@jini-ai/admin 0.4.11 → 0.4.13

package/dist/react/shell/model.d.ts

@@ -4,7 +4,10 @@ import type { AdminShellPanel, AdminShellSession } from './types.js';
 export interface AdminShellModel {
     readonly panels: readonly AdminShellPanel[];
     readonly panel: AdminShellPanel | undefined;
-    readonly route: AdminRoute;
+    /** Always names a panel: an unmatched or root path resolves to the host's default panel. */
+    readonly route: AdminRoute & {
+        readonly panelId: string;
+    };
     readonly nav: readonly AdminNavGroup[];
     readonly agentPageId: string | null;
 }

package/dist/react/shell/model.js

@@ -12,12 +12,13 @@ export function resolveAdminShellModel(args, options = {}) {
         permissions: args.session.effectivePermissions ?? [],
     });
     const matched = matchRoute({ routePath: args.routePath, panels });
-    const rawPath = args.routePath.split('?')[0] ?? '';
+    // `split` with a string separator always returns at least one element, so index 0 exists.
+    const rawPath = args.routePath.split('?')[0];
     const isRoot = rawPath.split('/').filter(Boolean).length === 0;
     // The existing matcher maps root to dashboard. The shell's default is host-owned.
     const route = isRoot || matched.panelId === null
         ? { panelId: args.defaultPanelId, view: null, params: {}, query: matched.query }
-        : matched;
+        : { ...matched, panelId: matched.panelId };
     return {
         panels,
         panel: panels.find((panel) => panel.id === route.panelId),

package/dist/react/shell/use-admin-shell-session.js

@@ -1,4 +1,24 @@
 import { useCallback, useEffect, useRef, useState } from 'react';
+/** Run one port operation and map its outcome, including adapter failures, to the next gate state. */
+async function settleOperation({ operation, port, context }) {
+    try {
+        if (operation === 'logout') {
+            await port.logout(context);
+            return { status: 'anonymous' };
+        }
+        const session = await port.read(context);
+        return session === null
+            ? { status: 'anonymous' }
+            : { status: 'authenticated', session };
+    }
+    catch (error) {
+        // Local sign-out must complete even when the server cannot revoke its cookie. A read
+        // retry here would quietly restore that still-valid session instead of showing login.
+        return operation === 'logout'
+            ? { status: 'anonymous' }
+            : { status: 'error', error };
+    }
+}
 /**
  * Own session reads and invalidation without any host API imports.
  * @param args Stable context and session port. Changing either starts a new session check.
@@ -22,33 +42,12 @@ export function useAdminShellSession(args) {
         const request = ++generation.current;
         const isCurrent = () => active.current === owner && generation.current === request;
         setOwned({ context, port, state: { status: 'checking' } });
-        try {
-            if (operation === 'logout') {
-                await port.logout(context);
-                if (isCurrent())
-                    setOwned({ context, port, state: { status: 'anonymous' } });
-                return;
-            }
-            const session = await port.read(context);
-            if (!isCurrent())
-                return;
-            const state = session === null
-                ? { status: 'anonymous' }
-                : { status: 'authenticated', session };
+        // settleOperation never rejects, so the logout latch below always clears.
+        const state = await settleOperation({ operation, port, context });
+        if (isCurrent())
             setOwned({ context, port, state });
-        }
-        catch (error) {
-            // Local sign-out must complete even when the server cannot revoke its cookie. A read
-            // retry here would quietly restore that still-valid session instead of showing login.
-            if (isCurrent())
-                setOwned({ context, port, state: operation === 'logout'
-                        ? { status: 'anonymous' }
-                        : { status: 'error', error } });
-        }
-        finally {
-            if (operation === 'logout' && loggingOut.current === owner)
-                loggingOut.current = null;
-        }
+        if (operation === 'logout' && loggingOut.current === owner)
+            loggingOut.current = null;
     }, [context, port]);
     const refresh = useCallback(() => run('read'), [run]);
     const logout = useCallback(() => run('logout'), [run]);

