@bsb/config-vault 9.6.9 → 9.6.11

package/lib/plugins/service-config-vault/http-server.js

@@ -122,7 +122,7 @@ export class VaultHttpServer {
         app.use('/api/groups', defineEventHandler(async (event) => {
             const user = await this.requireUser(event);
             const body = await readBody(event);
-            return this.options.vault.createGroup(user.userId, String(body.applicationId ?? ''), String(body.name ?? ''));
+            return this.options.vault.createDeployment(user.userId, String(body.applicationId ?? ''), String(body.name ?? ''));
         }));
         app.use('/api/profiles/update', defineEventHandler(async (event) => {
             const user = await this.requireUser(event);
@@ -141,6 +141,21 @@ export class VaultHttpServer {
             const body = await readBody(event);
             return this.options.vault.createProfile(user.userId, String(body.groupId ?? ''), String(body.name ?? 'default'));
         }));
+        app.use('/api/plugins/import', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createPlugin(user.userId, {
+                org: String(body.org ?? '_'),
+                name: String(body.name ?? ''),
+                pluginId: String(body.pluginId ?? body.name ?? ''),
+                packageName: body.packageName === undefined || body.packageName === '' ? null : String(body.packageName),
+                version: String(body.version ?? '0.0.0'),
+                kind: parseKind(body.kind),
+                source: 'registry',
+                configSchema: parseJsonObject(body.configSchema) ?? null,
+                eventSchema: parseJsonObject(body.eventSchema) ?? null,
+            });
+        }));
         app.use('/api/plugins', defineEventHandler(async (event) => {
             const user = await this.requireUser(event);
             const body = await readBody(event);
@@ -162,7 +177,7 @@ export class VaultHttpServer {
             const config = parseJsonObject(body.config);
             if (!config)
                 throw new Error('Config must be a JSON object');
-            await this.options.vault.saveDraft(user.userId, String(body.profileId ?? ''), config);
+            await this.options.vault.saveProfileDraft(user.userId, String(body.profileId ?? ''), config);
             return { success: true };
         }));
         app.use('/api/publish', defineEventHandler(async (event) => {
@@ -170,16 +185,46 @@ export class VaultHttpServer {
             const body = await readBody(event);
             return this.options.vault.publishDraft(user.userId, String(body.profileId ?? ''));
         }));
+        app.use('/api/profile-plugins/delete', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            await this.options.vault.removeProfilePlugin(user.userId, {
+                profileId: String(body.profileId ?? ''),
+                section: parseConfigSection(body.section),
+                name: String(body.name ?? ''),
+            });
+            return { success: true };
+        }));
+        app.use('/api/profile-plugins', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            await this.options.vault.upsertProfilePlugin(user.userId, {
+                profileId: String(body.profileId ?? ''),
+                section: parseConfigSection(body.section),
+                name: String(body.name ?? ''),
+                plugin: String(body.plugin ?? ''),
+                packageName: stringOrUndefined(body.packageName) ?? null,
+                version: stringOrUndefined(body.version) ?? null,
+                enabled: body.enabled === true || body.enabled === 'true' || body.enabled === 'on',
+                config: parseJsonObject(body.config) ?? {},
+            });
+            return { success: true };
+        }));
+        app.use('/api/runtime-keys/rotate', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.rotateProfileRuntimeKey(user.userId, {
+                keyId: String(body.keyId ?? ''),
+                name: stringOrUndefined(body.name),
+            });
+        }));
         app.use('/api/runtime-keys', defineEventHandler(async (event) => {
             const user = await this.requireUser(event);
             const body = await readBody(event);
-            return this.options.vault.createRuntimeKey(user.userId, {
+            return this.options.vault.createProfileRuntimeKey(user.userId, {
                 name: String(body.name ?? ''),
-                applicationId: String(body.applicationId ?? ''),
-                groupId: String(body.groupId ?? ''),
                 profileId: String(body.profileId ?? ''),
                 containerName: body.containerName === undefined ? null : String(body.containerName),
-                configPluginId: String(body.configPluginId ?? 'config-vault'),
             });
         }));
         app.use('/applications', defineEventHandler(async (event) => {
@@ -192,21 +237,45 @@ export class VaultHttpServer {
             const dashboard = await this.options.vault.dashboard();
             return this.page('Deployments', deploymentsPage(dashboard), 'deployments');
         }));
+        app.use('/deployment', defineEventHandler(async (event) => {
+            await this.requireUser(event);
+            const query = getQuery(event);
+            const profileId = String(query.profileId ?? '');
+            if (!profileId)
+                return sendRedirect(event, '/deployments');
+            const profile = await this.options.vault.deploymentProfile(profileId);
+            return this.page('Deployment', deploymentDetailPage(profile, {
+                publicUrl: this.options.publicUrl,
+                keyId: String(query.keyId ?? ''),
+                secret: String(query.secret ?? ''),
+            }), 'deployments');
+        }));
         app.use('/configs', defineEventHandler(async (event) => {
             await this.requireUser(event);
             const dashboard = await this.options.vault.dashboard();
-            return this.page('Configs', configsPage(dashboard), 'configs');
+            const firstProfile = dashboard.profiles[0];
