@jini-ai/admin 0.6.15-rc.2 → 0.6.16

package/dist/react/components/InteractiveHtmlEditor/InteractiveHtmlEditor.js

@@ -154,7 +154,9 @@ function parseEmbedConfig(raw) {
 }
 function galleryIdentityLabel(config) {
     const count = Array.isArray(config.images) ? config.images.length : 0;
-    return count === 0 ? 'no images set' : `${count} ${count === 1 ? 'image' : 'images'}`;
+    if (count === 0)
+        return 'no images set';
+    return count === 1 ? '1 image' : `${count} images`;
 }
 export function InteractiveHtmlEditor(props) {
     return (_jsx(HtmlEditor, { ...props, isProtectedElement: (el) => isProtectedEmbedElement({ el }), describeEmbedPlaceholder: (el) => describeEmbedPlaceholder({ el }) }));

package/dist/react/components/RowMenu/RowMenu.hooks.js

@@ -121,14 +121,10 @@ export function useRowMenu({ itemCount, window, document }) {
             openAt(0);
     }
     function onTriggerKeyDown(e) {
-        if (e.key === 'ArrowDown') {
-            e.preventDefault();
-            openAt(0);
-        }
-        else if (e.key === 'ArrowUp') {
-            e.preventDefault();
-            openAt(itemCount - 1);
-        }
+        if (e.key !== 'ArrowDown' && e.key !== 'ArrowUp')
+            return;
+        e.preventDefault();
+        openAt(e.key === 'ArrowDown' ? 0 : itemCount - 1);
     }
     function onMenuKeyDown(e) {
         switch (e.key) {

package/dist/react/components/Sidebar.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { Fragment, createContext, createElement, useContext, useEffect, useMemo, useRef, useState, } from 'react';
+import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState, } from 'react';
 import { createPortal } from 'react-dom';
 import { DEFAULT_ADMIN_BASE, adminHref } from '../../core/routing/rules.js';
 import { useNavSections } from '../hooks/use-nav-sections.js';

package/dist/react/entities/EntityField.js

@@ -43,6 +43,7 @@ export function EntityField(props) {
         case 'integer':
         case 'real': return _jsx(NumberInput, { ...props });
         case 'text': return _jsx("input", { ...commonProps(props), value: typeof value === 'string' ? value : '', onChange: (e) => onChange({ value: blankToUndefined(e.target.value) }) });
+        default: return null;
     }
 }
 //# sourceMappingURL=EntityField.js.map

package/dist/react/entities/contribution.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { trimCharsEnd } from '@jini-ai/core/text';
 import { EntityIndex } from './EntityIndex.js';
 import { EntityList } from './EntityList.js';
 import { EntityDetail } from './EntityDetail.js';
@@ -18,7 +19,7 @@ export function createEntityRoutes({ adminBase, panelId, navigate }) {
         throw new Error('Entity panelId must be one URL segment');
     if (!adminBase.startsWith('/') || adminBase.startsWith('//') || /[?#]/.test(adminBase))
         throw new Error('Entity adminBase must be an absolute pathname');
-    const base = adminBase.replace(/\/+$/, '');
+    const base = trimCharsEnd({ text: adminBase, chars: '/' });
     function routePath({ entity, id, view }) {
         const root = `/${panelId}`;
         if (entity === undefined)
@@ -45,6 +46,7 @@ export function createEntityPanel(args, options = {}) {
     const dependencies = { registry: args.registry, translate: args.translate, routes };
     return {
         id: args.panelId,
+        description: args.translate({ key: 'Browse and edit data records.' }),
         nav: options.nav ?? { label: args.translate({ key: 'Data' }) },
         agentReachable: options.agentReachable ?? false,
         ...(options.requires === undefined ? {} : { requires: options.requires }),

