@jini-ai/admin 0.6.15-rc.2 → 0.6.15

package/dist/react/shell/use-admin-shell-session.js

@@ -39,7 +39,8 @@ export function useAdminShellSession(args) {
             return;
         if (operation === 'logout')
             loggingOut.current = owner;
-        const request = ++generation.current;
+        generation.current += 1;
+        const request = generation.current;
         const isCurrent = () => active.current === owner && generation.current === request;
         setOwned({ context, port, state: { status: 'checking' } });
         // settleOperation never rejects, so the logout latch below always clears.

package/dist/react/shell/use-admin-theme.js

@@ -4,7 +4,9 @@ import { applyAdminTheme, resolveColorScheme } from '@jini-ai/ui/theme';
 export function useAdminTheme({ userId, workspace }, { theme, colorScheme, environment, preferenceStore, onColorSchemeChange } = {}) {
     const scope = JSON.stringify([userId, Object.entries(workspace).sort(([a], [b]) => a.localeCompare(b))]);
     const [saved, setSaved] = useState(null);
-    const [mediaRevision, setMediaRevision] = useState(0);
+    // Only the setter is used: bumping the revision re-renders, which re-reads the live media
+    // snapshot below; explicit choices never query the OS.
+    const [, setMediaRevision] = useState(0);
     const preference = colorScheme ?? (saved?.scope === scope ? saved.preference : 'system');
     useEffect(() => {
         if (!userId || !preferenceStore) {
@@ -16,25 +18,23 @@ export function useAdminTheme({ userId, workspace }, { theme, colorScheme, envir
     }, [userId, workspace, scope, preferenceStore]);
     useEffect(() => {
         if (!theme)
-            return;
+            return undefined;
         if (!environment)
             throw new TypeError('AdminShell theme requires a themeEnvironment port');
         return applyAdminTheme({ theme }, environment);
     }, [theme, environment]);
     useEffect(() => {
         if (!environment || preference !== 'system')
-            return;
+            return undefined;
         const media = environment.matchMedia('(prefers-color-scheme: dark)');
         const changed = () => setMediaRevision((revision) => revision + 1);
         media.addEventListener?.('change', changed);
         return () => media.removeEventListener?.('change', changed);
     }, [environment, preference]);
-    // A revision refreshes the live media snapshot; explicit choices never query the OS.
-    void mediaRevision;
     const resolved = environment ? resolveColorScheme({ preference }, { matchMedia: environment.matchMedia }) : 'light';
     useEffect(() => {
         if (!environment)
-            return;
+            return undefined;
         const previous = environment.target.getAttribute('data-color-scheme');
         environment.target.setAttribute('data-color-scheme', resolved);
         return () => {

package/dist/redirects/adapters/memory.js

@@ -15,15 +15,22 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
             throw new AdminApiError({ message: `redirect '${id}' was not found`, status: 404 }, { code: 'REDIRECT_NOT_FOUND' });
         return row;
     }
-    function create(input, source) {
-        // The core port documents reference-host rejection. A supplied validator owns alternate hosts.
-        if (validate)
-            validate(input);
-        else if (input.matchType === 'regex')
+    /** The core port documents reference-host rejection of a regex `matchType`. A supplied
+     *  validator owns alternate hosts and sees the whole candidate instead. */
+    function validateOrRejectRegex(candidate, matchType) {
+        if (validate) {
+            validate(candidate);
+            return;
+        }
+        if (matchType === 'regex')
             throw new AdminApiError({ message: 'regex match type is not supported', status: 400 }, { code: 'REDIRECT_VALIDATION_ERROR' });
+    }
+    function create(input, source) {
+        validateOrRejectRegex(input, input.matchType);
         let id;
         do {
-            id = `memory-redirect-${nextId++}`;
+            id = `memory-redirect-${nextId}`;
+            nextId += 1;
         } while (rows.has(id));
         const row = Object.freeze({ ...input, id, status: 'active', override: input.override ?? false,
             priority: input.priority ?? 0, source, sourceEntryId: null, fromPathAtCapture: null, toPathAtCapture: null,
@@ -34,20 +41,16 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
     }
     return {
         async listRedirects(_required, filter = {}) {
+            const matches = (wanted, actual) => wanted === undefined || actual === wanted;
             return Object.freeze([...rows.values()].filter(row => !trashed.has(row.id) &&
-                (filter.status === undefined || row.status === filter.status) &&
-                (filter.source === undefined || row.source === filter.source) &&
-                (filter.matchType === undefined || row.matchType === filter.matchType)));
+                matches(filter.status, row.status) && matches(filter.source, row.source) && matches(filter.matchType, row.matchType)));
         },
         async getRedirect({ id }) { return get(id); },
         async createRedirect(input, options = {}) { return create({ ...input, ...options }, 'manual'); },
         async updateRedirect({ id }, patch = {}) {
             const before = get(id);
             const next = { ...before, ...patch };
-            if (validate)
-                validate(next);
-            else if (patch.matchType === 'regex')
-                throw new AdminApiError({ message: 'regex match type is not supported', status: 400 }, { code: 'REDIRECT_VALIDATION_ERROR' });
+            validateOrRejectRegex(next, patch.matchType);
             const row = Object.freeze({ ...next, version: before.version + 1 });
             rows.set(id, row);
             if (patch.status === 'active')