+            return firstProfile ? sendRedirect(event, `/deployment?profileId=${encodeURIComponent(firstProfile.id)}`) : sendRedirect(event, '/deployments');
         }));
         app.use('/runtime-keys', defineEventHandler(async (event) => {
             await this.requireUser(event);
             const query = getQuery(event);
             const dashboard = await this.options.vault.dashboard();
-            return this.page('Runtime Keys', runtimeKeysPage(dashboard, String(query.secret ?? '')), 'runtime-keys');
+            const firstProfile = dashboard.profiles[0];
+            if (!String(query.secret ?? '') && firstProfile) {
+                return sendRedirect(event, `/deployment?profileId=${encodeURIComponent(firstProfile.id)}`);
+            }
+            return this.page('Container Key', runtimeKeysPage(dashboard, {
+                publicUrl: this.options.publicUrl,
+                keyId: String(query.keyId ?? ''),
+                secret: String(query.secret ?? ''),
+            }), 'runtime-keys');
         }));
         app.use('/plugins', defineEventHandler(async (event) => {
             await this.requireUser(event);
+            const query = getQuery(event);
             const dashboard = await this.options.vault.dashboard();
-            return this.page('Plugins', pluginsPage(dashboard), 'plugins');
+            const registry = await registrySearch(this.options.registryUrl, String(query.query ?? ''));
+            return this.page('Plugins', pluginsPage(dashboard, registry, String(query.query ?? '')), 'plugins');
         }));
         app.use('/profile', defineEventHandler(async (event) => {
             const session = await this.requireUser(event);
@@ -295,9 +364,12 @@ function html(title, body, active, authenticated) {
     .form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px}
     .metric{font-size:28px;font-weight:750}.page-head{display:flex;justify-content:space-between;align-items:flex-start;gap:16px;margin:0 0 18px}
     .inline-form{display:flex;gap:10px;align-items:end;flex-wrap:wrap}.inline-form label{min-width:190px}
+    .tabs{display:flex;gap:8px;flex-wrap:wrap;margin:0 0 16px}.tabs a{padding:8px 10px;border:1px solid var(--line);border-radius:6px;text-decoration:none;color:#344054;background:#fff;font-weight:650}.tabs a.active{background:#eaf1ff;color:#155eef;border-color:#b8cdfd}
     .muted{color:var(--muted)}.danger{color:var(--danger)}.ok{color:var(--ok)}
     .auth{max-width:480px;margin:32px auto}.stack{display:flex;flex-direction:column;gap:12px}.actions{display:flex;gap:10px;align-items:center;flex-wrap:wrap}
     .status{margin-top:12px;color:var(--muted);font-size:14px}.code{word-break:break-all;background:#f2f4f7;border:1px solid var(--line);border-radius:6px;padding:10px}
+    .schema-box{border:1px solid var(--line);border-radius:6px;margin:12px 0;padding:10px}.schema-box legend{font-weight:750;color:#344054}
+    .schema-repeat{border:1px solid #edf0f5;border-radius:6px;margin:12px 0;padding:10px;background:#fbfcfe}.repeat-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr) auto;gap:8px;align-items:start}.schema-repeat[data-array-path] .repeat-row{grid-template-columns:minmax(0,1fr) auto}
     @media(max-width:760px){.shell{display:block}nav{border-right:0;border-bottom:1px solid var(--line)}main{padding:16px}.page-head{display:block}}
   </style>
 </head>
@@ -312,8 +384,6 @@ function nav(active) {
         ['overview', 'Overview', '/'],
         ['applications', 'Applications', '/applications'],
         ['deployments', 'Deployments', '/deployments'],
-        ['configs', 'Configs', '/configs'],
-        ['runtime-keys', 'Runtime Keys', '/runtime-keys'],
         ['plugins', 'Plugins', '/plugins'],
         ['profile', 'Profile', '/profile'],
     ];
@@ -439,11 +509,11 @@ function overviewPage(data) {
     return `<div class="page-head"><div><h1>Overview</h1><p class="muted">Current Vault inventory and deployment configuration status.</p></div></div>
   <div class="grid">
     ${metric('Applications', data.applications.length)}
-    ${metric('Service Groups', data.groups.length)}
+    ${metric('Deployments', data.groups.length)}
     ${metric('Deployment Profiles', data.profiles.length)}
-    ${metric('Runtime Keys', data.runtimeKeys.length)}
+    ${metric('Container Keys', data.runtimeKeys.length)}
   </div>
-  <section><h2>Recent Runtime Keys</h2>${runtimeKeyTable(data.runtimeKeys.slice(0, 8), data)}</section>`;
+  <section><h2>Recent Container Keys</h2>${runtimeKeyTable(data.runtimeKeys.slice(0, 8), data)}</section>`;
 }
 function applicationsPage(data) {
     return `<div class="page-head"><div><h1>Applications</h1><p class="muted">Create product or system boundaries for deployment profiles.</p></div></div>
@@ -460,66 +530,67 @@ function applicationsPage(data) {
   ${formScript()}`;
 }
 function deploymentsPage(data) {
-    return `<div class="page-head"><div><h1>Deployments</h1><p class="muted">Model service groups and deployment profiles for containers.</p></div></div>
-  <div class="grid">
-    <section><h2>Create Service Group</h2>
+    return `<div class="page-head"><div><h1>Deployments</h1><p class="muted">A deployment represents the container group that will receive one selected profile.</p></div></div>
+  <section><h2>Create Deployment</h2>
       <form data-api="/api/groups" data-redirect="/deployments">
         ${select('applicationId', 'Application', data.applications.map((x) => [x.id, x.name]))}
-        ${input('name', 'Group Name', true)}
-        <button>Create Group</button><p class="status"></p>
+        ${input('name', 'Deployment Name', true)}
+        <button>Create Deployment</button><p class="status"></p>
       </form>
     </section>
-    <section><h2>Create Deployment Profile</h2>
-      <form data-api="/api/profiles" data-redirect="/deployments">
-        ${select('groupId', 'Service Group', data.groups.map((x) => [x.id, groupLabel(x, data)]))}
-        ${input('name', 'Profile Name', true, 'default')}
+  <section><h2>Deployments</h2>${groupsTable(data)}</section>
+  <section><h2>Profiles</h2>${profilesTable(data)}</section>
