@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,71 @@
+# @nocobase/app-plugin-releases
+
+## 0.1.0-beta.0
+
+### Minor Changes
+
+- 68d4feb: Add `@nocobase/app-plugin-releases`: release management for a NocoBase application. Apps (always running, or started on demand and stopped when idle), releases, environments, deployments and rollbacks, configuration with write-only secrets sealed by the secrets service, logs, upload tickets for CI, and deployment requests with approval. Deployment targets are pluggable drivers; the plugin ships the `host` driver, which deploys through App Hosts in process or in Docker containers (`@nocobase/app-host-docker`). The plugin knows nothing about projects, agents or roles: it declares what can be granted in `shared/access.ts` and the assembling application decides who holds what. CI reaches it with a scoped API key and the application's CLI (`release upload`, `release image`).
+
+### Patch Changes
+
+- 32d8faa: On PostgreSQL, a member who may see no project, no issue or no App no longer gets a server error: the filters used a NUL character as a placeholder id that matches nothing, which PostgreSQL refuses. The releases plugin's App list, for one, answered 500 to every member who had created no App.
+- ee4da29: A row's menu in the releases plugin's lists no longer closes by itself when the list renders again, such as when other data on the page loads: the lists' cells are no longer remounted on every render.
+- 6162033: Declare `@testing-library/user-event` as a development dependency, which the package's tests now use to open menus and selects. Nothing an application installs changes.
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [be0fbbd]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [6993158]
+- Updated dependencies [a6796d9]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [37c8d20]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [37c8d20]
+- Updated dependencies [bc1e83f]
+- Updated dependencies [6162033]
+  - @nocobase/app-host-docker@0.1.0-beta.0
+  - @nocobase/secrets@0.1.0-beta.0
+  - @nocobase/app-client@2.0.0-beta.1
+  - @nocobase/app-host@0.1.0-beta.14
+  - @nocobase/app-server@2.0.0-beta.1
+  - @nocobase/app-plugin-authentication@2.0.0-beta.1
+  - @nocobase/authorization@1.0.0-beta.12
+  - @nocobase/app-plugin-authorization@1.0.0-beta.25
+  - @nocobase/db@1.0.0-beta.18
+  - @nocobase/config@0.1.0-beta.2
+  - @nocobase/i18n@1.0.0-beta.5
+  - @nocobase/service-provider@0.0.2-beta.1
+
+## 0.0.1
+
+### Patch Changes
+
+- Add the initial plugin scaffold.