package/dist/react/entities/types.js

@@ -1,6 +1,6 @@
 /** Stable source templates let host dictionaries translate copy before values are inserted. */
 export function entityText({ translate, key, values }) {
-    return translate({ key: key }).replace(/\{([\w]+)\}/g, (match, name) => Object.hasOwn(values, name) ? String(values[name]) : match);
+    return translate({ key: key }).replace(/\{(\w+)\}/g, (match, name) => Object.hasOwn(values, name) ? String(values[name]) : match);
 }
 /**
  * Adapts the host's object-arg {@link EntityTranslate} to the positional `(key) => string` form the

package/dist/react/overlays.js

@@ -4,6 +4,7 @@ import { createControllerStore } from '../core/module/controller-store.js';
 export function createOverlayController(_required = {}, _optional = {}) {
     const store = createControllerStore({ initial: { entries: [] } });
     let sequence = 0, cancelActive = null;
+    const nextSequence = () => { sequence += 1; return sequence; };
     return {
         getSnapshot: store.getSnapshot,
         subscribe: store.subscribe,
@@ -28,7 +29,7 @@ export function createOverlayController(_required = {}, _optional = {}) {
                 signal?.addEventListener('abort', cancel, { once: true });
                 store.set({
                     patch: {
-                        entries: [{ id: ++sequence, render: () => render({ resolve: finish, cancel }) }],
+                        entries: [{ id: nextSequence(), render: () => render({ resolve: finish, cancel }) }],
                     },
                 });
             });

package/dist/react/shell/AdminShell.hooks.js

@@ -14,7 +14,7 @@ export function useShellDrawer(args) {
     useEffect(() => setOpen(false), [args.routePath]);
     useEffect(() => {
         if (!open)
-            return;
+            return undefined;
         const onKeyDown = (event) => {
             if (event.key === 'Escape')
                 setOpen(false);

package/dist/react/shell/use-admin-shell-session.js

@@ -39,7 +39,8 @@ export function useAdminShellSession(args) {
             return;
         if (operation === 'logout')
             loggingOut.current = owner;
-        const request = ++generation.current;
+        generation.current += 1;
+        const request = generation.current;
         const isCurrent = () => active.current === owner && generation.current === request;
         setOwned({ context, port, state: { status: 'checking' } });
         // settleOperation never rejects, so the logout latch below always clears.

package/dist/react/shell/use-admin-theme.js

@@ -4,7 +4,9 @@ import { applyAdminTheme, resolveColorScheme } from '@jini-ai/ui/theme';
 export function useAdminTheme({ userId, workspace }, { theme, colorScheme, environment, preferenceStore, onColorSchemeChange } = {}) {
     const scope = JSON.stringify([userId, Object.entries(workspace).sort(([a], [b]) => a.localeCompare(b))]);
     const [saved, setSaved] = useState(null);
-    const [mediaRevision, setMediaRevision] = useState(0);
+    // Only the setter is used: bumping the revision re-renders, which re-reads the live media
+    // snapshot below; explicit choices never query the OS.
+    const [, setMediaRevision] = useState(0);
     const preference = colorScheme ?? (saved?.scope === scope ? saved.preference : 'system');
     useEffect(() => {
         if (!userId || !preferenceStore) {
@@ -16,25 +18,23 @@ export function useAdminTheme({ userId, workspace }, { theme, colorScheme, envir
     }, [userId, workspace, scope, preferenceStore]);
     useEffect(() => {
         if (!theme)
-            return;
+            return undefined;
         if (!environment)
             throw new TypeError('AdminShell theme requires a themeEnvironment port');
         return applyAdminTheme({ theme }, environment);
     }, [theme, environment]);
     useEffect(() => {
         if (!environment || preference !== 'system')
-            return;
+            return undefined;
         const media = environment.matchMedia('(prefers-color-scheme: dark)');
         const changed = () => setMediaRevision((revision) => revision + 1);
         media.addEventListener?.('change', changed);
         return () => media.removeEventListener?.('change', changed);
     }, [environment, preference]);
-    // A revision refreshes the live media snapshot; explicit choices never query the OS.
-    void mediaRevision;
     const resolved = environment ? resolveColorScheme({ preference }, { matchMedia: environment.matchMedia }) : 'light';
     useEffect(() => {
         if (!environment)
-            return;
+            return undefined;
         const previous = environment.target.getAttribute('data-color-scheme');
         environment.target.setAttribute('data-color-scheme', resolved);
         return () => {