+  ${formScript()}`;
+}
+function runtimeKeysPage(data, credential) {
+    return `<div class="page-head"><div><h1>Container Key</h1><p class="muted">Use these env vars in the target BSB container.</p></div></div>
+  ${credential.secret ? runtimeEnvBlock(credential) : ''}
+  <section><h2>Container Keys</h2>${runtimeKeyTable(data.runtimeKeys, data)}</section>`;
+}
+function deploymentDetailPage(data, credential) {
+    const draft = data.draft ?? { observable: {}, events: {}, services: {} };
+    const redirect = `/deployment?profileId=${encodeURIComponent(data.profile.id)}`;
+    return `<div class="page-head"><div><h1>${escapeHtml(data.group.name)}</h1><p class="muted">${escapeHtml(data.application.name)} / ${escapeHtml(data.profile.name)}</p></div><a class="button secondary" href="/deployments">Back</a></div>
+  <div class="tabs">${data.profiles.map((profile) => `<a class="${profile.id === data.profile.id ? 'active' : ''}" href="/deployment?profileId=${encodeURIComponent(profile.id)}">${escapeHtml(profile.name)}</a>`).join('')}</div>
+  ${credential.secret ? runtimeEnvBlock(credential) : ''}
+  <div class="grid">
+    <section><h2>Create Profile</h2>
+      <form data-api="/api/profiles" data-redirect="${escapeHtml(redirect)}">
+        <input type="hidden" name="groupId" value="${escapeHtml(data.group.id)}">
+        ${input('name', 'Profile Name', true)}
         <button>Create Profile</button><p class="status"></p>
       </form>
     </section>
+    <section><h2>Container Key</h2>
+      <form data-api="/api/runtime-keys" data-secret-redirect="${escapeHtml(redirect)}">
+        <input type="hidden" name="profileId" value="${escapeHtml(data.profile.id)}">
+        ${input('name', 'Key Name', true, `${data.group.name}-${data.profile.name}`)}
+        ${input('containerName', 'Container Name')}
+        <button>Create Key</button><p class="status"></p>
+      </form>
+    </section>
   </div>
-  <section><h2>Service Groups</h2>${groupsTable(data)}</section>
-  <section><h2>Deployment Profiles</h2>${profilesTable(data)}</section>
-  ${formScript()}`;
-}
-function configsPage(data) {
-    return `<div class="page-head"><div><h1>Configs</h1><p class="muted">Save draft runtime config for a deployment profile, then publish it when ready.</p></div></div>
-  <section><h2>Edit Draft</h2>
-    <form data-api="/api/drafts" data-redirect="/configs">
-      ${select('profileId', 'Deployment Profile', data.profiles.map((x) => [x.id, profileLabel(x, data)]))}
-      <label>Config JSON</label><textarea name="config" required placeholder='{"default":{"observable":{},"events":{},"services":{}}}'></textarea>
-      <button>Save Draft</button><p class="status"></p>
-    </form>
-  </section>
-  <section><h2>Publish Draft</h2>
-    <form data-api="/api/publish" data-redirect="/configs">
-      ${select('profileId', 'Deployment Profile', data.profiles.map((x) => [x.id, profileLabel(x, data)]))}
-      <button>Publish Active Version</button><p class="status"></p>
+  <section><h2>Profile Config</h2>
+    ${profileConfigEditor(data, draft, redirect)}
+    <form data-api="/api/publish" data-redirect="${escapeHtml(redirect)}">
+      <input type="hidden" name="profileId" value="${escapeHtml(data.profile.id)}">
+      <button class="secondary">Publish Draft</button><p class="status"></p>
     </form>
   </section>
+  <section><h2>Container Keys</h2>${profileRuntimeKeyTable(data.runtimeKeys, data)}</section>
+  ${pluginEditorScript(data.plugins)}
   ${formScript()}`;
 }
-function runtimeKeysPage(data, secret) {
-    return `<div class="page-head"><div><h1>Runtime Keys</h1><p class="muted">Bind a container credential to one application, service group, deployment profile, and config plugin.</p></div></div>
-  ${secret ? `<section><h2>Runtime Secret</h2><p class="muted">Shown once. Store it in the container environment now.</p><p class="code"><code>${escapeHtml(secret)}</code></p></section>` : ''}
-  <section><h2>Create Runtime Key</h2>
-    <form data-api="/api/runtime-keys" data-secret-redirect="/runtime-keys">
-      <div class="form-grid">
-        ${input('name', 'Name', true)}
-        ${select('applicationId', 'Application', data.applications.map((x) => [x.id, x.name]))}
-        ${select('groupId', 'Service Group', data.groups.map((x) => [x.id, groupLabel(x, data)]))}
-        ${select('profileId', 'Deployment Profile', data.profiles.map((x) => [x.id, profileLabel(x, data)]))}
-        ${input('containerName', 'Container Name')}
-        ${input('configPluginId', 'Config Plugin', true, 'config-vault')}
-      </div>
-      <button>Create Runtime Key</button><p class="status"></p>
+function pluginsPage(data, registry, query) {
+    return `<div class="page-head"><div><h1>Plugin Catalog</h1><p class="muted">Import registry plugins for config authoring, or create private plugin entries manually.</p></div></div>
+  <section><h2>Registry Search</h2>
+    <form method="get" action="/plugins" class="inline-form">
+      ${input('query', 'Search', false, query)}
+      <button>Search Registry</button>
     </form>
+    ${registry.length === 0 ? '<p class="muted">No registry results loaded.</p>' : registryTable(registry)}
   </section>
-  <section><h2>Runtime Keys</h2>${runtimeKeyTable(data.runtimeKeys, data)}</section>
-  ${formScript()}`;
-}
-function pluginsPage(data) {
-    return `<div class="page-head"><div><h1>Plugin Catalog</h1><p class="muted">Register public, private, or uploaded plugin schemas for config authoring.</p></div></div>
-  <section><h2>Create Plugin</h2>
+  <section><h2>Private Plugin</h2>
     <form data-api="/api/plugins" data-redirect="/plugins">
       <div class="form-grid">
         ${input('org', 'Org', true, '_')}
@@ -537,6 +608,27 @@ function pluginsPage(data) {
   <section><h2>Catalog</h2>${table(data.plugins.map((x) => [x.pluginId, x.version, x.kind, x.source, x.packageName ?? '']))}</section>
   ${formScript()}`;
 }
+function registryTable(items) {
+    return `<table>${items.map((item) => `<tr>
+    <td>${escapeHtml(item.pluginId)}</td>
