decimal digits: no blank, hex or exponent; a date is one the calendar has) — is X_ADMIN_FILTER_INVALID: a 400 naming what the list answers, never the unfiltered list. The MCP list tool takes the same grammar (scope, where: [{ field, op?, value }]).

Statements per list page: 1 for the rows (2 when the sort column is nullable, one more when a page ends inside one millisecond of an instant sort, and a page past its first adds the rest of the boundary's tie), 1 per counted scope, 1 per referenced resource per 200 ids (2 for one with more than 50 rows that a control picks from). A reference picker is a <select> up to 50 rows and the target's lookup screen above that — both work with scripting off.

As of 2026-10.

The admin-level gate an action needs — adminPermissionForAction (packages/admin/src/action-gate.ts), first match wins, so a contradiction fails closed:

Still one MCP tool per action — a batch action's takes ids. No script on any of it: the row checkboxes join the bar's form by their form attribute, and a confirmation is a server round trip. An action's input fields are labelled admin.input.<action>.<field> — beside its own admin.action.<action>, never under it, so both fit one JSON catalog. An action on a row the actor cannot see (gone, or outside its rows) is refused, when or none.

A create, or an update of the fields it touches, whose resulting row falls outside the actor's rows(actor) is refused before the repo is called — audited as a denial, reason admin.error.row-out-of-scope, on the screens and over MCP alike. Both are then decided again on the validated values they write, as the subject's input (an update: beside its row).

An edit form carries the row's version (_version); a row someone changed after the form was drawn is a 409 (admin.error.row-changed) with the form redrawn over the row as it is now — never overwritten. A datetime-local box holds minutes, so an instant posted back exactly as it was drawn is left out of the write.

As of 2026-10. defineAdmin({ audit }) takes one AuditLog; the default is memoryAuditLog().

As of 2026-10. Every defineAdmin() serves it; the app declares nothing. It is built from the admin's own pieces — four resources over the queue's operator surface (JobIntrospection) with a repo:, scopes, a row scope and actions, plus one overview screen. Zero JavaScript, like every admin screen.

The served admin, in every environment:

The /_x dev dashboard (devDashboard(), @ultimat3/admin/dev) is a separate page that refuses to mount in production. Its tabs are DEV_PANELS in packages/admin/src/dev/server.ts; each has a --json twin at /_x/<tab>?json=1:

One authz seam for the whole admin: the rendered button, the HTTP call behind it, the MCP tool, the nav item, and the search result all ask the same interface.

The admin exposes an MCP surface over the actions the app already declared, so the user's agents can drive the user's product with exactly the permissions the human has.

mcp: { expose: true, description: 'Publish a draft post' },

The projected tool calls action.run(...) — the same entry point the HTTP route calls. Policy evaluation lives inside run, so there is nothing to keep in sync. Details: MCP and AI.

As of 2026-10. adminMcp() hands the MCP registry one scope per tool (adminToolScopes, packages/admin/src/mcp-scopes.ts). Tool names are unchanged.

A call is decided in this order:

The token's scopes are tokenScopes on what adminMcp({ actor }) returns for a session (AdminMcpActor), expanded by adminTokenScopes: admin:destroy ⇒ admin:write ⇒ admin:read.

Named tokenScopes, not scopes: core's Actor.scopes is a different thing, and an actor handed straight through must not have its [] read as "this token may do nothing". A stdio host builds its caller's scopes with adminTokenScopes(granted) too.

The generated admin reads the same 24 semantic colour roles as the app, through the same four blocks: light in :root, dark behind the media query, both mirrored under html[data-theme]. A raw hex in an admin stylesheet is the same raw-colour guard finding as anywhere else, and ThemeTokenRef is a template-literal type, so --x-* typechecks and a hex does not.

The /_x dev dashboard is a standalone page with no stylesheet pipeline, so it inlines its six channels — bg, surface-raised, fg, fg-muted, line, accent — into a <style> element. As of 2026-08 it derives them from @ultimat3/ui's colorTokens at render time rather than keeping a copy: the copy it used to keep went stale through the WCAG retune and shipped line on surface-raised at 1.16:1. The barrel is reached by dynamic import(), for the same reason the panels reach introspection that way — /_x stays out of the production graph → Theming.