package/dist/security/adapters/http.js

@@ -40,15 +40,14 @@ export function createHttpSecurityApi({ transport, workspacePath }, _optional =
 function mediaEntry({ entry }, { apiKey } = {}) {
     return { ...(entry.baseUrl !== undefined ? { baseUrl: entry.baseUrl } : {}), ...(entry.model !== undefined ? { model: entry.model } : {}), ...(apiKey !== undefined ? { apiKey } : {}) };
 }
+const MEDIA_PROVIDERS_PATH = '/media/providers';
 /** Replacing the ENTIRE map requires sibling settings unchanged. Blank apiKey preserves their stored keys. */
 function rebuildMedia(current, id, token) {
     const next = {};
-    for (const [key, entry] of Object.entries(current)) {
-        if (key !== id)
-            next[key] = mediaEntry({ entry });
-        else if (token !== undefined)
-            next[key] = mediaEntry({ entry }, { apiKey: token });
-    }
+    // The replaced entry is dropped when no token is given; every sibling is echoed unchanged.
+    const kept = Object.entries(current).filter(([key]) => key !== id || token !== undefined);
+    for (const [key, entry] of kept)
+        next[key] = mediaEntry({ entry }, key === id && token !== undefined ? { apiKey: token } : {});
     return next;
 }
 export function createHttpOtherCredentials({ transport, workspacePath }, { mediaLabels = {} } = {}) {
@@ -62,7 +61,7 @@ export function createHttpOtherCredentials({ transport, workspacePath }, { media
                 return r.data.isSet ? [{ store, id: store, label: singles[store].label, category: 'ai', configured: true, supportsReplace: true, updatedAt: r.data.updatedAt }] : [];
             }
             if (store === 'media-provider') {
-                const map = await request('/media/providers', 'GET', options);
+                const map = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
                 return Object.entries(map).filter(([, entry]) => entry.apiKeyConfigured).map(([id]) => ({ store, id, label: mediaLabels[id] ?? id, category: 'media', configured: true, supportsReplace: true }));
             }
             const { servers } = await request('/mcp-servers', 'GET', options);
@@ -74,16 +73,16 @@ export function createHttpOtherCredentials({ transport, workspacePath }, { media
             if (store === 'external-mcp')
                 throw new Error('Edit the full server configuration on its own screen');
             if (store === 'media-provider') {
-                const current = await request('/media/providers', 'GET', options);
-                await request('/media/providers', 'PUT', options, rebuildMedia(current, id, token));
+                const current = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
+                await request(MEDIA_PROVIDERS_PATH, 'PUT', options, rebuildMedia(current, id, token));
             }
             else
                 await request(singles[store].path, 'PUT', options, { apiKey: token });
         },
         async remove({ store, id }, options = {}) {
             if (store === 'media-provider') {
-                const current = await request('/media/providers', 'GET', options);
-                await request('/media/providers', 'PUT', options, rebuildMedia(current, id));
+                const current = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
+                await request(MEDIA_PROVIDERS_PATH, 'PUT', options, rebuildMedia(current, id));
             }
             else if (store === 'external-mcp')
                 await request(`/mcp-servers/${encodeURIComponent(id)}`, 'DELETE', options);