package/dist/redirects/adapters/memory.js

@@ -6,6 +6,8 @@ import { AdminApiError } from '../../core/transport/errors.js';
 export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { validate, onImport } = {}) {
     const rows = new Map(redirects.map(row => [row.id, Object.freeze({ ...row })]));
     const stats = new Map(Object.entries(hits).map(([id, value]) => [id, Object.freeze({ ...value })]));
+    // Ids removed to the Trash: hidden from the list, still readable by id, restored by `status: 'active'`.
+    const trashed = new Set();
     let nextId = 1;
     function get(id) {
         const row = rows.get(id);
@@ -32,7 +34,8 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
     }
     return {
         async listRedirects(_required, filter = {}) {
-            return Object.freeze([...rows.values()].filter(row => (filter.status === undefined || row.status === filter.status) &&
+            return Object.freeze([...rows.values()].filter(row => !trashed.has(row.id) &&
+                (filter.status === undefined || row.status === filter.status) &&
                 (filter.source === undefined || row.source === filter.source) &&
                 (filter.matchType === undefined || row.matchType === filter.matchType)));
         },
@@ -47,14 +50,18 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
                 throw new AdminApiError({ message: 'regex match type is not supported', status: 400 }, { code: 'REDIRECT_VALIDATION_ERROR' });
             const row = Object.freeze({ ...next, version: before.version + 1 });
             rows.set(id, row);
+            if (patch.status === 'active')
+                trashed.delete(id);
             return row;
         },
         async tombstoneRedirect({ id }) {
             const row = get(id);
-            if (row.status === 'disabled')
+            // Keyed on the Trash, not on `status`: a rule already toggled off still moves to the Trash.
+            if (trashed.has(id))
                 return row;
             const disabled = Object.freeze({ ...row, status: 'disabled', version: row.version + 1 });
             rows.set(id, disabled);
+            trashed.add(id);
             return disabled;
         },
         async getRedirectHitStats({ id }) {

