@package-broker/ui 2.0.0-rc.4 → 2.0.0-rc.5

package/dist/assets/{setup.8e977608d413.js → setup.7bc86366227c.js}

@@ -1 +1 @@
-var R={brand:"PACKAGE.broker",description:"open-source package registry broker",version:"2.0.0-rc.4",links:[{label:"AGPL-3.0",href:"https://github.com/package-broker/broker/blob/main/LICENSE"},{label:"Source code",href:"https://github.com/package-broker/broker"},{label:"Documentation",href:"https://package.broker/docs/"}]};function W(e){return e("footer",{className:"product-footer"},e("span",{},e("strong",{},R.brand),` ${R.description}`),e("span",{},`Version ${R.version}`),...R.links.map(({label:t,href:o})=>e("a",{href:o,target:"_blank",rel:"noopener noreferrer","aria-label":`${t} (opens externally in a new tab)`},t)))}function H(){return W((e,t,...o)=>{let r=document.createElement(e);for(let[a,u]of Object.entries(t))r.setAttribute(a==="className"?"class":a,u);return r.append(...o),r})}var F=[10,16,26,18,24,16,18,22,22,26,30,22,22,24],U=[1,1,1,2,2,4,4,4,5,5,5,8,9,9],Y=[[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,50],[6,30,54],[6,32,58],[6,34,62],[6,26,46,66]],J=[236,17],Z=21522,ee=1335,te=7973,j=8;function D(e){let t=(16*e+128)*e+64;if(e>=2){let o=Math.floor(e/7)+2;t-=(25*o-10)*o-55,e>=7&&(t-=36)}return t}function A(e){let t=e-1;return Math.floor(D(e)/8)-F[t]*U[t]}function K(e){return e<=9?8:16}function G(e){if(!Number.isInteger(e)||e<1||e>14)throw new RangeError("unsupported QR version");return Math.floor((A(e)*8-4-K(e))/8)}var Q=G(14),x=new Uint8Array(512),L=new Uint8Array(256);{let e=1;for(let t=0;t<255;t+=1)x[t]=e,L[e]=t,e<<=1,e&256&&(e^=285);for(let t=255;t<512;t+=1)x[t]=x[t-255]}function P(e,t){return e===0||t===0?0:x[L[e]+L[t]]}function ne(e,t){let o=[1];for(let a=0;a<t;a+=1){let u=new Array(o.length+1).fill(0);for(let s=0;s<o.length;s+=1)u[s]=u[s]^P(o[s],1),u[s+1]=u[s+1]^P(o[s],x[a]);o=u}let r=new Array(t).fill(0);for(let a of e){let u=a^r.shift();r.push(0);for(let s=0;s<t;s+=1)r[s]=r[s]^P(o[s+1],u)}return r}function oe(e,t){let o=[],r=(n,l)=>{for(let i=l-1;i>=0;i-=1)o.push(n>>>i&1)};r(4,4),r(t.length,K(e));for(let n of t)r(n,8);let a=A(e)*8;r(0,Math.min(4,a-o.length)),r(0,(8-o.length%8)%8);let u=[];for(let n=0;n<o.length;n+=8)u.push(parseInt(o.slice(n,n+8).join(""),2));for(let n=0;u.length<A(e);n+=1)u.push(J[n%2]);let s=e-1,f=U[s],w=F[s],b=Math.floor(D(e)/8),m=f-b%f,h=Math.floor(b/f)-w,g=[],k=[],c=0;for(let n=0;n<f;n+=1){let l=h+(n<m?0:1),i=u.slice(c,c+l);c+=l,g.push(i),k.push(ne(i,w))}let d=[];for(let n=0;n<h+1;n+=1)for(let l of g)n<l.length&&d.push(l[n]);for(let n=0;n<w;n+=1)for(let l of k)d.push(l[n]);return d}function B(e,t,o){let r=e;for(let a=0;a<o;a+=1)r=r<<1^(r>>>o-1)*t;return r}function re(e,t,o){switch(e){case 0:return(t+o)%2===0;case 1:return o%2===0;case 2:return t%3===0;case 3:return(t+o)%3===0;case 4:return(Math.floor(t/3)+Math.floor(o/2))%2===0;case 5:return t*o%2+t*o%3===0;case 6:return(t*o%2+t*o%3)%2===0;default:return((t+o)%2+t*o%3)%2===0}}function q(e){let t=0,o=1;for(let a=1;a<=e.length;a+=1){if(a<e.length&&e[a]===e[a-1]){o+=1;continue}o>=5&&(t+=3+(o-5)),o=1}let r=`0000${e.map(a=>a?"1":"0").join("")}0000`;for(let a=0;a+11<=r.length;a+=1){let u=r.slice(a,a+11);(u==="10111010000"||u==="00001011101")&&(t+=40)}return t}function se(e){let t=e.length,o=0,r=0;for(let u=0;u<t;u+=1){let s=e[u];o+=q(s),o+=q(e.map(f=>f[u]));for(let f=0;f<t;f+=1)s[f]&&(r+=1),f+1<t&&u+1<t&&s[f]===s[f+1]&&s[f]===e[u+1][f]&&s[f]===e[u+1][f+1]&&(o+=3)}let a=t*t;return o+=(Math.ceil(Math.abs(r*20-a*10)/a)-1)*10,o}function ae(e,t,o){let r=e*4+17,a=Array.from({length:r},()=>new Array(r).fill(!1)),u=Array.from({length:r},()=>new Array(r).fill(!1)),s=(c,d,n)=>{a[d][c]=n,u[d][c]=!0};for(let c=0;c<r;c+=1)s(6,c,c%2===0),s(c,6,c%2===0);let f=(c,d)=>{for(let n=-4;n<=4;n+=1)for(let l=-4;l<=4;l+=1){let i=Math.max(Math.abs(l),Math.abs(n)),y=c+l,_=d+n;y>=0&&y<r&&_>=0&&_<r&&s(y,_,i!==2&&i!==4)}};f(3,3),f(r-4,3),f(3,r-4);let w=Y[e-1],b=w.length-1;w.forEach((c,d)=>{w.forEach((n,l)=>{if(!(d===0&&l===0||d===0&&l===b||d===b&&l===0))for(let i=-2;i<=2;i+=1)for(let y=-2;y<=2;y+=1)s(n+y,c+i,Math.max(Math.abs(y),Math.abs(i))!==1)})});let m=c=>{let d=c,n=(d<<10|B(d,ee,10))^Z,l=i=>(n>>>i&1)!==0;for(let i=0;i<=5;i+=1)s(8,i,l(i));s(8,7,l(6)),s(8,8,l(7)),s(7,8,l(8));for(let i=9;i<15;i+=1)s(14-i,8,l(i));for(let i=0;i<8;i+=1)s(r-1-i,8,l(i));for(let i=8;i<15;i+=1)s(8,r-15+i,l(i));s(8,r-8,!0)};if(m(0),e>=7){let c=e<<12|B(e,te,12);for(let d=0;d<18;d+=1){let n=(c>>>d&1)!==0,l=r-11+d%3,i=Math.floor(d/3);s(l,i,n),s(i,l,n)}}let h=0;for(let c=r-1;c>=1;c-=2){c===6&&(c=5);for(let d=0;d<r;d+=1)for(let n=0;n<2;n+=1){let l=c-n,y=(c+1&2)===0?r-1-d:d;!u[y][l]&&h<t.length*8&&(a[y][l]=(t[h>>>3]>>>7-(h&7)&1)!==0,h+=1)}}let g=c=>a.map((d,n)=>d.map((l,i)=>!u[n][i]&&re(c,i,n)?!l:l)),k=o??0;if(o===void 0){let c=1/0;for(let d=0;d<j;d+=1){m(d);let n=se(g(d));n<c&&(c=n,k=d)}}return m(k),{version:e,size:r,mask:k,modules:g(k)}}function V(e,t={}){let{mask:o}=t;if(o!==void 0&&(!Number.isInteger(o)||o<0||o>=j))throw new RangeError("unsupported QR mask");if(typeof e!="string"||e.length===0)throw new TypeError("QR text is empty");if(e.length>Q)throw new RangeError("QR text is too long");let r=new TextEncoder().encode(e);if(r.length>Q)throw new RangeError("QR text is too long");let a=1;for(;G(a)<r.length;)a+=1;return ae(a,oe(a,r),o)}var v="/_pb/ui/";var ie="/_pb/auth/local/setup/start",le="/_pb/auth/local/setup/finish",ue=43,X=1024,ce=["too_short","too_long","equals_email","not_well_formed"];function T(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function de(e){if(!T(e)||!T(e.error))return null;let t=e.error;if(t.code!=="weak_password"||!Array.isArray(t.problems))return null;let o=t.problems.filter(r=>typeof r=="string"&&ce.includes(r));return o.length>0?o:null}function pe(e){try{return V(e)}catch{return null}}function fe(e){let{transport:t}=e,o=new Set,r=null,a={stage:"checking",busy:!1,notice:null,problems:[],enrollment:null},u=!1,s=b=>{if(!u){a={...a,...b};for(let m of[...o])m()}},f=()=>{r=null},w=async(b,m)=>{try{return await t.post(b,m)}catch{return null}};return t.get("/_pb/auth/providers").then(b=>{if(u)return;let m=b.json;s({stage:b.status===200&&T(m)&&typeof m.local=="boolean"?m.local?"token":"disabled":"unavailable"})},()=>s({stage:"unavailable"})),{snapshot:()=>a,subscribe(b){return o.add(b),()=>{o.delete(b)}},async submitToken(b){if(a.busy||a.stage!=="token")return;let m=b.trim();if(m.length!==ue||!/^[A-Za-z0-9_-]+$/.test(m)){s({notice:"bad_token_shape"});return}s({busy:!0,notice:null});let h=await w(ie,{token:m});if(h===null){s({busy:!1,notice:"unavailable"});return}if($(h)){f(),s({busy:!1,stage:"disabled",notice:null,enrollment:null,problems:[]});return}if(h.status===200){let g=h.json;if(T(g)&&typeof g.provisioningUri=="string"&&typeof g.secret=="string"&&g.secret.length>0){r=m;let k=pe(g.provisioningUri);s({busy:!1,stage:"enroll",notice:k===null?"qr_unavailable":null,enrollment:{provisioningUri:g.provisioningUri,secret:g.secret,qr:k}});return}s({busy:!1,notice:"unavailable"});return}s({busy:!1,notice:me(h.status)})},async finish(b){if(a.busy||a.stage!=="enroll"||r===null)return;let{password:m,confirmation:h,code:g}=b,k=g.replace(/\s+/g,"");if(m.length===0||k.length===0){s({notice:"missing_fields",problems:[]});return}if(m.length>X||k.length>X||m!==h){s({notice:"password_mismatch",problems:[]});return}s({busy:!0,notice:null,problems:[]});let c=await w(le,{token:r,password:m,code:k});if(c===null||c.status>=500){f(),s({busy:!1,stage:"uncertain",notice:null,enrollment:null});return}if($(c)){f(),s({busy:!1,stage:"disabled",notice:null,enrollment:null,problems:[]});return}if(c.status===204){f(),s({busy:!1,stage:"done",notice:null,enrollment:null});return}let d=c.status===400?de(c.json):null;if(d!==null){s({busy:!1,notice:"weak_password",problems:d});return}if(c.status===403){s({busy:!1,notice:"origin_refused"});return}if(c.status===429){s({busy:!1,notice:"rate_limited"});return}s({busy:!1,notice:"finish_refused"})},dispose(){f(),u=!0,a={...a,enrollment:null,problems:[],busy:!1},o.clear()}}}function $(e){let t=e.json;return e.status===403&&T(t)&&T(t.error)&&t.error.code==="local_auth_disabled"}function me(e){return e===401||e===400?"token_refused":e===403?"origin_refused":e===429?"rate_limited":"unavailable"}function be(e,t){return{async get(o){let r=await e(o,{credentials:"same-origin",cache:"no-store",redirect:"error",referrerPolicy:"no-referrer",...t===void 0?