@jini-ai/admin 0.4.12 → 0.6.10

package/dist/security/adapters/memory.js

@@ -1,13 +1,27 @@
 import { START_FRESH_CONFIRMATION } from '../rules.js';
+function customUsernameField({ patch }, { initial } = {}) {
+    const username = patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username;
+    return username ? { username } : {};
+}
+function customHosts({ patch }, { initial } = {}) { return Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]); }
+function customProjection({ patch }, { initial } = {}) {
+    return { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: customHosts({ patch }, { initial }), ...customUsernameField({ patch }, { initial }) };
+}
 /** Fake backend: retains only read models, never credential material. */
 export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
     let items = rows.map(r => Object.freeze({ ...r }));
     let sequence = 0;
     function store(kind) {
-        function project(id, patch, providerId, initial) {
+        function isDefaultFor({ patch, providerId }, { initial } = {}) {
+            if (kind === 'custom')
+                return false;
+            return patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId);
+        }
+        /** The caller resolves the label: create requires one, update falls back to the saved label. */
+        function project({ id, patch, providerId, label }, { initial } = {}) {
             const now = new Date().toISOString();
-            return Object.freeze({ kind, id, providerId, label: patch.label ?? initial?.label ?? '', configured: true, isDefault: kind === 'custom' ? false : patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId), createdAt: initial?.createdAt ?? now, updatedAt: now,
-                ...(kind === 'custom' ? { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]), ...((patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) ? { username: (patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) } : {}) } : {}),
+            return Object.freeze({ kind, id, providerId, label, configured: true, isDefault: isDefaultFor({ patch, providerId }, { initial }), createdAt: initial?.createdAt ?? now, updatedAt: now,
+                ...(kind === 'custom' ? customProjection({ patch }, { initial }) : {}),
             });
         }
         function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
@@ -21,9 +35,9 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
         return {
             async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
             async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
-                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project(`credential-${++sequence}`, input, providerId)); },
+                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project({ id: `credential-${++sequence}`, patch: input, providerId, label: input.label })); },
             async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
-                throw new Error('Credential not found'); check(patch.label ?? old.label, old.providerId, id); return insert(project(id, patch, old.providerId, old)); },
+                throw new Error('Credential not found'); const label = patch.label ?? old.label; check(label, old.providerId, id); return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old })); },
             async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
                 const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
                 if (next)

package/dist/security/controllers/access-tokens.controller.js

@@ -1,5 +1,9 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
-import { blankCredentialDraft, buildCredentialPatch, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+import { blankCredentialDraft, buildCredentialPatch, credentialCategory, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+/** An edit draft never carries the saved secret: token and extra values start blank. */
+function draftFromRow({ row, providers }, _optional = {}) {
+    return { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers }), category: credentialCategory({ row }), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' };
+}
 export function createAccessTokensController({ api, permissions = [] }, _optional = {}) {
     const grants = new Set(permissions);
     const store = createControllerStore({ initial: { rows: [], providers: [], draft: null, loading: false, saving: false, error: null, errors: {}, query: '', category: 'all' } });
@@ -43,7 +47,7 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
         const k = row?.kind ?? kind ?? 'custom';
         if (!allowed(k) || store.getSnapshot().saving)
             return;
-        const draft = row ? { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers: store.getSnapshot().providers }), category: row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' } : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
+        const draft = row ? draftFromRow({ row, providers: store.getSnapshot().providers }) : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
         store.set({ patch: { draft, error: null } });
     }
     async function save(_required, _optional = {}) {
@@ -57,44 +61,41 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
         }
         const patch = buildCredentialPatch({ draft, providers: state.providers });
         const target = credentialStore({ api, kind: draft.kind });
-        store.set({ patch: { saving: true, error: null } });
-        try {
-            const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
-            // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
-            store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
-            // First-create default assignment can change siblings; the server owns that invariant.
-            await load({});
-            return !store.signal.aborted;
-        }
-        catch {
-            store.set({ patch: { error: 'Unable to save credential' } });
-            return false;
-        }
-        finally {
-            store.set({ patch: { saving: false } });
-        }
+        return mutate({ failure: 'Unable to save credential', run: async () => {
+                const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
+                // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
+                store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
+            } });
     }
     async function write({ row, remove }) {
         if (!allowed(row.kind) || store.getSnapshot().saving)
             return false;
+        return mutate({ failure: 'Unable to update credential', run: async () => {
+                const target = credentialStore({ api, kind: row.kind });
+                if (remove)
+                    await target.remove({ id: row.id }, { signal: store.signal });
+                else
+                    await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            } });
+    }
+    /** Shared write lifecycle: one write at a time, a fixed failure message, and a refetch after success. */
+    async function mutate({ run, failure }, _optional = {}) {
         store.set({ patch: { saving: true, error: null } });
+        let ok = false;
         try {
-            const target = credentialStore({ api, kind: row.kind });
-            if (remove)
-                await target.remove({ id: row.id }, { signal: store.signal });
-            else
-                await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            await run();
+            // First-create default assignment can change siblings; the server owns that invariant.
             // Remove/default can promote another row. Refetch rather than duplicating server promotion rules.
             await load({});
-            return !store.signal.aborted;
+            ok = !store.signal.aborted;
         }
         catch {
-            store.set({ patch: { error: 'Unable to update credential' } });
-            return false;
+            store.set({ patch: { error: failure } });
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return ok;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, load, begin, save,

