@jini-ai/admin 0.4.11 → 0.4.13

package/dist/security/controllers/root-key.controller.js

@@ -1,10 +1,16 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+/** Receivers named in a result need their new signing secret; the message tells the operator which ones. */
+function resultMessage({ result, response }, _optional = {}) {
+    const hooks = response.affectedWebhooks;
+    return hooks?.length ? `${result} Update receivers: ${hooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result;
+}
 export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
     const granted = permissions.includes(ROOT_KEY_PERMISSION);
     const store = createControllerStore({ initial: { status: null, preview: null, token: '', confirm: '', loading: false, saving: false, error: null, result: null, confirming: false } });
     let generation = 0;
     const allowed = () => granted && !store.signal.aborted;
+    const canPreview = () => { const state = store.getSnapshot(); return allowed() && isRootKeyLocked({ status: state.status }) && !state.saving && !state.loading; };
     async function load(_required, _optional = {}) {
         if (!allowed())
             return;
@@ -28,19 +34,20 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         if (!allowed() || store.getSnapshot().saving)
             return false;
         store.set({ patch: { saving: true, error: null } });
+        let ok = false;
         try {
             const response = await run();
-            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: response.affectedWebhooks?.length ? `${result} Update receivers: ${response.affectedWebhooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result } });
+            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: resultMessage({ result, response }) } });
             await load({});
-            return !store.signal.aborted;
+            ok = !store.signal.aborted;
         }
         catch {
             store.set({ patch: { error: 'Recovery refused. Check the host key configuration.' } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return ok;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
@@ -57,26 +64,27 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         },
         importToken(_required, _optional = {}) { const token = store.getSnapshot().token.trim(); return token && isRootKeyLocked({ status: store.getSnapshot().status }) ? execute(() => api.importToken({ token }, { signal: store.signal }), 'Unlocked. Saved credentials work again.') : Promise.resolve(false); },
         async preview(_required, _optional = {}) {
-            if (!allowed() || !isRootKeyLocked({ status: store.getSnapshot().status }) || store.getSnapshot().saving || store.getSnapshot().loading)
+            if (!canPreview())
                 return false;
             const ticket = ++generation;
             store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
+            let ok = false;
             try {
                 const preview = await api.previewStartFresh({}, { signal: store.signal });
-                if (ticket !== generation || !allowed())
-                    return false;
-                store.set({ patch: { preview, confirming: true } });
-                return true;
+                if (ticket === generation && allowed()) {
+                    store.set({ patch: { preview, confirming: true } });
+                    ok = true;
+                }
             }
             catch {
                 if (ticket === generation)
                     store.set({ patch: { error: 'Recovery preview unavailable' } });
-                return false;
             }
             finally {
                 if (ticket === generation)
                     store.set({ patch: { loading: false } });
             }
+            return ok;
         },
         startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
             return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },

package/dist/security/react/hooks/AccessTokensTab.hooks.d.ts

@@ -1,44 +1,11 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 import type { CredentialSummary, OtherCredentialSummary, CredentialCategory } from '../../models.js';
+type Removal = {
+    row: CredentialSummary | OtherCredentialSummary;
+    type: 'access' | 'other';
+};
 export declare function useAccessTokensTab({ permissions }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    rows: {
-        row: CredentialSummary;
-        label: string;
-        canWrite: boolean;
-        edit(): void;
-        remove(): void;
-        makeDefault(): void;
-    }[];
-    otherRows: {
-        row: OtherCredentialSummary;
-        canWrite: boolean;
-        token: string;
-        onToken({ value }: {
-            value: string;
-        }): void;
-        replace(): void;
-        remove(): void;
-    }[];
-    providers: {
-        provider: import("../../models.js").CredentialProvider;
-        canWrite: boolean;
-        add(): void;
-    }[];
-    categories: readonly {
-        value: CredentialCategory | "all";
-        label: string;
-    }[];
-    query: string;
-    category: "all" | CredentialCategory;
-    total: number;
-    matched: number;
-    removal: {
-        row: CredentialSummary | OtherCredentialSummary;
-        type: "access" | "other";
-    } | null;
+    removal: Removal | null;
     draft: import("../../models.js").CredentialDraft | null;
     errors: string[];
     canAddCustom: boolean;
@@ -90,5 +57,40 @@ export declare function useAccessTokensTab({ permissions }: TabViewProps, _optio
         }, _optional?: {}): Promise<boolean>;
         dispose(_required?: Record<string, never>, _optional?: {}): void;
     } | null;
+    total: number;
+    matched: number;
+    rows: {
+        row: CredentialSummary;
+        label: string;
+        canWrite: boolean;
+        edit(): void;
+        remove(): void;
+        makeDefault(): void;
+    }[];
+    otherRows: {
+        row: OtherCredentialSummary;
+        canWrite: boolean;
+        token: string;
+        onToken({ value }: {
+            value: string;
+        }): void;
+        replace(): void;
+        remove(): void;
+    }[];
+    providers: {
+        provider: import("../../models.js").CredentialProvider;
+        canWrite: boolean;
+        add(): void;
+    }[];
+    categories: readonly {
+        value: CredentialCategory | "all";
+        label: string;
+    }[];
+    query: string;
+    category: "all" | CredentialCategory;
+    loading: boolean;
+    saving: boolean;
+    denied: boolean;
 };
+export {};
 //# sourceMappingURL=AccessTokensTab.hooks.d.ts.map

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -4,6 +4,35 @@ import { createAccessTokensController } from '../../controllers/access-tokens.co
 import { createOtherCredentialsController } from '../../controllers/other-credentials.controller.js';
 import { CATEGORIES, credentialLabel, filterCredentials, filterOtherCredentials, otherWritePermission, writePermission } from '../../rules.js';
 import { noOtherCredentials, useSecurityPorts } from './SecurityPorts.hooks.js';
+function currentFilter({ snapshot: s }, _optional = {}) { return { query: s?.query ?? '', category: s?.category ?? 'all' }; }
+function accessRows({ snapshot: s, controller, scope }, _optional = {}) {
+    if (!s)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void controller?.makeDefault({ row }); } }));
+}
+function otherRowsView({ snapshot: o, controller, scope }, _optional = {}) {
+    if (!o)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } }));
+}
+function providerOptions({ snapshot: s, controller, scope }, _optional = {}) {
+    const { permissions, query, category } = scope;
+    return (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
+}
+function tokenCounts({ access: s, other: o, query }, _optional = {}) {
+    // Count remains global across categories; the search count answers how many saved tokens this host holds.
+    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
+    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
+    return { total, matched };
+}
+function tabStatus({ access: s, other: o }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false) };
+}
+function errorList({ access: s, other: o }, _optional = {}) {
+    return [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})];
+}
 export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const ports = useSecurityPorts({});
     const key = permissions.join('\0');
@@ -12,15 +41,13 @@ export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const other = useController({ create: () => createOtherCredentialsController({ api: ports.otherCredentials ?? noOtherCredentials, permissions }), dependencies: [ports.otherCredentials, key] }, { start: ({ controller }) => { void controller.load({}); } });
     const [removal, setRemoval] = useState(null);
     const s = access.snapshot, o = other.snapshot;
-    const query = s?.query ?? '', category = s?.category ?? 'all';
-    const rows = s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { access.controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void access.controller?.makeDefault({ row }); } })) : [];
-    const otherRows = o ? filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { other.controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void other.controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } })) : [];
-    const providers = (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { access.controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
-    // Count remains global across categories; the search count answers how many saved tokens this host holds.
-    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
-    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
-    return { denied: !canRead, loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false), rows, otherRows, providers, categories: CATEGORIES, query, category, total, matched, removal,
-        draft: s?.draft ?? null, errors: [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})],
+    const { query, category } = currentFilter({ snapshot: s });
+    const scope = { permissions, query, category, setRemoval };
+    const rows = accessRows({ snapshot: s, controller: access.controller, scope });
+    const otherRows = otherRowsView({ snapshot: o, controller: other.controller, scope });
+    const providers = providerOptions({ snapshot: s, controller: access.controller, scope });
+    return { denied: !canRead, ...tabStatus({ access: s, other: o }), rows, otherRows, providers, categories: CATEGORIES, query, category, ...tokenCounts({ access: s, other: o, query }), removal,
+        draft: s?.draft ?? null, errors: errorList({ access: s, other: o }),
         canAddCustom: permissions.includes('custom-credentials.write'),
         addCustom() { access.controller?.begin({ kind: 'custom' }); },
         onQuery({ value }) { access.controller?.filter({ query: value }); },