+    <td>${escapeHtml(item.version)}</td>
+    <td>${escapeHtml(item.kind)}</td>
+    <td>${escapeHtml(item.packageName ?? '')}</td>
+    <td>
+      <form data-api="/api/plugins/import" data-redirect="/plugins">
+        <input type="hidden" name="org" value="${escapeHtml(item.org)}">
+        <input type="hidden" name="name" value="${escapeHtml(item.name)}">
+        <input type="hidden" name="pluginId" value="${escapeHtml(item.pluginId)}">
+        <input type="hidden" name="packageName" value="${escapeHtml(item.packageName ?? '')}">
+        <input type="hidden" name="version" value="${escapeHtml(item.version)}">
+        <input type="hidden" name="kind" value="${escapeHtml(item.kind)}">
+        <input type="hidden" name="configSchema" value="${escapeHtml(JSON.stringify(item.configSchema ?? {}))}">
+        <input type="hidden" name="eventSchema" value="${escapeHtml(JSON.stringify(item.eventSchema ?? {}))}">
+        <button class="secondary">Import</button><p class="status"></p>
+      </form>
+    </td>
+  </tr>`).join('')}</table>`;
+}
 function profilePage(data) {
     return `<div class="page-head"><div><h1>Profile</h1><p class="muted">Account security and admin authentication settings.</p></div></div>
   <section><h2>Account</h2>${table([[data.user.email, data.user.createdAt]])}</section>
@@ -555,11 +647,15 @@ function applicationsTable(data) {
       ${input('description', 'Description', false, app.description ?? '')}
       <button>Save</button><p class="status"></p>
     </form>
-  </td><td class="actions">${deleteForm('/api/applications/delete', app.id, '/applications', 'Delete application and related groups, profiles, configs, and keys?')}</td></tr>`).join('')}</table>`;
+  </td><td class="actions">
+    <a class="button secondary" href="/deployments">Deployments</a>
+    ${deleteForm('/api/applications/delete', app.id, '/applications', 'Delete application and related deployments, profiles, configs, and keys?')}
+  </td></tr>`).join('')}</table>`;
 }
 function groupsTable(data) {
     if (data.groups.length === 0)
         return '<p class="muted">None</p>';
+    const defaultProfileFor = (groupId) => data.profiles.find((profile) => profile.groupId === groupId && profile.name === 'default') ?? data.profiles.find((profile) => profile.groupId === groupId);
     return `<table>${data.groups.map((group) => `<tr><td>
     <form data-api="/api/groups/update" data-redirect="/deployments" class="inline-form">
       <input type="hidden" name="id" value="${escapeHtml(group.id)}">
@@ -567,7 +663,10 @@ function groupsTable(data) {
       ${input('name', 'Name', true, group.name)}
       <button>Save</button><p class="status"></p>
     </form>
-  </td><td class="actions">${deleteForm('/api/groups/delete', group.id, '/deployments', 'Delete group and related profiles, configs, and keys?')}</td></tr>`).join('')}</table>`;
+  </td><td class="actions">
+    ${defaultProfileFor(group.id) ? `<a class="button secondary" href="/deployment?profileId=${encodeURIComponent(defaultProfileFor(group.id).id)}">Open</a>` : ''}
+    ${deleteForm('/api/groups/delete', group.id, '/deployments', 'Delete deployment and related profiles, configs, and keys?')}
+  </td></tr>`).join('')}</table>`;
 }
 function profilesTable(data) {
     if (data.profiles.length === 0)
@@ -575,12 +674,15 @@ function profilesTable(data) {
     return `<table>${data.profiles.map((profile) => `<tr><td>
     <form data-api="/api/profiles/update" data-redirect="/deployments" class="inline-form">
       <input type="hidden" name="id" value="${escapeHtml(profile.id)}">
-      ${select('groupId', 'Service Group', selectedOptions(data.groups.map((x) => [x.id, groupLabel(x, data)]), profile.groupId))}
+      ${select('groupId', 'Deployment', selectedOptions(data.groups.map((x) => [x.id, groupLabel(x, data)]), profile.groupId))}
       ${input('name', 'Name', true, profile.name)}
       <span class="muted">${profile.activeVersionId ? 'published' : 'no published config'}</span>
       <button>Save</button><p class="status"></p>
     </form>
-  </td><td class="actions">${deleteForm('/api/profiles/delete', profile.id, '/deployments', 'Delete deployment profile and related configs and keys?')}</td></tr>`).join('')}</table>`;
+  </td><td class="actions">
+    <a class="button secondary" href="/deployment?profileId=${encodeURIComponent(profile.id)}">Open</a>
+    ${deleteForm('/api/profiles/delete', profile.id, '/deployments', 'Delete deployment profile and related configs and keys?')}
+  </td></tr>`).join('')}</table>`;
 }
 function deleteForm(action, id, redirect, confirm) {
     return `<form data-api="${escapeHtml(action)}" data-redirect="${escapeHtml(redirect)}" data-confirm="${escapeHtml(confirm)}">
@@ -624,6 +726,183 @@ function runtimeKeyTable(keys, data) {
         key.revokedAt ?? 'active',
     ]));
 }
+function profileConfigEditor(data, draft, redirect) {
+    return `
+    ${addPluginForm(data, redirect)}
+    ${configSectionEditor(data, draft, 'services', 'Services', redirect)}
+    ${configSectionEditor(data, draft, 'events', 'Events', redirect)}
+    ${configSectionEditor(data, draft, 'observable', 'Observable', redirect)}
+  `;
+}
+function addPluginForm(data, redirect) {
+    const configurablePlugins = data.plugins.filter((plugin) => plugin.kind !== 'config');
+    if (configurablePlugins.length === 0) {
+        return '<p class="muted">Import or create plugins in the Plugin Catalog before adding profile config.</p>';
+    }
+    return `<section><h3>Add Plugin</h3>
+    <form data-api="/api/profile-plugins" data-redirect="${escapeHtml(redirect)}" data-config-form>
+      <input type="hidden" name="profileId" value="${escapeHtml(data.profile.id)}">
+      <input type="hidden" name="plugin">
+      <input type="hidden" name="packageName">
+      <input type="hidden" name="version">
+      <input type="hidden" name="config">
+      <div class="form-grid">
+        ${select('section', 'Type', [['services', 'Service'], ['events', 'Events'], ['observable', 'Observable']])}