package/dist/redirects/conformance/redirects-api.conformance.js

@@ -1,17 +1,14 @@
 import { AdminApiError } from '../../core/transport/errors.js';
-/** Destructive framework-free checklist: use an isolated backend with no production data.
- * Validates core soft-delete, snapshots, lazy-read data and per-item partial import contracts.
- * Reference regex rejection probes can be disabled for a host implementing the port's open vocabulary.
- * @example await runRedirectsApiConformance({ api: createMemoryRedirectsApi({}, {}) }, {});
- */
-export async function runRedirectsApiConformance({ api }, { referenceRegexRejection = true } = {}) {
-    const checks = [];
-    function assert(ok, name) {
+/** The id every not-found probe asks for; no conforming backend may hold it. */
+const MISSING = { id: 'missing-conformance-rule' };
+function createChecklist(_required = {}, _optional = {}) {
+    const passed = [];
+    function check({ ok, name }) {
         if (!ok)
             throw new AdminApiError({ message: `Redirects API conformance: ${name}`, status: 0 }, { code: 'CONFORMANCE_FAILED' });
-        checks.push(name);
+        passed.push(name);
     }
-    async function rejects(run, name) {
+    async function rejects({ run, name }) {
         let rejected = false;
         try {
             await run();
@@ -19,48 +16,81 @@ export async function runRedirectsApiConformance({ api }, { referenceRegexReject
         catch {
             rejected = true;
         }
-        assert(rejected, name);
+        check({ ok: rejected, name });
     }
-    const input = { matchType: 'exact', fromPattern: '/redirects-conformance-a', toTarget: '/redirects-conformance-b', statusCode: 301 };
+    return { passed, check, rejects };
+}
+async function checkCreateAndRead({ api, list, input }, _optional = {}) {
     const created = await api.createRedirect(input, { override: true, priority: 7 });
-    assert(created.status === 'active' && created.override && created.priority === 7, 'create preserves fields and options');
+    list.check({ ok: created.status === 'active' && created.override && created.priority === 7, name: 'create preserves fields and options' });
     const before = await api.listRedirects({});
-    assert(before.some(row => row.id === created.id), 'list contains the created rule');
-    assert((await api.getRedirect({ id: created.id })).id === created.id, 'get reads by id');
+    list.check({ ok: before.some(row => row.id === created.id), name: 'list contains the created rule' });
+    list.check({ ok: (await api.getRedirect({ id: created.id })).id === created.id, name: 'get reads by id' });
     const hits = await api.getRedirectHitStats({ id: created.id });
-    assert(hits.redirectId === created.id && hits.hitCount === 0 && hits.lastHitAt === null, 'new rule has zero hits');
+    list.check({ ok: hits.redirectId === created.id && hits.hitCount === 0 && hits.lastHitAt === null, name: 'new rule has zero hits' });
+    return { created, before };
+}
+async function checkUpdate({ api, list, created, before }, _optional = {}) {
     const updated = await api.updateRedirect({ id: created.id }, { status: 'disabled' });
-    assert(updated.status === 'disabled' && updated.toTarget === created.toTarget, 'partial update preserves other fields');
-    assert(created.status === 'active' && before.find(row => row.id === created.id)?.status === 'active', 'prior snapshots stay unchanged');
-    assert((await api.listRedirects({}, { status: 'disabled' })).every(row => row.status === 'disabled'), 'status filter');
+    list.check({ ok: updated.status === 'disabled' && updated.toTarget === created.toTarget, name: 'partial update preserves other fields' });
+    list.check({ ok: created.status === 'active' && before.find(row => row.id === created.id)?.status === 'active', name: 'prior snapshots stay unchanged' });
+    list.check({ ok: (await api.listRedirects({}, { status: 'disabled' })).every(row => row.status === 'disabled'), name: 'status filter' });
     await api.updateRedirect({ id: created.id }, { status: 'active' });
-    const disabled = await api.tombstoneRedirect({ id: created.id });
-    assert(disabled.status === 'disabled', 'tombstone returns the disabled rule');
-    assert((await api.listRedirects({})).some(row => row.id === created.id), 'soft deletion retains the rule');
-    assert((await api.getRedirect({ id: created.id })).status === 'disabled', 'tombstoned rule remains readable');
-    await rejects(() => api.getRedirect({ id: 'missing-conformance-rule' }), 'missing rule rejects');
-    await rejects(() => api.getRedirectHitStats({ id: 'missing-conformance-rule' }), 'missing hits differs from zero hits');
-    await rejects(() => api.updateRedirect({ id: 'missing-conformance-rule' }, { status: 'disabled' }), 'missing update rejects');
-    await rejects(() => api.tombstoneRedirect({ id: 'missing-conformance-rule' }), 'missing tombstone rejects');
-    if (referenceRegexRejection) {
-        await rejects(() => api.createRedirect({ ...input, fromPattern: '/regex-conformance', matchType: 'regex' }), 'reference regex create is loudly rejected');