package/README.md

@@ -1,3 +1,119 @@
-# Temporary Holding Version
+# @nocobase/app-plugin-releases
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Release management for a NocoBase application: Apps (always running or started on demand, stopped when idle), releases, environments, deployments and rollbacks, configuration with write-only secrets, logs, upload tickets and deployment requests with approval. CI uses an API key with a scope (see below). Deployment targets are pluggable drivers; the plugin ships the `host` driver, which deploys through App Hosts in process or in Docker containers (see below).
+
+The plugin is generic. It knows nothing about projects, issues, agents or roles: it declares what can be granted (`shared/access.ts`) and the application that assembles it decides who holds what.
+
+## Assembling it
+
+Server: list `@nocobase/app-plugin-releases/server` with the authentication and authorization plugins, add a `releases` configuration section (`ReleasesPluginConfig`) and bind the ports:
+
+| Token                  | What the application provides                                                                                                                                                                                                                                                                                                            |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `releasesAccessToken`  | `ReleasesAccess`: each caller's `ReleasesPermissions` (pages, settings, the nine `rel.apps` actions at none/related/all), optionally `actorKindOf` (marks agents), `relatedAppIds` / `isRelated` (widens "related" beyond the Apps a user created) and `approversOf` (who decides deployment requests). Unbound, everyone holds nothing. |
+| `releasesDriversToken` | Register more `DeploymentDriver`s (Kubernetes, say). `host` is registered when `releases.host.enabled`.                                                                                                                                                                                                                                  |
+| `releasesEventsToken`  | Subscribe to `app.created`, `app.removed`, `release.created`, `deployment.succeeded`, `deployment.failed`, `deployment.rolledBack`, `request.created` (with the approvers to notify) and `request.decided`. The plugin sends no notifications itself.                                                                                    |
+| `releasesToken`        | The services, to call in process with a `Caller` (`callerForUser(userId, 'human' \| 'agent' \| 'rule')`).                                                                                                                                                                                                                                |
+| `releasesHostToken`    | `proxyTarget()` of the local Host, for a listener that forwards traffic outside the application's own mount.                                                                                                                                                                                                                             |
+
+Environment credentials and registry passwords are sealed with the application's secrets service, so the application registers `SecretsProvider` and sets `secrets.keys`; without them, storing or reading credentials answers `SECRETS_NOT_CONFIGURED` (503). Both tables are registered as secrets stores, so `pnpm nocobase secrets rotate` reseals them.
+
+Client: list `@nocobase/app-plugin-releases/client`. Pass `routes: false` and use `@nocobase/app-plugin-releases/client/pages` to place the pages yourself; otherwise they mount at `/releases` and `/release-environments` (paths are options), with an App's page at `:appId` (Overview, Deployments, Variables, Settings) and an environment's at `:environmentId` (Overview, Variables, Settings) below them, the tab in `?tab=`. An application that mounts the pages elsewhere provides `ReleasesPathsContext` (or wraps them with `withReleasesPaths`) so they link to one another.
+
+## CI and API keys with a scope
+
+The plugin has no keys of its own. The API is authenticated by the application, which accepts a person's session or an API key, and opts into scoped keys (`auth.required({ scopedKeys: true })`). A request made with a scoped key (or any key of a service account) carries the key's `KeyScope` on its identity, and `callerOf` turns it into a `key` caller: its permissions are cut down to what the scope covers, and the Apps it reaches to the ones the scope picked (`keyScope.objects('rel.apps')`), for listing as well as every App check.
+
+`shared/access.ts` declares what a key's scope may hold, for the application to hand to the API keys plugin: the `releases.apps` group (read: see Apps, releases, deployments and logs; write: also upload, deploy and start or stop; may be limited to some Apps, whose source is `releasesKeyScopeObjects(() => services)`), the `releases.environments` group, and the "CI deploy" preset (`releases.apps` read and write on the Apps chosen, 90 days). Configuring, creating and deleting Apps are not offered to keys.
+
+## HTTP API
+
+Everything is under `/api/releases` and follows the application's HTTP API rules: `{ data }`, lists as `{ data, meta }`, and failures in the standard error body with domain `releases` and a stable `reason` (`APP_NOT_FOUND`, `CONFIRMATION_REQUIRED`, …). A route refuses a caller who may not use it at all (`403`) before it reads the input, and the input is checked against a schema (`400 INVALID_INPUT`, domain `app`, unknown body fields included) before the services check the record.
+
+| Resource            | Routes                                                                                                                                                                                                                                                                                                                                                                    |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Caller              | `GET /me`                                                                                                                                                                                                                                                                                                                                                                 |
+| Drivers             | `GET /drivers` (`meta.total`)                                                                                                                                                                                                                                                                                                                                             |
+| Environments        | `GET`, `POST /environments`; `GET`, `PATCH`, `DELETE /environments/:environmentId`; `POST /environments/check` (unsaved settings), `POST /environments/:environmentId/check`                                                                                                                                                                                              |
+| Registries          | the same under `/registries`, `/registries/check` and `/registries/:registryId/check`                                                                                                                                                                                                                                                                                     |
+| Apps                | `GET /apps` (`q`, `environmentId`, `label=key=value`, `page`, `pageSize`), `POST /apps`; `GET`, `PATCH`, `DELETE /apps/:appId?confirm=<appId>`; `POST /apps/:appId/{start,stop,restart}`; `GET`, `PUT /apps/:appId/config`                                                                                                                                                |
+| Variables           | `GET /environments/:environmentId/variables`, `PUT`, `DELETE …/variables/:name`; `GET /environments/:environmentId/declaredVariables`; `GET /apps/:appId/variables` (`releaseId`), `PUT`, `DELETE /apps/:appId/variables/:name` (`scope`); `GET /apps/:appId/releases/:releaseId/variables`; `GET /apps/:appId/initialAdmin`, `POST /apps/:appId/initialAdmin/dismiss`    |
+| Releases            | `GET /apps/:appId/releases` (paged), `POST /apps/:appId/releases` (the archive as the body: `201`, `202` when it also deploys, `200` when it is a release already uploaded), `GET`, `PATCH /apps/:appId/releases/:releaseId`, `GET …/configTemplate`, `POST …/promote`, `POST /apps/:appId/imageReleases`, `POST /apps/:appId/uploadTickets`                              |
+| Deployments         | `POST /apps/:appId/deploy` and `/rollback` (`202` with the deployment), `GET /apps/:appId/deployments` (paged), `GET /apps/:appId/deployments/:deploymentId`, `GET /apps/:appId/logs` and `GET /apps/:appId/deployments/:deploymentId/logs` (`pageToken`, `q`, `level`, `source`, `since`, `until`, `fromStart`; entries as `data`, `meta.nextPageToken` to read on from) |
+| Deployment requests | `GET /deploymentRequests` (`appId`, `status`, `awaitingMe`, paged), `POST /apps/:appId/deploymentRequests`, `GET /deploymentRequests/:requestId`, `POST /deploymentRequests/:requestId/{approve,reject,cancel}`                                                                                                                                                           |
+
+`check` is a fixed segment beside environment and registry IDs, so neither may be called `check`.
+
+## Rules the plugin enforces
+
+- An agent or a key never configures or deletes an App, or decides a deployment request, whatever it holds.
+- A protected environment takes every deployment, rollbacks included, through a deployment request someone else (a person, not the requester) approves, typing the App ID again; nobody deploys there directly (`APPROVAL_REQUIRED`), and an upload ticket cannot deploy there. Anyone who may deploy the App, a key or an agent included, may make the request. Its approvers are the environment's `approvers` as the application resolves them (`ReleasesAccess.approversOf`); with nobody named, whoever holds `deploy-protected` on the App.
+- Upload tickets are single use and expire; they act with what their issuer may still do. A key acts with what its owner may still do, within its scope.
+
+## Releases: archives and images
+
+A release is one of two kinds (`kind`):
+
+- `archive`: the `.tar.gz` a CI job built and uploaded (`POST /apps/:appId/releases`, `acme release upload`), identified by its checksum, plus the commit and build it came from when the upload says so (`x-release-source-commit`, `x-release-build`). In-process environments run it.
+- `image`: an OCI image a CI job built and pushed to a registry, registered by digest with `POST /apps/:appId/imageReleases` (`{ version, ref, digest, platform?, sourceCommit?, build?, labels? }`, `acme release image`). It needs `upload` on the App, so a CI key that may upload may register too. Docker environments run it, pulled by digest. Registering the same digest again answers its release (`reused`); an image for another platform joins the image release of the same version; another digest for a platform the release has is refused (`IMAGE_CONFLICT`), because a release's image never changes. Its images are recorded in `relReleaseArtifacts`, and the release reads answer them as `artifacts`.
+
+A promoted release carries its source's images, and an image registered later reaches the releases promoted from it, so staging and production run the same digest. Each deployment records what it ran (`DeploymentView.artifact`): `tarball` for the archive in process, `image` with the digest it pulled. A deployment the environment cannot run is refused before it starts: an archive in a Docker environment, or an image release without an image in the environment's registry (`IMAGE_REQUIRED`), and an image release in an in-process environment (`ARCHIVE_REQUIRED`).
+
+Image registries (`/registries`, behind `rel.environments`: read lists them, manage changes them) are any OCI Distribution registry: an address, the namespace release images go under, and a write-only pull credential. The username is kept in the clear, the password sealed with the application's secrets service (`secrets.keys`), as an environment's credentials are; `secretKeys` says whether it is set and `secretChanges` replaces (a value) or removes (`null`) it. `POST /registries/check` tries unsaved settings and `POST /registries/:registryId/check` stored ones: `/v2/` anonymously, then the credential with Basic authentication or a token from the realm a Bearer challenge names. CI pushes with its own credentials; nothing here pushes. An environment names the registry it pulls from (`registryId`); for a driver with `capabilities.images`, a deployment hands the driver the release's images in that registry with its pull credentials (`AppDeploymentSpec.images`, `registryAuth`), and the driver reports what it ran (`DeploymentEvent.artifact`).
+
+## When Apps run
+
+Each App has a runtime policy (`activation`, `idleStopMinutes`, `dormantAfterHours` on create and `PATCH /apps/:appId`):
+
+- `activation: 'eager'` (the default) starts the App when it is deployed and whenever the runtime restarts; `'onDemand'` starts it by its first request after a deployment or a runtime restart. A deployment always starts the App once, so it proves the release runs.