{}:{signal:t}});return{status:r.status,json:await r.json().catch(()=>null)}},async post(o,r){let a=await e(o,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r),credentials:"same-origin",cache:"no-store",redirect:"error",referrerPolicy:"no-referrer",...t===void 0?{}:{signal:t}}),u=await a.json().catch(()=>null);return{status:a.status,json:u}}}}var he={bad_token_shape:"That does not look like a setup token. Paste the whole token exactly as it was issued.",token_refused:"This setup token was not accepted. It may be wrong, expired or already used. Ask the person who runs the broker for a fresh token.",origin_refused:"The broker refused this request because it came from a different address.",rate_limited:"Too many attempts. Wait a few minutes and try again.",unavailable:"The broker could not be reached or answered unexpectedly. Try again in a moment.",password_mismatch:"The password and its confirmation do not match.",missing_fields:"Enter a password and the six digit code from your authenticator.",weak_password:"The password does not meet the requirements.",finish_refused:"Setup was not completed. Check the six digit code and try again. If it keeps failing, ask for a fresh setup token.",qr_unavailable:"The QR code could not be drawn. Enter the setup key below in your authenticator instead."},ge={too_short:"The password is too short.",too_long:"The password is too long.",equals_email:"The password must not be the same as the account e-mail address.",not_well_formed:"The password contains characters that are not allowed."},S=6,N=4;function ye(e,t){let o=t.size+N*2;e.width=o*S,e.height=o*S;let r=e.getContext("2d");r!==null&&(r.fillStyle="#ffffff",r.fillRect(0,0,e.width,e.height),r.fillStyle="#000000",t.modules.forEach((a,u)=>{a.forEach((s,f)=>{s&&r.fillRect((f+N)*S,(u+N)*S,S,S)})}))}function p(e,t={},...o){let r=document.createElement(e);for(let[a,u]of Object.entries(t))r.setAttribute(a,u);for(let a of o)r.append(a);return r}var we="mt-1 block w-full rounded border border-gray-400 px-3 py-2 text-base focus:outline-none focus:ring-2 focus:ring-blue-600",O="rounded bg-blue-700 px-4 py-2 text-base font-medium text-white hover:bg-blue-800 focus:outline-none focus:ring-2 focus:ring-blue-600 focus:ring-offset-2 disabled:opacity-60";function M(e,t,o,r){let a=p("input",{id:e,name:e,class:we,autocapitalize:"off",spellcheck:"false",required:"",...r===void 0?{}:{"aria-describedby":`${e}-hint`},...o});return{wrapper:p("div",{class:"mt-4"},p("label",{for:e,class:"block text-sm font-medium"},t),...r===void 0?[]:[p("p",{id:`${e}-hint`,class:"mt-1 text-sm text-gray-700"},r)],a),input:a}}function ke(e,t){let o=fe({transport:t.transport}),r=null,a={},u=null,s=null,f=null,w=n=>p("h1",{class:"text-2xl font-semibold",tabindex:"-1",id:"setup-heading"},n),b=()=>{for(let n of Object.values(a))n.value="";a={}},m=()=>{let n=M("setup-token","Setup token",{type:"password",autocomplete:"off","aria-describedby":"setup-token-hint"}),l=p("p",{id:"setup-token-hint",class:"mt-1 text-sm text-gray-700"},"Paste the one-time token printed by the command that created your administrator account. It is never put in the address bar.");n.wrapper.insertBefore(l,n.input),a={token:n.input},f=p("button",{type:"submit",class:O},"Continue");let i=p("form",{id:"token-form",novalidate:"","aria-labelledby":"setup-heading"},n.wrapper,p("div",{class:"mt-6"},f));return i.addEventListener("submit",y=>{y.preventDefault(),o.submitToken(n.input.value)}),p("section",{},w("Set up the administrator account"),p("p",{class:"mt-2 text-gray-700"},"Step 1 of 2. Enter your setup token. You will then choose a password and connect an authenticator app."),i)},h=n=>{let l=n.enrollment,i=M("setup-password","Password",{type:"password",autocomplete:"new-password"}),y=M("setup-password-confirm","Confirm password",{type:"password",autocomplete:"new-password"}),_=M("setup-code","Six digit code from your authenticator",{type:"text",inputmode:"numeric",autocomplete:"one-time-code",pattern:"[0-9 ]*"});a={password:i.input,confirmation:y.input,code:_.input};let I=p("div",{class:"mt-4"});if(l?.qr){let E=p("canvas",{id:"setup-qr",role:"img","aria-label":"QR code for your authenticator app. If you cannot scan it, use the setup key below.",class:"h-auto max-w-full rounded border border-gray-400 [image-rendering:pixelated]"});ye(E,l.qr),I.append(E)}let z=p("div",{class:"mt-4"},p("p",{class:"text-sm font-medium",id:"setup-secret-label"},"Setup key (enter manually)"),p("code",{id:"setup-secret","aria-labelledby":"setup-secret-label",class:"mt-1 block break-all rounded bg-gray-100 px-3 py-2 font-mono text-base"},l?.secret??""),p("p",{class:"mt-1 text-sm text-gray-700"},"Type: time based, 6 digits, 30 seconds, SHA-1."));f=p("button",{type:"submit",class:O},"Finish setup");let C=p("form",{id:"finish-form",novalidate:"","aria-labelledby":"setup-heading"},i.wrapper,y.wrapper,_.wrapper,p("div",{class:"mt-6"},f));return C.addEventListener("submit",E=>{E.preventDefault(),o.finish({password:i.input.value,confirmation:y.input.value,code:_.input.value})}),p("section",{},w("Connect your authenticator"),p("p",{class:"mt-2 text-gray-700"},"Step 2 of 2. Scan the QR code with an authenticator app, or enter the setup key by hand. Then choose a password and enter the current code."),I,z,C)},g=()=>{let n=p("button",{type:"button",id:"open-app",class:O},"Open Package Broker");return n.addEventListener("click",()=>{t.navigate(v)}),p("section",{},w("Setup complete"),p("p",{class:"mt-2 text-gray-700"},"Your administrator account is ready and you are signed in. From now on sign in with your e-mail address, your password and a code from your authenticator."),p("div",{class:"mt-6"},n))},k=()=>p("section",{},w("Setup may or may not have finished"),p("p",{class:"mt-2 text-gray-700"},"The broker did not give a clear answer. Nothing was retried. Keep your authenticator enrollment and the password you chose. The broker currently accepts sign-in through its HTTP API. If sign-in fails, ask for a fresh setup token and start again."),p("p",{class:"mt-4 text-gray-700"},"From a trusted HTTP client, send POST /_pb/auth/local/login to this broker with Content-Type: application/json and an Origin header equal to the broker address. Supply JSON fields email (your administrator e-mail address), password (the password you just chose), and code (a fresh six digit authenticator code). Read credentials from a protected file or private prompt, rather than command-line arguments. Save the response to a protected file and session cookies to a protected cookie jar; do not print either. A 204 response means you are signed in for subsequent requests using that cookie jar in the same client. See docs/workers-install.md for curl instructions and cleanup.")),c=()=>{let n=o.snapshot();if(r!==n.stage){b(),e.replaceChildren();let l=n.stage==="checking"||n.stage==="disabled"||n.stage==="unavailable"?p("section",{},w("Set up the administrator account"),...n.stage==="checking"?[]:[p("h2",{class:"mt-4 font-semibold"},n.stage==="disabled"?"Sign in with your organization's account":"Setup is unavailable")],p("p",{role:n.stage==="unavailable"?"alert":"status",class:"mt-2 text-gray-700"},n.stage==="checking"?"Checking sign-in options\u2026":n.stage==="disabled"?"Password setup is unavailable. Sign in to continue, or contact your administrator for help.":"Sign-in options could not be loaded. Reload the page to try again."),p("a",{href:`${v}#/login`,class:"mt-4 block text-blue-700 underline"},"Go to sign in")):n.stage==="token"?m():n.stage==="enroll"?h(n):n.stage==="done"?g():k();s=p("div",{id:"setup-notice",role:"alert",class:"mt-4 text-red-800"}),u=p("p",{id:"setup-status",role:"status",class:"mt-4 text-gray-700"});let i=p("main",{class:"mx-auto w-full max-w-xl flex-1 p-6"},l,s,u);e.className="flex min-h-screen flex-col",e.append(i,H()),document.getElementById("setup-heading")?.focus(),r=n.stage}f&&(f.disabled=n.busy),u&&(u.textContent=n.busy?"Working\u2026":""),s&&(s.replaceChildren(),n.notice!==null&&(s.append(p("p",{},he[n.notice])),n.notice==="weak_password"&&s.append(p("ul",{class:"mt-1 list-disc pl-6"},...n.problems.map(l=>p("li",{},ge[l]))))))},d=o.subscribe(c);return c(),()=>{d(),b(),o.dispose(),e.replaceChildren()}}if(typeof document<"u"){let e=document.getElementById("root");if(e!==null){let t=ke(e,{transport:be(fetch.bind(globalThis)),navigate:o=>{window.location.assign(o)}});window.addEventListener("pagehide",t,{once:!0}),window.addEventListener("pageshow",o=>{o.persisted&&window.location.reload()})}}export{v as APP_PATH,he as NOTICE_TEXT,ge as PROBLEM_TEXT,le as SETUP_FINISH_PATH,ie as SETUP_START_PATH,be as createFetchTransport,fe as createSetupController,ke as mountSetup};