-        await rejects(() => api.updateRedirect({ id: created.id }, { matchType: 'regex' }), 'reference regex update is loudly rejected');
-    }
+}
+async function checkSoftDelete({ api, list, id }, _optional = {}) {
+    const disabled = await api.tombstoneRedirect({ id });
+    list.check({ ok: disabled.status === 'disabled', name: 'tombstone returns the disabled rule' });
+    // Removal moves the rule to the Trash: it leaves the list and is shown only there (Bug B).
+    list.check({ ok: !(await api.listRedirects({})).some(row => row.id === id), name: 'removed rule leaves the list' });
+    list.check({ ok: (await api.getRedirect({ id })).status === 'disabled', name: 'tombstoned rule remains readable' });
+    // A pure `status: 'active'` update is the restore; remove the rule again so the run leaves it in the Trash.
+    await api.updateRedirect({ id }, { status: 'active' });
+    list.check({ ok: (await api.listRedirects({})).some(row => row.id === id), name: 'restore returns the rule to the list' });
+    await api.tombstoneRedirect({ id });
+}
+async function checkMissingRule({ api, list }, _optional = {}) {
+    await list.rejects({ run: () => api.getRedirect(MISSING), name: 'missing rule rejects' });
+    await list.rejects({ run: () => api.getRedirectHitStats(MISSING), name: 'missing hits differs from zero hits' });
+    await list.rejects({ run: () => api.updateRedirect(MISSING, { status: 'disabled' }), name: 'missing update rejects' });
+    await list.rejects({ run: () => api.tombstoneRedirect(MISSING), name: 'missing tombstone rejects' });
+}
+async function checkReferenceRegexRejection({ api, list, input, id }, _optional = {}) {
+    await list.rejects({ run: () => api.createRedirect({ ...input, fromPattern: '/regex-conformance', matchType: 'regex' }), name: 'reference regex create is loudly rejected' });
+    await list.rejects({ run: () => api.updateRedirect({ id }, { matchType: 'regex' }), name: 'reference regex update is loudly rejected' });
+}
+/** With reference rejection, a regex item sits between two valid ones to prove per-item partial success. */
+async function checkImport({ api, list, input }, { referenceRegexRejection }) {
     const batch = await api.importRedirects({ rules: [
             { ...input, fromPattern: '/import-conformance-a' },
             ...(referenceRegexRejection ? [{ ...input, fromPattern: '/import-conformance-regex', matchType: 'regex' }] : []),
             { ...input, fromPattern: '/import-conformance-c' },
         ] });
     if (referenceRegexRejection) {
-        assert(batch.created.length === 2 && batch.failed.length === 1 && batch.failed[0]?.index === 1, 'middle failure preserves both successful siblings');
-        assert(batch.created.every(row => row.fromPattern !== '/import-conformance-regex'), 'invalid item is never reported created');
+        list.check({ ok: batch.created.length === 2 && batch.failed.length === 1 && batch.failed[0]?.index === 1, name: 'middle failure preserves both successful siblings' });
+        list.check({ ok: batch.created.every(row => row.fromPattern !== '/import-conformance-regex'), name: 'invalid item is never reported created' });
     }
     else {
-        assert(batch.created.length === 2 && batch.failed.length === 0, 'valid import batch succeeds');
+        list.check({ ok: batch.created.length === 2 && batch.failed.length === 0, name: 'valid import batch succeeds' });
     }
-    assert(batch.created.every(row => row.source === 'import'), 'import provenance is stamped by the backend');
+    list.check({ ok: batch.created.every(row => row.source === 'import'), name: 'import provenance is stamped by the backend' });
     for (const row of batch.created)
         await api.tombstoneRedirect({ id: row.id });
-    return Object.freeze(checks);
+}
+/** Destructive framework-free checklist: use an isolated backend with no production data.
+ * Validates core soft-delete, snapshots, lazy-read data and per-item partial import contracts.
+ * Reference regex rejection probes can be disabled for a host implementing the port's open vocabulary.
+ * @example await runRedirectsApiConformance({ api: createMemoryRedirectsApi({}, {}) }, {});
+ */
+export async function runRedirectsApiConformance({ api }, { referenceRegexRejection = true } = {}) {
+    const list = createChecklist();
+    const input = { matchType: 'exact', fromPattern: '/redirects-conformance-a', toTarget: '/redirects-conformance-b', statusCode: 301 };
+    const { created, before } = await checkCreateAndRead({ api, list, input });
+    await checkUpdate({ api, list, created, before });
+    await checkSoftDelete({ api, list, id: created.id });
+    await checkMissingRule({ api, list });
+    if (referenceRegexRejection)
+        await checkReferenceRegexRejection({ api, list, input, id: created.id });
+    await checkImport({ api, list, input }, { referenceRegexRejection });
+    return Object.freeze(list.passed);
 }
 //# sourceMappingURL=redirects-api.conformance.js.map