+- `idleStopMinutes` stops the App after that many minutes without a request; the next request starts it again (a browser gets a short "starting" page that refreshes itself, API calls wait). `null` never stops it.
+- `dormantAfterHours` (fractions allowed, at least one minute) makes it dormant after that long without a request: stopped, with its unpacked release removed while its record, releases, configuration and data stay; the next request prepares it again from the stored release. It must be longer than the idle stop. `null` never does.
+
+An App created without `idleStopMinutes` or `dormantAfterHours` takes its environment's `defaultIdleStopMinutes` and `defaultDormantAfterHours` (null: never), and an environment holds at most `maxApps` Apps.
+
+A changed policy reaches the runtime without restarting the App. The App summary's `runtime.state` adds `starting` and `dormant`, and `runtime.lastAccessedAt` tells when it was last requested. A driver declares `capabilities.onDemand` when it honours the policy; the local Host driver does, and on other drivers the policy is stored but the App keeps running. Removing an App and its data is always an explicit `DELETE`, never a timer: Apps do not expire. Stops and dormancies count towards the Host's `restartAfterChurn`, which waits while an on-demand App is running; the Host settings `sweepIntervalSeconds`, `activationHoldMs` and `activationWaitMs` tune how often timers are checked and how long requests wait for a starting App.
+
+Labels are opaque to the plugin. An assembling application that adds labels of its own may provide `ReleasesSystemLabelsContext` (client) with `explain(key, value)`; Apps lists and an App's page then leave those labels out (showing the application's `Summary`, below, in their place), its Settings tab shows them read-only with the explanation on hover, and editing the others keeps them. The create and upload dialogs and an App's Settings tab edit labels as rows of a name and a value under "Advanced (optional)".
+
+Create App opens over the Apps page at `new`, so an App may not be called `new` or `requests`. A deployment request opens as a dialog (`ReleasesRequestPage`) over its App's page at `:appId/requests/:requestId`, and over the Apps page at `requests/:requestId` for older links. An App's pending request (there is at most one) is the first row of its deployments, on the Overview and the Deployments tab, with Review for an approver and View for anyone else; an approver also sees a one-line notice under the App's header. The dialog says what would run where and who asked, and an approver adds an optional comment and approves or rejects there; the comment is the decision note the requester is told. The Apps list marks an App with a pending request "Pending approval" beside its state. An application that builds Apps from something of its own may say where an App comes from by providing `ReleasesAppOriginContext` (client) with an `Origin` component, which the App's Overview renders under its details, and optionally a `Summary` component, a one-line description lists and the App's header show in place of its system labels; each renders nothing for an App it does not know. The assembling application uses them to name the repository that builds the App, and a preview's pull request.
+
+Such an application may also say what deleting an App affects beyond the plugin's records by providing `ReleasesDeleteAppImpactContext` (client) with an `Impact` component, given the App's ID. The Delete App confirmation shows it under its own description; the component loads and words what it needs and renders nothing when nothing uses the App. The plugin's `app.removed` event is where the application then cleans up after the App.
+
+`GET /api/releases/environments` answers each environment's `capabilities`: whether it runs uploaded release archives (`archives`) or release images CI registers (`images`), and whether it honours an App's runtime policy (`onDemand`).
+
+## Configuration and its secrets
+
+Each deployment of an App in file mode stores its `config.yml` under `releases.dataDir` (mode 0600) and hands it to the runtime as written. Whatever leaves the server sees it masked (`server/services/config-secrets.ts`): `GET /apps/:appId/config`, the answer of `PUT`, the release's `configTemplate` and the services the CLI calls replace every secret value with `CONFIG_SECRET_MASK` (`••••••••`) and list the masked paths in `secrets`. A value is a secret when its nearest key names one by its last word (`password`, `secret`, `token`, `key`, `dsn`, `credential`, `salt`, `authorization`, … but not `publicKey` or `primaryKey`), when it is a URL with a password, or when it equals or contains a secret found that way. There is no way to read a value back through the API; an operator who needs one reads the file on the server.
+
+`PUT /apps/:appId/config` takes `{ content, secretChanges? }`. A mask left in place keeps the stored value at its path (a mask where nothing is stored is refused with `CONFIG_SECRET_NOT_STORED`); a value typed over it replaces it. `secretChanges` (`[{ path, value }]`, `null` removes) replace or clear one secret without showing the others, which is what the App page's "Set · Replace · Clear" list sends. A deployment given `config.content` restores masks the same way, so content read from the API can be deployed again. Each deployment makes sure the App has `secrets.keys`, `auth.secret` and `session.secret`: one missing, empty or left at the placeholder takes the value the App already uses, or a generated one. One whose variable the build declares is generated as that variable instead (see Variables). An App built from a template older than `secrets.keys` still needs the other two. Clearing one makes the plugin restore the stored value; changing `secrets.keys`, `auth.secret` or `session.secret` signs everyone out of the App.
+
+## Variables
+
+A build declares the environment variables it reads in `dist/variables.json`, which `pnpm build` writes and `pnpm build --tar` packs; the plugin keeps it on the release (`ReleaseView.variables` on the list; `GET …/releases/:releaseId/variables`), and an image release takes it from CI (`variables` of `POST /apps/:appId/imageReleases`, `--variables-file dist/variables.json`). A manifest that is not one is refused (`INVALID_VARIABLES_MANIFEST`); a build without one deploys as before, with only the values someone set.
+
+Values are set per environment (`rel.environments` `manage`) and per App (`configure`), and sealed with the secrets service whether they are secrets or not (`relEnvironmentVariables`, `relAppVariables`, both secrets stores). An App created with `previewOf` is a preview of that App and is removed with it; it takes none of that App's values, only its own and its environment's. Names the runtime sets itself (`NODE_ENV`, `APP_BASE_PATH`, `APP_SERVER_HOST`, `APP_SERVER_PORT`, `APP_CONFIG_FILE`, `PATH`, `HOME`) are refused (`VARIABLE_RESERVED`). A secret's value never leaves the server.
+
+Which variables an App has is declared by its most recent build: its newest release (uploaded or promoted to it) that carries a manifest, else the release it runs, else its newest (`GET /apps/:appId/variables` answers which in `meta.releaseId` and `meta.releaseVersion`; `AppSummary.variables` reads the same one). The Variables tab of an App's page lists what that build declares with where each value comes from (the App, its environment, `config.yml`, generated, the build's default, or unset), the required ones nothing sets first, an environment's value overridable in one click, and what the App or its environment set that the build does not declare under "Undeclared"; before any build it lists the App's own values. The Variables tab of an environment's page lists its values together with what the most recent build of each of its Apps declares (`GET /environments/:environmentId/declaredVariables`: the declaring Apps, whether the environment sets it, and the Apps that require it and would get no value), pull request previews named `<app>-pr-<number>` folded into one entry. Values are set one at a time, or edited together as `.env` text whose changes are shown before anything is sent, one `PUT` or `DELETE` per variable. The text holds only plain values: a line replaces a Secret, and leaving one out keeps it.
+
+Each deployment resolves them, strongest first: the App's value, the environment's, then the App's `config.yml` (which a variable would override at runtime), what the plugin generates, and the build's defaults. A required variable nothing supplies refuses the deployment, a rollback, a deployment request when it is made and when it is approved, and an upload that would deploy (the release is kept) with `VARIABLES_MISSING` (`400`), naming the variables in `metadata.variables` with the App's `appId` and `environmentId`, so a client can link to both places a value can be set. The plugin generates what the manifest lets it: a secret with `generate` (`SECRETS_KEYS`, `AUTH_SECRET`, `SESSION_SECRET`) once, kept as the App's value (`generated`), instead of writing it into `config.yml`; `APP_PUBLIC_ORIGIN` from the App's URL (one under a path of this application takes its `app.publicOrigin`); `APP_SAMPLE_DATA=true` on a first deployment where the environment has `sampleDataOnFirstDeploy`; and on a first deployment whose administrator password nothing names (the example's `admin123` counts as none), `INITIAL_ADMIN_PASSWORD`. The deployment keeps what it ran with, sealed, and gives it to the driver (`AppDeploymentSpec.env`): the Host hands it to the in-process App's scope, the Docker Host to the container after its own fixed variables. Its log names the variables and their sources, never a value. `AppSummary.variables.changed` tells that a value changed since (one read only on the first start does not count); deploying the release again applies it.
+
+The generated first administrator is sealed on the deployment: `GET /apps/:appId/initialAdmin` answers it to a person who may deploy the App (agents and keys are refused, and it is not a CLI command) until someone saves it (`POST …/initialAdmin/dismiss`) or 24 hours pass; a preview App's stays until the App goes. Nothing else is shown again.
+
+## Deploying previews
+
+A preview served under another origin needs `app.publicOrigin`; the plugin fills it from the App's public URL when the configuration does not set it (as `APP_PUBLIC_ORIGIN` when the build declares that variable). Keep the application's own session cookie scoped to its own path or origin, since Apps on the same Host share the listener's origin. The Host runtime takes the supervisor's `env.allow`, `uid` / `gid` and `launchPrefix` so Apps cannot read the application's secrets, and `restartAfterChurn` to reclaim the memory of replaced, removed, stopped or dormant in-process Apps.
+
+## The `host` driver
+
+The `host` driver deploys over the App Host management service (`@nocobase/app-host/management`, see the App Host README). An environment of driver `host` holds `{ backend, backendConfig? }` as its settings, its run mode and that backend's settings, and the backend's credentials as its write-only secret. Each environment is one scope on its Host: its own desired set with its own revision, so restoring one environment never touches another's Apps on the same Host, and an App belongs to one scope only.
+
+| `backend`    | Where Apps run                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `in-process` | The App Host child this plugin starts with `releases.host.enabled`, which runs release archives in its own process, with on-demand start, idle stop and dormancy. It takes no settings and no credentials.                                                                                                                                                                                                                                    |
+| `docker`     | A second Host child, started with `releases.docker.enabled`, that runs each App's release image in its own container (`@nocobase/app-host-docker`): pulled by digest, health-gated start-first switch, routing and on-demand start through its listener. It uses the local Docker Engine (`DOCKER_HOST`, else the current Docker context) with built-in container settings, so it takes no settings; its only credentials are the registry's. |
+
+The in-process Host runs App code under preview, so it never holds Docker access and never receives an environment's credentials; the Docker Host runs no App code (`trustedApps` is refused otherwise), so Docker access and the registry credentials sit only there. The driver checks a Docker environment with the Docker Host (`checkScope`) before it is saved, and its connection test reports the Docker endpoint it found and what Docker answers. `capabilitiesOf` and `variants` tell the forms which run mode runs images and which offers subdomain URLs.
+
+## Deployments that outlive the process
+
+A Host records each deployment's outcome under its deployment ID in an operation log that outlives the Host process (`host.controlDir`). At startup the plugin asks each environment's session for the `operation` of every deployment still marked `deploying`, records what the Host reports (one that finished while this application restarted succeeds and becomes the App's current deployment), and only then sends the environment its desired set; one the Host never saw is marked interrupted. A Host child that is told to stop lets a deployment under way finish and record its outcome first. Docker containers keep running while their Host restarts, and the Host adopts them again. Readers of Apps and deployments wait up to five seconds at startup for all of this.