package/dist/security/controllers/other-credentials.controller.js

@@ -40,6 +40,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
             if (store.signal.aborted)
                 return false;
             store.set({ patch: { saving: true } });
+            // One exit after `finally`: a catch that returned left a fall-through path nothing could take.
+            let saved = false;
             try {
                 if (remove)
                     await api.remove({ store: row.store, id: row.id }, { signal: store.signal });
@@ -49,15 +51,15 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
                 delete drafts[`${row.store}:${row.id}`];
                 store.set({ patch: { drafts } });
                 await read(row.store, generation);
-                return !store.signal.aborted;
+                saved = !store.signal.aborted;
             }
             catch {
                 store.set({ patch: { errors: { ...store.getSnapshot().errors, [row.store]: 'Unable to update credential' } } });
-                return false;
             }
             finally {
                 store.set({ patch: { saving: false } });
             }
+            return saved;
         });
         lane = run.then(() => undefined);
         return run;

package/dist/security/controllers/root-key.controller.js

@@ -1,10 +1,16 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+/** Receivers named in a result need their new signing secret; the message tells the operator which ones. */
+function resultMessage({ result, response }, _optional = {}) {
+    const hooks = response.affectedWebhooks;
+    return hooks?.length ? `${result} Update receivers: ${hooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result;
+}
 export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
     const granted = permissions.includes(ROOT_KEY_PERMISSION);
     const store = createControllerStore({ initial: { status: null, preview: null, token: '', confirm: '', loading: false, saving: false, error: null, result: null, confirming: false } });
     let generation = 0;
     const allowed = () => granted && !store.signal.aborted;
+    const canPreview = () => { const state = store.getSnapshot(); return allowed() && isRootKeyLocked({ status: state.status }) && !state.saving && !state.loading; };
     async function load(_required, _optional = {}) {
         if (!allowed())
             return;
@@ -28,19 +34,20 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         if (!allowed() || store.getSnapshot().saving)
             return false;
         store.set({ patch: { saving: true, error: null } });
+        let ok = false;
         try {
             const response = await run();
-            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: response.affectedWebhooks?.length ? `${result} Update receivers: ${response.affectedWebhooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result } });
+            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: resultMessage({ result, response }) } });
             await load({});
-            return !store.signal.aborted;
+            ok = !store.signal.aborted;
         }
         catch {
             store.set({ patch: { error: 'Recovery refused. Check the host key configuration.' } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return ok;
     }
     return {
         getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
@@ -57,26 +64,27 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         },
         importToken(_required, _optional = {}) { const token = store.getSnapshot().token.trim(); return token && isRootKeyLocked({ status: store.getSnapshot().status }) ? execute(() => api.importToken({ token }, { signal: store.signal }), 'Unlocked. Saved credentials work again.') : Promise.resolve(false); },
         async preview(_required, _optional = {}) {
-            if (!allowed() || !isRootKeyLocked({ status: store.getSnapshot().status }) || store.getSnapshot().saving || store.getSnapshot().loading)
+            if (!canPreview())
                 return false;
             const ticket = ++generation;
             store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
+            let ok = false;
             try {
                 const preview = await api.previewStartFresh({}, { signal: store.signal });
-                if (ticket !== generation || !allowed())
-                    return false;
-                store.set({ patch: { preview, confirming: true } });
-                return true;
+                if (ticket === generation && allowed()) {
+                    store.set({ patch: { preview, confirming: true } });
+                    ok = true;
+                }
             }
             catch {
                 if (ticket === generation)
                     store.set({ patch: { error: 'Recovery preview unavailable' } });
-                return false;
             }
             finally {
                 if (ticket === generation)
                     store.set({ patch: { loading: false } });
             }
+            return ok;
         },
         startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
             return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },

package/dist/security/react/hooks/AccessTokensTab.hooks.d.ts

@@ -1,44 +1,11 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 import type { CredentialSummary, OtherCredentialSummary, CredentialCategory } from '../../models.js';
+type Removal = {
+    row: CredentialSummary | OtherCredentialSummary;
+    type: 'access' | 'other';
+};
 export declare function useAccessTokensTab({ permissions }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    rows: {
-        row: CredentialSummary;
-        label: string;
-        canWrite: boolean;
-        edit(): void;
-        remove(): void;
-        makeDefault(): void;
-    }[];
-    otherRows: {
-        row: OtherCredentialSummary;
-        canWrite: boolean;
-        token: string;
-        onToken({ value }: {
-            value: string;
-        }): void;
-        replace(): void;
-        remove(): void;
-    }[];
-    providers: {
-        provider: import("../../models.js").CredentialProvider;
-        canWrite: boolean;
-        add(): void;
-    }[];
-    categories: readonly {
-        value: CredentialCategory | "all";
-        label: string;
-    }[];
-    query: string;
-    category: "all" | CredentialCategory;
-    total: number;
-    matched: number;
-    removal: {
-        row: CredentialSummary | OtherCredentialSummary;
-        type: "access" | "other";
-    } | null;
+    removal: Removal | null;
     draft: import("../../models.js").CredentialDraft | null;
     errors: string[];
     canAddCustom: boolean;
@@ -90,5 +57,40 @@ export declare function useAccessTokensTab({ permissions }: TabViewProps, _optio
         }, _optional?: {}): Promise<boolean>;
         dispose(_required?: Record<string, never>, _optional?: {}): void;
     } | null;
+    total: number;
+    matched: number;
+    rows: {
+        row: CredentialSummary;
+        label: string;
+        canWrite: boolean;
+        edit(): void;
+        remove(): void;
+        makeDefault(): void;
+    }[];
+    otherRows: {
+        row: OtherCredentialSummary;
+        canWrite: boolean;
+        token: string;
+        onToken({ value }: {
+            value: string;
+        }): void;
+        replace(): void;
+        remove(): void;
+    }[];
+    providers: {
+        provider: import("../../models.js").CredentialProvider;
+        canWrite: boolean;
+        add(): void;
+    }[];
+    categories: readonly {
+        value: CredentialCategory | "all";
+        label: string;
+    }[];
+    query: string;
+    category: "all" | CredentialCategory;
+    loading: boolean;
+    saving: boolean;
+    denied: boolean;
 };
+export {};
 //# sourceMappingURL=AccessTokensTab.hooks.d.ts.map