package/dist/redirects/react/hooks/use-import-redirects-form.hooks.d.ts

@@ -9,7 +9,7 @@ export declare function useImportRedirectsForm({ api }: {
     locale?: string;
 }): {
     raw: string;
-    setRaw: (raw: string) => void | undefined;
+    setRaw: (next: string) => void | undefined;
     error: string | null;
     result: import("../../index.js").AdminRedirectImportResult | null;
     importing: boolean;

package/dist/redirects/react/hooks/use-import-redirects-form.hooks.js

@@ -5,6 +5,13 @@ import { useController } from '../../../core/react/use-controller.js';
 import { createImportRedirectsController } from '../../controllers/import-redirects.controller.js';
 import { KEYS } from '../../rules.js';
 import { translateRedirectsEn } from '../../messages.en.js';
+/** Before the controller mounts there is no snapshot: an empty form. A parse error wins over a
+ * request error, so a later parse failure replaces an earlier request failure instead of stacking. */
+function deriveFormState({ snapshot, requestError }, _optional = {}) {
+    return { raw: snapshot?.raw ?? '',
+        error: snapshot?.parseError ?? (requestError ? describeApiError({ e: requestError, fallback: 'Import failed' }) : null),
+        result: snapshot?.result ?? null };
+}
 /** A resolved 207 is a result, including failed items; only transport failures enter error state. */
 export function useImportRedirectsForm({ api }, { t = translateRedirectsEn, locale = 'en' } = {}) {
     const mutation = useFetchMutation({ run: ({ input: rules }) => api.importRedirects({ rules }) }, { invalidates: [KEYS.list] });
@@ -18,8 +25,8 @@ export function useImportRedirectsForm({ api }, { t = translateRedirectsEn, loca
         e.preventDefault();
         return controller?.submit() ?? Promise.resolve();
     }
-    return { raw: snapshot?.raw ?? '', setRaw: (raw) => controller?.setRaw({ raw }),
-        error: snapshot?.parseError ?? (mutation.error ? describeApiError({ e: mutation.error, fallback: 'Import failed' }) : null),
-        result: snapshot?.result ?? null, importing: mutation.status === 'pending', submit, t, locale };
+    const { raw, error, result } = deriveFormState({ snapshot, requestError: mutation.error });
+    return { raw, setRaw: (next) => controller?.setRaw({ raw: next }),
+        error, result, importing: mutation.status === 'pending', submit, t, locale };
 }
 //# sourceMappingURL=use-import-redirects-form.hooks.js.map

package/dist/redirects/react/hooks/wired.hooks.d.ts

@@ -44,7 +44,7 @@ export declare function useWiredImportRedirectsForm({ t, locale }: {
     createdText: string;
     failedLabel: (failure: AdminRedirectImportFailure) => string;
     raw: string;
-    setRaw: (raw: string) => void | undefined;
+    setRaw: (next: string) => void | undefined;
     error: string | null;
     result: import("../../index.js").AdminRedirectImportResult | null;
     importing: boolean;