+var R={brand:"PACKAGE.broker",description:"open-source package registry broker",version:"2.0.0-rc.5",links:[{label:"AGPL-3.0",href:"https://github.com/package-broker/broker/blob/main/LICENSE"},{label:"Source code",href:"https://github.com/package-broker/broker"},{label:"Documentation",href:"https://package.broker/docs/"}]};function W(e){return e("footer",{className:"product-footer"},e("span",{},e("strong",{},R.brand),` ${R.description}`),e("span",{},`Version ${R.version}`),...R.links.map(({label:t,href:o})=>e("a",{href:o,target:"_blank",rel:"noopener noreferrer","aria-label":`${t} (opens externally in a new tab)`},t)))}function H(){return W((e,t,...o)=>{let r=document.createElement(e);for(let[a,u]of Object.entries(t))r.setAttribute(a==="className"?"class":a,u);return r.append(...o),r})}var F=[10,16,26,18,24,16,18,22,22,26,30,22,22,24],U=[1,1,1,2,2,4,4,4,5,5,5,8,9,9],Y=[[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,50],[6,30,54],[6,32,58],[6,34,62],[6,26,46,66]],J=[236,17],Z=21522,ee=1335,te=7973,j=8;function D(e){let t=(16*e+128)*e+64;if(e>=2){let o=Math.floor(e/7)+2;t-=(25*o-10)*o-55,e>=7&&(t-=36)}return t}function A(e){let t=e-1;return Math.floor(D(e)/8)-F[t]*U[t]}function K(e){return e<=9?8:16}function G(e){if(!Number.isInteger(e)||e<1||e>14)throw new RangeError("unsupported QR version");return Math.floor((A(e)*8-4-K(e))/8)}var Q=G(14),x=new Uint8Array(512),L=new Uint8Array(256);{let e=1;for(let t=0;t<255;t+=1)x[t]=e,L[e]=t,e<<=1,e&256&&(e^=285);for(let t=255;t<512;t+=1)x[t]=x[t-255]}function P(e,t){return e===0||t===0?0:x[L[e]+L[t]]}function ne(e,t){let o=[1];for(let a=0;a<t;a+=1){let u=new Array(o.length+1).fill(0);for(let s=0;s<o.length;s+=1)u[s]=u[s]^P(o[s],1),u[s+1]=u[s+1]^P(o[s],x[a]);o=u}let r=new Array(t).fill(0);for(let a of e){let u=a^r.shift();r.push(0);for(let s=0;s<t;s+=1)r[s]=r[s]^P(o[s+1],u)}return r}function oe(e,t){let o=[],r=(n,l)=>{for(let i=l-1;i>=0;i-=1)o.push(n>>>i&1)};r(4,4),r(t.length,K(e));for(let n of t)r(n,8);let a=A(e)*8;r(0,Math.min(4,a-o.length)),r(0,(8-o.length%8)%8);let u=[];for(let n=0;n<o.length;n+=8)u.push(parseInt(o.slice(n,n+8).join(""),2));for(let n=0;u.length<A(e);n+=1)u.push(J[n%2]);let s=e-1,f=U[s],w=F[s],b=Math.floor(D(e)/8),m=f-b%f,h=Math.floor(b/f)-w,g=[],k=[],c=0;for(let n=0;n<f;n+=1){let l=h+(n<m?0:1),i=u.slice(c,c+l);c+=l,g.push(i),k.push(ne(i,w))}let d=[];for(let n=0;n<h+1;n+=1)for(let l of g)n<l.length&&d.push(l[n]);for(let n=0;n<w;n+=1)for(let l of k)d.push(l[n]);return d}function B(e,t,o){let r=e;for(let a=0;a<o;a+=1)r=r<<1^(r>>>o-1)*t;return r}function re(e,t,o){switch(e){case 0:return(t+o)%2===0;case 1:return o%2===0;case 2:return t%3===0;case 3:return(t+o)%3===0;case 4:return(Math.floor(t/3)+Math.floor(o/2))%2===0;case 5:return t*o%2+t*o%3===0;case 6:return(t*o%2+t*o%3)%2===0;default:return((t+o)%2+t*o%3)%2===0}}function q(e){let t=0,o=1;for(let a=1;a<=e.length;a+=1){if(a<e.length&&e[a]===e[a-1]){o+=1;continue}o>=5&&(t+=3+(o-5)),o=1}let r=`0000${e.map(a=>a?"1":"0").join("")}0000`;for(let a=0;a+11<=r.length;a+=1){let u=r.slice(a,a+11);(u==="10111010000"||u==="00001011101")&&(t+=40)}return t}function se(e){let t=e.length,o=0,r=0;for(let u=0;u<t;u+=1){let s=e[u];o+=q(s),o+=q(e.map(f=>f[u]));for(let f=0;f<t;f+=1)s[f]&&(r+=1),f+1<t&&u+1<t&&s[f]===s[f+1]&&s[f]===e[u+1][f]&&s[f]===e[u+1][f+1]&&(o+=3)}let a=t*t;return o+=(Math.ceil(Math.abs(r*20-a*10)/a)-1)*10,o}function ae(e,t,o){let r=e*4+17,a=Array.from({length:r},()=>new Array(r).fill(!1)),u=Array.from({length:r},()=>new Array(r).fill(!1)),s=(c,d,n)=>{a[d][c]=n,u[d][c]=!0};for(let c=0;c<r;c+=1)s(6,c,c%2===0),s(c,6,c%2===0);let f=(c,d)=>{for(let n=-4;n<=4;n+=1)for(let l=-4;l<=4;l+=1){let i=Math.max(Math.abs(l),Math.abs(n)),y=c+l,_=d+n;y>=0&&y<r&&_>=0&&_<r&&s(y,_,i!==2&&i!==4)}};f(3,3),f(r-4,3),f(3,r-4);let w=Y[e-1],b=w.length-1;w.forEach((c,d)=>{w.forEach((n,l)=>{if(!(d===0&&l===0||d===0&&l===b||d===b&&l===0))for(let i=-2;i<=2;i+=1)for(let y=-2;y<=2;y+=1)s(n+y,c+i,Math.max(Math.abs(y),Math.abs(i))!==1)})});let m=c=>{let d=c,n=(d<<10|B(d,ee,10))^Z,l=i=>(n>>>i&1)!==0;for(let i=0;i<=5;i+=1)s(8,i,l(i));s(8,7,l(6)),s(8,8,l(7)),s(7,8,l(8));for(let i=9;i<15;i+=1)s(14-i,8,l(i));for(let i=0;i<8;i+=1)s(r-1-i,8,l(i));for(let i=8;i<15;i+=1)s(8,r-15+i,l(i));s(8,r-8,!0)};if(m(0),e>=7){let c=e<<12|B(e,te,12);for(let d=0;d<18;d+=1){let n=(c>>>d&1)!==0,l=r-11+d%3,i=Math.floor(d/3);s(l,i,n),s(i,l,n)}}let h=0;for(let c=r-1;c>=1;c-=2){c===6&&(c=5);for(let d=0;d<r;d+=1)for(let n=0;n<2;n+=1){let l=c-n,y=(c+1&2)===0?r-1-d:d;!u[y][l]&&h<t.length*8&&(a[y][l]=(t[h>>>3]>>>7-(h&7)&1)!==0,h+=1)}}let g=c=>a.map((d,n)=>d.map((l,i)=>!u[n][i]&&re(c,i,n)?!l:l)),k=o??0;if(o===void 0){let c=1/0;for(let d=0;d<j;d+=1){m(d);let n=se(g(d));n<c&&(c=n,k=d)}}return m(k),{version:e,size:r,mask:k,modules:g(k)}}function V(e,t={}){let{mask:o}=t;if(o!==void 0&&(!Number.isInteger(o)||o<0||o>=j))throw new RangeError("unsupported QR mask");if(typeof e!="string"||e.length===0)throw new TypeError("QR text is empty");if(e.length>Q)throw new RangeError("QR text is too long");let r=new TextEncoder().encode(e);if(r.length>Q)throw new RangeError("QR text is too long");let a=1;for(;G(a)<r.length;)a+=1;return ae(a,oe(a,r),o)}var v="/_pb/ui/";var ie="/_pb/auth/local/setup/start",le="/_pb/auth/local/setup/finish",ue=43,X=1024,ce=["too_short","too_long","equals_email","not_well_formed"];function T(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function de(e){if(!T(e)||!T(e.error))return null;let t=e.error;if(t.code!=="weak_password"||!Array.isArray(t.problems))return null;let o=t.problems.filter(r=>typeof r=="string"&&ce.includes(r));return o.length>0?o:null}function pe(e){try{return V(e)}catch{return null}}function fe(e){let{transport:t}=e,o=new Set,r=null,a={stage:"checking",busy:!1,notice:null,problems:[],enrollment:null},u=!1,s=b=>{if(!u){a={...a,...b};for(let m of[...o])m()}},f=()=>{r=null},w=async(b,m)=>{try{return await t.post(b,m)}catch{return null}};return t.get("/_pb/auth/providers").then(b=>{if(u)return;let m=b.json;s({stage:b.status===200&&T(m)&&typeof m.local=="boolean"?m.local?"token":"disabled":"unavailable"})},()=>s({stage:"unavailable"})),{snapshot:()=>a,subscribe(b){return o.add(b),()=>{o.delete(b)}},async submitToken(b){if(a.busy||a.stage!=="token")return;let m=b.trim();if(m.length!==ue||!/^[A-Za-z0-9_-]+$/.test(m)){s({notice:"bad_token_shape"});return}s({busy:!0,notice:null});let h=await w(ie,{token:m});if(h===null){s({busy:!1,notice:"unavailable"});return}if($(h)){f(),s({busy:!1,stage:"disabled",notice:null,enrollment:null,problems:[]});return}if(h.status===200){let g=h.json;if(T(g)&&typeof g.provisioningUri=="string"&&typeof g.secret=="string"&&g.secret.length>0){r=m;let k=pe(g.provisioningUri);s({busy:!1,stage:"enroll",notice:k===null?"qr_unavailable":null,enrollment:{provisioningUri:g.provisioningUri,secret:g.secret,qr:k}});return}s({busy:!1,notice:"unavailable"});return}s({busy:!1,notice:me(h.status)})},async finish(b){if(a.busy||a.stage!=="enroll"||r===null)return;let{password:m,confirmation:h,code:g}=b,k=g.replace(/\s+/g,"");if(m.length===0||k.length===0){s({notice:"missing_fields",problems:[]});return}if(m.length>X||k.length>X||m!