package/dist/security/react/hooks/RootKeyTab.hooks.d.ts

@@ -1,19 +1,5 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function useRootKeyTab({ permissions, params }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    status: import("../../models.js").RootKeyStatus | null | undefined;
-    error: string | null | undefined;
-    result: string | null | undefined;
-    scopeNotice: string;
-    token: string;
-    confirm: string;
-    confirming: boolean;
-    preview: import("../../models.js").RootKeyPreview | null | undefined;
-    locked: boolean;
-    canGenerate: boolean;
-    canConfirm: boolean;
     onToken({ value }: {
         value: string;
     }): void;
@@ -25,5 +11,19 @@ export declare function useRootKeyTab({ permissions, params }: TabViewProps, _op
     previewFresh(): void;
     cancelFresh(): void;
     confirmFresh(): Promise<void>;
+    locked: boolean;
+    canGenerate: boolean;
+    canConfirm: boolean;
+    token: string;
+    confirm: string;
+    confirming: boolean;
+    preview: import("../../models.js").RootKeyPreview | null | undefined;
+    scopeNotice: string;
+    loading: boolean;
+    saving: boolean;
+    status: import("../../models.js").RootKeyStatus | null | undefined;
+    error: string | null | undefined;
+    result: string | null | undefined;
+    denied: boolean;
 };
 //# sourceMappingURL=RootKeyTab.hooks.d.ts.map

package/dist/security/react/hooks/RootKeyTab.hooks.js

@@ -2,14 +2,23 @@ import { useController } from '../../../core/react/use-controller.js';
 import { createRootKeyController } from '../../controllers/root-key.controller.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../../rules.js';
 import { unavailableRootKey, useSecurityPorts } from './SecurityPorts.hooks.js';
+/** Before the controller exists the tab reads as loading with nothing known yet. */
+function rootKeyProgress({ snapshot: s }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result };
+}
+function rootKeyInputs({ snapshot: s }, _optional = {}) {
+    return { token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview };
+}
+function rootKeyFlags({ snapshot: s }, _optional = {}) {
+    return { locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION };
+}
 export function useRootKeyTab({ permissions = [], params }, _optional = {}) {
     const { rootKey } = useSecurityPorts({});
     const key = permissions.join('\0');
     const { controller, snapshot: s } = useController({ create: () => createRootKeyController({ api: rootKey ?? unavailableRootKey, permissions }), dependencies: [rootKey, key] }, { start: ({ controller }) => { void controller.load({}); } });
-    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result,
+    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), ...rootKeyProgress({ snapshot: s }),
         scopeNotice: typeof params.scopeNotice === 'string' ? params.scopeNotice : 'This key protects saved credentials. Keep its backup separate from the database.',
-        token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview,
-        locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION,
+        ...rootKeyInputs({ snapshot: s }), ...rootKeyFlags({ snapshot: s }),
         onToken({ value }) { controller?.setToken({ value }); }, onConfirmText({ value }) { controller?.setConfirm({ value }); },
         generate() { void controller?.generate({}); }, unlock() { void controller?.importToken({}); }, previewFresh() { void controller?.preview({}); },
         cancelFresh() { controller?.cancel({}); }, async confirmFresh() { if (!await controller?.startFresh({}))