package/dist/client/components/actor-name.d.ts

@@ -0,0 +1,5 @@
+/** An operator, requester or decider: the application's rendering (`ReleasesActorNameContext`), else the id. */
+import { type ReactElement } from 'react';
+import { type ActorNameProps } from '../lib/actor-names.js';
+export declare function ActorName({ id, kind }: ActorNameProps): ReactElement;
+//# sourceMappingURL=actor-name.d.ts.map

package/dist/client/components/actor-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-name.d.ts","sourceRoot":"","sources":["../../../client/components/actor-name.tsx"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAEtD,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,wBAAgB,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,GAAG,YAAY,CAIpE"}

package/dist/client/components/actor-name.js

@@ -0,0 +1,11 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/** An operator, requester or decider: the application's rendering (`ReleasesActorNameContext`), else the id. */
+import { useContext } from 'react';
+import { ReleasesActorNameContext, } from '../lib/actor-names.js';
+export function ActorName({ id, kind }) {
+    const names = useContext(ReleasesActorNameContext);
+    if (names)
+        return _jsx(names.Name, { id: id, kind: kind });
+    return _jsx("span", { className: 'font-mono text-xs', children: id });
+}
+//# sourceMappingURL=actor-name.js.map

package/dist/client/components/actor-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-name.js","sourceRoot":"","sources":["../../../client/components/actor-name.tsx"],"names":[],"mappings":";AAAA,gHAAgH;AAChH,OAAO,EAAE,UAAU,EAAqB,MAAM,OAAO,CAAC;AAEtD,OAAO,EACL,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,UAAU,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAkB;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,wBAAwB,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,OAAO,KAAC,KAAK,CAAC,IAAI,IAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAI,CAAC;IACrD,OAAO,eAAM,SAAS,EAAC,mBAAmB,YAAE,EAAE,GAAQ,CAAC;AACzD,CAAC"}

package/dist/client/components/advanced-section.d.ts

@@ -0,0 +1,8 @@
+import { type ReactElement, type ReactNode } from 'react';
+export declare function AdvancedSection({ children, defaultOpen, summary, }: {
+    readonly children: ReactNode;
+    readonly defaultOpen?: boolean;
+    /** What is set inside, shown next to the title while it is folded. */
+    readonly summary?: string | null;
+}): ReactElement;
+//# sourceMappingURL=advanced-section.d.ts.map

package/dist/client/components/advanced-section.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced-section.d.ts","sourceRoot":"","sources":["../../../client/components/advanced-section.tsx"],"names":[],"mappings":"AAGA,OAAO,EAAY,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AASpE,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,WAAmB,EACnB,OAAO,GACR,EAAE;IACD,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,YAAY,CAwBf"}

package/dist/client/components/advanced-section.js

@@ -0,0 +1,13 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/** Optional settings folded under "Advanced (optional)" in a dialog, open once someone asks for them. */
+import { useTranslation } from '@nocobase/i18n/client';
+import { ChevronRightIcon } from 'lucide-react';
+import { useState } from 'react';
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+import { Collapsible, CollapsibleContent, CollapsibleTrigger, } from './ui/collapsible.js';
+export function AdvancedSection({ children, defaultOpen = false, summary, }) {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    const [open, setOpen] = useState(defaultOpen);
+    return (_jsxs(Collapsible, { open: open, onOpenChange: setOpen, className: 'flex flex-col gap-4', children: [_jsxs(CollapsibleTrigger, { className: 'group/advanced flex w-fit items-center gap-1 text-sm font-medium text-muted-foreground hover:text-foreground', children: [_jsx(ChevronRightIcon, { className: 'size-4 transition-transform group-data-[panel-open]/advanced:rotate-90', "aria-hidden": 'true' }), t('ui.advanced'), !open && summary ? (_jsxs("span", { className: 'font-normal', children: ["\u00B7 ", summary] })) : null] }), _jsx(CollapsibleContent, { className: 'flex flex-col gap-5', children: children })] }));
+}
+//# sourceMappingURL=advanced-section.js.map