==h){s({notice:"password_mismatch",problems:[]});return}s({busy:!0,notice:null,problems:[]});let c=await w(le,{token:r,password:m,code:k});if(c===null||c.status>=500){f(),s({busy:!1,stage:"uncertain",notice:null,enrollment:null});return}if($(c)){f(),s({busy:!1,stage:"disabled",notice:null,enrollment:null,problems:[]});return}if(c.status===204){f(),s({busy:!1,stage:"done",notice:null,enrollment:null});return}let d=c.status===400?de(c.json):null;if(d!==null){s({busy:!1,notice:"weak_password",problems:d});return}if(c.status===403){s({busy:!1,notice:"origin_refused"});return}if(c.status===429){s({busy:!1,notice:"rate_limited"});return}s({busy:!1,notice:"finish_refused"})},dispose(){f(),u=!0,a={...a,enrollment:null,problems:[],busy:!1},o.clear()}}}function $(e){let t=e.json;return e.status===403&&T(t)&&T(t.error)&&t.error.code==="local_auth_disabled"}function me(e){return e===401||e===400?"token_refused":e===403?"origin_refused":e===429?"rate_limited":"unavailable"}function be(e,t){return{async get(o){let r=await e(o,{credentials:"same-origin",cache:"no-store",redirect:"error",referrerPolicy:"no-referrer",...t===void 0?{}:{signal:t}});return{status:r.status,json:await r.json().catch(()=>null)}},async post(o,r){let a=await e(o,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r),credentials:"same-origin",cache:"no-store",redirect:"error",referrerPolicy:"no-referrer",...t===void 0?{}:{signal:t}}),u=await a.json().catch(()=>null);return{status:a.status,json:u}}}}var he={bad_token_shape:"That does not look like a setup token. Paste the whole token exactly as it was issued.",token_refused:"This setup token was not accepted. It may be wrong, expired or already used. Ask the person who runs the broker for a fresh token.",origin_refused:"The broker refused this request because it came from a different address.",rate_limited:"Too many attempts. Wait a few minutes and try again.",unavailable:"The broker could not be reached or answered unexpectedly. Try again in a moment.",password_mismatch:"The password and its confirmation do not match.",missing_fields:"Enter a password and the six digit code from your authenticator.",weak_password:"The password does not meet the requirements.",finish_refused:"Setup was not completed. Check the six digit code and try again. If it keeps failing, ask for a fresh setup token.",qr_unavailable:"The QR code could not be drawn. Enter the setup key below in your authenticator instead."},ge={too_short:"The password is too short.",too_long:"The password is too long.",equals_email:"The password must not be the same as the account e-mail address.",not_well_formed:"The password contains characters that are not allowed."},S=6,N=4;function ye(e,t){let o=t.size+N*2;e.width=o*S,e.height=o*S;let r=e.getContext("2d");r!==null&&(r.fillStyle="#ffffff",r.fillRect(0,0,e.width,e.height),r.fillStyle="#000000",t.modules.forEach((a,u)=>{a.forEach((s,f)=>{s&&r.fillRect((f+N)*S,(u+N)*S,S,S)})}))}function p(e,t={},...o){let r=document.createElement(e);for(let[a,u]of Object.entries(t))r.setAttribute(a,u);for(let a of o)r.append(a);return r}var we="mt-1 block w-full rounded border border-gray-400 px-3 py-2 text-base focus:outline-none focus:ring-2 focus:ring-blue-600",O="rounded bg-blue-700 px-4 py-2 text-base font-medium text-white hover:bg-blue-800 focus:outline-none focus:ring-2 focus:ring-blue-600 focus:ring-offset-2 disabled:opacity-60";function M(e,t,o,r){let a=p("input",{id:e,name:e,class:we,autocapitalize:"off",spellcheck:"false",required:"",...r===void 0?{}:{"aria-describedby":`${e}-hint`},...o});return{wrapper:p("div",{class:"mt-4"},p("label",{for:e,class:"block text-sm font-medium"},t),...r===void 0?[]:[p("p",{id:`${e}-hint`,class:"mt-1 text-sm text-gray-700"},r)],a),input:a}}function ke(e,t){let o=fe({transport:t.transport}),r=null,a={},u=null,s=null,f=null,w=n=>p("h1",{class:"text-2xl font-semibold",tabindex:"-1",id:"setup-heading"},n),b=()=>{for(let n of Object.values(a))n.value="";a={}},m=()=>{let n=M("setup-token","Setup token",{type:"password",autocomplete:"off","aria-describedby":"setup-token-hint"}),l=p("p",{id:"setup-token-hint",class:"mt-1 text-sm text-gray-700"},"Paste the one-time token printed by the command that created your administrator account. It is never put in the address bar.");n.wrapper.insertBefore(l,n.input),a={token:n.input},f=p("button",{type:"submit",class:O},"Continue");let i=p("form",{id:"token-form",novalidate:"","aria-labelledby":"setup-heading"},n.wrapper,p("div",{class:"mt-6"},f));return i.addEventListener("submit",y=>{y.preventDefault(),o.submitToken(n.input.value)}),p("section",{},w("Set up the administrator account"),p("p",{class:"mt-2 text-gray-700"},"Step 1 of 2. Enter your setup token. You will then choose a password and connect an authenticator app."),i)},h=n=>{let l=n.enrollment,i=M("setup-password","Password",{type:"password",autocomplete:"new-password"}),y=M("setup-password-confirm","Confirm password",{type:"password",autocomplete:"new-password"}),_=M("setup-code","Six digit code from your authenticator",{type:"text",inputmode:"numeric",autocomplete:"one-time-code",pattern:"[0-9 ]*"});a={password:i.input,confirmation:y.input,code:_.input};let I=p("div",{class:"mt-4"});if(l?.qr){let E=p("canvas",{id:"setup-qr",role:"img","aria-label":"QR code for your authenticator app. If you cannot scan it, use the setup key below.",class:"h-auto max-w-full rounded border border-gray-400 [image-rendering:pixelated]"});ye(E,l.qr),I.append(E)}let z=p("div",{class:"mt-4"},p("p",{class:"text-sm font-medium",id:"setup-secret-label"},"Setup key (enter manually)"),p("code",{id:"setup-secret","aria-labelledby":"setup-secret-label",class:"mt-1 block break-all rounded bg-gray-100 px-3 py-2 font-mono text-base"},l?.secret??""),p("p",{class:"mt-1 text-sm text-gray-700"},"Type: time based, 6 digits, 30 seconds, SHA-1."));f=p("button",{type:"submit",class:O},"Finish setup");let C=p("form",{id:"finish-form",novalidate:"","aria-labelledby":"setup-heading"},i.wrapper,y.wrapper,_.wrapper,p("div",{class:"mt-6"},f));return C.addEventListener("submit",E=>{E.preventDefault(),o.finish({password:i.input.value,confirmation:y.input.value,code:_.input.value})}),p("section",{},w("Connect your authenticator"),p("p",{class:"mt-2 text-gray-700"},"Step 2 of 2. Scan the QR code with an authenticator app, or enter the setup key by hand. Then choose a password and enter the current code."),I,z,C)},g=()=>{let n=p("button",{type:"button",id:"open-app",class:O},"Open Package Broker");return n.addEventListener("click",()=>{t.navigate(v)}),p("section",{},w("Setup complete"),p("p",{class:"mt-2 text-gray-700"},"Your administrator account is ready and you are signed in. From now on sign in with your e-mail address, your password and a code from your authenticator."),p("div",{class:"mt-6"},n))},k=()=>p("section",{},w("Setup may or may not have finished"),p("p",{class:"mt-2 text-gray-700"},"The broker did not give a clear answer. Nothing was retried. Keep your authenticator enrollment and the password you chose. The broker currently accepts sign-in through its HTTP API. If sign-in fails, ask for a fresh setup token and start again."),p("p",{class:"mt-4 text-gray-700"},"From a trusted HTTP client, send POST /_pb/auth/local/login to this broker with Content-Type: application/json and an Origin header equal to the broker address. Supply JSON fields email (your administrator e-mail address), password (the password you just chose), and code (a fresh six digit authenticator code). Read credentials from a protected file or private prompt, rather than command-line arguments. Save the response to a protected file and session cookies to a protected cookie jar; do not print either. A 204 response means you are signed in for subsequent requests using that cookie jar in the same client. See docs/workers-install.md for curl instructions and cleanup.")),c=()=>{let n=o.snapshot();if(r!==n.stage){b(),e.replaceChildren();let l=n.stage==="checking"||n.stage==="disabled"||n.stage==="unavailable"?p("section",{},w("Set up the administrator account"),...n.stage==="checking"?