+        <label>Plugin<select name="catalogId" data-plugin-picker required>${configurablePlugins.map((plugin) => `<option value="${escapeHtml(plugin.id)}">${escapeHtml(plugin.pluginId)} ${escapeHtml(plugin.version)}</option>`).join('')}</select></label>
+        ${input('name', 'Config Name', true)}
+        <label>Enabled<select name="enabled"><option value="true">Enabled</option><option value="false">Disabled</option></select></label>
+      </div>
+      <div data-config-fields></div>
+      <button>Add Plugin</button><p class="status"></p>
+    </form>
+  </section>`;
+}
+function configSectionEditor(data, draft, section, title, redirect) {
+    const entries = Object.entries(draft[section] ?? {});
+    return `<section><h3>${escapeHtml(title)}</h3>
+    ${entries.length === 0 ? '<p class="muted">No plugins configured.</p>' : entries.map(([name, entry]) => {
+        const catalog = findCatalogPlugin(data, entry.plugin, entry.version, entry.package);
+        return `<div style="border-top:1px solid var(--line);padding-top:12px;margin-top:12px">
+        <form data-api="/api/profile-plugins" data-redirect="${escapeHtml(redirect)}" data-config-form>
+          <input type="hidden" name="profileId" value="${escapeHtml(data.profile.id)}">
+          <input type="hidden" name="section" value="${escapeHtml(section)}">
+          <input type="hidden" name="name" value="${escapeHtml(name)}">
+          <input type="hidden" name="plugin" value="${escapeHtml(entry.plugin)}">
+          <input type="hidden" name="packageName" value="${escapeHtml(entry.package ?? '')}">
+          <input type="hidden" name="version" value="${escapeHtml(entry.version ?? '')}">
+          <input type="hidden" name="config">
+          <div class="form-grid">
+            ${input('displayName', 'Config Name', false, name).replace('name="displayName"', 'name="displayName" disabled')}
+            ${input('pluginDisplay', 'Plugin', false, entry.plugin).replace('name="pluginDisplay"', 'name="pluginDisplay" disabled')}
+            <label>Enabled<select name="enabled">${entry.enabled ? '<option value="true" selected>Enabled</option><option value="false">Disabled</option>' : '<option value="true">Enabled</option><option value="false" selected>Disabled</option>'}</select></label>
+          </div>
+          <div data-config-fields>${renderSchemaFields(catalog?.configSchema, entry.config ?? {})}</div>
+          <button>Save</button><p class="status"></p>
+        </form>
+        <form data-api="/api/profile-plugins/delete" data-redirect="${escapeHtml(redirect)}" data-confirm="Remove this plugin from the profile?">
+          <input type="hidden" name="profileId" value="${escapeHtml(data.profile.id)}">
+          <input type="hidden" name="section" value="${escapeHtml(section)}">
+          <input type="hidden" name="name" value="${escapeHtml(name)}">
+          <button class="secondary">Remove</button><p class="status"></p>
+        </form>
+      </div>`;
+    }).join('')}
+  </section>`;
+}
+function findCatalogPlugin(data, pluginId, version, packageName) {
+    return data.plugins.find((plugin) => plugin.pluginId === pluginId &&
+        (version ? plugin.version === version : true) &&
+        (packageName ? plugin.packageName === packageName : true)) ?? data.plugins.find((plugin) => plugin.pluginId === pluginId);
+}
+function renderSchemaFields(schema, config) {
+    const root = objectField(objectField(schema)?.root);
+    if (!root || root.kind !== 'object' || !objectField(root.properties)) {
+        return '<p class="muted">No config schema available for this plugin.</p>';
+    }
+    return renderProperties(root.properties, config, '');
+}
+function renderProperties(properties, config, prefix) {
+    return Object.entries(properties).map(([key, schema]) => {
+        const path = prefix ? `${prefix}.${key}` : key;
+        const value = prefix ? objectField(config)?.[key] : valueAtPath(config, path);
+        return renderSchemaControl(key, objectField(schema), path, value);
+    }).join('');
+}
+function renderSchemaControl(key, rawNode, path, rawValue) {
+    const node = unwrapSchema(rawNode);
+    if (!node)
+        return '';
+    const value = rawValue ?? node.default ?? '';
+    const label = schemaLabel(key, node);
+    if (node.kind === 'object' && objectField(node.properties)) {
+        return `<fieldset class="schema-box"><legend>${escapeHtml(key)}</legend>${renderProperties(node.properties, isRecord(value) ? value : {}, path)}</fieldset>`;
+    }
+    if (node.kind === 'bool' || node.kind === 'boolean') {
+        return `<label>${escapeHtml(label)}<select data-config-path="${escapeHtml(path)}" data-kind="bool"><option value="true" ${value === true ? 'selected' : ''}>true</option><option value="false" ${value === false ? 'selected' : ''}>false</option></select></label>`;
+    }
+    if (node.kind === 'enum' && Array.isArray(node.values)) {
+        return `<label>${escapeHtml(label)}<select data-config-path="${escapeHtml(path)}" data-kind="string">${node.values.map((item) => `<option value="${escapeHtml(String(item))}" ${String(value) === String(item) ? 'selected' : ''}>${escapeHtml(String(item))}</option>`).join('')}</select></label>`;
+    }
+    if (node.kind === 'array') {
+        const itemNode = unwrapSchema(objectField(node.items) ?? objectField(node.item));
+        const kind = inputKind(itemNode);
+        const values = Array.isArray(value) ? value : [];
+        const rows = (values.length ? values : ['']).map((item) => `<div class="repeat-row"><input data-array-item data-kind="${escapeHtml(kind)}" ${kind === 'number' ? 'type="number"' : ''} value="${escapeHtml(String(item ?? ''))}"><button type="button" class="secondary" data-remove-row>Remove</button></div>`).join('');
+        return `<div class="schema-repeat" data-array-path="${escapeHtml(path)}" data-item-kind="${escapeHtml(kind)}"><label>${escapeHtml(label)}</label><div data-repeat-rows>${rows}</div><button type="button" class="secondary" data-add-array-item>Add Item</button></div>`;
+    }
+    if (node.kind === 'record') {
+        const valueNode = unwrapSchema(objectField(node.valueSchema) ?? objectField(node.values) ?? objectField(node.value));