package/dist/client/components/advanced-section.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced-section.js","sourceRoot":"","sources":["../../../client/components/advanced-section.tsx"],"names":[],"mappings":";AAAA,yGAAyG;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAqC,MAAM,OAAO,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,WAAW,GAAG,KAAK,EACnB,OAAO,GAMR;IACC,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,CACL,MAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,OAAO,EACrB,SAAS,EAAC,qBAAqB,aAE/B,MAAC,kBAAkB,IAAC,SAAS,EAAC,8GAA8G,aAC1I,KAAC,gBAAgB,IACf,SAAS,EAAC,wEAAwE,iBACtE,MAAM,GAClB,EACD,CAAC,CAAC,aAAa,CAAC,EAChB,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAClB,gBAAM,SAAS,EAAC,aAAa,wBAAI,OAAO,IAAQ,CACjD,CAAC,CAAC,CAAC,IAAI,IACW,EACrB,KAAC,kBAAkB,IAAC,SAAS,EAAC,qBAAqB,YAChD,QAAQ,GACU,IACT,CACf,CAAC;AACJ,CAAC"}

package/dist/client/components/app-settings-card.d.ts

@@ -0,0 +1,7 @@
+import { type ReactElement } from 'react';
+import type { AppSummary } from '../../shared/releases.js';
+export declare function AppSettingsCard({ summary, onSaved, }: {
+    readonly summary: AppSummary;
+    readonly onSaved: () => void;
+}): ReactElement;
+//# sourceMappingURL=app-settings-card.d.ts.map

package/dist/client/components/app-settings-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-settings-card.d.ts","sourceRoot":"","sources":["../../../client/components/app-settings-card.tsx"],"names":[],"mappings":"AAMA,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAGpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AA6B3D,wBAAgB,eAAe,CAAC,EAC9B,OAAO,EACP,OAAO,GACR,EAAE;IACD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,GAAG,YAAY,CA8Ff"}

package/dist/client/components/app-settings-card.js

@@ -0,0 +1,69 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * An App's runtime policy and labels, on its Settings tab: a card saved on its own. Labels the assembling application
+ * added stay as they are and show read-only; the rest are edited as rows. A policy change reaches the runtime without
+ * restarting the App.
+ */
+import { useTranslation } from '@nocobase/i18n/client';
+import { useState } from 'react';
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+import { useNotify } from '../hooks/use-notify.js';
+import { useReleasesApi } from '../hooks/use-releases.js';
+import { labelRowErrors, labelsOf, newLabelRow, } from '../lib/labels.js';
+import { parsePolicyDraft, policyDraft, } from '../lib/runtime-policy.js';
+import { useSystemLabels } from '../lib/system-labels.js';
+import { LabelsEditor } from './labels-editor.js';
+import { RuntimePolicyFields } from './runtime-policy-fields.js';
+import { Button } from './ui/button.js';
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, } from './ui/card.js';
+import { Field, FieldGroup, FieldLabel, FieldSeparator } from './ui/field.js';
+import { Spinner } from './ui/spinner.js';
+export function AppSettingsCard({ summary, onSaved, }) {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    const api = useReleasesApi();
+    const notify = useNotify();
+    const systemOf = useSystemLabels();
+    const system = systemOf(summary.app.labels);
+    const initialRows = () => Object.entries(summary.app.labels)
+        .filter(([key]) => !(key in system))
+        .map(([key, value]) => newLabelRow(key, value));
+    const [policy, setPolicy] = useState(() => policyDraft(summary.app));
+    const [rows, setRows] = useState(initialRows);
+    const [dirty, setDirty] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const parsed = parsePolicyDraft(policy);
+    const labelsValid = labelRowErrors(rows, Object.keys(system)).size === 0;
+    const submit = async (event) => {
+        event.preventDefault();
+        if (!parsed.policy || !labelsValid)
+            return;
+        setBusy(true);
+        try {
+            await api.send('PATCH', `apps/${summary.app.id}`, {
+                ...parsed.policy,
+                labels: { ...labelsOf(rows), ...system },
+            });
+            notify.success(t('ui.settings.saved'));
+            setDirty(false);
+            onSaved();
+        }
+        catch (reason) {
+            notify.error(reason);
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (_jsxs(Card, { "data-slot": 'app-settings', children: [_jsxs(CardHeader, { children: [_jsx(CardTitle, { children: t('ui.settings.edit') }), _jsx(CardDescription, { children: t('ui.settings.editDescription') })] }), _jsx(CardContent, { children: _jsx("form", { id: 'rel-app-settings', onSubmit: (event) => void submit(event), children: _jsxs(FieldGroup, { children: [_jsx(RuntimePolicyFields, { value: policy, onChange: (next) => {
+                                    setPolicy(next);
+                                    setDirty(true);
+                                } }), _jsx(FieldSeparator, {}), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t('ui.apps.labels') }), _jsx(LabelsEditor, { rows: rows, onChange: (next) => {
+                                            setRows(next);
+                                            setDirty(true);
+                                        }, systemLabels: system })] })] }) }) }), _jsxs(CardFooter, { className: 'justify-end gap-2', children: [dirty ? (_jsx(Button, { variant: 'outline', disabled: busy, onClick: () => {
+                            setPolicy(policyDraft(summary.app));
+                            setRows(initialRows());
+                            setDirty(false);
+                        }, children: t('ui.config.discard') })) : null, _jsxs(Button, { type: 'submit', form: 'rel-app-settings', disabled: busy || !dirty || !parsed.policy || !labelsValid, children: [busy ? _jsx(Spinner, { "data-icon": 'inline-start' }) : null, t('ui.settings.save')] })] })] }));
+}
+//# sourceMappingURL=app-settings-card.js.map

package/dist/client/components/app-settings-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-settings-card.js","sourceRoot":"","sources":["../../../client/components/app-settings-card.tsx"],"names":[],"mappings":";AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAqC,MAAM,OAAO,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,QAAQ,EACR,WAAW,GAEZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,WAAW,GAEZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,IAAI,EACJ,WAAW,EACX,eAAe,EACf,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,UAAU,eAAe,CAAC,EAC9B,OAAO,EACP,OAAO,GAIR;IACC,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAe,EAAE,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAqB,GAAG,EAAE,CAC5D,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CACzB,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAa,WAAW,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAAiB,EAAE;QACvD,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW;YAAE,OAAO;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;gBAChD,GAAG,MAAM,CAAC,MAAM;gBAChB,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE;aACzC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACvC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,MAAC,IAAI,iBAAW,cAAc,aAC5B,MAAC,UAAU,eACT,KAAC,SAAS,cAAE,CAAC,CAAC,kBAAkB,CAAC,GAAa,EAC9C,KAAC,eAAe,cAAE,CAAC,CAAC,6BAA6B,CAAC,GAAmB,IAC1D,EACb,KAAC,WAAW,cACV,eAAM,EAAE,EAAC,kBAAkB,EAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,YACjE,MAAC,UAAU,eACT,KAAC,mBAAmB,IAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;oCACjB,SAAS,CAAC,IAAI,CAAC,CAAC;oCAChB,QAAQ,CAAC,IAAI,CAAC,CAAC;gCACjB,CAAC,GACD,EACF,KAAC,cAAc,KAAG,EAClB,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,gBAAgB,CAAC,GAAc,EAC9C,KAAC,YAAY,IACX,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;4CACjB,OAAO,CAAC,IAAI,CAAC,CAAC;4CACd,QAAQ,CAAC,IAAI,CAAC,CAAC;wCACjB,CAAC,EACD,YAAY,EAAE,MAAM,GACpB,IACI,IACG,GACR,GACK,EACd,MAAC,UAAU,IAAC,SAAS,EAAC,mBAAmB,aACtC,KAAK,CAAC,CAAC,CAAC,CACP,KAAC,MAAM,IACL,OAAO,EAAC,SAAS,EACjB,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,GAAG,EAAE;4BACZ,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;4BACpC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;4BACvB,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAClB,CAAC,YAEA,CAAC,CAAC,mBAAmB,CAAC,GAChB,CACV,CAAC,CAAC,CAAC,IAAI,EACR,MAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,kBAAkB,EACvB,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,aAEzD,IAAI,CAAC,CAAC,CAAC,KAAC,OAAO,iBAAW,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,EAClD,CAAC,CAAC,kBAAkB,CAAC,IACf,IACE,IACR,CACR,CAAC;AACJ,CAAC"}