[]:[p("h2",{class:"mt-4 font-semibold"},n.stage==="disabled"?"Sign in with your organization's account":"Setup is unavailable")],p("p",{role:n.stage==="unavailable"?"alert":"status",class:"mt-2 text-gray-700"},n.stage==="checking"?"Checking sign-in options\u2026":n.stage==="disabled"?"Password setup is unavailable. Sign in to continue, or contact your administrator for help.":"Sign-in options could not be loaded. Reload the page to try again."),p("a",{href:`${v}#/login`,class:"mt-4 block text-blue-700 underline"},"Go to sign in")):n.stage==="token"?m():n.stage==="enroll"?h(n):n.stage==="done"?g():k();s=p("div",{id:"setup-notice",role:"alert",class:"mt-4 text-red-800"}),u=p("p",{id:"setup-status",role:"status",class:"mt-4 text-gray-700"});let i=p("main",{class:"mx-auto w-full max-w-xl flex-1 p-6"},l,s,u);e.className="flex min-h-screen flex-col",e.append(i,H()),document.getElementById("setup-heading")?.focus(),r=n.stage}f&&(f.disabled=n.busy),u&&(u.textContent=n.busy?"Working\u2026":""),s&&(s.replaceChildren(),n.notice!==null&&(s.append(p("p",{},he[n.notice])),n.notice==="weak_password"&&s.append(p("ul",{class:"mt-1 list-disc pl-6"},...n.problems.map(l=>p("li",{},ge[l]))))))},d=o.subscribe(c);return c(),()=>{d(),b(),o.dispose(),e.replaceChildren()}}if(typeof document<"u"){let e=document.getElementById("root");if(e!==null){let t=ke(e,{transport:be(fetch.bind(globalThis)),navigate:o=>{window.location.assign(o)}});window.addEventListener("pagehide",t,{once:!0}),window.addEventListener("pageshow",o=>{o.persisted&&window.location.reload()})}}export{v as APP_PATH,he as NOTICE_TEXT,ge as PROBLEM_TEXT,le as SETUP_FINISH_PATH,ie as SETUP_START_PATH,be as createFetchTransport,fe as createSetupController,ke as mountSetup};

package/dist/assets/setup.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="referrer" content="no-referrer" />
     <title>Package Broker setup</title>
-    <link rel="stylesheet" href="/_pb/ui/setup/assets/app.45b156168495.css" />
-    <script type="module" src="/_pb/ui/setup/assets/setup.8e977608d413.js"></script>
+    <link rel="stylesheet" href="/_pb/ui/setup/assets/app.ec678c27ec0a.css" />
+    <script type="module" src="/_pb/ui/setup/assets/setup.7bc86366227c.js"></script>
   </head>
   <body>
     <div id="root"></div>

package/dist/assets/sources.d95aabfbec73.js

@@ -0,0 +1 @@
+import{l as a,m as b,n as c,o as d,p as e,q as f,r as g,s as h,t as i,u as j,v as k,w as l}from"./chunk.fac952720b72.js";import"./chunk.675b635d9462.js";import"./chunk.4acf8fa7653f.js";import"./chunk.e3b0c44298fc.js";import"./chunk.53134c7df4e5.js";import"./chunk.2c3648a5bad1.js";import"./chunk.4721d4544d48.js";import"./chunk.f0fd799728ef.js";import"./chunk.304a2b5d1663.js";import"./chunk.56e058d97e0f.js";import"./chunk.75e1357175af.js";import"./chunk.dc41ee9219cf.js";import"./chunk.3f077ff17cea.js";import"./chunk.837eb41f53ef.js";export{g as CredentialFields,h as SYNC_ERROR_LABELS,i as SourceActions,l as SourcesPage,k as SourcesView,e as createSourcesModel,d as displayUrl,j as filterSources,b as sourceCredentialKind,a as sourceCredentialKinds,f as submitCredential,c as suggestedScopePatterns};

package/dist/assets/{tokens.6b86d8d97e07.js → tokens.4ee13a722abb.js}

@@ -1,4 +1,4 @@
-import{a as be}from"./chunk.f54ea1378c8c.js";import"./chunk.e3b0c44298fc.js";import{b as je}from"./chunk.28a4d8aab337.js";import{b as ae}from"./chunk.8442124f6802.js";import{a as G}from"./chunk.a6d755a9789f.js";import{a as Q,b as ve,c as F}from"./chunk.965b76812604.js";import"./chunk.3fcd6998795a.js";import{a as X}from"./chunk.d813fefb410d.js";import{a as L}from"./chunk.741aec8d1ff9.js";import{D as ne,E as U,F as D,K as ye,c as B,d as te,g as H,h as me,i as ge,m as fe,n as he,p as C}from"./chunk.fd375c54b526.js";var re=()=>({packageName:"",repository:"",workflow:"",environment:"",refPattern:""});function ke(e){let t={items:[],next:null,hasPrevious:!1,draft:re(),editing:null,loading:!1,loadError:!1,busy:!1,stale:!1,editDisabled:!1,notice:null},n=0,u=[void 0],a=new Set,p=f=>{t={...t,...f};for(let i of a)i()},k=f=>{let i=f.code==="conflict"||f.status===412||f.status===428;p({stale:i,notice:i?"This publisher changed. Reload the latest settings and review your draft before saving.":f.code==="github_credentials_required"?"Configure a GitHub source for this repository with a GitHub App installation or token first.":f.code==="ambiguous_trusted_publisher"?"A publisher already uses this package, repository, workflow and environment.":f.code==="name_not_claimed"?"Claim this package on an active hosted npm source first.":"The publisher could not be saved. Check your settings and try again."})},s={snapshot:()=>t,subscribe(f){return a.add(f),()=>{a.delete(f)}},draft(f){p({draft:f})},edit(f){p({draft:{packageName:f.packageName,repository:f.repository,workflow:f.workflow,environment:f.environment,refPattern:f.refPattern??""},editing:{id:f.id,revision:f.revision},notice:null,editDisabled:!1})},cancel(){p({draft:re(),editing:null,notice:null,editDisabled:!1})},clear(){n++,u=[void 0],p({draft:re(),editing:null,items:[],next:null,hasPrevious:!1,notice:null,busy:!1,loading:!1,stale:!1,editDisabled:!1,loadError:!1})},async load(){if(t.busy)return;let f=++n;p({loading:!0,loadError:!1});let i=u[u.length-1],x=await e.client.request("get","/_pb/trusted-publishers",{query:i===void 0?{}:{cursor:i}});if(f!==n)return;if(!x.ok){p({loading:!1,loadError:!0});return}let S=t.editing,N=!1;if(S!==null){let I=x.data.items.find(o=>o.id===S.id&&o.disabledAt===null);N=I===void 0,I!==void 0&&(S={id:I.id,revision:I.revision})}p({items:x.data.items,next:x.data.next??null,hasPrevious:u.length>1,loading:!1,stale:!1,editing:S,editDisabled:N,notice:N?"This publisher was disabled or is no longer available. Cancel this edit to create a new publisher.":t.stale?"Latest settings loaded. Review your draft before saving again.":t.notice})},async nextPage(){t.busy||t.loading||t.stale||t.loadError||t.editing!==null||t.next===null||(u.push(t.next),await s.load())},async previousPage(){t.busy||t.loading||t.stale||t.loadError||t.editing!==null||u.length<2||(u.pop(),await s.load())},async save(){if(t.busy||t.loading||t.stale||t.loadError||t.editDisabled)return;let f=n;p({busy:!0,notice:null});let{draft:i,editing:x}=t,S={packageName:i.packageName,repository:i.repository,workflow:i.workflow,environment:i.environment,...i.refPattern===""?{}:{refPattern:i.refPattern}},N=x===null?await e.client.request("post","/_pb/trusted-publishers",{body:S}):await e.client.request("put","/_pb/trusted-publishers/{id}",{params:{id:x.id},headers:{"If-Match":`"r${x.revision}"`},body:S});if(f===n){if(p({busy:!1}),!N.ok){k(N);return}p({draft:re(),editing:null,notice:"Trusted publisher saved."}),await s.load()}},async disable(f){if(t.busy||t.loading||t.stale||t.loadError)return;let i=n;p({busy:!0,notice:null});let x=await e.client.request("delete","/_pb/trusted-publishers/{id}",{params:{id:f.id},headers:{"If-Match":`"r${f.revision}"`}});if(i===n){if(p({busy:!1}),!x.ok){k(x);return}p({notice:"Publisher disabled. Its workload tokens have been revoked."}),await s.load()}}};return s}var R=B(te(),1);var j=B(H(),1),_e=e=>(window.addEventListener("hashchange",e),()=>window.removeEventListener("hashchange",e)),$e=()=>window.location.hash,qe=()=>"";function we({controller:e,permissions:t}){let n=(0,R.useSyncExternalStore)(e.subscribe,e.snapshot,e.snapshot),u=(0,R.useSyncExternalStore)(_e,$e,qe),a=new URLSearchParams(u.split("?")[1]??"").get("section")==="trusted-publishers",[p,k]=(0,R.useState)(a||n.editing!==null),[s,f]=(0,R.useState)(!1),[i,x]=(0,R.useState)(!1),S=(0,R.useRef)(null),N=(0,R.useRef)(null),I=s||n.editing!==null,o=n.busy||n.loading||n.stale||n.loadError;(0,R.useEffect)(()=>{(a||n.editing!==null)&&k(!0)},[a,n.editing]),(0,R.useEffect)(()=>{p&&I&&document.getElementById("publisher-packageName")?.focus()},[p,I,n.editing?.id]),(0,R.useEffect)(()=>{if(!i||I||o)return;(N.current?.isConnected?N.current:S.current)?.focus(),x(!1)},[i,I,o]);let h=t.includes("org:service-principals:write"),m=h&&t.includes("org:packages:publish");if((0,R.useEffect)(()=>(h&&e.load(),()=>e.clear()),[e,h]),!h)return null;let w=l=>{l.preventDefault(),e.save().then(()=>{e.snapshot().notice==="Trusted publisher saved."