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -4,6 +4,35 @@ import { createAccessTokensController } from '../../controllers/access-tokens.co
 import { createOtherCredentialsController } from '../../controllers/other-credentials.controller.js';
 import { CATEGORIES, credentialLabel, filterCredentials, filterOtherCredentials, otherWritePermission, writePermission } from '../../rules.js';
 import { noOtherCredentials, useSecurityPorts } from './SecurityPorts.hooks.js';
+function currentFilter({ snapshot: s }, _optional = {}) { return { query: s?.query ?? '', category: s?.category ?? 'all' }; }
+function accessRows({ snapshot: s, controller, scope }, _optional = {}) {
+    if (!s)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void controller?.makeDefault({ row }); } }));
+}
+function otherRowsView({ snapshot: o, controller, scope }, _optional = {}) {
+    if (!o)
+        return [];
+    const { permissions, query, category, setRemoval } = scope;
+    return filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } }));
+}
+function providerOptions({ snapshot: s, controller, scope }, _optional = {}) {
+    const { permissions, query, category } = scope;
+    return (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
+}
+function tokenCounts({ access: s, other: o, query }, _optional = {}) {
+    // Count remains global across categories; the search count answers how many saved tokens this host holds.
+    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
+    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
+    return { total, matched };
+}
+function tabStatus({ access: s, other: o }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false) };
+}
+function errorList({ access: s, other: o }, _optional = {}) {
+    return [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})];
+}
 export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const ports = useSecurityPorts({});
     const key = permissions.join('\0');
@@ -12,15 +41,13 @@ export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
     const other = useController({ create: () => createOtherCredentialsController({ api: ports.otherCredentials ?? noOtherCredentials, permissions }), dependencies: [ports.otherCredentials, key] }, { start: ({ controller }) => { void controller.load({}); } });
     const [removal, setRemoval] = useState(null);
     const s = access.snapshot, o = other.snapshot;
-    const query = s?.query ?? '', category = s?.category ?? 'all';
-    const rows = s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { access.controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void access.controller?.makeDefault({ row }); } })) : [];
-    const otherRows = o ? filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { other.controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void other.controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } })) : [];
-    const providers = (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { access.controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
-    // Count remains global across categories; the search count answers how many saved tokens this host holds.
-    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
-    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
-    return { denied: !canRead, loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false), rows, otherRows, providers, categories: CATEGORIES, query, category, total, matched, removal,
-        draft: s?.draft ?? null, errors: [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})],
+    const { query, category } = currentFilter({ snapshot: s });
+    const scope = { permissions, query, category, setRemoval };
+    const rows = accessRows({ snapshot: s, controller: access.controller, scope });
+    const otherRows = otherRowsView({ snapshot: o, controller: other.controller, scope });
+    const providers = providerOptions({ snapshot: s, controller: access.controller, scope });
+    return { denied: !canRead, ...tabStatus({ access: s, other: o }), rows, otherRows, providers, categories: CATEGORIES, query, category, ...tokenCounts({ access: s, other: o, query }), removal,
+        draft: s?.draft ?? null, errors: errorList({ access: s, other: o }),
         canAddCustom: permissions.includes('custom-credentials.write'),
         addCustom() { access.controller?.begin({ kind: 'custom' }); },
         onQuery({ value }) { access.controller?.filter({ query: value }); },

package/dist/security/react/hooks/RootKeyTab.hooks.d.ts

@@ -1,19 +1,5 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function useRootKeyTab({ permissions, params }: TabViewProps, _optional?: {}): {
-    denied: boolean;
-    loading: boolean;
-    saving: boolean;
-    status: import("../../models.js").RootKeyStatus | null | undefined;
-    error: string | null | undefined;
-    result: string | null | undefined;
-    scopeNotice: string;
-    token: string;
-    confirm: string;
-    confirming: boolean;
-    preview: import("../../models.js").RootKeyPreview | null | undefined;
-    locked: boolean;
-    canGenerate: boolean;
-    canConfirm: boolean;
     onToken({ value }: {
         value: string;
     }): void;
@@ -25,5 +11,19 @@ export declare function useRootKeyTab({ permissions, params }: TabViewProps, _op
     previewFresh(): void;
     cancelFresh(): void;
     confirmFresh(): Promise<void>;
+    locked: boolean;
+    canGenerate: boolean;
+    canConfirm: boolean;
+    token: string;
+    confirm: string;
+    confirming: boolean;
+    preview: import("../../models.js").RootKeyPreview | null | undefined;
+    scopeNotice: string;
+    loading: boolean;
+    saving: boolean;
+    status: import("../../models.js").RootKeyStatus | null | undefined;
+    error: string | null | undefined;
+    result: string | null | undefined;
+    denied: boolean;
 };
 //# sourceMappingURL=RootKeyTab.hooks.d.ts.map