package/dist/security/react/tabs/RootKeyTab.d.ts

@@ -1,4 +1,4 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
-export declare function RootKeyTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
+export declare function RootKeyTab(props: TabViewProps): import("react").JSX.Element;
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.d.ts.map

package/dist/security/react/tabs/RootKeyTab.js

@@ -1,9 +1,18 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, TextField, Notice, ConfirmDialog, Spinner } from '@jini-ai/ui-kit/react';
 import { useRootKeyTab } from '../hooks/RootKeyTab.hooks.js';
-export function RootKeyTab(props, _optional = {}) {
+function RootKeyMessages({ vm }) {
+    return _jsxs(_Fragment, { children: [vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result })] });
+}
+function LockedActions({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] });
+}
+function StartFreshBody({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] });
+}
+export function RootKeyTab(props) {
     const vm = useRootKeyTab(props);
-    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
+    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), _jsx(RootKeyMessages, { vm: vm }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsx(LockedActions, { vm: vm }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsx(StartFreshBody, { vm: vm }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
 }
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.js.map

package/dist/security/rules.js

@@ -9,8 +9,9 @@ export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', '
 export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
 export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
 export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
+function defaultCategory({ kind }, _optional = {}) { return kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general'; }
 export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
-    return { kind, providerId, label: '', token: '', values: {}, category: kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general', baseUrl: '', additionalHosts: '', username: '' };
+    return { kind, providerId, label: '', token: '', values: {}, category: defaultCategory({ kind }), baseUrl: '', additionalHosts: '', username: '' };
 }
 /** Legacy sentinel labels are display-only: opening this page must never mutate saved data. */
 export function credentialLabel({ row, providers }, _optional = {}) {
@@ -18,46 +19,65 @@ export function credentialLabel({ row, providers }, _optional = {}) {
         return row.label;
     return `${providers.find(p => p.kind === row.kind && p.id === row.providerId)?.label ?? row.providerId} token`;
 }
-export function credentialCategory({ row }, _optional = {}) { return row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'); }
+export function credentialCategory({ row }, _optional = {}) { return row.category ?? defaultCategory({ kind: row.kind }); }
 export function filterCredentials({ rows, query, category, providers }, _optional = {}) {
     const q = query.trim().toLowerCase();
     return rows.filter(row => (category === 'all' || credentialCategory({ row }) === category) && [credentialLabel({ row, providers }), row.providerId, row.baseUrl ?? '', row.accountLabel ?? ''].join(' ').toLowerCase().includes(q));
 }
 export function filterOtherCredentials({ rows, query, category }, _optional = {}) { return rows.filter(row => (category === 'all' || row.category === category) && `${row.label} ${row.store}`.toLowerCase().includes(query.trim().toLowerCase())); }
+function findProvider({ draft, providers }, _optional = {}) { return providers.find(p => p.kind === draft.kind && p.id === draft.providerId); }
+function isDuplicateLabel({ draft, rows }, _optional = {}) {
+    const label = draft.label.trim().toLowerCase();
+    return rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === label);
+}
+function customDraftError({ draft }, _optional = {}) {
+    try {
+        if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
+            return 'Enter an HTTP or HTTPS URL';
+    }
+    catch {
+        return 'Enter an HTTP or HTTPS URL';
+    }
+    return null;
+}
+function providerDraftError({ draft, providers }, _optional = {}) {
+    if (draft.id && !draft.token.trim())
+        return null;
+    const provider = findProvider({ draft, providers });
+    if (!provider)
+        return 'Provider is unavailable';
+    if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
+        return 'Complete all required fields';
+    return null;
+}
 /** A custom row is its own provider identity; its username can change without retyping its token. */
 export function validateCredentialDraft({ draft, rows, providers }, _optional = {}) {
     if (!draft.label.trim())
         return 'Enter a name';
-    if (rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === draft.label.trim().toLowerCase()))
+    if (isDuplicateLabel({ draft, rows }))
         return 'That name is already in use';
     if (!draft.id && !draft.token.trim())
         return 'Enter an access token';
-    if (draft.kind === 'custom') {
-        try {
-            if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
-                return 'Enter an HTTP or HTTPS URL';
-        }
-        catch {
-            return 'Enter an HTTP or HTTPS URL';
-        }
-    }
-    else if (!draft.id || draft.token.trim()) {
-        const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
-        if (!provider)
-            return 'Provider is unavailable';
-        if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
-            return 'Complete all required fields';
-    }
-    return null;
+    return draft.kind === 'custom' ? customDraftError({ draft }) : providerDraftError({ draft, providers });
+}
+function customConnection({ draft, token }, _optional = {}) {
+    const username = draft.username.trim();
+    return { token, ...(username ? { username } : {}) };
+}
+function providerConnection({ draft, token, providers }, _optional = {}) {
+    const provider = findProvider({ draft, providers });
+    const extras = provider ? provider.fields.filter(f => f.name !== provider.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()]) : [];
+    return { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries(extras) };
+}
+function customPatchFields({ draft }, _optional = {}) {
+    return { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null };
 }
 /** Omitting connection preserves the saved secret. Never send an empty or half-blank replacement. */
 export function buildCredentialPatch({ draft, providers }, _optional = {}) {
-    const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
     const token = draft.token.trim();
-    const connection = token ? draft.kind === 'custom'
-        ? { token, ...(draft.username.trim() ? { username: draft.username.trim() } : {}) }
-        : { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries((provider?.fields ?? []).filter(f => f.name !== provider?.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()])) } : undefined;
-    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(draft.kind === 'custom' ? { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null } : {}) };
+    const custom = draft.kind === 'custom';
+    const connection = token ? (custom ? customConnection({ draft, token }) : providerConnection({ draft, token, providers })) : undefined;
+    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(custom ? customPatchFields({ draft }) : {}) };
 }
 export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }
 //# sourceMappingURL=rules.js.map