package/dist/redirects/adapters/memory.js

@@ -15,15 +15,22 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
             throw new AdminApiError({ message: `redirect '${id}' was not found`, status: 404 }, { code: 'REDIRECT_NOT_FOUND' });
         return row;
     }
-    function create(input, source) {
-        // The core port documents reference-host rejection. A supplied validator owns alternate hosts.
-        if (validate)
-            validate(input);
-        else if (input.matchType === 'regex')
+    /** The core port documents reference-host rejection of a regex `matchType`. A supplied
+     *  validator owns alternate hosts and sees the whole candidate instead. */
+    function validateOrRejectRegex(candidate, matchType) {
+        if (validate) {
+            validate(candidate);
+            return;
+        }
+        if (matchType === 'regex')
             throw new AdminApiError({ message: 'regex match type is not supported', status: 400 }, { code: 'REDIRECT_VALIDATION_ERROR' });
+    }
+    function create(input, source) {
+        validateOrRejectRegex(input, input.matchType);
         let id;
         do {
-            id = `memory-redirect-${nextId++}`;
+            id = `memory-redirect-${nextId}`;
+            nextId += 1;
         } while (rows.has(id));
         const row = Object.freeze({ ...input, id, status: 'active', override: input.override ?? false,
             priority: input.priority ?? 0, source, sourceEntryId: null, fromPathAtCapture: null, toPathAtCapture: null,
@@ -34,20 +41,16 @@ export function createMemoryRedirectsApi({ redirects = [], hits = {} }, { valida
     }
     return {
         async listRedirects(_required, filter = {}) {
+            const matches = (wanted, actual) => wanted === undefined || actual === wanted;
             return Object.freeze([...rows.values()].filter(row => !trashed.has(row.id) &&
-                (filter.status === undefined || row.status === filter.status) &&
-                (filter.source === undefined || row.source === filter.source) &&
-                (filter.matchType === undefined || row.matchType === filter.matchType)));
+                matches(filter.status, row.status) && matches(filter.source, row.source) && matches(filter.matchType, row.matchType)));
         },
         async getRedirect({ id }) { return get(id); },
         async createRedirect(input, options = {}) { return create({ ...input, ...options }, 'manual'); },
         async updateRedirect({ id }, patch = {}) {
             const before = get(id);
             const next = { ...before, ...patch };
-            if (validate)
-                validate(next);
-            else if (patch.matchType === 'regex')
-                throw new AdminApiError({ message: 'regex match type is not supported', status: 400 }, { code: 'REDIRECT_VALIDATION_ERROR' });
+            validateOrRejectRegex(next, patch.matchType);
             const row = Object.freeze({ ...next, version: before.version + 1 });
             rows.set(id, row);
             if (patch.status === 'active')