package/dist/client/components/artifacts.d.ts

@@ -0,0 +1,9 @@
+import type { ReactElement } from 'react';
+import type { DeploymentArtifact, ReleaseView } from '../../shared/releases.js';
+export declare function ReleaseArtifacts({ release, }: {
+    readonly release: ReleaseView;
+}): ReactElement;
+export declare function DeploymentArtifactTag({ artifact, }: {
+    readonly artifact: DeploymentArtifact | null;
+}): ReactElement;
+//# sourceMappingURL=artifacts.d.ts.map

package/dist/client/components/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../client/components/artifacts.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAOhF,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,GACR,EAAE;IACD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B,GAAG,YAAY,CAwCf;AAED,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC9C,GAAG,YAAY,CA0Bf"}

package/dist/client/components/artifacts.js

@@ -0,0 +1,26 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * A release's artifacts and what a deployment ran. An archive release lists its archive; an image release its OCI
+ * images by platform and digest. A deployment shows the digest it pulled or the archive it ran in process.
+ */
+import { useTranslation } from '@nocobase/i18n/client';
+import { BoxIcon, PackageIcon } from 'lucide-react';
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+/** `sha256:0123456789ab…` → `0123456789ab`. */
+function shortDigest(digest) {
+    return digest.replace(/^sha256:/u, '').slice(0, 12);
+}
+export function ReleaseArtifacts({ release, }) {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    const images = (release.artifacts ?? []).filter((artifact) => artifact.kind === 'oci-image');
+    return (_jsxs("ul", { className: 'flex min-w-0 flex-col gap-1', "data-slot": 'release-artifacts', children: [release.kind === 'archive' ? (_jsxs("li", { className: 'flex items-center gap-1.5 text-xs', title: `${t('ui.artifacts.tarball')} sha256:${release.checksum}`, children: [_jsx(PackageIcon, { className: 'size-3.5 shrink-0 text-muted-foreground' }), _jsx("span", { className: 'text-muted-foreground', children: t('ui.artifacts.tarball') }), _jsx("span", { className: 'font-mono', children: release.checksum.slice(0, 12) })] })) : null, images.map((image) => (_jsxs("li", { className: 'flex min-w-0 items-center gap-1.5 text-xs', title: `${image.ref}@${image.digest}`, "data-slot": 'release-image', children: [_jsx(BoxIcon, { className: 'size-3.5 shrink-0 text-muted-foreground' }), _jsx("span", { className: 'text-muted-foreground', children: t('ui.artifacts.image') }), _jsxs("span", { className: 'truncate font-mono', children: [image.ref.split('/').slice(-1)[0], "@", shortDigest(image.digest)] }), _jsx("span", { className: 'shrink-0 text-muted-foreground', children: image.platform })] }, image.id)))] }));
+}
+export function DeploymentArtifactTag({ artifact, }) {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    if (!artifact)
+        return _jsx("span", { className: 'text-muted-foreground', children: "\u2014" });
+    if (artifact.kind === 'image')
+        return (_jsxs("span", { className: 'inline-flex min-w-0 items-center gap-1.5 text-xs', title: `${artifact.ref}@${artifact.digest} (${artifact.platform})`, "data-slot": 'deployment-artifact', "data-kind": 'image', children: [_jsx(BoxIcon, { className: 'size-3.5 shrink-0 text-muted-foreground' }), _jsx("span", { className: 'font-mono', children: shortDigest(artifact.digest) }), _jsx("span", { className: 'text-muted-foreground', children: artifact.platform })] }));
+    return (_jsxs("span", { className: 'inline-flex items-center gap-1.5 text-xs text-muted-foreground', "data-slot": 'deployment-artifact', "data-kind": 'tarball', children: [_jsx(PackageIcon, { className: 'size-3.5 shrink-0' }), t('ui.artifacts.ranTarball')] }));
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/client/components/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../../client/components/artifacts.tsx"],"names":[],"mappings":";AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,+CAA+C;AAC/C,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,GAGR;IACC,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAC5C,CAAC;IACF,OAAO,CACL,cAAI,SAAS,EAAC,6BAA6B,eAAW,mBAAmB,aACtE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC5B,cACE,SAAS,EAAC,mCAAmC,EAC7C,KAAK,EAAE,GAAG,CAAC,CAAC,sBAAsB,CAAC,WAAW,OAAO,CAAC,QAAQ,EAAE,aAEhE,KAAC,WAAW,IAAC,SAAS,EAAC,yCAAyC,GAAG,EACnE,eAAM,SAAS,EAAC,uBAAuB,YACpC,CAAC,CAAC,sBAAsB,CAAC,GACrB,EACP,eAAM,SAAS,EAAC,WAAW,YAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAQ,IAC/D,CACN,CAAC,CAAC,CAAC,IAAI,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,cAEE,SAAS,EAAC,2CAA2C,EACrD,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,eAC3B,eAAe,aAEzB,KAAC,OAAO,IAAC,SAAS,EAAC,yCAAyC,GAAG,EAC/D,eAAM,SAAS,EAAC,uBAAuB,YACpC,CAAC,CAAC,oBAAoB,CAAC,GACnB,EACP,gBAAM,SAAS,EAAC,oBAAoB,aACjC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IACzD,EACP,eAAM,SAAS,EAAC,gCAAgC,YAC7C,KAAK,CAAC,QAAQ,GACV,KAdF,KAAK,CAAC,EAAE,CAeV,CACN,CAAC,IACC,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,GAGT;IACC,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,eAAM,SAAS,EAAC,uBAAuB,uBAAS,CAAC;IACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC3B,OAAO,CACL,gBACE,SAAS,EAAC,kDAAkD,EAC5D,KAAK,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,GAAG,eACxD,qBAAqB,eACrB,OAAO,aAEjB,KAAC,OAAO,IAAC,SAAS,EAAC,yCAAyC,GAAG,EAC/D,eAAM,SAAS,EAAC,WAAW,YAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAQ,EACjE,eAAM,SAAS,EAAC,uBAAuB,YAAE,QAAQ,CAAC,QAAQ,GAAQ,IAC7D,CACR,CAAC;IACJ,OAAO,CACL,gBACE,SAAS,EAAC,gEAAgE,eAChE,qBAAqB,eACrB,SAAS,aAEnB,KAAC,WAAW,IAAC,SAAS,EAAC,mBAAmB,GAAG,EAC5C,CAAC,CAAC,yBAAyB,CAAC,IACxB,CACR,CAAC;AACJ,CAAC"}