package/dist/security/react/hooks/RootKeyTab.hooks.js

@@ -2,14 +2,23 @@ import { useController } from '../../../core/react/use-controller.js';
 import { createRootKeyController } from '../../controllers/root-key.controller.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../../rules.js';
 import { unavailableRootKey, useSecurityPorts } from './SecurityPorts.hooks.js';
+/** Before the controller exists the tab reads as loading with nothing known yet. */
+function rootKeyProgress({ snapshot: s }, _optional = {}) {
+    return { loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result };
+}
+function rootKeyInputs({ snapshot: s }, _optional = {}) {
+    return { token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview };
+}
+function rootKeyFlags({ snapshot: s }, _optional = {}) {
+    return { locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION };
+}
 export function useRootKeyTab({ permissions = [], params }, _optional = {}) {
     const { rootKey } = useSecurityPorts({});
     const key = permissions.join('\0');
     const { controller, snapshot: s } = useController({ create: () => createRootKeyController({ api: rootKey ?? unavailableRootKey, permissions }), dependencies: [rootKey, key] }, { start: ({ controller }) => { void controller.load({}); } });
-    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result,
+    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), ...rootKeyProgress({ snapshot: s }),
         scopeNotice: typeof params.scopeNotice === 'string' ? params.scopeNotice : 'This key protects saved credentials. Keep its backup separate from the database.',
-        token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview,
-        locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION,
+        ...rootKeyInputs({ snapshot: s }), ...rootKeyFlags({ snapshot: s }),
         onToken({ value }) { controller?.setToken({ value }); }, onConfirmText({ value }) { controller?.setConfirm({ value }); },
         generate() { void controller?.generate({}); }, unlock() { void controller?.importToken({}); }, previewFresh() { void controller?.preview({}); },
         cancelFresh() { controller?.cancel({}); }, async confirmFresh() { if (!await controller?.startFresh({}))

package/dist/security/react/tabs/RootKeyTab.d.ts

@@ -1,4 +1,4 @@
 import type { TabViewProps } from '../../../core/react/bind-react.js';
-export declare function RootKeyTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
+export declare function RootKeyTab(props: TabViewProps): import("react").JSX.Element;
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.d.ts.map

package/dist/security/react/tabs/RootKeyTab.js

@@ -1,9 +1,18 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, TextField, Notice, ConfirmDialog, Spinner } from '@jini-ai/ui-kit/react';
 import { useRootKeyTab } from '../hooks/RootKeyTab.hooks.js';
-export function RootKeyTab(props, _optional = {}) {
+function RootKeyMessages({ vm }) {
+    return _jsxs(_Fragment, { children: [vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result })] });
+}
+function LockedActions({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] });
+}
+function StartFreshBody({ vm }) {
+    return _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] });
+}
+export function RootKeyTab(props) {
     const vm = useRootKeyTab(props);
-    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
+    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), _jsx(RootKeyMessages, { vm: vm }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsx(LockedActions, { vm: vm }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsx(StartFreshBody, { vm: vm }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
 }
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.js.map