package/dist/security/adapters/http.js

@@ -3,8 +3,17 @@ function summary(row, kind) {
     return Object.freeze({ kind, id: row.id, providerId: row.providerId ?? '', label: row.label, configured: row.configured, isDefault: row.isDefault ?? false, createdAt: row.createdAt, updatedAt: row.updatedAt,
         ...(row.accountLabel !== undefined ? { accountLabel: row.accountLabel } : {}), ...(kind === 'custom' ? { category: row.category ?? 'general', baseUrl: row.baseUrl ?? '', additionalHosts: Object.freeze([...(row.additionalHosts ?? [])]), ...(row.username ? { username: row.username } : {}) } : {}) });
 }
+function trimBase({ workspacePath }, _optional = {}) { return workspacePath.replace(/\/$/, ''); }
+function descriptorExtras({ credential }, _optional = {}) {
+    const help = credential?.userHelp ?? credential?.help;
+    return { ...(credential?.tokenPageUrl ? { tokenPageUrl: credential.tokenPageUrl } : {}), ...(help ? { help } : {}) };
+}
+function providerFromDescriptor({ kind, descriptor: d }, _optional = {}) {
+    const c = d.credential;
+    return { kind, id: d.id, label: d.label, vendorLabel: c?.vendorLabel ?? d.label, category: kind === 'publish' ? 'hosting' : 'source-control', tokenField: c?.tokenField ?? 'token', fields: c?.fields ?? [], ...descriptorExtras({ credential: c }) };
+}
 export function createHttpSecurityApi({ transport, workspacePath }, _optional = {}) {
-    const base = workspacePath.replace(/\/$/, '');
+    const base = trimBase({ workspacePath });
     function store(kind, suffix) {
         const path = `${base}/system/${suffix}/credentials`;
         async function mutate(method, target, body, options) { options.signal?.throwIfAborted(); const r = await transport.request({ method, path: target, body }, options); return summary(r.credential, kind); }
@@ -22,24 +31,28 @@ export function createHttpSecurityApi({ transport, workspacePath }, _optional =
                 transport.request({ method: 'GET', path: `${base}/system/publish-targets` }, options),
                 transport.request({ method: 'GET', path: `${base}/system/source-control/providers` }, options),
             ]);
-            const map = (kind, d) => ({ kind, id: d.id, label: d.label, vendorLabel: d.credential?.vendorLabel ?? d.label, category: kind === 'publish' ? 'hosting' : 'source-control', tokenField: d.credential?.tokenField ?? 'token', fields: d.credential?.fields ?? [], ...(d.credential?.tokenPageUrl ? { tokenPageUrl: d.credential.tokenPageUrl } : {}), ...((d.credential?.userHelp ?? d.credential?.help) ? { help: d.credential.userHelp ?? d.credential.help } : {}) });
-            return [...publish.targets.filter(d => d.credential).map(d => map('publish', d)), ...source.providers.map(d => map('source-control', d))];
+            return [...publish.targets.filter(d => d.credential).map(descriptor => providerFromDescriptor({ kind: 'publish', descriptor })), ...source.providers.map(descriptor => providerFromDescriptor({ kind: 'source-control', descriptor }))];
         },
         publish: store('publish', 'publish'), sourceControl: store('source-control', 'source-control'), custom: store('custom', 'custom'),
     };
 }
+/** Only non-secret settings are echoed back; apiKey is sent solely for the entry being replaced. */
+function mediaEntry({ entry }, { apiKey } = {}) {
+    return { ...(entry.baseUrl !== undefined ? { baseUrl: entry.baseUrl } : {}), ...(entry.model !== undefined ? { model: entry.model } : {}), ...(apiKey !== undefined ? { apiKey } : {}) };
+}
 /** Replacing the ENTIRE map requires sibling settings unchanged. Blank apiKey preserves their stored keys. */
 function rebuildMedia(current, id, token) {
     const next = {};
     for (const [key, entry] of Object.entries(current)) {
-        if (key === id && token === undefined)
-            continue;
-        next[key] = { ...(entry.baseUrl !== undefined ? { baseUrl: entry.baseUrl } : {}), ...(entry.model !== undefined ? { model: entry.model } : {}), ...(key === id && token !== undefined ? { apiKey: token } : {}) };
+        if (key !== id)
+            next[key] = mediaEntry({ entry });
+        else if (token !== undefined)
+            next[key] = mediaEntry({ entry }, { apiKey: token });
     }
     return next;
 }
 export function createHttpOtherCredentials({ transport, workspacePath }, { mediaLabels = {} } = {}) {
-    const base = workspacePath.replace(/\/$/, '');
+    const base = trimBase({ workspacePath });
     const singles = { 'site-assistant': { path: '/assistant/site-credential', label: 'Assistant model key' }, 'admin-byok': { path: '/assistant/execution-credential', label: 'Admin model key' } };
     async function request(path, method, options, body) { options.signal?.throwIfAborted(); return transport.request({ path: `${base}${path}`, method, ...(body !== undefined ? { body } : {}) }, options); }
     return {
@@ -79,15 +92,17 @@ export function createHttpOtherCredentials({ transport, workspacePath }, { media
         },
     };
 }
+/** Explicit projection: receivers carry signing secrets the UI must never hold. */
+function webhookTargets({ webhooks }, _optional = {}) { return webhooks.map(w => ({ label: w.label, targetUrl: w.targetUrl })); }
 export function createHttpRootKey({ transport, workspacePath }, _optional = {}) {
-    const path = `${workspacePath.replace(/\/$/, '')}/system/site-token`;
+    const path = `${trimBase({ workspacePath })}/system/site-token`;
     async function request(suffix, method, options, body) { options.signal?.throwIfAborted(); return transport.request({ path: `${path}${suffix}`, method, ...(body !== undefined ? { body } : {}) }, options); }
-    function result(r) { return { outcome: r.outcome, fingerprint: r.fingerprint, keyFilePath: r.keyFilePath, runtimeMode: r.runtimeMode, ...(r.resealed !== undefined ? { resealed: r.resealed } : {}), ...(r.discarded !== undefined ? { discarded: r.discarded } : {}), ...(r.kept !== undefined ? { kept: r.kept } : {}), ...(r.restorePointId ? { restorePointId: r.restorePointId } : {}), ...(r.affectedWebhooks ? { affectedWebhooks: r.affectedWebhooks.map(w => ({ label: w.label, targetUrl: w.targetUrl })) } : {}) }; }
+    function result(r) { return { outcome: r.outcome, fingerprint: r.fingerprint, keyFilePath: r.keyFilePath, runtimeMode: r.runtimeMode, ...(r.resealed !== undefined ? { resealed: r.resealed } : {}), ...(r.discarded !== undefined ? { discarded: r.discarded } : {}), ...(r.kept !== undefined ? { kept: r.kept } : {}), ...(r.restorePointId ? { restorePointId: r.restorePointId } : {}), ...(r.affectedWebhooks ? { affectedWebhooks: webhookTargets({ webhooks: r.affectedWebhooks }) } : {}) }; }
     return {
         async status(_r, o = {}) { const r = await request('', 'GET', o); return { active: r.active, source: r.source, state: r.state, keyFilePath: r.keyFilePath, runtimeMode: r.runtimeMode, ...(r.fingerprint ? { fingerprint: r.fingerprint } : {}), ...(r.invalid !== undefined ? { invalid: r.invalid } : {}) }; },
         async generate(_r, o = {}) { return result(await request('/generate', 'POST', o)); },
         async importToken({ token }, o = {}) { return result(await request('/import', 'POST', o, { token })); },
-        async previewStartFresh(_r, o = {}) { const r = await request('/start-fresh', 'GET', o); return { removes: r.removes, detail: r.detail, runtimeMode: r.runtimeMode, affectedWebhooks: r.affectedWebhooks.map(w => ({ label: w.label, targetUrl: w.targetUrl })) }; },
+        async previewStartFresh(_r, o = {}) { const r = await request('/start-fresh', 'GET', o); return { removes: r.removes, detail: r.detail, runtimeMode: r.runtimeMode, affectedWebhooks: webhookTargets({ webhooks: r.affectedWebhooks }) }; },
         async startFresh({ confirm }, o = {}) { return result(await request('/start-fresh', 'POST', o, { confirm })); },
     };
 }