package/dist/client/components/config-secrets.d.ts

@@ -0,0 +1,10 @@
+import type { ReactElement } from 'react';
+import { type ConfigSecret } from '../../shared/releases.js';
+import { type ConfigSecretDrafts } from '../lib/config-secrets.js';
+export declare function ConfigSecrets({ secrets, drafts, disabled, onChange, }: {
+    readonly secrets: readonly ConfigSecret[];
+    readonly drafts: ConfigSecretDrafts;
+    readonly disabled?: boolean;
+    readonly onChange: (drafts: ConfigSecretDrafts) => void;
+}): ReactElement | null;
+//# sourceMappingURL=config-secrets.d.ts.map

package/dist/client/components/config-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-secrets.d.ts","sourceRoot":"","sources":["../../../client/components/config-secrets.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAKlC,wBAAgB,aAAa,CAAC,EAC5B,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACzD,GAAG,YAAY,GAAG,IAAI,CA2GtB"}

package/dist/client/components/config-secrets.js

@@ -0,0 +1,34 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The secrets an App's `config.yml` holds, write-only like an environment's credentials: each reads "Set" with Replace
+ * and Clear, and its value is never shown. The server masks them in the configuration text (`CONFIG_SECRET_MASK`); a
+ * replacement or a removal is sent beside the text as a `ConfigSecretChange`.
+ */
+import { useTranslation } from '@nocobase/i18n/client';
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+import { formatConfigPath } from '../../shared/releases.js';
+import { configPathKey, } from '../lib/config-secrets.js';
+import { Badge } from './ui/badge.js';
+import { Button } from './ui/button.js';
+import { Input } from './ui/input.js';
+export function ConfigSecrets({ secrets, drafts, disabled, onChange, }) {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    if (secrets.length === 0)
+        return null;
+    const set = (key, draft) => {
+        const next = { ...drafts };
+        if (draft)
+            next[key] = draft;
+        else
+            delete next[key];
+        onChange(next);
+    };
+    return (_jsxs("div", { className: 'space-y-2', "data-slot": 'config-secrets', children: [_jsxs("div", { children: [_jsx("p", { className: 'text-sm font-medium', children: t('ui.config.secrets') }), _jsx("p", { className: 'text-sm text-muted-foreground', children: t('ui.config.secretsHint') })] }), _jsx("ul", { className: 'divide-y rounded-lg border bg-card', children: secrets.map((secret) => {
+                    const key = configPathKey(secret.path);
+                    const label = formatConfigPath(secret.path);
+                    const draft = drafts[key];
+                    const inputId = `rel-config-secret-${encodeURIComponent(key)}`;
+                    return (_jsxs("li", { className: 'flex flex-col gap-2 p-3 sm:flex-row sm:items-center sm:justify-between', children: [_jsx("label", { htmlFor: draft?.mode === 'replace' ? inputId : undefined, className: 'min-w-0 truncate font-mono text-xs', children: label }), draft?.mode === 'replace' ? (_jsxs("div", { className: 'flex flex-wrap items-center gap-2', children: [_jsx(Input, { id: inputId, type: 'password', autoComplete: 'new-password', autoFocus: true, className: 'h-8 w-full sm:w-64', "aria-label": t('ui.config.newValue', { path: label }), value: draft.value, disabled: disabled, onChange: (event) => set(key, { mode: 'replace', value: event.target.value }) }), _jsx(Button, { type: 'button', size: 'sm', variant: 'ghost', disabled: disabled, onClick: () => set(key, null), children: t('ui.driverForm.keepStored') })] })) : draft?.mode === 'clear' ? (_jsxs("div", { className: 'flex flex-wrap items-center gap-2', children: [_jsx(Badge, { variant: 'destructive', children: t('ui.driverForm.secretCleared') }), _jsx(Button, { type: 'button', size: 'sm', variant: 'ghost', disabled: disabled, onClick: () => set(key, null), children: t('ui.driverForm.undo') })] })) : (_jsxs("div", { className: 'flex flex-wrap items-center gap-2', children: [_jsx(Badge, { variant: 'secondary', children: t('ui.driverForm.secretSet') }), _jsx(Button, { type: 'button', size: 'sm', variant: 'outline', disabled: disabled, "aria-label": t('ui.config.replace', { path: label }), onClick: () => set(key, { mode: 'replace', value: '' }), children: t('ui.driverForm.replace') }), _jsx(Button, { type: 'button', size: 'sm', variant: 'ghost', disabled: disabled, "aria-label": t('ui.config.clear', { path: label }), onClick: () => set(key, { mode: 'clear', value: '' }), children: t('ui.driverForm.clear') })] }))] }, key));
+                }) })] }));
+}
+//# sourceMappingURL=config-secrets.js.map

package/dist/client/components/config-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-secrets.js","sourceRoot":"","sources":["../../../client/components/config-secrets.tsx"],"names":[],"mappings":";AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAqB,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,EAC5B,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,GAMT;IACC,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAA+B,EAAQ,EAAE;QACjE,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;;YACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,eAAW,gBAAgB,aACnD,0BACE,YAAG,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAK,EAC/D,YAAG,SAAS,EAAC,+BAA+B,YACzC,CAAC,CAAC,uBAAuB,CAAC,GACzB,IACA,EACN,aAAI,SAAS,EAAC,oCAAoC,YAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;oBACtB,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,OAAO,GAAG,qBAAqB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/D,OAAO,CACL,cAEE,SAAS,EAAC,wEAAwE,aAElF,gBACE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACxD,SAAS,EAAC,oCAAoC,YAE7C,KAAK,GACA,EACP,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAC3B,eAAK,SAAS,EAAC,mCAAmC,aAChD,KAAC,KAAK,IACJ,EAAE,EAAE,OAAO,EACX,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,EAC3B,SAAS,QACT,SAAS,EAAC,oBAAoB,gBAClB,CAAC,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACpD,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAE1D,EACF,KAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,IAAI,EACT,OAAO,EAAC,OAAO,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAE5B,CAAC,CAAC,0BAA0B,CAAC,GACvB,IACL,CACP,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAC5B,eAAK,SAAS,EAAC,mCAAmC,aAChD,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YACzB,CAAC,CAAC,6BAA6B,CAAC,GAC3B,EACR,KAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,IAAI,EACT,OAAO,EAAC,OAAO,EACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAE5B,CAAC,CAAC,oBAAoB,CAAC,GACjB,IACL,CACP,CAAC,CAAC,CAAC,CACF,eAAK,SAAS,EAAC,mCAAmC,aAChD,KAAC,KAAK,IAAC,OAAO,EAAC,WAAW,YACvB,CAAC,CAAC,yBAAyB,CAAC,GACvB,EACR,KAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,IAAI,EACT,OAAO,EAAC,SAAS,EACjB,QAAQ,EAAE,QAAQ,gBACN,CAAC,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACnD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,YAEtD,CAAC,CAAC,uBAAuB,CAAC,GACpB,EACT,KAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,IAAI,EACT,OAAO,EAAC,OAAO,EACf,QAAQ,EAAE,QAAQ,gBACN,CAAC,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACjD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,YAEpD,CAAC,CAAC,qBAAqB,CAAC,GAClB,IACL,CACP,KA3EI,GAAG,CA4EL,CACN,CAAC;gBACJ,CAAC,CAAC,GACC,IACD,CACP,CAAC;AACJ,CAAC"}