+        const kind = inputKind(valueNode);
+        const entries = isRecord(value) ? Object.entries(value) : [];
+        const rows = (entries.length ? entries : [['', '']]).map(([recordKey, recordValue]) => `<div class="repeat-row"><input data-record-key placeholder="Key" value="${escapeHtml(String(recordKey))}"><input data-record-value data-kind="${escapeHtml(kind)}" ${kind === 'number' ? 'type="number"' : ''} placeholder="Value" value="${escapeHtml(String(recordValue ?? ''))}"><button type="button" class="secondary" data-remove-row>Remove</button></div>`).join('');
+        return `<div class="schema-repeat" data-record-path="${escapeHtml(path)}" data-value-kind="${escapeHtml(kind)}"><label>${escapeHtml(label)}</label><div data-repeat-rows>${rows}</div><button type="button" class="secondary" data-add-record-row>Add Entry</button></div>`;
+    }
+    if (node.kind === 'tuple') {
+        const items = (Array.isArray(node.items) ? node.items : Array.isArray(node.elements) ? node.elements : []).map((item) => objectField(item));
+        const values = Array.isArray(value) ? value : [];
+        return `<fieldset class="schema-box" data-tuple-path="${escapeHtml(path)}"><legend>${escapeHtml(label)}</legend>${items.map((item, index) => {
+            const child = unwrapSchema(item);
+            const kind = inputKind(child);
+            return `<label>Item ${index + 1}<input data-tuple-index="${index}" data-kind="${escapeHtml(kind)}" ${kind === 'number' ? 'type="number"' : ''} value="${escapeHtml(String(values[index] ?? child?.default ?? ''))}"></label>`;
+        }).join('')}</fieldset>`;
+    }
+    if (node.kind === 'union' && Array.isArray(node.variants)) {
+        const variant = unwrapSchema(objectField(node.variants[0]));
+        return renderSchemaControl(label, variant, path, value);
+    }
+    const kind = inputKind(node);
+    return `<label>${escapeHtml(label)}<input data-config-path="${escapeHtml(path)}" data-kind="${escapeHtml(kind)}" ${kind === 'number' ? 'type="number"' : ''} value="${escapeHtml(String(value ?? ''))}"></label>`;
+}
+function schemaLabel(key, node) {
+    return node.metadata && typeof node.metadata === 'object' && 'description' in node.metadata
+        ? String(node.metadata.description)
+        : key;
+}
+function inputKind(node) {
+    if (!node)
+        return 'string';
+    if (node.kind === 'bool' || node.kind === 'boolean')
+        return 'bool';
+    return ['int', 'int32', 'int64', 'number', 'float', 'float32', 'float64'].includes(String(node.kind)) ? 'number' : 'string';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unwrapSchema(node) {
+    let current = node;
+    while (current && (current.kind === 'optional' || current.kind === 'nullable')) {
+        current = objectField(current.inner);
+    }
+    return current;
+}
+function valueAtPath(source, path) {
+    return path.split('.').reduce((acc, part) => objectField(acc)?.[part], source);
+}
+function profileRuntimeKeyTable(keys, data) {
+    if (keys.length === 0)
+        return '<p class="muted">No container keys created for this profile.</p>';
+    return `<table>${keys.map((key) => `<tr>
+    <td>${escapeHtml(key.name)}</td>
+    <td>${escapeHtml(key.id)}</td>
+    <td>${escapeHtml(data.profile.name)}</td>
+    <td>${escapeHtml(key.containerName ?? '')}</td>
+    <td>${escapeHtml(key.revokedAt ?? 'active')}</td>
+    <td>${key.revokedAt ? '' : `<form data-api="/api/runtime-keys/rotate" data-secret-redirect="/deployment?profileId=${escapeHtml(data.profile.id)}"><input type="hidden" name="keyId" value="${escapeHtml(key.id)}"><button class="secondary">Rotate</button><p class="status"></p></form>`}</td>
+  </tr>`).join('')}</table>`;
+}
+function runtimeEnvBlock(credential) {
+    const env = [
+        'BSB_CONFIG_PLUGIN=config-vault',
+        'BSB_CONFIG_PLUGIN_PACKAGE=@bsb/config-vault',
+        `vaultUrl=${credential.publicUrl}`,
+        `apiKeyId=${credential.keyId}`,
+        `apiSecret=${credential.secret}`,
+    ].join('\n');
+    return `<section><h2>Container Environment</h2>
+    <p class="muted">Shown once. Add these env vars to the BSB container that should load this deployment profile.</p>
+    <pre class="code"><code>${escapeHtml(env)}</code></pre>
+  </section>`;
+}
 function shortId(value) {
     return value.length > 18 ? `${value.slice(0, 10)}...${value.slice(-6)}` : value;
 }
@@ -650,7 +929,10 @@ function formScript() {
         const result = await res.json();
         if (!res.ok) throw new Error(result.message || 'Save failed');
         if (form.dataset.secretRedirect && result.secret) {
-          location.href = form.dataset.secretRedirect + '?secret=' + encodeURIComponent(result.secret);
+          const joiner = form.dataset.secretRedirect.includes('?') ? '&' : '?';
+          location.href = form.dataset.secretRedirect
+            + joiner + 'keyId=' + encodeURIComponent(result.keyId || result.id || '')
+            + '&secret=' + encodeURIComponent(result.secret);
           return;
         }
         location.href = form.dataset.redirect || location.pathname;
@@ -664,6 +946,164 @@ function formScript() {
   });
   </script>`;
 }
+function pluginEditorScript(plugins) {
+    const catalog = plugins.reduce((acc, plugin) => {
+        acc[plugin.id] = {
+            plugin: plugin.pluginId,
+            packageName: plugin.packageName ?? '',
+            version: plugin.version,
+            kind: plugin.kind,
+            schema: plugin.configSchema ?? null,
+        };
+        return acc;
+    }, {});
+    return `<script>
+  const vaultPluginCatalog = ${jsonForScript(catalog)};
+  function setPath(target, path, value) {
+    const parts = path.split('.');
+    let current = target;
+    for (let i = 0; i < parts.length - 1; i += 1) {
+      current[parts[i]] = current[parts[i]] || {};
+      current = current[parts[i]];
+    }
+    current[parts[parts.length - 1]] = value;
+  }
+  function readConfigForm(form) {
+    const config = {};
+    form.querySelectorAll('[data-array-path]').forEach((group) => {