package/dist/security/adapters/memory.js

@@ -1,13 +1,27 @@
 import { START_FRESH_CONFIRMATION } from '../rules.js';
+function customUsernameField({ patch }, { initial } = {}) {
+    const username = patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username;
+    return username ? { username } : {};
+}
+function customHosts({ patch }, { initial } = {}) { return Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]); }
+function customProjection({ patch }, { initial } = {}) {
+    return { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: customHosts({ patch }, { initial }), ...customUsernameField({ patch }, { initial }) };
+}
 /** Fake backend: retains only read models, never credential material. */
 export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
     let items = rows.map(r => Object.freeze({ ...r }));
     let sequence = 0;
     function store(kind) {
-        function project(id, patch, providerId, initial) {
+        function isDefaultFor({ patch, providerId }, { initial } = {}) {
+            if (kind === 'custom')
+                return false;
+            return patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId);
+        }
+        /** The caller resolves the label: create requires one, update falls back to the saved label. */
+        function project({ id, patch, providerId, label }, { initial } = {}) {
             const now = new Date().toISOString();
-            return Object.freeze({ kind, id, providerId, label: patch.label ?? initial?.label ?? '', configured: true, isDefault: kind === 'custom' ? false : patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId), createdAt: initial?.createdAt ?? now, updatedAt: now,
-                ...(kind === 'custom' ? { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]), ...((patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) ? { username: (patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) } : {}) } : {}),
+            return Object.freeze({ kind, id, providerId, label, configured: true, isDefault: isDefaultFor({ patch, providerId }, { initial }), createdAt: initial?.createdAt ?? now, updatedAt: now,
+                ...(kind === 'custom' ? customProjection({ patch }, { initial }) : {}),
             });
         }
         function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
@@ -21,9 +35,9 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
         return {
             async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
             async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
-                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project(`credential-${++sequence}`, input, providerId)); },
+                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project({ id: `credential-${++sequence}`, patch: input, providerId, label: input.label })); },
             async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
-                throw new Error('Credential not found'); check(patch.label ?? old.label, old.providerId, id); return insert(project(id, patch, old.providerId, old)); },
+                throw new Error('Credential not found'); const label = patch.label ?? old.label; check(label, old.providerId, id); return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old })); },
             async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
                 const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
                 if (next)