package/dist/client/components/confirm-dialog.d.ts

@@ -0,0 +1,22 @@
+import { type ReactElement, type ReactNode } from 'react';
+export interface ConfirmOptions {
+    readonly title: string;
+    readonly description?: string;
+    /** More under the description, such as what else the action affects. */
+    readonly details?: ReactNode;
+    /** The action button's text. */
+    readonly action: string;
+    readonly destructive?: boolean;
+    /** Text the person must type before the action is enabled. */
+    readonly typeToConfirm?: string;
+    /** An optional note to write, named by `label`. */
+    readonly note?: {
+        readonly label: string;
+        readonly placeholder?: string;
+    };
+}
+export declare function useConfirmDialog(): {
+    readonly ask: (options: ConfirmOptions) => Promise<string | null>;
+    readonly dialog: ReactElement;
+};
+//# sourceMappingURL=confirm-dialog.d.ts.map

package/dist/client/components/confirm-dialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-dialog.d.ts","sourceRoot":"","sources":["../../../client/components/confirm-dialog.tsx"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAgB5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAMD,wBAAgB,gBAAgB,IAAI;IAClC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,CA0FA"}

package/dist/client/components/confirm-dialog.js

@@ -0,0 +1,47 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Confirmations as the application's alert dialog rather than the browser's `confirm` / `prompt`: `ask()` opens it and
+ * resolves with what the person entered ('' when nothing is typed), or null when they cancel. With `typeToConfirm` the
+ * action stays disabled until that text is typed exactly, as protected deploys and deleting an App require; with `note`
+ * the person may write an optional note, such as why a request is rejected, which is what it resolves with.
+ */
+import { useTranslation } from '@nocobase/i18n/client';
+import { useRef, useState } from 'react';
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+import { AlertDialog, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, } from './ui/alert-dialog.js';
+import { Button } from './ui/button.js';
+import { Input } from './ui/input.js';
+import { Textarea } from './ui/textarea.js';
+export function useConfirmDialog() {
+    const { t } = useTranslation(ACCESS_NAMESPACE);
+    const [pending, setPending] = useState(null);
+    const [typed, setTyped] = useState('');
+    const inputRef = useRef(null);
+    const noteRef = useRef(null);
+    const close = (value) => {
+        pending?.resolve(value);
+        setPending(null);
+        setTyped('');
+    };
+    const ask = (options) => new Promise((resolve) => {
+        setTyped('');
+        setPending({ ...options, resolve });
+    });
+    const matches = pending?.typeToConfirm === undefined || typed === pending.typeToConfirm;
+    const dialog = (_jsx(AlertDialog, { open: pending !== null, onOpenChange: (open) => {
+            if (!open)
+                close(null);
+        }, children: _jsx(AlertDialogContent, { initialFocus: pending?.typeToConfirm
+                ? inputRef
+                : pending?.note
+                    ? noteRef
+                    : undefined, children: _jsxs("form", { className: 'grid gap-4', onSubmit: (event) => {
+                    event.preventDefault();
+                    if (matches)
+                        close(typed);
+                }, children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: pending?.title }), pending?.description ? (_jsx(AlertDialogDescription, { children: pending.description })) : null] }), pending?.details ?? null, pending?.typeToConfirm !== undefined ? (_jsx(Input, { ref: inputRef, "aria-label": t('ui.confirm.typeLabel', {
+                            text: pending.typeToConfirm,
+                        }), placeholder: pending.typeToConfirm, autoComplete: 'off', spellCheck: false, className: 'font-mono', value: typed, onChange: (event) => setTyped(event.target.value) })) : null, pending?.note ? (_jsx(Textarea, { ref: noteRef, "aria-label": pending.note.label, placeholder: pending.note.placeholder ?? pending.note.label, maxLength: 2000, className: 'min-h-20', value: typed, onChange: (event) => setTyped(event.target.value) })) : null, _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { children: t('ui.confirm.cancel') }), _jsx(Button, { type: 'submit', variant: pending?.destructive ? 'destructive' : 'default', disabled: !matches, children: pending?.action })] })] }) }) }));
+    return { ask, dialog };
+}
+//# sourceMappingURL=confirm-dialog.js.map

package/dist/client/components/confirm-dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-dialog.js","sourceRoot":"","sources":["../../../client/components/confirm-dialog.tsx"],"names":[],"mappings":";AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAqC,MAAM,OAAO,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAoB5C,MAAM,UAAU,gBAAgB;IAI9B,MAAM,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAiB,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAmB,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,KAAoB,EAAQ,EAAE;QAC3C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,QAAQ,CAAC,EAAE,CAAC,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,OAAuB,EAA0B,EAAE,CAC9D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GACX,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa,CAAC;IAC1E,MAAM,MAAM,GAAG,CACb,KAAC,WAAW,IACV,IAAI,EAAE,OAAO,KAAK,IAAI,EACtB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,YAED,KAAC,kBAAkB,IACjB,YAAY,EACV,OAAO,EAAE,aAAa;gBACpB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,EAAE,IAAI;oBACb,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,SAAS,YAGjB,gBACE,SAAS,EAAC,YAAY,EACtB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;oBAClB,KAAK,CAAC,cAAc,EAAE,CAAC;oBACvB,IAAI,OAAO;wBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC,aAED,MAAC,iBAAiB,eAChB,KAAC,gBAAgB,cAAE,OAAO,EAAE,KAAK,GAAoB,EACpD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CACtB,KAAC,sBAAsB,cACpB,OAAO,CAAC,WAAW,GACG,CAC1B,CAAC,CAAC,CAAC,IAAI,IACU,EACnB,OAAO,EAAE,OAAO,IAAI,IAAI,EACxB,OAAO,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CACtC,KAAC,KAAK,IACJ,GAAG,EAAE,QAAQ,gBACD,CAAC,CAAC,sBAAsB,EAAE;4BACpC,IAAI,EAAE,OAAO,CAAC,aAAa;yBAC5B,CAAC,EACF,WAAW,EAAE,OAAO,CAAC,aAAa,EAClC,YAAY,EAAC,KAAK,EAClB,UAAU,EAAE,KAAK,EACjB,SAAS,EAAC,WAAW,EACrB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GACjD,CACH,CAAC,CAAC,CAAC,IAAI,EACP,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CACf,KAAC,QAAQ,IACP,GAAG,EAAE,OAAO,gBACA,OAAO,CAAC,IAAI,CAAC,KAAK,EAC9B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAC3D,SAAS,EAAE,IAAI,EACf,SAAS,EAAC,UAAU,EACpB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GACjD,CACH,CAAC,CAAC,CAAC,IAAI,EACR,MAAC,iBAAiB,eAChB,KAAC,iBAAiB,cAAE,CAAC,CAAC,mBAAmB,CAAC,GAAqB,EAC/D,KAAC,MAAM,IACL,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EACzD,QAAQ,EAAE,CAAC,OAAO,YAEjB,OAAO,EAAE,MAAM,GACT,IACS,IACf,GACY,GACT,CACf,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}