package/dist/security/adapters/http.js

@@ -40,15 +40,14 @@ export function createHttpSecurityApi({ transport, workspacePath }, _optional =
 function mediaEntry({ entry }, { apiKey } = {}) {
     return { ...(entry.baseUrl !== undefined ? { baseUrl: entry.baseUrl } : {}), ...(entry.model !== undefined ? { model: entry.model } : {}), ...(apiKey !== undefined ? { apiKey } : {}) };
 }
+const MEDIA_PROVIDERS_PATH = '/media/providers';
 /** Replacing the ENTIRE map requires sibling settings unchanged. Blank apiKey preserves their stored keys. */
 function rebuildMedia(current, id, token) {
     const next = {};
-    for (const [key, entry] of Object.entries(current)) {
-        if (key !== id)
-            next[key] = mediaEntry({ entry });
-        else if (token !== undefined)
-            next[key] = mediaEntry({ entry }, { apiKey: token });
-    }
+    // The replaced entry is dropped when no token is given; every sibling is echoed unchanged.
+    const kept = Object.entries(current).filter(([key]) => key !== id || token !== undefined);
+    for (const [key, entry] of kept)
+        next[key] = mediaEntry({ entry }, key === id && token !== undefined ? { apiKey: token } : {});
     return next;
 }
 export function createHttpOtherCredentials({ transport, workspacePath }, { mediaLabels = {} } = {}) {
@@ -62,7 +61,7 @@ export function createHttpOtherCredentials({ transport, workspacePath }, { media
                 return r.data.isSet ? [{ store, id: store, label: singles[store].label, category: 'ai', configured: true, supportsReplace: true, updatedAt: r.data.updatedAt }] : [];
             }
             if (store === 'media-provider') {
-                const map = await request('/media/providers', 'GET', options);
+                const map = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
                 return Object.entries(map).filter(([, entry]) => entry.apiKeyConfigured).map(([id]) => ({ store, id, label: mediaLabels[id] ?? id, category: 'media', configured: true, supportsReplace: true }));
             }
             const { servers } = await request('/mcp-servers', 'GET', options);
@@ -74,16 +73,16 @@ export function createHttpOtherCredentials({ transport, workspacePath }, { media
             if (store === 'external-mcp')
                 throw new Error('Edit the full server configuration on its own screen');
             if (store === 'media-provider') {
-                const current = await request('/media/providers', 'GET', options);
-                await request('/media/providers', 'PUT', options, rebuildMedia(current, id, token));
+                const current = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
+                await request(MEDIA_PROVIDERS_PATH, 'PUT', options, rebuildMedia(current, id, token));
             }
             else
                 await request(singles[store].path, 'PUT', options, { apiKey: token });
         },
         async remove({ store, id }, options = {}) {
             if (store === 'media-provider') {
-                const current = await request('/media/providers', 'GET', options);
-                await request('/media/providers', 'PUT', options, rebuildMedia(current, id));
+                const current = await request(MEDIA_PROVIDERS_PATH, 'GET', options);
+                await request(MEDIA_PROVIDERS_PATH, 'PUT', options, rebuildMedia(current, id));
             }
             else if (store === 'external-mcp')
                 await request(`/mcp-servers/${encodeURIComponent(id)}`, 'DELETE', options);

