Native AdminApp host contract for authenticated product shells

[flashlog]

Problem

EmDash currently exports AdminApp, but the mounted application still assumes the standalone /_emdash/admin/* route and hardcoded /_emdash/api client. Products that already own authentication, authorization, routing, and an application shell cannot mount the real EmDash admin natively without copying the UI, exposing a separate browser session, or using an iframe/external application.

Proposed public contract

Add an additive native-host mode to @emdash-cms/admin and the EmDash runtime:

• inject an upstream-owned fetch-compatible admin API transport;
• inject a base-path/history adapter for nested routing, deep links, refresh, Back/Forward, and redirects;
• accept a host portal root for dialogs, menus, toasts, focus traps, and keyboard ownership;
• export scoped styles and documented theme tokens;
• accept an exact build-time plugin-admin registry;
• expose loading, typed error, mutation invalidation, streaming upload/download, and unsaved-change hooks;
• add a headless runtime mode that retains authenticated admin API and MCP handlers but omits standalone admin/login pages; and
• add an external authenticated-principal request adapter so a trusted server boundary can authenticate each request while EmDash retains roles, authorization, audit, and user attribution.

Standalone EmDash remains the default and must retain current behavior. The new surface is additive; no hardcoded API path may be used when the injected transport is selected.

Security and authority

The browser authenticates only to its host product. The host server authorizes the user and site, then dispatches the streamed request to the site-scoped EmDash runtime with a short-lived external principal. Credentials are never exposed to browser JavaScript. EmDash remains authoritative for CMS data, validation, roles, audit, and admin screens.

Verification

Contract tests should cover custom transport, nested route/history behavior, direct deep-link hydration, standalone compatibility, scoped styles/portal ownership, streaming media, external-principal attribution and rejection, and headless omission of setup/login/admin shell routes.

This contract is needed to mount the real upstream AdminApp as a first-class workspace inside WebbsAI Design without a fork, iframe, copied CRUD UI, or standalone browser session.