package/dist/security/rules.js

@@ -9,8 +9,9 @@ export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', '
 export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
 export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
 export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
+function defaultCategory({ kind }, _optional = {}) { return kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general'; }
 export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
-    return { kind, providerId, label: '', token: '', values: {}, category: kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general', baseUrl: '', additionalHosts: '', username: '' };
+    return { kind, providerId, label: '', token: '', values: {}, category: defaultCategory({ kind }), baseUrl: '', additionalHosts: '', username: '' };
 }
 /** Legacy sentinel labels are display-only: opening this page must never mutate saved data. */
 export function credentialLabel({ row, providers }, _optional = {}) {
@@ -18,46 +19,65 @@ export function credentialLabel({ row, providers }, _optional = {}) {
         return row.label;
     return `${providers.find(p => p.kind === row.kind && p.id === row.providerId)?.label ?? row.providerId} token`;
 }
-export function credentialCategory({ row }, _optional = {}) { return row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'); }
+export function credentialCategory({ row }, _optional = {}) { return row.category ?? defaultCategory({ kind: row.kind }); }
 export function filterCredentials({ rows, query, category, providers }, _optional = {}) {
     const q = query.trim().toLowerCase();
     return rows.filter(row => (category === 'all' || credentialCategory({ row }) === category) && [credentialLabel({ row, providers }), row.providerId, row.baseUrl ?? '', row.accountLabel ?? ''].join(' ').toLowerCase().includes(q));
 }
 export function filterOtherCredentials({ rows, query, category }, _optional = {}) { return rows.filter(row => (category === 'all' || row.category === category) && `${row.label} ${row.store}`.toLowerCase().includes(query.trim().toLowerCase())); }
+function findProvider({ draft, providers }, _optional = {}) { return providers.find(p => p.kind === draft.kind && p.id === draft.providerId); }
+function isDuplicateLabel({ draft, rows }, _optional = {}) {
+    const label = draft.label.trim().toLowerCase();
+    return rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === label);
+}
+function customDraftError({ draft }, _optional = {}) {
+    try {
+        if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
+            return 'Enter an HTTP or HTTPS URL';
+    }
+    catch {
+        return 'Enter an HTTP or HTTPS URL';
+    }
+    return null;
+}
+function providerDraftError({ draft, providers }, _optional = {}) {
+    if (draft.id && !draft.token.trim())
+        return null;
+    const provider = findProvider({ draft, providers });
+    if (!provider)
+        return 'Provider is unavailable';
+    if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
+        return 'Complete all required fields';
+    return null;
+}
 /** A custom row is its own provider identity; its username can change without retyping its token. */
 export function validateCredentialDraft({ draft, rows, providers }, _optional = {}) {
     if (!draft.label.trim())
         return 'Enter a name';
-    if (rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === draft.label.trim().toLowerCase()))
+    if (isDuplicateLabel({ draft, rows }))
         return 'That name is already in use';
     if (!draft.id && !draft.token.trim())
         return 'Enter an access token';
-    if (draft.kind === 'custom') {
-        try {
-            if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
-                return 'Enter an HTTP or HTTPS URL';
-        }
-        catch {
-            return 'Enter an HTTP or HTTPS URL';
-        }
-    }
-    else if (!draft.id || draft.token.trim()) {
-        const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
-        if (!provider)
-            return 'Provider is unavailable';
-        if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
-            return 'Complete all required fields';
-    }
-    return null;
+    return draft.kind === 'custom' ? customDraftError({ draft }) : providerDraftError({ draft, providers });
+}
+function customConnection({ draft, token }, _optional = {}) {
+    const username = draft.username.trim();
+    return { token, ...(username ? { username } : {}) };
+}
+function providerConnection({ draft, token, providers }, _optional = {}) {
+    const provider = findProvider({ draft, providers });
+    const extras = provider ? provider.fields.filter(f => f.name !== provider.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()]) : [];
+    return { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries(extras) };
+}
+function customPatchFields({ draft }, _optional = {}) {
+    return { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null };
 }
 /** Omitting connection preserves the saved secret. Never send an empty or half-blank replacement. */
 export function buildCredentialPatch({ draft, providers }, _optional = {}) {
-    const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
     const token = draft.token.trim();
-    const connection = token ? draft.kind === 'custom'
-        ? { token, ...(draft.username.trim() ? { username: draft.username.trim() } : {}) }
-        : { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries((provider?.fields ?? []).filter(f => f.name !== provider?.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()])) } : undefined;
-    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(draft.kind === 'custom' ? { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null } : {}) };
+    const custom = draft.kind === 'custom';
+    const connection = token ? (custom ? customConnection({ draft, token }) : providerConnection({ draft, token, providers })) : undefined;
+    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(custom ? customPatchFields({ draft }) : {}) };
 }
 export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }
 //# sourceMappingURL=rules.js.map

package/dist/seo/controllers/seo.controller.js

@@ -27,18 +27,20 @@ export function createSeoController({ api }, { t = (key) => key } = {}) {
     }
     async function regenerateSitemap(_required = {}, _optional = {}) {
         store.set({ patch: { saving: true, error: null, notice: null } });
+        // One exit after `finally`: returning from both try and catch left a fall-through nothing took.
+        let accepted = false;
         try {
             await api.regenerateSeoSitemap({});
             store.set({ patch: { notice: t('Sitemap regeneration accepted.') } });
-            return true;
+            accepted = true;
         }
         catch (error) {
             store.set({ patch: { error: describeSeoError({ error, fallback: t('failed to regenerate sitemap') }) } });
-            return false;
         }
         finally {
             store.set({ patch: { saving: false } });
         }
+        return accepted;
     }
     return {
         ...store, load, save, regenerateSitemap,