package/dist/security/adapters/memory.js

@@ -11,6 +11,7 @@ function customProjection({ patch }, { initial } = {}) {
 export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
     let items = rows.map(r => Object.freeze({ ...r }));
     let sequence = 0;
+    const nextSequence = () => { sequence += 1; return sequence; };
     function store(kind) {
         function isDefaultFor({ patch, providerId }, { initial } = {}) {
             if (kind === 'custom')
@@ -24,8 +25,11 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
                 ...(kind === 'custom' ? customProjection({ patch }, { initial }) : {}),
             });
         }
-        function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
-            throw new Error('Duplicate label'); }
+        function check(label, providerId, id) {
+            const sameScope = (r) => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId);
+            if (items.some(r => sameScope(r) && r.label.toLowerCase() === label.toLowerCase()))
+                throw new Error('Duplicate label');
+        }
         function insert(row) {
             if (row.isDefault)
                 items = items.map(r => r.kind === kind && r.providerId === row.providerId ? Object.freeze({ ...r, isDefault: false }) : r);
@@ -34,10 +38,23 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
         }
         return {
             async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
-            async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
-                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project({ id: `credential-${++sequence}`, patch: input, providerId, label: input.label })); },
-            async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
-                throw new Error('Credential not found'); const label = patch.label ?? old.label; check(label, old.providerId, id); return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old })); },
+            async create(input, o = {}) {
+                o.signal?.throwIfAborted();
+                if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
+                    throw new Error('Incomplete credential');
+                const providerId = kind === 'custom' ? '' : input.connection.providerId ?? '';
+                check(input.label, providerId);
+                return insert(project({ id: `credential-${nextSequence()}`, patch: input, providerId, label: input.label }));
+            },
+            async update({ id, patch }, o = {}) {
+                o.signal?.throwIfAborted();
+                const old = items.find(r => r.id === id && r.kind === kind);
+                if (!old)
+                    throw new Error('Credential not found');
+                const label = patch.label ?? old.label;
+                check(label, old.providerId, id);
+                return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old }));
+            },
             async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
                 const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
                 if (next)
@@ -51,8 +68,13 @@ export function createMemoryOtherCredentials({ rows = [] }, _optional = {}) {
     let items = rows.map(row => Object.freeze({ ...row }));
     return {
         async list({ store }, o = {}) { o.signal?.throwIfAborted(); return items.filter(r => r.store === store); },
-        async replace({ store, id, token }, o = {}) { o.signal?.throwIfAborted(); const row = items.find(r => r.store === store && r.id === id); if (!row?.supportsReplace || !token.trim())
-            throw new Error('Replacement unavailable'); items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r); },
+        async replace({ store, id, token }, o = {}) {
+            o.signal?.throwIfAborted();
+            const row = items.find(r => r.store === store && r.id === id);
+            if (!row?.supportsReplace || !token.trim())
+                throw new Error('Replacement unavailable');
+            items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r);
+        },
         async remove({ store, id }, o = {}) { o.signal?.throwIfAborted(); items = items.filter(r => r.store !== store || r.id !== id); },
     };
 }
@@ -61,14 +83,27 @@ export function createMemoryRootKey({ status = { active: false, source: 'none',
     function activate(outcome) { current = Object.freeze({ ...current, active: true, state: 'active', source: 'file', fingerprint: 'memory-fingerprint' }); return { outcome, fingerprint: 'memory-fingerprint', keyFilePath: current.keyFilePath, runtimeMode: current.runtimeMode }; }
     return {
         async status(_r, o = {}) { o.signal?.throwIfAborted(); return current; },
-        async generate(_r, o = {}) { o.signal?.throwIfAborted(); if (current.active)
-            return { ...activate('already-active') }; if (current.state !== 'missing')
-            throw new Error('Key dependent data'); return activate('created'); },
-        async importToken({ token }, o = {}) { o.signal?.throwIfAborted(); if (!/^[0-9a-f]{64}$/i.test(token))
-            throw new Error('Invalid token'); return { ...activate('unlocked'), resealed: 0 }; },
+        async generate(_r, o = {}) {
+            o.signal?.throwIfAborted();
+            if (current.active)
+                return { ...activate('already-active') };
+            if (current.state !== 'missing')
+                throw new Error('Key dependent data');
+            return activate('created');
+        },
+        async importToken({ token }, o = {}) {
+            o.signal?.throwIfAborted();
+            if (!/^[0-9a-f]{64}$/i.test(token))
+                throw new Error('Invalid token');
+            return { ...activate('unlocked'), resealed: 0 };
+        },
         async previewStartFresh(_r, o = {}) { o.signal?.throwIfAborted(); return preview; },
-        async startFresh({ confirm }, o = {}) { o.signal?.throwIfAborted(); if (confirm !== START_FRESH_CONFIRMATION)
-            throw new Error('Confirmation required'); return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' }; },
+        async startFresh({ confirm }, o = {}) {
+            o.signal?.throwIfAborted();
+            if (confirm !== START_FRESH_CONFIRMATION)
+                throw new Error('Confirmation required');
+            return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' };
+        },
     };
 }
 //# sourceMappingURL=memory.js.map