One shape for every generated route, from one call site — adminRouteConfig in packages/admin/src/routes.ts, never an author's choice, As of 2026-08.

Interactivity on an admin URL is an app file that claims the route — An admin page in your own shell — where hydrate derives from the islands it declares.

The request timeline and the live query inspector are not admin routes: they are /_x panels (panel-timeline.ts, panel-live.ts), mounted by devDashboard(), which throws rather than mounting when ROLE and the environment say production. The live panel reads registered live queries and their subscribers out of introspection — @ultimat3/admin does not depend on @ultimat3/realtime and subscribes to nothing.

See Routes and render modes.

Own routes in your own app. Never fork the framework.

No plugin API, in 1.x, 2.x, 3.x or 4.0.0 (axiom). The extension point is that the admin is your app.

claimAdminRoute(admin, path, options) — the one way an app file serves an admin path, As of 2026-10. For a console that keeps the app's own chrome (theme switch, language switch, an enrolment banner) or needs an island on a page: every other admin route ships no script.

// apps/admin/app/admin/credits/page.tsx — the file at the page's own path
import { type AdminApp, type AdminClaimData, claimAdminRoute } from '@ultimat3/admin';
import { island } from '@ultimat3/render';
import type { JSX } from 'solid-js';

declare const admin: AdminApp; // `import { admin } from '../admin'` — the defineAdmin() module
declare function AppShell(props: {
  readonly titleKey: string | null;
  readonly children: JSX.Element;
}): JSX.Element;

interface ShellData {
  readonly role: string | null;
  readonly orgId: string | null;
}

// Islands FIRST: the claim's defineRoute drains them, which is how the page hydrates.
const GrantForm = island({ src: './credits-grant.island.tsx', props: ['orgId'] });

export const config = claimAdminRoute(admin, `${admin.basePath}/credits`, {
  hydrate: 'idle',
  budget: { js: '60kb' },
  // The app's half of the data, read AFTER the screen decided — the refused included (`denied`).
  load: ({ ctx }): ShellData => ({
    role: ctx.actor.roles?.[0] ?? null,
    orgId: ctx.actor.orgId ?? null,
  }),
});

export function Page(props: { readonly data: AdminClaimData<ShellData> }): JSX.Element {
  return (
    <AppShell titleKey={props.data.denied ? null : props.data.titleKey}>
      {props.data.body}
      <GrantForm orgId={props.data.app.orgId} />
    </AppShell>
  );
}

• Only a pages: entry or the dashboard (admin.basePath). A generated screen posts its forms back to its own URL, which only the admin answers: X_ADMIN_PAGE_PATH_INVALID, naming what may be claimed. A claimed dashboard leaves POST /admin (app-wide actions) to the admin.
• Only the config claimAdminRoute issued, at the path it was issued for. A hand-written defineRoute on an admin path — or defineRoute({ ...claimed, load }) — is X_ROUTE_DUPLICATE, as before: the admin answers render's claimable(path, config) by identity.
• An island inside the pages: component is rendered by the component, but declared by the claiming file (the island's src resolves against it): hand it down — a module-level slot the file binds, or a prop of the shell.
• x routes lists the path once: the file, with defineAdmin() · <permissions>.

See Deployment.

• One declaration, mounted by the framework. A hand-written page for an admin URL is a second server for it; a file serves one only through claimAdminRoute, under the admin's guard.
• One authz seam. The UI never shows what the call would refuse.
• Destructive operations confirm and audit — enforced by the permission table, not by a view.
• Read-only SQL, capped. No write console.
• Keyset pagination only.
• A list's state is its URL; a parameter the resource does not derive is refused, never ignored.
• A sealed column is never a filter, a scope predicate, a label or a computed column's input.
• Every write emits an audit diff with sensitive fields redacted.
• MCP runs with the human's own permissions. Projecting an action into an app MCP surface is opt-in — mcp: { expose: true }, the one rule every other surface reads too; inside the admin's own catalog, and nowhere else, a registered action opts out with mcp: { expose: false }.
• Extend with pages:, resources: and actions:, never by forking @ultimat3/admin.
• No island: every control is a link or a native form, and the admin ships zero JavaScript.

Source: packages/admin/src