&&(f(!1),x(!0))})};return(0,j.jsxs)("details",{id:"trusted-publishers",className:"detail-group space-y-4",open:p,onToggle:l=>k(l.currentTarget.open),children:[(0,j.jsx)("summary",{className:"min-h-11 cursor-pointer font-semibold",children:"Trusted publishers"}),(0,j.jsx)("p",{children:"Organization \xB7 Let a GitHub Actions workflow publish one claimed npm package using short-lived credentials."}),(0,j.jsx)("p",{children:"Configure an organization GitHub source for the repository with a GitHub App installation or token so its numeric identity can be verified."}),n.notice===null?null:(0,j.jsx)("p",{role:"status",children:n.notice}),m&&!I?(0,j.jsx)(C,{ref:S,type:"button",className:"min-h-11",disabled:o,onClick:l=>{N.current=l.currentTarget,f(!0)},children:"Add trusted publisher"}):null,(0,j.jsx)(C,{type:"button",variant:"outline",className:"min-h-11",disabled:n.busy||n.loading,onClick:()=>{e.load()},children:"Reload trusted publishers"}),n.loading?(0,j.jsx)(F,{kind:"loading",title:"Loading trusted publishers\u2026"}):n.loadError?(0,j.jsx)(F,{kind:"error",title:"Trusted publishers could not be loaded."}):n.items.length===0?(0,j.jsx)(F,{kind:"empty",title:n.hasPrevious?"No trusted publishers on this page.":"No trusted publishers yet."}):(0,j.jsx)(Q,{label:"Organization trusted publishers",items:n.items,columns:[{key:"package",label:"Package",value:l=>l.packageName,render:l=>(0,j.jsx)("strong",{className:"break-all",children:l.packageName})},{key:"workflow",label:"GitHub workflow",value:l=>l.repository,render:l=>(0,j.jsxs)("div",{className:"break-all",children:[(0,j.jsx)("p",{children:l.repository}),(0,j.jsx)("p",{children:l.workflow})]})},{key:"binding",label:"Conditions",value:l=>l.environment,render:l=>(0,j.jsxs)(j.Fragment,{children:[(0,j.jsxs)("p",{children:["Environment: ",l.environment||"No environment"]}),(0,j.jsxs)("p",{children:["Ref: ",l.refPattern??"Any ref"]}),(0,j.jsx)("p",{children:l.disabledAt===null?"Enabled":"Disabled"})]})},{key:"used",label:"Last used",value:l=>l.lastUsedAt??"",render:l=>l.lastUsedAt===null?"Never used":(0,j.jsx)(X,{value:l.lastUsedAt})},{key:"actions",label:"Actions",value:()=>"",sortable:!1,render:l=>!m||l.disabledAt!==null?null:(0,j.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o,onClick:v=>{N.current=v.currentTarget,f(!1),e.edit(l)},children:"Edit publisher"}),(0,j.jsx)(G,{action:"Disable publisher",target:`${l.packageName}: ${l.repository} / ${l.workflow}`,scope:"Organization",description:"This workflow will no longer be able to publish through this binding. Its workload tokens will be revoked immediately. The binding remains in the history and cannot be recreated.",disabled:o,onConfirm:()=>{e.disable(l)}})]})}]}),(0,j.jsxs)("p",{children:[n.items.length," trusted publishers on this page"]}),(0,j.jsxs)("div",{className:"flex gap-2",children:[(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o||I||!n.hasPrevious,onClick:()=>{e.previousPage()},children:"Previous publishers"}),(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o||I||n.next===null,onClick:()=>{e.nextPage()},children:"Next publishers"})]}),m?I?(0,j.jsxs)("form",{onSubmit:w,className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2","aria-label":n.editing===null?"New trusted publisher":"Edit trusted publisher",children:[(0,j.jsx)("h3",{className:"lg:col-span-2 font-semibold",children:n.editing===null?"New trusted publisher":"Edit trusted publisher"}),[["packageName","npm package",!0],["repository","GitHub repository (owner/name)",!0],["workflow","Workflow filename",!0],["environment","Environment (optional)",!1],["refPattern","Ref pattern (optional)",!1]].map(([l,v,E])=>(0,j.jsxs)("div",{children:[(0,j.jsx)(D,{htmlFor:`publisher-${l}`,children:v}),(0,j.jsx)(U,{id:`publisher-${l}`,value:n.draft[l],required:E,maxLength:l==="packageName"?214:l==="repository"?140:255,disabled:n.busy,"aria-describedby":l==="refPattern"?"publisher-ref-help":l==="environment"?"publisher-environment-help":void 0,onChange:A=>e.draft({...n.draft,[l]:A.target.value})}),l==="refPattern"?(0,j.jsx)("p",{id:"publisher-ref-help",children:"Use a full ref such as refs/tags/v*. * crosses /, ? matches one character, and matching is case-sensitive. Leave blank to allow any ref."}):l==="environment"?(0,j.jsx)("p",{id:"publisher-environment-help",children:"ASCII letters are matched without case. Leave blank for a workflow job without an environment. A named environment must match."}):null]},l)),(0,j.jsx)("p",{className:"lg:col-span-2",children:"Saving creates or updates an organization service identity with permission to publish this package. Workflow identity is verified against GitHub's numeric repository and owner IDs."}),(0,j.jsxs)("div",{className:"lg:col-span-2 flex flex-wrap gap-2",children:[(0,j.jsx)(C,{type:"submit",className:"min-h-11 w-full sm:w-auto",disabled:o||n.editDisabled,children:n.busy?"Saving publisher\u2026":"Save trusted publisher"}),(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:n.busy,onClick:()=>{e.cancel(),f(!1),x(!0)},children:n.editing===null?"Cancel":"Cancel edit"})]})]}):null:(0,j.jsx)("p",{children:"Publishing and service identity management permissions are both required to manage publishers."})]})}var M=B(te(),1);var $=B(te(),1);var _=B(te(),1);var P=B(H(),1),Y={"project:read":["Read project details","View project information."],"project:packages:read":["Install and download packages","Read package metadata and download packages."],"project:packages:write":["Include publish permission","Publishing is not available in this version."],"project:grants:read":["Read project grants","View who has access to this project."],"project:sources:read":["Read project sources","View this project's package sources."],"project:audit:read":["Read project audit records","View recorded changes in this project."],"org:packages:publish":["Include organization publish permission","Include permission to publish packages to the organization. Publishing is not available in this version."],"org:read":["Read organization details","View organization information."],"org:users:read":["Read organization users","Read user information allowed by the API."],"org:roles:read":["Read organization roles","View organization role definitions."],"org:grants:read":["Read organization grants","View organization access rules."],"org:sources:read":["Read organization sources","View organization package sources."],"org:import:write":["Create and read import runs","Plan and inspect imports; cannot approve or apply them."],"org:audit:read":["Read organization audit records","View recorded organization changes."]},se=Object.keys(Y),Z=["project:read","project:packages:read"],Pe=["project:read","project:grants:read","project:sources:read","project:audit:read"];function Ce({state:e,controller:t}){let[n,u]=(0,_.useState)(!1),[a,p]=(0,_.useState)(""),[k,s]=(0,_.useState)(""),[f,i]=(0,_.useState)(Z),[x,S]=(0,_.useState)("Install packages"),[N,I]=(0,_.useState)(""),[o,h]=(0,_.useState)("principal-name"),[m,w]=(0,_.useState)(null),l=e.projects.find(g=>g.id===k),v=k==="organization"?e.organizationPermissions:l?.permissions??[],E=se.filter(g=>k==="organization"||g.startsWith("project:")).map(g=>({name:g,scope:g.startsWith("org:")?"organization":"project",description:Y[g][0]})),A=e.organizationPermissions.includes("org:service-principals:write"),y=e.organizationPermissions.includes("org:settings:write")&&A;return(0,_.useEffect)(()=>{l&&t.loadProjectPolicies([l.id])},[t,l]),(0,_.useEffect)(()=>{!k||l&&l.policyState!=="loaded"||i(g=>(x==="Install packages"?Z:x==="Read project records"?Pe:g).filter(b=>v.includes(b)))},[k,l,x,e.organizationPermissions]),y?