package/dist/security/conformance/security-api.conformance.js

@@ -3,9 +3,12 @@ import { credentialStore } from '../rules.js';
 export async function runSecurityApiConformance({ createApi, provider }, _optional = {}) {
     const api = await createApi({}), target = credentialStore({ api, kind: provider.kind });
     let passed = 0;
-    function check(value, message) { if (!value)
-        throw new Error(`Security contract: ${message}`); passed++; }
-    const suffix = `${Date.now()}-${Math.random()}`;
+    function check(value, message) {
+        if (!value)
+            throw new Error(`Security contract: ${message}`);
+        passed++;
+    }
+    const suffix = `${Date.now()}-${globalThis.crypto.randomUUID()}`;
     const secret = `contract-secret-${suffix}`;
     const connection = { providerId: provider.id, [provider.tokenField]: secret, ...Object.fromEntries(provider.fields.filter(f => f.name !== provider.tokenField).map(f => [f.name, 'test-value'])) };
     const ids = [];

package/dist/security/controllers/access-tokens.controller.js

@@ -12,7 +12,8 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
     async function load(_required, _optional = {}) {
         if (store.signal.aborted || !grants.has('security.read'))
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         // Independent stores retain their own successful results; one unavailable store cannot hide the rest.
         const kinds = ['publish', 'source-control', 'custom'];
@@ -105,8 +106,11 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
             store.set({ patch: { draft: null, error: null } }); },
         filter({ query, category }, _optional = {}) { store.set({ patch: { ...(query !== undefined ? { query } : {}), ...(category ? { category } : {}) } }); },
         remove({ row }, _optional = {}) { return write({ row, remove: true }); },
-        makeDefault({ row }, _optional = {}) { if (row.kind === 'custom')
-            return Promise.resolve(false); return write({ row, remove: false }); },
+        makeDefault({ row }, _optional = {}) {
+            if (row.kind === 'custom')
+                return Promise.resolve(false);
+            return write({ row, remove: false });
+        },
         dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
     };
 }

package/dist/security/controllers/other-credentials.controller.js

@@ -21,7 +21,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
     async function load(_required, _optional = {}) {
         if (store.signal.aborted || !grants.has('security.read'))
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         await Promise.all(OTHER_STORES.map(id => read(id, ticket)));
         if (ticket === generation)
@@ -31,7 +32,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
     // This is tab-local; cross-session races still require a server concurrency check.
     let lane = Promise.resolve();
     function write(row, remove) {
-        if (store.signal.aborted || !grants.has('security.read') || !grants.has(otherWritePermission({ store: row.store })) || (!remove && !row.supportsReplace))
+        const permitted = grants.has('security.read') && grants.has(otherWritePermission({ store: row.store }));
+        if (store.signal.aborted || !permitted || (!remove && !row.supportsReplace))
             return Promise.resolve(false);
         const token = store.getSnapshot().drafts[`${row.store}:${row.id}`]?.trim() ?? '';
         if (!remove && !token)