package/dist/seo/adapters/http.js

@@ -20,6 +20,11 @@ export function createHttpSeoApi({ transport, basePath }, { sitemapTransport, im
         analyzeSeoEntry: ({ entryId }) => data(`${entryPath(entryId)}/analyze`, 'GET'),
         listSeoPosts: () => choices('posts'),
         listSeoPages: () => choices('pages'),
+        // The admin media list route the picker already reads; projected so no media row type leaks in.
+        async listSeoMedia() {
+            const response = await transport.request({ path: `${base}/media`, method: 'GET' });
+            return response.media.map(({ id, slug, title, width, height, contentType }) => ({ id, title, ...(slug ? { slug } : {}), width: width ?? null, height: height ?? null, contentType: contentType ?? null }));
+        },
         mediaOriginalUrl: ({ id }) => transport.url({ path: `${base}/media/${encodeURIComponent(id)}/original` }),
         mediaPreviewUrl: ({ value }) => resolveMediaRefPreviewUrl({ value, mediaOriginalUrl: id => transport.url({ path: `${base}/media/${encodeURIComponent(id)}/original` }) }, { siteOrigin }),
         ...(imageTransport ? { async inspectShareImage({ url }, options = {}) {

package/dist/seo/controllers/seo.controller.js

@@ -27,18 +27,20 @@ export function createSeoController({ api }, { t = (key) => key } = {}) {
     }
     async function regenerateSitemap(_required = {}, _optional = {}) {
         store.set({ patch: { saving: true, error: null, notice: null } });
+        // One exit after `finally`: returning from both try and catch left a fall-through nothing took.
+        let accepted = false;
         try {
             await api.regenerateSeoSitemap({});
             store.set({ patch: { notice: t('Sitemap regeneration accepted.') } });
-            return true;
+            accepted = true;
         }
         catch (error) {
             store.set({ patch: { error: describeSeoError({ error, fallback: t('failed to regenerate sitemap') }) } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return accepted;
     }
     return {
         ...store, load, save, regenerateSitemap,