+      const values = Array.from(group.querySelectorAll('[data-array-item]'))
+        .map((field) => parseFieldValue(field))
+        .filter((value) => value !== undefined);
+      if (values.length > 0) setPath(config, group.dataset.arrayPath, values);
+    });
+    form.querySelectorAll('[data-record-path]').forEach((group) => {
+      const record = {};
+      group.querySelectorAll('.repeat-row').forEach((row) => {
+        const key = row.querySelector('[data-record-key]')?.value?.trim();
+        const valueField = row.querySelector('[data-record-value]');
+        const value = valueField ? parseFieldValue(valueField) : undefined;
+        if (key && value !== undefined) record[key] = value;
+      });
+      if (Object.keys(record).length > 0) setPath(config, group.dataset.recordPath, record);
+    });
+    form.querySelectorAll('[data-tuple-path]').forEach((group) => {
+      const values = [];
+      group.querySelectorAll('[data-tuple-index]').forEach((field) => {
+        const value = parseFieldValue(field);
+        if (value !== undefined) values[Number(field.dataset.tupleIndex)] = value;
+      });
+      if (values.length > 0) setPath(config, group.dataset.tuplePath, values);
+    });
+    form.querySelectorAll('[data-config-path]').forEach((field) => {
+      if (field.closest('[data-array-path],[data-record-path],[data-tuple-path]')) return;
+      const value = parseFieldValue(field);
+      if (value !== undefined) setPath(config, field.dataset.configPath, value);
+    });
+    return config;
+  }
+  function parseFieldValue(field) {
+    const raw = field.value;
+    if (raw === '') return undefined;
+    if (field.dataset.kind === 'number') return Number(raw);
+    if (field.dataset.kind === 'bool') return raw === 'true';
+    return raw;
+  }
+  function schemaRoot(schema) {
+    return schema && schema.root && schema.root.kind === 'object' ? schema.root : null;
+  }
+  function escapeClient(value) {
+    return String(value ?? '').replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+  }
+  function unwrapNode(node) {
+    while (node && (node.kind === 'optional' || node.kind === 'nullable')) node = node.inner;
+    return node;
+  }
+  function inputKind(node) {
+    node = unwrapNode(node);
+    if (!node) return 'string';
+    if (node.kind === 'bool' || node.kind === 'boolean') return 'bool';
+    return ['int','int32','int64','number','float','float32','float64'].includes(String(node.kind)) ? 'number' : 'string';
+  }
+  function primitiveInput(attrs, kind, value) {
+    return '<input ' + attrs + ' data-kind="' + kind + '"' + (kind === 'number' ? ' type="number"' : '') + ' value="' + escapeClient(value || '') + '">';
+  }
+  function repeatRow(kind, key, value) {
+    return '<div class="repeat-row">'
+      + (key === null ? '' : '<input data-record-key placeholder="Key" value="' + escapeClient(key || '') + '">')
+      + primitiveInput(key === null ? 'data-array-item' : 'data-record-value', kind, value)
+      + '<button type="button" class="secondary" data-remove-row>Remove</button></div>';
+  }
+  function renderFields(properties, prefix) {
+    return Object.entries(properties || {}).map(([key, rawNode]) => {
+      let node = unwrapNode(rawNode);
+      if (!node) return '';
+      const path = prefix ? prefix + '.' + key : key;
+      const label = (node.metadata && node.metadata.description) || key;
+      if (node.kind === 'object' && node.properties) {
+        return '<fieldset class="schema-box"><legend>' + escapeClient(key) + '</legend>' + renderFields(node.properties, path) + '</fieldset>';
+      }
+      if (node.kind === 'bool' || node.kind === 'boolean') {
+        return '<label>' + escapeClient(label) + '<select data-config-path="' + escapeClient(path) + '" data-kind="bool"><option value="true">true</option><option value="false">false</option></select></label>';
+      }
+      if (node.kind === 'enum' && Array.isArray(node.values)) {
+        return '<label>' + escapeClient(label) + '<select data-config-path="' + escapeClient(path) + '" data-kind="string">' + node.values.map((item) => '<option value="' + escapeClient(item) + '">' + escapeClient(item) + '</option>').join('') + '</select></label>';
+      }
+      if (node.kind === 'array') {
+        const kind = inputKind(node.items || node.item);
+        return '<div class="schema-repeat" data-array-path="' + escapeClient(path) + '" data-item-kind="' + kind + '"><label>' + escapeClient(label) + '</label><div data-repeat-rows>' + repeatRow(kind, null, '') + '</div><button type="button" class="secondary" data-add-array-item>Add Item</button></div>';
+      }
+      if (node.kind === 'record') {
+        const kind = inputKind(node.valueSchema || node.values || node.value);
+        return '<div class="schema-repeat" data-record-path="' + escapeClient(path) + '" data-value-kind="' + kind + '"><label>' + escapeClient(label) + '</label><div data-repeat-rows>' + repeatRow(kind, '', '') + '</div><button type="button" class="secondary" data-add-record-row>Add Entry</button></div>';
+      }
+      if (node.kind === 'tuple') {
+        const items = Array.isArray(node.items) ? node.items : Array.isArray(node.elements) ? node.elements : [];
+        return '<fieldset class="schema-box" data-tuple-path="' + escapeClient(path) + '"><legend>' + escapeClient(label) + '</legend>' + items.map((item, index) => '<label>Item ' + (index + 1) + primitiveInput('data-tuple-index="' + index + '"', inputKind(item), '') + '</label>').join('') + '</fieldset>';
+      }
+      if (node.kind === 'union' && Array.isArray(node.variants) && node.variants[0]) {
+        return renderFields({ [key]: node.variants[0] }, prefix);
+      }
+      const kind = inputKind(node);
+      return '<label>' + escapeClient(label) + primitiveInput('data-config-path="' + escapeClient(path) + '"', kind, '') + '</label>';
+    }).join('');
+  }
+  document.addEventListener('click', (event) => {
+    const button = event.target.closest('[data-add-array-item],[data-add-record-row],[data-remove-row]');
+    if (!button) return;