package/dist/security/controllers/root-key.controller.js

@@ -1,9 +1,10 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+const receiverLabel = (w) => `${w.label} (${w.targetUrl})`;
 /** Receivers named in a result need their new signing secret; the message tells the operator which ones. */
 function resultMessage({ result, response }, _optional = {}) {
     const hooks = response.affectedWebhooks;
-    return hooks?.length ? `${result} Update receivers: ${hooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result;
+    return hooks?.length ? `${result} Update receivers: ${hooks.map(receiverLabel).join(', ')}` : result;
 }
 export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
     const granted = permissions.includes(ROOT_KEY_PERMISSION);
@@ -14,7 +15,8 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
     async function load(_required, _optional = {}) {
         if (!allowed())
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         try {
             const status = await api.status({}, { signal: store.signal });
@@ -66,7 +68,8 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         async preview(_required, _optional = {}) {
             if (!canPreview())
                 return false;
-            const ticket = ++generation;
+            generation += 1;
+            const ticket = generation;
             store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
             let ok = false;
             try {
@@ -86,8 +89,12 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
             }
             return ok;
         },
-        startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
-            return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },
+        startFresh(_required, _optional = {}) {
+            const state = store.getSnapshot();
+            if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
+                return Promise.resolve(false);
+            return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.');
+        },
         cancel(_required, _optional = {}) { if (!store.getSnapshot().saving) {
             generation++;
             store.set({ patch: { confirming: false, preview: null, confirm: '', loading: false } });

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -55,9 +55,14 @@ export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
         reload() { void access.controller?.load({}); void other.controller?.load({}); },
         cancelRemove() { if (!s?.saving && !o?.saving)
             setRemoval(null); },
-        async confirmRemove() { if (!removal)
-            return; const ok = removal.type === 'access' ? await access.controller?.remove({ row: removal.row }) : await other.controller?.remove({ row: removal.row }); if (!ok)
-            throw new Error('Unable to remove credential'); setRemoval(null); },
+        async confirmRemove() {
+            if (!removal)
+                return;
+            const ok = removal.type === 'access' ? await access.controller?.remove({ row: removal.row }) : await other.controller?.remove({ row: removal.row });
+            if (!ok)
+                throw new Error('Unable to remove credential');
+            setRemoval(null);
+        },
         controller: access.controller, };
 }
 //# sourceMappingURL=AccessTokensTab.hooks.js.map

package/dist/security/react/hooks/SecurityPorts.hooks.js

@@ -6,6 +6,10 @@ const refuse = async () => { throw new Error('Unavailable'); };
 export const unavailableRootKey = { status: refuse, generate: refuse, importToken: refuse, previewStartFresh: refuse, startFresh: refuse };
 export const noOtherCredentials = { async list() { return []; }, replace: refuse, remove: refuse };
 export const SecurityPortsContext = createContext(null);
-export function useSecurityPorts(_required = {}, _optional = {}) { const ports = useContext(SecurityPortsContext); if (!ports)
-    throw new AdminConfigError({ issues: ['React scope unavailable: security'] }); return ports; }
+export function useSecurityPorts(_required = {}, _optional = {}) {
+    const ports = useContext(SecurityPortsContext);
+    if (!ports)
+        throw new AdminConfigError({ issues: ['React scope unavailable: security'] });
+    return ports;
+}
 //# sourceMappingURL=SecurityPorts.hooks.js.map