package/dist/security/adapters/memory.js

@@ -11,6 +11,7 @@ function customProjection({ patch }, { initial } = {}) {
 export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
     let items = rows.map(r => Object.freeze({ ...r }));
     let sequence = 0;
+    const nextSequence = () => { sequence += 1; return sequence; };
     function store(kind) {
         function isDefaultFor({ patch, providerId }, { initial } = {}) {
             if (kind === 'custom')
@@ -24,8 +25,11 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
                 ...(kind === 'custom' ? customProjection({ patch }, { initial }) : {}),
             });
         }
-        function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
-            throw new Error('Duplicate label'); }
+        function check(label, providerId, id) {
+            const sameScope = (r) => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId);
+            if (items.some(r => sameScope(r) && r.label.toLowerCase() === label.toLowerCase()))
+                throw new Error('Duplicate label');
+        }
         function insert(row) {
             if (row.isDefault)
                 items = items.map(r => r.kind === kind && r.providerId === row.providerId ? Object.freeze({ ...r, isDefault: false }) : r);
@@ -34,10 +38,23 @@ export function createMemorySecurityApi({ providers = [], rows = [] }, _optional
         }
         return {
             async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
-            async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
-                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project({ id: `credential-${++sequence}`, patch: input, providerId, label: input.label })); },
-            async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
-                throw new Error('Credential not found'); const label = patch.label ?? old.label; check(label, old.providerId, id); return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old })); },
+            async create(input, o = {}) {
+                o.signal?.throwIfAborted();
+                if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
+                    throw new Error('Incomplete credential');
+                const providerId = kind === 'custom' ? '' : input.connection.providerId ?? '';
+                check(input.label, providerId);
+                return insert(project({ id: `credential-${nextSequence()}`, patch: input, providerId, label: input.label }));
+            },
+            async update({ id, patch }, o = {}) {
+                o.signal?.throwIfAborted();
+                const old = items.find(r => r.id === id && r.kind === kind);
+                if (!old)
+                    throw new Error('Credential not found');
+                const label = patch.label ?? old.label;
+                check(label, old.providerId, id);
+                return insert(project({ id, patch, providerId: old.providerId, label }, { initial: old }));
+            },
             async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
                 const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
                 if (next)
@@ -51,8 +68,13 @@ export function createMemoryOtherCredentials({ rows = [] }, _optional = {}) {
     let items = rows.map(row => Object.freeze({ ...row }));
     return {
         async list({ store }, o = {}) { o.signal?.throwIfAborted(); return items.filter(r => r.store === store); },
-        async replace({ store, id, token }, o = {}) { o.signal?.throwIfAborted(); const row = items.find(r => r.store === store && r.id === id); if (!row?.supportsReplace || !token.trim())
-            throw new Error('Replacement unavailable'); items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r); },
+        async replace({ store, id, token }, o = {}) {
+            o.signal?.throwIfAborted();
+            const row = items.find(r => r.store === store && r.id === id);
+            if (!row?.supportsReplace || !token.trim())
+                throw new Error('Replacement unavailable');
+            items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r);
+        },
         async remove({ store, id }, o = {}) { o.signal?.throwIfAborted(); items = items.filter(r => r.store !== store || r.id !== id); },
     };
 }
@@ -61,14 +83,27 @@ export function createMemoryRootKey({ status = { active: false, source: 'none',
     function activate(outcome) { current = Object.freeze({ ...current, active: true, state: 'active', source: 'file', fingerprint: 'memory-fingerprint' }); return { outcome, fingerprint: 'memory-fingerprint', keyFilePath: current.keyFilePath, runtimeMode: current.runtimeMode }; }
     return {
         async status(_r, o = {}) { o.signal?.throwIfAborted(); return current; },
-        async generate(_r, o = {}) { o.signal?.throwIfAborted(); if (current.active)
-            return { ...activate('already-active') }; if (current.state !== 'missing')
-            throw new Error('Key dependent data'); return activate('created'); },
-        async importToken({ token }, o = {}) { o.signal?.throwIfAborted(); if (!/^[0-9a-f]{64}$/i.test(token))
-            throw new Error('Invalid token'); return { ...activate('unlocked'), resealed: 0 }; },
+        async generate(_r, o = {}) {
+            o.signal?.throwIfAborted();
+            if (current.active)
+                return { ...activate('already-active') };
+            if (current.state !== 'missing')
+                throw new Error('Key dependent data');
+            return activate('created');
+        },
+        async importToken({ token }, o = {}) {
+            o.signal?.throwIfAborted();
+            if (!/^[0-9a-f]{64}$/i.test(token))
+                throw new Error('Invalid token');
+            return { ...activate('unlocked'), resealed: 0 };
+        },
         async previewStartFresh(_r, o = {}) { o.signal?.throwIfAborted(); return preview; },
-        async startFresh({ confirm }, o = {}) { o.signal?.throwIfAborted(); if (confirm !== START_FRESH_CONFIRMATION)
-            throw new Error('Confirmation required'); return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' }; },
+        async startFresh({ confirm }, o = {}) {
+            o.signal?.throwIfAborted();
+            if (confirm !== START_FRESH_CONFIRMATION)
+                throw new Error('Confirmation required');
+            return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' };
+        },
     };
 }
 //# sourceMappingURL=memory.js.map