+    if (button.matches('[data-remove-row]')) {
+      button.closest('.repeat-row')?.remove();
+      return;
+    }
+    const group = button.closest('.schema-repeat');
+    const rows = group?.querySelector('[data-repeat-rows]');
+    if (!group || !rows) return;
+    if (button.matches('[data-add-array-item]')) rows.insertAdjacentHTML('beforeend', repeatRow(group.dataset.itemKind || 'string', null, ''));
+    if (button.matches('[data-add-record-row]')) rows.insertAdjacentHTML('beforeend', repeatRow(group.dataset.valueKind || 'string', '', ''));
+  });
+  document.querySelectorAll('[data-plugin-picker]').forEach((select) => {
+    const form = select.closest('form');
+    const sync = () => {
+      const item = vaultPluginCatalog[select.value];
+      if (!item || !form) return;
+      form.elements.plugin.value = item.plugin || '';
+      form.elements.packageName.value = item.packageName || '';
+      form.elements.version.value = item.version || '';
+      if (form.elements.section && item.kind) form.elements.section.value = item.kind === 'service' ? 'services' : item.kind;
+      if (form.elements.name && !form.elements.name.value) form.elements.name.value = item.plugin || '';
+      const root = schemaRoot(item.schema);
+      const fields = form.querySelector('[data-config-fields]');
+      if (fields) fields.innerHTML = root ? renderFields(root.properties, '') : '<p class="muted">No config schema available for this plugin.</p>';
+    };
+    select.addEventListener('change', sync);
+    sync();
+  });
+  document.querySelectorAll('form[data-config-form]').forEach((form) => {
+    form.addEventListener('submit', () => {
+      if (form.elements.config) form.elements.config.value = JSON.stringify(readConfigForm(form));
+    }, { capture: true });
+  });
+  </script>`;
+}
 function webauthnClientScript() {
     return `
   function base64UrlToBuffer(value) {
@@ -717,29 +1157,63 @@ function webauthnClientScript() {
   }
   `;
 }
-function apiForm(action, fields, textarea) {
-    return `<form data-api="${action}" onsubmit="return submitJson(this)">
-    ${fields.map((field) => `<input name="${field}" placeholder="${field}" ${field === 'configPluginId' ? 'value="config-vault"' : ''}>`).join('')}
-    ${textarea ? `<textarea name="${textarea}" placeholder="${textarea} JSON"></textarea>` : ''}
-    <button>Submit</button>
-  </form>
-  <script>
-  async function submitJson(form){
-    const data={}; for(const item of new FormData(form).entries()){data[item[0]]=item[1]}
-    const csrf=document.cookie.split('; ').find(x=>x.startsWith('vault_csrf='))?.split('=')[1]||'';
-    const res=await fetch(form.dataset.api,{method:'POST',headers:{'content-type':'application/json','x-csrf-token':csrf},body:JSON.stringify(data)});
-    alert(JSON.stringify(await res.json(),null,2)); location.reload(); return false;
-  }
-  </script>`;
-}
-function pluginForm() {
-    return apiForm('/api/plugins', ['org', 'name', 'pluginId', 'packageName', 'version', 'kind', 'source'], 'configSchema');
-}
 function table(rows) {
     if (rows.length === 0)
         return '<p class="muted">None</p>';
     return `<table>${rows.map((row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell)}</td>`).join('')}</tr>`).join('')}</table>`;
 }
+async function registrySearch(registryUrl, query) {
+    const url = new URL('/plugins', registryUrl);
+    url.searchParams.set('language', 'nodejs');
+    url.searchParams.set('limit', '20');
+    if (query.trim())
+        url.searchParams.set('query', query.trim());
+    try {
+        const response = await fetch(url, { headers: { accept: 'application/json' } });
+        if (!response.ok)
+            return [];
+        const parsed = await response.json();
+        return (Array.isArray(parsed.plugins) ? parsed.plugins : [])
+            .map(normalizeRegistryCandidate)
+            .filter((item) => item !== null);
+    }
+    catch {
+        return [];
+    }
+}
+function normalizeRegistryCandidate(input) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input))
+        return null;
+    const value = input;
+    const org = stringField(value.org) ?? orgFromPackage(value.packageName ?? value.package) ?? '_';
+    const name = stringField(value.name) ?? stringField(value.pluginId) ?? stringField(value.id);
+    if (!name)
+        return null;
+    const packageName = stringField(value.packageName) ?? stringField(value.package) ?? null;
+    const pluginId = stringField(value.pluginId) ?? stringField(value.id) ?? name;
+    return {
+        org,
+        name,
+        pluginId,
+        packageName,
+        version: stringField(value.version) ?? '0.0.0',
+        kind: parseKind(value.kind ?? value.category ?? value.type),
+        configSchema: objectField(value.configSchema) ?? objectField(value.schema) ?? objectField(value.validationSchema) ?? null,
+        eventSchema: objectField(value.eventSchema) ?? objectField(value.events) ?? null,
+    };
+}
+function stringField(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function objectField(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+function orgFromPackage(value) {
+    if (typeof value !== 'string' || !value.startsWith('@'))
+        return undefined;
+    const [org] = value.split('/');
+    return org || undefined;
+}
 function parseJsonObject(value) {
     if (typeof value === 'object' && value !== null && !Array.isArray(value))
         return value;
@@ -753,6 +1227,9 @@ function parseJsonObject(value) {
 function parseKind(value) {
     return value === 'events' || value === 'observable' || value === 'config' ? value : 'service';
 }
+function parseConfigSection(value) {
+    return value === 'events' || value === 'observable' ? value : 'services';
+}
 function parseSource(value) {
     return value === 'registry' || value === 'upload' ? value : 'manual';
 }
@@ -768,4 +1245,7 @@ function escapeHtml(value) {
         "'": '&#39;',
     }[char] ?? char));
 }
+function jsonForScript(value) {
+    return JSON.stringify(value).replace(/<\//g, '<\\/');
+}
 //# sourceMappingURL=http-server.js.map