package/dist/security/rules.js

@@ -6,10 +6,22 @@ export const CATEGORIES = [
     { value: 'ai', label: 'AI' }, { value: 'ops', label: 'Ops' }, { value: 'general', label: 'General' },
 ];
 export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', 'external-mcp'];
-export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
+export function writePermission({ kind }, _optional = {}) {
+    if (kind === 'custom')
+        return 'custom-credentials.write';
+    return kind === 'publish' ? 'system.publish' : 'source-control.credentials.write';
+}
 export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
-export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
-function defaultCategory({ kind }, _optional = {}) { return kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general'; }
+export function credentialStore({ api, kind }, _optional = {}) {
+    if (kind === 'source-control')
+        return api.sourceControl;
+    return kind === 'publish' ? api.publish : api.custom;
+}
+function defaultCategory({ kind }, _optional = {}) {
+    if (kind === 'publish')
+        return 'hosting';
+    return kind === 'source-control' ? 'source-control' : 'general';
+}
 export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
     return { kind, providerId, label: '', token: '', values: {}, category: defaultCategory({ kind }), baseUrl: '', additionalHosts: '', username: '' };
 }
@@ -28,7 +40,8 @@ export function filterOtherCredentials({ rows, query, category }, _optional = {}
 function findProvider({ draft, providers }, _optional = {}) { return providers.find(p => p.kind === draft.kind && p.id === draft.providerId); }
 function isDuplicateLabel({ draft, rows }, _optional = {}) {
     const label = draft.label.trim().toLowerCase();
-    return rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === label);
+    const sameScope = (r) => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId);
+    return rows.some(r => sameScope(r) && r.label.trim().toLowerCase() === label);
 }
 function customDraftError({ draft }, _optional = {}) {
     try {
@@ -76,7 +89,8 @@ function customPatchFields({ draft }, _optional = {}) {
 export function buildCredentialPatch({ draft, providers }, _optional = {}) {
     const token = draft.token.trim();
     const custom = draft.kind === 'custom';
-    const connection = token ? (custom ? customConnection({ draft, token }) : providerConnection({ draft, token, providers })) : undefined;
+    const connectionFor = (value) => (custom ? customConnection({ draft, token: value }) : providerConnection({ draft, token: value, providers }));
+    const connection = token ? connectionFor(token) : undefined;
     return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(custom ? customPatchFields({ draft }) : {}) };
 }
 export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }

package/dist/seo/adapters/memory.js

@@ -1,3 +1,4 @@
+import { omitKeys } from '../../core/omit-keys.js';
 const defaultSettings = () => ({ titleTemplate: '%s', defaultRobots: { noindex: false, nofollow: false }, sitemapEnabled: true, robotsRules: [] });
 const clone = (value) => structuredClone(value);
 /** `patch value ?? meta value`, named — {@link applySeoPatch} calls this once per field instead of
@@ -66,7 +67,7 @@ function settingOrCleared(patchValue, currentValue) {
  *  @complexity O(1) — three fixed field reads, no iteration. */
 function applySettingsPatch(current, patch) {
     const { defaultDescription, defaultOgImage, twitterSite, ...rest } = patch;
-    const { defaultDescription: _description, defaultOgImage: _image, twitterSite: _site, ...retained } = current;
+    const retained = omitKeys(current, ['defaultDescription', 'defaultOgImage', 'twitterSite']);
     return {
         ...retained,
         ...rest,
@@ -106,9 +107,11 @@ export function createMemorySeoApi(required = {}, { resolveEntry } = {}) {
             // O(k) in patch keys; null removes only touched overrides, omission preserves other edits.
             for (const key of Object.keys(patch)) {
                 const value = patch[key];
+                if (value === undefined)
+                    continue;
                 if (value === null)
                     delete current[key];
-                else if (value !== undefined)
+                else
                     Object.assign(current, { [key]: value });
             }
             overrides[entryId] = current;

package/dist/seo/controllers/seo-entry.controller.js

@@ -34,7 +34,8 @@ export function createSeoEntryController({ api, entryId }, { t = key => key, des
             store.set({ patch: { resolved, touched: {}, notice: t('Saved.') } });
             // Saving finishes with the PUT, before this best-effort analysis settles. A newer save's
             // analysis must supersede an earlier slow response (the source's 2026-09-07 race fix).
-            const ticket = ++analyzeGeneration;
+            analyzeGeneration += 1;
+            const ticket = analyzeGeneration;
             void api.analyzeSeoEntry({ entryId }).then(analysis => {
                 if (ticket === analyzeGeneration)
                     store.set({ patch: { analysis } });