package/dist/security/conformance/security-api.conformance.js

@@ -3,9 +3,12 @@ import { credentialStore } from '../rules.js';
 export async function runSecurityApiConformance({ createApi, provider }, _optional = {}) {
     const api = await createApi({}), target = credentialStore({ api, kind: provider.kind });
     let passed = 0;
-    function check(value, message) { if (!value)
-        throw new Error(`Security contract: ${message}`); passed++; }
-    const suffix = `${Date.now()}-${Math.random()}`;
+    function check(value, message) {
+        if (!value)
+            throw new Error(`Security contract: ${message}`);
+        passed++;
+    }
+    const suffix = `${Date.now()}-${globalThis.crypto.randomUUID()}`;
     const secret = `contract-secret-${suffix}`;
     const connection = { providerId: provider.id, [provider.tokenField]: secret, ...Object.fromEntries(provider.fields.filter(f => f.name !== provider.tokenField).map(f => [f.name, 'test-value'])) };
     const ids = [];

package/dist/security/controllers/access-tokens.controller.js

@@ -12,7 +12,8 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
     async function load(_required, _optional = {}) {
         if (store.signal.aborted || !grants.has('security.read'))
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         // Independent stores retain their own successful results; one unavailable store cannot hide the rest.
         const kinds = ['publish', 'source-control', 'custom'];
@@ -105,8 +106,11 @@ export function createAccessTokensController({ api, permissions = [] }, _optiona
             store.set({ patch: { draft: null, error: null } }); },
         filter({ query, category }, _optional = {}) { store.set({ patch: { ...(query !== undefined ? { query } : {}), ...(category ? { category } : {}) } }); },
         remove({ row }, _optional = {}) { return write({ row, remove: true }); },
-        makeDefault({ row }, _optional = {}) { if (row.kind === 'custom')
-            return Promise.resolve(false); return write({ row, remove: false }); },
+        makeDefault({ row }, _optional = {}) {
+            if (row.kind === 'custom')
+                return Promise.resolve(false);
+            return write({ row, remove: false });
+        },
         dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
     };
 }

package/dist/security/controllers/other-credentials.controller.js

@@ -21,7 +21,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
     async function load(_required, _optional = {}) {
         if (store.signal.aborted || !grants.has('security.read'))
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         await Promise.all(OTHER_STORES.map(id => read(id, ticket)));
         if (ticket === generation)
@@ -31,7 +32,8 @@ export function createOtherCredentialsController({ api, permissions = [] }, _opt
     // This is tab-local; cross-session races still require a server concurrency check.
     let lane = Promise.resolve();
     function write(row, remove) {
-        if (store.signal.aborted || !grants.has('security.read') || !grants.has(otherWritePermission({ store: row.store })) || (!remove && !row.supportsReplace))
+        const permitted = grants.has('security.read') && grants.has(otherWritePermission({ store: row.store }));
+        if (store.signal.aborted || !permitted || (!remove && !row.supportsReplace))
             return Promise.resolve(false);
         const token = store.getSnapshot().drafts[`${row.store}:${row.id}`]?.trim() ?? '';
         if (!remove && !token)

package/dist/security/controllers/root-key.controller.js

@@ -1,9 +1,10 @@
 import { createControllerStore } from '../../core/module/controller-store.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+const receiverLabel = (w) => `${w.label} (${w.targetUrl})`;
 /** Receivers named in a result need their new signing secret; the message tells the operator which ones. */
 function resultMessage({ result, response }, _optional = {}) {
     const hooks = response.affectedWebhooks;
-    return hooks?.length ? `${result} Update receivers: ${hooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result;
+    return hooks?.length ? `${result} Update receivers: ${hooks.map(receiverLabel).join(', ')}` : result;
 }
 export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
     const granted = permissions.includes(ROOT_KEY_PERMISSION);
@@ -14,7 +15,8 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
     async function load(_required, _optional = {}) {
         if (!allowed())
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { loading: true } });
         try {
             const status = await api.status({}, { signal: store.signal });
@@ -66,7 +68,8 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
         async preview(_required, _optional = {}) {
             if (!canPreview())
                 return false;
-            const ticket = ++generation;
+            generation += 1;
+            const ticket = generation;
             store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
             let ok = false;
             try {
@@ -86,8 +89,12 @@ export function createRootKeyController({ api, permissions = [] }, _optional = {
             }
             return ok;
         },
-        startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
-            return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },
+        startFresh(_required, _optional = {}) {
+            const state = store.getSnapshot();
+            if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
+                return Promise.resolve(false);
+            return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.');
+        },
         cancel(_required, _optional = {}) { if (!store.getSnapshot().saving) {
             generation++;
             store.set({ patch: { confirming: false, preview: null, confirm: '', loading: false } });