package/dist/seo/messages.en.d.ts

@@ -20,21 +20,24 @@ export declare const seoMessagesEn: {
     readonly "Canonical URL": "Canonical URL";
     readonly Noindex: "Noindex";
     readonly Nofollow: "Nofollow";
-    readonly "OG title": "OG title";
-    readonly "OG description": "OG description";
-    readonly "OG image": "OG image";
-    readonly "Twitter title": "Twitter title";
-    readonly "Twitter description": "Twitter description";
-    readonly "Twitter image": "Twitter image";
+    readonly "Preview title": "Preview title";
+    readonly "Preview description": "Preview description";
+    readonly "Preview image": "Preview image";
+    readonly "X/Twitter title": "X/Twitter title";
+    readonly "X/Twitter description": "X/Twitter description";
+    readonly "X/Twitter image": "X/Twitter image";
+    readonly "Customize for X/Twitter (optional)": "Customize for X/Twitter (optional)";
+    readonly "Same as the preview image": "Same as the preview image";
+    readonly "Used by Facebook, LinkedIn, Slack, Discord, iMessage, WhatsApp and X/Twitter": "Used by Facebook, LinkedIn, Slack, Discord, iMessage, WhatsApp and X/Twitter";
     readonly "Saving\u2026": "Saving…";
     readonly "Save overrides": "Save overrides";
     readonly "Per-entry SEO": "Per-entry SEO";
     readonly "Search appearance": "Search appearance";
     readonly "Title template (must contain %s)": "Title template (must contain %s)";
     readonly "Default meta description": "Default meta description";
-    readonly "Social sharing": "Social sharing";
-    readonly "Default Open Graph / Twitter image": "Default Open Graph / Twitter image";
-    readonly "Twitter @site handle": "Twitter @site handle";
+    readonly "Social preview": "Social preview";
+    readonly "Default preview image": "Default preview image";
+    readonly "X/Twitter @handle": "X/Twitter @handle";
     readonly Crawling: "Crawling";
     readonly "Default noindex": "Default noindex";
     readonly "Default nofollow": "Default nofollow";
@@ -47,7 +50,7 @@ export declare const seoMessagesEn: {
     readonly "View sitemap": "View sitemap";
     readonly "Loading SEO settings\u2026": "Loading SEO settings…";
     readonly Marketing: "Marketing";
-    readonly "Site-wide defaults for meta titles, descriptions, Open Graph/Twitter cards, and robots directives.": "Site-wide defaults for meta titles, descriptions, Open Graph/Twitter cards, and robots directives.";
+    readonly "Site-wide defaults for meta titles, descriptions, social previews, and robots directives.": "Site-wide defaults for meta titles, descriptions, social previews, and robots directives.";
     readonly "Choose image": "Choose image";
     readonly Remove: "Remove";
     readonly "Sitemap \u00B7 {count} URLs": "Sitemap · {count} URLs";
@@ -75,5 +78,7 @@ export declare const seoMessagesEn: {
     readonly "failed to load the sitemap": "failed to load the sitemap";
     readonly "Could not load the sitemap (HTTP {status}).": "Could not load the sitemap (HTTP {status}).";
     readonly "Selected image": "Selected image";
+    readonly "Using site default: {name}": "Using site default: {name}";
+    readonly "Using image from page content: {name}": "Using image from page content: {name}";
 };
 //# sourceMappingURL=messages.en.d.ts.map