package/dist/seo/controllers/sitemap.controller.js

@@ -6,7 +6,8 @@ export function createSitemapController({ api, enabled }, _optional = {}) {
     async function load(_required = {}, _optional = {}) {
         if (!enabled)
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { status: 'loading', error: null } });
         try {
             const { text } = await api.fetchSitemapXml({}, { signal: store.signal });

package/dist/seo/react/hooks/MediaPickerBridge.hooks.js

@@ -8,7 +8,7 @@ export function useMediaPickerBridge(required, _optional = {}) {
     useEffect(() => {
         if (!mediaPicker) {
             setError('Media picker unavailable');
-            return;
+            return undefined;
         }
         const abort = new AbortController();
         void mediaPicker.pick({ accept: callbacks.current.accept ?? ['image/*'] }, { signal: abort.signal }).then(item => {

package/dist/seo/react/hooks/use-seo.hooks.js

@@ -27,7 +27,7 @@ export function useSeo({ api }, { t, events } = {}) {
     }, [controller, cached.query.data]);
     useEffect(() => {
         if (!controller || !events)
-            return;
+            return undefined;
         return events.subscribe({ onRefresh: () => { invalidate({ key: SEO_KEYS.settings }); } });
     }, [controller, events, invalidate]);
     return {

package/dist/seo/react/hooks/use-share-image-warning.hooks.js

@@ -18,7 +18,7 @@ export function useShareImageWarning({ value, previewUrl, api }, { t = key => ke
     useEffect(() => {
         const inspect = api.inspectShareImage;
         if (!previewUrl || !inspect || !isBrowserSameOrigin({ url: previewUrl }))
-            return;
+            return undefined;
         const controller = new AbortController();
         let active = true;
         const timeout = setTimeout(() => {

package/dist/seo/react/hooks/use-sitemap-modal.hooks.js

@@ -4,10 +4,18 @@ import { useController } from '../../../core/react/use-controller.js';
 import { createSitemapController } from '../../controllers/sitemap.controller.js';
 import { parseSitemapXml, filterSitemapEntries } from '../../rules.js';
 import { useSeoPorts } from './SeoPorts.hooks.js';
+/** Disabled outranks a failed fetch, which outranks a loaded document; anything else is still loading. */
+function sitemapStatus({ enabled, query }) {
+    if (!enabled)
+        return 'disabled';
+    if (query.error)
+        return 'error';
+    return query.data ? 'ready' : 'loading';
+}
 export function useSitemapModal({ api, enabled }, _optional = {}) {
     const cached = useSitemapQuery({ api, enabled });
     const { controller, snapshot } = useController({ create: () => createSitemapController({ api: cached.api, enabled }), dependencies: [cached.api, enabled] }, { start: ({ controller }) => { void controller.load({}); } });
-    const state = { ...(snapshot ?? { filter: '', view: 'table' }), status: !enabled ? 'disabled' : cached.query.error ? 'error' : cached.query.data ? 'ready' : 'loading', error: cached.query.error?.message ?? null, xmlText: cached.query.data?.text ?? '' };
+    const state = { ...(snapshot ?? { filter: '', view: 'table' }), status: sitemapStatus({ enabled, query: cached.query }), error: cached.query.error?.message ?? null, xmlText: cached.query.data?.text ?? '' };
     // Parse only when text/status changes, never on each filter keystroke.
     const entries = useMemo(() => state.status === 'ready' ? parseSitemapXml({ xmlText: state.xmlText }) : [], [state.status, state.xmlText]);
     const filteredEntries = useMemo(() => filterSitemapEntries({ entries, query: state.filter }), [entries, state.filter]);