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -55,9 +55,14 @@ export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
         reload() { void access.controller?.load({}); void other.controller?.load({}); },
         cancelRemove() { if (!s?.saving && !o?.saving)
             setRemoval(null); },
-        async confirmRemove() { if (!removal)
-            return; const ok = removal.type === 'access' ? await access.controller?.remove({ row: removal.row }) : await other.controller?.remove({ row: removal.row }); if (!ok)
-            throw new Error('Unable to remove credential'); setRemoval(null); },
+        async confirmRemove() {
+            if (!removal)
+                return;
+            const ok = removal.type === 'access' ? await access.controller?.remove({ row: removal.row }) : await other.controller?.remove({ row: removal.row });
+            if (!ok)
+                throw new Error('Unable to remove credential');
+            setRemoval(null);
+        },
         controller: access.controller, };
 }
 //# sourceMappingURL=AccessTokensTab.hooks.js.map

package/dist/security/react/hooks/SecurityPorts.hooks.js

@@ -6,6 +6,10 @@ const refuse = async () => { throw new Error('Unavailable'); };
 export const unavailableRootKey = { status: refuse, generate: refuse, importToken: refuse, previewStartFresh: refuse, startFresh: refuse };
 export const noOtherCredentials = { async list() { return []; }, replace: refuse, remove: refuse };
 export const SecurityPortsContext = createContext(null);
-export function useSecurityPorts(_required = {}, _optional = {}) { const ports = useContext(SecurityPortsContext); if (!ports)
-    throw new AdminConfigError({ issues: ['React scope unavailable: security'] }); return ports; }
+export function useSecurityPorts(_required = {}, _optional = {}) {
+    const ports = useContext(SecurityPortsContext);
+    if (!ports)
+        throw new AdminConfigError({ issues: ['React scope unavailable: security'] });
+    return ports;
+}
 //# sourceMappingURL=SecurityPorts.hooks.js.map

package/dist/security/rules.js

@@ -6,10 +6,22 @@ export const CATEGORIES = [
     { value: 'ai', label: 'AI' }, { value: 'ops', label: 'Ops' }, { value: 'general', label: 'General' },
 ];
 export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', 'external-mcp'];
-export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
+export function writePermission({ kind }, _optional = {}) {
+    if (kind === 'custom')
+        return 'custom-credentials.write';
+    return kind === 'publish' ? 'system.publish' : 'source-control.credentials.write';
+}
 export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
-export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
-function defaultCategory({ kind }, _optional = {}) { return kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general'; }
+export function credentialStore({ api, kind }, _optional = {}) {
+    if (kind === 'source-control')
+        return api.sourceControl;
+    return kind === 'publish' ? api.publish : api.custom;
+}
+function defaultCategory({ kind }, _optional = {}) {
+    if (kind === 'publish')
+        return 'hosting';
+    return kind === 'source-control' ? 'source-control' : 'general';
+}
 export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
     return { kind, providerId, label: '', token: '', values: {}, category: defaultCategory({ kind }), baseUrl: '', additionalHosts: '', username: '' };
 }
@@ -28,7 +40,8 @@ export function filterOtherCredentials({ rows, query, category }, _optional = {}
 function findProvider({ draft, providers }, _optional = {}) { return providers.find(p => p.kind === draft.kind && p.id === draft.providerId); }
 function isDuplicateLabel({ draft, rows }, _optional = {}) {
     const label = draft.label.trim().toLowerCase();
-    return rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === label);
+    const sameScope = (r) => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId);
+    return rows.some(r => sameScope(r) && r.label.trim().toLowerCase() === label);
 }
 function customDraftError({ draft }, _optional = {}) {
     try {
@@ -76,7 +89,8 @@ function customPatchFields({ draft }, _optional = {}) {
 export function buildCredentialPatch({ draft, providers }, _optional = {}) {
     const token = draft.token.trim();
     const custom = draft.kind === 'custom';
-    const connection = token ? (custom ? customConnection({ draft, token }) : providerConnection({ draft, token, providers })) : undefined;
+    const connectionFor = (value) => (custom ? customConnection({ draft, token: value }) : providerConnection({ draft, token: value, providers }));
+    const connection = token ? connectionFor(token) : undefined;
     return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(custom ? customPatchFields({ draft }) : {}) };
 }
 export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }

package/dist/seo/adapters/memory.js

@@ -1,3 +1,4 @@
+import { omitKeys } from '../../core/omit-keys.js';
 const defaultSettings = () => ({ titleTemplate: '%s', defaultRobots: { noindex: false, nofollow: false }, sitemapEnabled: true, robotsRules: [] });
 const clone = (value) => structuredClone(value);
 /** `patch value ?? meta value`, named — {@link applySeoPatch} calls this once per field instead of
@@ -66,7 +67,7 @@ function settingOrCleared(patchValue, currentValue) {
  *  @complexity O(1) — three fixed field reads, no iteration. */
 function applySettingsPatch(current, patch) {
     const { defaultDescription, defaultOgImage, twitterSite, ...rest } = patch;
-    const { defaultDescription: _description, defaultOgImage: _image, twitterSite: _site, ...retained } = current;
+    const retained = omitKeys(current, ['defaultDescription', 'defaultOgImage', 'twitterSite']);
     return {
         ...retained,
         ...rest,
@@ -106,9 +107,11 @@ export function createMemorySeoApi(required = {}, { resolveEntry } = {}) {
             // O(k) in patch keys; null removes only touched overrides, omission preserves other edits.
             for (const key of Object.keys(patch)) {
                 const value = patch[key];
+                if (value === undefined)
+                    continue;
                 if (value === null)
                     delete current[key];
-                else if (value !== undefined)
+                else
                     Object.assign(current, { [key]: value });
             }
             overrides[entryId] = current;

package/dist/seo/controllers/seo-entry.controller.js

@@ -34,7 +34,8 @@ export function createSeoEntryController({ api, entryId }, { t = key => key, des
             store.set({ patch: { resolved, touched: {}, notice: t('Saved.') } });
             // Saving finishes with the PUT, before this best-effort analysis settles. A newer save's
             // analysis must supersede an earlier slow response (the source's 2026-09-07 race fix).
-            const ticket = ++analyzeGeneration;
+            analyzeGeneration += 1;
+            const ticket = analyzeGeneration;
             void api.analyzeSeoEntry({ entryId }).then(analysis => {
                 if (ticket === analyzeGeneration)
                     store.set({ patch: { analysis } });

package/dist/seo/controllers/sitemap.controller.js

@@ -6,7 +6,8 @@ export function createSitemapController({ api, enabled }, _optional = {}) {
     async function load(_required = {}, _optional = {}) {
         if (!enabled)
             return;
-        const ticket = ++generation;
+        generation += 1;
+        const ticket = generation;
         store.set({ patch: { status: 'loading', error: null } });
         try {
             const { text } = await api.fetchSitemapXml({}, { signal: store.signal });

package/dist/seo/react/hooks/MediaPickerBridge.hooks.js

@@ -8,7 +8,7 @@ export function useMediaPickerBridge(required, _optional = {}) {
     useEffect(() => {
         if (!mediaPicker) {
             setError('Media picker unavailable');
-            return;
+            return undefined;
         }
         const abort = new AbortController();
         void mediaPicker.pick({ accept: callbacks.current.accept ?? ['image/*'] }, { signal: abort.signal }).then(item => {