package/dist/seo/messages.en.js

@@ -20,21 +20,24 @@ export const seoMessagesEn = {
     "Canonical URL": "Canonical URL",
     "Noindex": "Noindex",
     "Nofollow": "Nofollow",
-    "OG title": "OG title",
-    "OG description": "OG description",
-    "OG image": "OG image",
-    "Twitter title": "Twitter title",
-    "Twitter description": "Twitter description",
-    "Twitter image": "Twitter image",
+    "Preview title": "Preview title",
+    "Preview description": "Preview description",
+    "Preview image": "Preview image",
+    "X/Twitter title": "X/Twitter title",
+    "X/Twitter description": "X/Twitter description",
+    "X/Twitter image": "X/Twitter image",
+    "Customize for X/Twitter (optional)": "Customize for X/Twitter (optional)",
+    "Same as the preview image": "Same as the preview image",
+    "Used by Facebook, LinkedIn, Slack, Discord, iMessage, WhatsApp and X/Twitter": "Used by Facebook, LinkedIn, Slack, Discord, iMessage, WhatsApp and X/Twitter",
     "Saving…": "Saving…",
     "Save overrides": "Save overrides",
     "Per-entry SEO": "Per-entry SEO",
     "Search appearance": "Search appearance",
     "Title template (must contain %s)": "Title template (must contain %s)",
     "Default meta description": "Default meta description",
-    "Social sharing": "Social sharing",
-    "Default Open Graph / Twitter image": "Default Open Graph / Twitter image",
-    "Twitter @site handle": "Twitter @site handle",
+    "Social preview": "Social preview",
+    "Default preview image": "Default preview image",
+    "X/Twitter @handle": "X/Twitter @handle",
     "Crawling": "Crawling",
     "Default noindex": "Default noindex",
     "Default nofollow": "Default nofollow",
@@ -47,7 +50,7 @@ export const seoMessagesEn = {
     "View sitemap": "View sitemap",
     "Loading SEO settings…": "Loading SEO settings…",
     "Marketing": "Marketing",
-    "Site-wide defaults for meta titles, descriptions, Open Graph/Twitter cards, and robots directives.": "Site-wide defaults for meta titles, descriptions, Open Graph/Twitter cards, and robots directives.",
+    "Site-wide defaults for meta titles, descriptions, social previews, and robots directives.": "Site-wide defaults for meta titles, descriptions, social previews, and robots directives.",
     "Choose image": "Choose image",
     "Remove": "Remove",
     "Sitemap · {count} URLs": "Sitemap · {count} URLs",
@@ -75,5 +78,7 @@ export const seoMessagesEn = {
     "failed to load the sitemap": "failed to load the sitemap",
     "Could not load the sitemap (HTTP {status}).": "Could not load the sitemap (HTTP {status}).",
     "Selected image": "Selected image",
+    "Using site default: {name}": "Using site default: {name}",
+    "Using image from page content: {name}": "Using image from page content: {name}",
 };
 //# sourceMappingURL=messages.en.js.map

package/dist/seo/models.d.ts

@@ -75,6 +75,8 @@ export interface SeoController {
 }
 export interface EntryPickerController {
     entries: readonly AdminPost[] | null;
+    /** Searchable-picker rows (grouped Pages/Posts); null while entries load. */
+    options?: import('./rules.js').SeoEntryPickerOption[] | null;
     error: string | null;
 }
 export interface SeoEntryPanelOptions {
@@ -98,6 +100,9 @@ export interface SeoEntryPanelController {
      *  `null` for each one they emptied. An untouched field is ABSENT, never `null`: "unchanged" must
      *  never become "clear". */
     touched: SeoEntryOverridesPatch;
+    /** The social preview image comes from content or the site default (`ogImageInherited`, rules.ts). Optional
+     *  for injected legacy views. */
+    ogImageInherited?: false | 'default' | 'content';
 }
 export interface SeoEntrySectionController {
     entryId: string;
@@ -153,6 +158,12 @@ export interface MediaRefFieldController {
     /** The field's current value resolved to a thumbnail `<img src>`, or `null` when the value is
      *  empty or unparseable — see `resolveMediaRefPreviewUrl`'s own doc. */
     previewUrl: string | null;
+    /** The chosen file's display name and pixel size (`describeMediaRef`), or null when empty.
+     *  Optional for injected legacy views. */
+    file?: {
+        name: string;
+        size: string | null;
+    } | null;
     /** Shared diagnostics for defaults, OG and Twitter fields; optional for injected legacy views. */
     warning?: string | null;
     onPreviewLoad?: (event: {