package/dist/seo/react/pages/SeoPage.js

@@ -52,6 +52,12 @@ function EntryPicker({ locale, entryId, onChange, useEntryPickerHook = useWiredE
        than leaving a placeholder-only control with no name at all. The i18n key is unchanged. */
     return (_jsx("div", { className: "jini-seo-entry-picker", children: _jsx(Select, { value: entryId, onChange: onChange, options: options ?? [], placeholder: t({ locale: locale, key: "Choose an entry…" }), "aria-label": t({ locale: locale, key: "Entry" }), agentHandle: "seo-entry-picker", translate: (key) => t({ locale, key }) }) }));
 }
+/** Status-chip modifier for an issue: errors read as failures, warnings as warnings, anything else as success. */
+function issueStatusClass(severity) {
+    if (severity === "error")
+        return "failure";
+    return severity === "warning" ? "warning" : "success";
+}
 /** Read-only score + issues view (REQ-07) — exact field names read off `SeoAnalysis`/`SeoIssue`
  * (`src/seo/types.ts`), not guessed. No state of its own — only the severity sort, which lives in
  * `rules.ts` as `sortIssuesBySeverity`. */
@@ -62,7 +68,7 @@ function AnalyzePanel(props) {
     /* Heading + score pill on one line, issues as a compact list (owner, 2026-10-15: the bare
        "Score: 100 / No issues." read as unstyled text). The pill reuses the issue pills' status
        tones, so the score and the issues under it speak one colour language. */
-    return (_jsxs("section", { className: "jini-seo-analyze-panel", "aria-labelledby": "seo-analysis-heading", children: [_jsxs("div", { className: "jini-seo-analyze-head", children: [_jsx("h3", { id: "seo-analysis-heading", children: t({ locale: locale, key: "Analysis" }) }), _jsxs("span", { className: `jini-status jini-status-${tone} jini-seo-score`, children: [t({ locale: locale, key: "Score:" }), " ", _jsx("strong", { children: props.analysis.score })] })] }), sortedIssues.length === 0 ? (_jsx("p", { className: "jini-seo-analyze-empty", children: t({ locale: locale, key: "No issues." }) })) : (_jsx("ul", { className: "jini-seo-issues", children: sortedIssues.map((issue, i) => (_jsxs("li", { className: "jini-seo-issue", children: [_jsx("span", { className: `jini-status jini-status-${issue.severity === "error" ? "failure" : issue.severity === "warning" ? "warning" : "success"}`, children: issue.severity }), _jsxs("span", { className: "jini-seo-issue-text", children: [issue.message, issue.field ? _jsxs("span", { className: "jini-muted-cell", children: [" (", issue.field, ")"] }) : null] })] }, `${issue.code}-${i}`))) }))] }));
+    return (_jsxs("section", { className: "jini-seo-analyze-panel", "aria-labelledby": "seo-analysis-heading", children: [_jsxs("div", { className: "jini-seo-analyze-head", children: [_jsx("h3", { id: "seo-analysis-heading", children: t({ locale: locale, key: "Analysis" }) }), _jsxs("span", { className: `jini-status jini-status-${tone} jini-seo-score`, children: [t({ locale: locale, key: "Score:" }), " ", _jsx("strong", { children: props.analysis.score })] })] }), sortedIssues.length === 0 ? (_jsx("p", { className: "jini-seo-analyze-empty", children: t({ locale: locale, key: "No issues." }) })) : (_jsx("ul", { className: "jini-seo-issues", children: sortedIssues.map((issue, i) => (_jsxs("li", { className: "jini-seo-issue", children: [_jsx("span", { className: `jini-status jini-status-${issueStatusClass(issue.severity)}`, children: issue.severity }), _jsxs("span", { className: "jini-seo-issue-text", children: [issue.message, issue.field ? _jsxs("span", { className: "jini-muted-cell", children: [" (", issue.field, ")"] }) : null] })] }, `${issue.code}-${i}`))) }))] }));
 }
 /** Per-entry overrides edit form (REQ-06). Pre-fills from `getSeoEntry`'s resolved meta, but
  * tracks which fields the user actually touched so `putSeoEntry` only ever sends a genuine