(0,P.jsxs)(P.Fragment,{children:[(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>{u(!0),w(null)},children:"New service principal"}),m&&(0,P.jsx)("div",{children:(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>{t.choosePrincipal(m.id,e.projects.find(g=>g.id===m.projectId)?.slug??null,m.projectId===null),w(null),document.getElementById("new-token")?.focus()},children:"Create token"})}),n&&(0,P.jsxs)("form",{noValidate:!0,"aria-label":"New service principal",className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2",onSubmit:g=>{g.preventDefault();let b=a.trim()?k?l?.policyState==="loading"||l?.policyState==="idle"?{target:"principal-project",message:"Project access is still loading."}:l?.policyState==="error"?{target:"principal-project",message:"Project access could not be loaded. Try again."}:f.length?f.every(T=>v.includes(T))?null:{target:"principal-permissions",message:"You cannot grant every selected permission here."}:{target:"principal-permissions",message:"Choose at least one permission."}:{target:"principal-project",message:"Choose a project."}:{target:"principal-name",message:"Enter a service identity name."};if(b){h(b.target),requestAnimationFrame(()=>document.getElementById("principal-errors")?.focus()),I(b.message);return}I(""),t.createPrincipal(a,k==="organization"?"":k,f).then(T=>{T&&(w(T),u(!1),p(""))})},children:[(0,P.jsx)("h2",{className:"lg:col-span-2",children:"New service principal"}),(0,P.jsx)("p",{className:"lg:col-span-2",children:"Create a service identity for automation, then issue a token for it."}),N&&(0,P.jsx)("div",{id:"principal-errors",tabIndex:-1,role:"alert",className:"lg:col-span-2",children:(0,P.jsx)("button",{type:"button",className:"min-h-11 underline",onClick:()=>document.getElementById(o)?.focus(),children:N})}),(0,P.jsxs)("div",{children:[(0,P.jsx)(D,{htmlFor:"principal-name",children:"Service identity name"}),(0,P.jsx)(U,{className:"min-h-11",id:"principal-name","aria-invalid":!!N&&o==="principal-name",value:a,placeholder:"e.g. ci-storefront","aria-describedby":"principal-name-help",onChange:g=>p(g.target.value)}),(0,P.jsx)("p",{id:"principal-name-help",children:"Use one identity for each CI pipeline so you can stop its access separately."})]}),(0,P.jsxs)("div",{children:[(0,P.jsx)(D,{htmlFor:"principal-project",children:"Project"}),(0,P.jsxs)(L,{className:"min-h-11",id:"principal-project","aria-invalid":!!N&&o==="principal-project",value:k,onChange:g=>{let b=g.target.value,T=f.filter(K=>b==="organization"||K.startsWith("project:"));s(b),i(T),T.length!==f.length&&t.announce("Project changed. Incompatible permissions were removed.")},children:[(0,P.jsx)("option",{value:"",children:"Choose a project"}),e.projects.map(g=>(0,P.jsx)("option",{value:g.id,children:g.name},g.id)),(0,P.jsx)("option",{value:"organization",children:"Organization-wide (advanced)"})]}),k==="organization"&&(0,P.jsx)("p",{children:"Can carry permissions across projects and for the organization. Choose a single project for a CI pipeline that only installs its packages."})]}),(0,P.jsxs)("fieldset",{id:"principal-permissions",tabIndex:-1,className:"lg:col-span-2",children:[(0,P.jsx)("legend",{children:"Permissions"}),(0,P.jsx)("div",{className:"flex flex-wrap gap-2",children:["Install packages","Read project records","Custom"].map(g=>(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button","aria-pressed":x===g,onClick:()=>{S(g),g!=="Custom"&&i((g==="Install packages"?Z:Pe).filter(b=>v.includes(b)))},children:g},g))}),x==="Read project records"&&(0,P.jsx)("p",{children:"To issue an Install and download token, also select Install and download packages."}),l?.policyState==="loading"&&(0,P.jsx)("p",{children:"Loading project access\u2026"}),l?.policyState==="error"&&(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>t.loadProjectPolicies([l.id],!0),children:"Try again loading project access"}),(k==="organization"?["Packages","Project records","Organization"]:["Packages","Project records"]).map(g=>(0,P.jsxs)("fieldset",{children:[(0,P.jsx)("legend",{children:g}),E.filter(b=>g==="Organization"?b.scope==="organization":g==="Packages"?Z.includes(b.name)||b.name==="project:packages:write":b.scope==="project"&&!Z.includes(b.name)&&b.name!=="project:packages:write").map(b=>(0,P.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,P.jsx)("input",{type:"checkbox",checked:f.includes(b.name)&&v.includes(b.name),disabled:!v.includes(b.name),"aria-invalid":!!N&&o==="principal-permissions",onChange:T=>{S("Custom"),i(K=>T.target.checked?[...K,b.name]:K.filter(q=>q!==b.name))}}),Y[b.name]?.[0]??b.description," \u2014 ",Y[b.name]?.[1],!v.includes(b.name)&&" You cannot grant this permission here."]},b.name))]},g)),(0,P.jsx)("p",{children:"A token's access level and the project's access policy may limit these permissions further."})]}),(0,P.jsxs)("p",{className:"lg:col-span-2",children:[a," \xB7 ",k==="organization"?"Organization-wide":l?.name," \xB7"," ",f.length," ",f.length===1?"permission":"permissions"]}),(0,P.jsxs)("div",{className:"flex flex-wrap gap-2 lg:col-span-2",children:[(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"submit",disabled:e.busy,children:e.busy?"Creating service principal\u2026":"Create service principal"}),(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",variant:"outline",onClick:()=>u(!1),children:"Cancel"})]})]})]}):null}var d=B(H(),1),Fe="Create token",W={read:"Install and download",write:"Include publish permission",full:"Include grants, sources and audit access"},Me={"project:read":"Read project details","project:packages:read":"Install and download packages","project:packages:write":"Include publish permission","project:grants:read":"Read project grants","project:sources:read":"Read project sources","project:audit:read":"Read project audit records"},Oe={read:"Read project details and download packages.",write:"Also include the package publishing permission. Publish npm packages to an enabled hosted source that claims the package name.",full:"Also allow reading project grants, sources and audit records, plus the publish permission."},Ne={read:"project:packages:read",write:"project:packages:write",full:null},Ue={read:["project:read","project:packages:read"],write:["project:read","project:packages:read","project:packages:write"],full:null};function xe(e,t,n){let u=Ue[t];return[...new Set(e.filter(a=>se.includes(a)&&(u===null||u.includes(a))&&(n||a.startsWith("project:"))))].sort()}function Ke(e,t,n){if(!t)return"Choose a service identity first.";if(!t.length)return"This service identity has no permissions.";let u=xe(t,e,!0),a=Ne[e];return a!==null&&!u.includes(a)?"The service identity needs the required package permission.":u.length?u.some(p=>!n.includes(p))?"You cannot confer this service identity\u2019s permissions at this access level.":null:"This service identity has no token-eligible permissions at this access level."}function Ie(e,t,n,u){if(!t.length)return"Choose a project first.";let a={read:0,write:1,full:2};for(let p of t){if(p.policyState==="idle"||p.policyState==="loading")return"Loading project access\u2026";if(p.cap===null||p.permissions===null)return"Project policy or permissions could not be loaded. Try again.";if(a[e]>a[p.cap])return"This access level is not available for every selected project. Choose Install and download or change the selected projects.";let k=e==="read"?"project:packages:read":"project:packages:write";if(n&&!p.permissions.includes(k))return e==="full"?"Creating this access level requires package publishing permission on every selected project, even when you only need audit access.":"Your access does not include the required package permission for every selected project.";if(!n){if(!p.permissions.includes("project:tokens:create"))return"You need permission to create tokens for this project.";if(!u)return"Choose a service identity first.";if(!u.length)return"This service identity has no permissions. Choose another identity or ask an organization administrator to grant it access.";let s=xe(u,e,!1);if(e!=="full"&&!s.includes(Ne[e]))return"The service identity needs the required package permission.";if(!s.length||s.some(f=>!p.permissions.includes(f)))return"You cannot confer this service identity\u2019s permissions at this access level."