package/dist/security/controllers/access-tokens.controller.js

@@ -1,5 +1,9 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
-import { blankCredentialDraft, buildCredentialPatch, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+import { blankCredentialDraft, buildCredentialPatch, credentialCategory, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+/** An edit draft never carries the saved secret: token and extra values start blank. */
+function draftFromRow({ row, providers }, _optional = {}) {
+    return { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers }), category: credentialCategory({ row }), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' };
+}
 export function createAccessTokensController({ api, permissions = [] }, _optional = {}) {
     const grants = new Set(permissions);
     const store = createControllerStore({ initial: { rows: [], providers: [], draft: null, loading: false, saving: false, error: null, errors: {}, query: '', category: 'all' } });
@@ -43,7 +47,7 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
         const k = row?.kind ?? kind ?? 'custom';
         if (!allowed(k) || store.getSnapshot().saving)
             return;
-        const draft = row ? { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers: store.getSnapshot().providers }), category: row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' } : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
+        const draft = row ? draftFromRow({ row, providers: store.getSnapshot().providers }) : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
         store.set({ patch: { draft, error: null } });
     }
     async function save(_required, _optional = {}) {
@@ -57,44 +61,41 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
         }
         const patch = buildCredentialPatch({ draft, providers: state.providers });
         const target = credentialStore({ api, kind: draft.kind });
-        store.set({ patch: { saving: true, error: null } });
-        try {
-            const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
-            // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
-            store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
-            // First-create default assignment can change siblings; the server owns that invariant.
-            await load({});
-            return !store.signal.aborted;
-        }
-        catch {
-            store.set({ patch: { error: 'Unable to save credential' } });
-            return false;
-        }
-        finally {
-            store.set({ patch: { saving: false } });
-        }
+        return mutate({ failure: 'Unable to save credential', run: async () => {
+                const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
+                // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
+                store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
+            } });
     }
     async function write({ row, remove }) {
         if (!allowed(row.kind) || store.getSnapshot().saving)
             return false;
+        return mutate({ failure: 'Unable to update credential', run: async () => {
+                const target = credentialStore({ api, kind: row.kind });
+                if (remove)
+                    await target.remove({ id: row.id }, { signal: store.signal });
+                else
+                    await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            } });
+    }
+    /** Shared write lifecycle: one write at a time, a fixed failure message, and a refetch after success. */
+    async function mutate({ run, failure }, _optional = {}) {
         store.set({ patch: { saving: true, error: null } });
+        let ok = false;
         try {
-            const target = credentialStore({ api, kind: row.kind });
-            if (remove)
-                await target.remove({ id: row.id }, { signal: store.signal });
-            else
-                await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            await run();
+            // First-create default assignment can change siblings; the server owns that invariant.
             // Remove/default can promote another row. Refetch rather than duplicating server promotion rules.
             await load({});
-            return !store.signal.aborted;
+            ok = !store.signal.aborted;
         }
         catch {
-            store.set({ patch: { error: 'Unable to update credential' } });
-            return false;
+            store.set({ patch: { error: failure } });
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return ok;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, load, begin, save,

package/dist/security/controllers/other-credentials.controller.js

@@ -40,6 +40,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
             if (store.signal.aborted)
                 return false;
             store.set({ patch: { saving: true } });
+            // One exit after `finally`: a catch that returned left a fall-through path nothing could take.
+            let saved = false;
             try {
                 if (remove)
                     await api.remove({ store: row.store, id: row.id }, { signal: store.signal });
@@ -49,15 +51,15 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
                 delete drafts[`${row.store}:${row.id}`];
                 store.set({ patch: { drafts } });
                 await read(row.store, generation);
-                return !store.signal.aborted;
+                saved = !store.signal.aborted;
             }
             catch {
                 store.set({ patch: { errors: { ...store.getSnapshot().errors, [row.store]: 'Unable to update credential' } } });
-                return false;
             }
             finally {
                 store.set({ patch: { saving: false } });
             }
+            return saved;
         });
         lane = run.then(() => undefined);
         return run;