}}return null}var le=()=>({name:"",scope:"read",days:"",project:"",ids:[],mode:"selected",principal:""});function Se(e){return e.length<1||e.length>200?"Choose between 1 and 200 projects.":null}function Ve(e,t){return e.principals.filter(n=>n.status==="active"&&n.projectId===t)}function Te({state:e,controller:t,initialAudience:n="ci",defaultOpen:u=!1}){let a=e.issuanceDraft,[p,k]=(0,$.useState)(u||a!==null),[s,f]=(0,$.useState)(a?a.target==="personal":n==="personal"),i=()=>a?{name:a.draft.name,scope:a.draft.scope,days:String(a.draft.lifetimeDays),project:a.target==="organization"?"__organization":a.project??"",ids:a.draft.projectIds,mode:a.draft.projectMode,principal:a.draft.servicePrincipalId}:le(),[x,S]=(0,$.useState)(()=>a&&a.target!=="personal"?i():{...le(),project:e.issuanceProject??""});(0,$.useEffect)(()=>{e.issuanceProject!==null&&S(c=>({...c,project:e.issuanceProject,principal:e.issuancePrincipal??c.principal,scope:e.issuanceProject==="__organization"?"full":c.scope})),e.issuancePrincipal&&(k(!0),f(!1))},[e.issuanceProject,e.issuancePrincipal,e.issuanceNonce]);let[N,I]=(0,$.useState)(()=>a?.target==="personal"?i():le());(0,$.useEffect)(()=>{if(!a)return;let c={name:a.draft.name,scope:a.draft.scope,days:String(a.draft.lifetimeDays),project:a.target==="organization"?"__organization":a.project??"",ids:a.draft.projectIds,mode:a.draft.projectMode,principal:a.draft.servicePrincipalId};(a.target==="personal"?I:S)(c),f(a.target==="personal"),k(!0)},[a]);let[o,h]=(0,$.useState)(""),[m,w]=(0,$.useState)(null),[l,v]=(0,$.useState)(null),E=s?l:m,A=s?v:w,y=s?N:x,g=c=>(s?I:S)(z=>({...z,...c})),b=s?e.projects.filter(c=>y.mode==="all"?c.permissions===null||c.permissions.some(z=>z==="project:packages:read"||z==="project:packages:write"):y.ids.includes(c.id)):e.projects.filter(c=>c.slug===y.project),T=!s&&y.project==="__organization",K=Ve(e,T?null:b[0]?.id),q=K.find(c=>c.id===y.principal),O=e.lifetime?.[s?"personal":"service"],ee=y.days||String(O?.defaultDays??""),V=s&&y.mode==="all",de=c=>q?Ke(c,q.permissions,e.organizationPermissions):"Choose a service identity first.",ue=V?null:T?de(y.scope):Ie(y.scope,b,s,q?.permissions),oe=b.map(c=>c.id).join(",");(0,$.useEffect)(()=>{p&&!V&&t.loadProjectPolicies(oe?oe.split(","):[])},[t,p,V,oe,e.projects]);function Le(){return y.name.trim()?e.projectsError&&!V?{message:"Projects could not be loaded. Try again.",target:s?"project-search":"issue-project"}:s&&y.mode==="selected"&&Se(y.ids)?{message:Se(y.ids),target:"project-search"}:!s&&!y.project?{message:"Choose a project first.",target:"issue-project"}:!s&&!q?{message:"Choose a service identity first.",target:"issue-principal"}:ue?{message:ue,target:"issue-access"}:!O||!ie(O).includes(Number(ee))?{message:"Choose an available lifetime.",target:"issue-lifetime"}:null:{message:"Enter a token name.",target:"issue-name"}}function Re(){k(!1),document.getElementById("new-token")?.focus()}return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(C,{className:"min-h-11",id:"new-token",type:"button",onClick:()=>k(!0),children:"New token"}),p?(0,d.jsxs)("form",{noValidate:!0,className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2",onSubmit:c=>{c.preventDefault();let z=Le();if(z){A(z),requestAnimationFrame(()=>document.getElementById("token-errors")?.focus());return}A(null),t.issueFor(s?"personal":T?"organization":"project",s||T?null:y.project,{name:y.name,scope:y.scope,lifetimeDays:Number(ee),servicePrincipalId:s?"":y.principal,projectMode:s?y.mode:"selected",projectIds:s&&y.mode==="selected"?y.ids:[]})},children:[(0,d.jsx)("h2",{className:"lg:col-span-2",children:"New token"}),(0,d.jsxs)("fieldset",{className:"lg:col-span-2",children:[(0,d.jsx)("legend",{children:"Who is this token for?"}),(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"audience",checked:!s,onChange:()=>{f(!1)}}),"A CI pipeline or service"]}),(0,d.jsx)("p",{children:"Keeps working when the person who created it leaves."}),(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"audience",checked:s,onChange:()=>{f(!0)}}),"Me"]}),(0,d.jsx)("p",{children:"Uses your access. Stops working if you leave or your account is suspended."})]}),E&&(0,d.jsx)("div",{id:"token-errors",role:"alert",tabIndex:-1,className:"lg:col-span-2",children:(0,d.jsx)("button",{type:"button",className:"min-h-11 underline",onClick:()=>document.getElementById(E.target)?.focus(),children:E.message})}),(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-name",children:"Token name"}),(0,d.jsx)(U,{className:"min-h-11",id:"issue-name",value:y.name,"aria-invalid":!!E&&!y.name.trim(),"aria-describedby":E?"token-errors":void 0,placeholder:s?"e.g. My laptop":"e.g. Storefront CI",onChange:c=>g({name:c.target.value})})]}),s?(0,d.jsxs)("fieldset",{children:[(0,d.jsx)("legend",{children:"Which projects?"}),["selected","all"].map(c=>(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"projects-mode",checked:y.mode===c,onChange:()=>g({mode:c})}),c==="selected"?"Choose projects":"All projects I can access"]},c)),y.mode==="all"?(0,d.jsx)("p",{children:"Includes projects you can access now and projects you gain access to later."}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(D,{htmlFor:"project-search",children:"Search projects"}),(0,d.jsx)(U,{className:"min-h-11",id:"project-search",value:o,onChange:c=>h(c.target.value)}),(0,d.jsx)("p",{id:"project-help",children:"Choose up to 200 projects. This does not give you access you do not already have."}),(0,d.jsxs)("p",{children:[y.ids.length," ",y.ids.length===1?"project selected":"projects selected"]}),(0,d.jsx)("div",{className:"max-h-60 overflow-y-auto",children:e.projects.filter(c=>c.name.toLowerCase().includes(o.toLowerCase())).map(c=>(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"checkbox",checked:y.ids.includes(c.id),disabled:!y.ids.includes(c.id)&&y.ids.length>=200,"aria-describedby":"project-help",onChange:z=>g({ids:z.target.checked?[...y.ids,c.id]:y.ids.filter(ze=>ze!==c.id)})}),c.name]},c.id))})]})]}):(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-project",children:"Project"}),(0,d.jsxs)(L,{className:"min-h-11","aria-invalid":!!E&&!y.project,"aria-describedby":E?"token-errors":void 0,id:"issue-project",value:y.project,onChange:c=>g({project:c.target.value,principal:"",scope:c.target.value==="__organization"?"full":"read"}),children:[(0,d.jsx)("option",{value:"",children:"Choose a project"}),e.projects.map(c=>(0,d.jsx)("option",{value:c.slug,children:c.name},c.id)),e.organizationPermissions.includes("org:settings:write")&&e.organizationPermissions.includes("org:service-principals:write")&&(0,d.jsx)("option",{value:"__organization",children:"Organization-wide (advanced)"})]}),y.project===""&&y.principal!==""&&e.principals.some(c=>c.id===y.principal&&c.projectId!==null)&&(0,d.jsx)("p",{children:"Project name unavailable. You may not have access to this service identity\u2019s project."})]}),e.projectsError&&(0,d.jsxs)("p",{className:"lg:col-span-2",children:["Projects could not be loaded."," ",(0,d.jsx)(C,{type:"button",onClick:()=>{t.identity()},children:"Try again"})]}),(0,d.jsxs)("fieldset",{id:"issue-access",tabIndex:-1,className:"lg:col-span-2","aria-describedby":"access-help",children:[(0,d.jsx)("legend",{children:"What can this token do?"}),["read","write","full"].map(c=>{let z=V?null:T?de(c):Ie(c,b,s,q?.permissions);return(0,d.jsxs)("div",{children:[(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"access",checked:y.scope===c,disabled:z!==null,"aria-invalid":E?.target==="issue-access",onChange:()=>g({scope:c}),"aria-describedby":`help-${c}`}),W[c]]}),(0,d.jsxs)("p",{id:`help-${c}`,children:[Oe[c]," ",z]})]},c)}),b.filter(c=>!V||c.policyState==="error").map(c=>(0,d.jsx)("p",{children:c.cap&&!V?`${c.name} allows ${{read:"install and download only",write:"install, download and publish permission",full:"all token-eligible project permissions"}[c.cap]}.`:`${c.name}: ${c.policyState==="loading"?"Loading project access\u2026":c.policyState==="error"?"Project access could not be loaded.":"Project access has not been loaded."}`},c.id)),b.some(c=>c.policyState==="error")&&(0,d.jsx)(C,{type:"button",onClick:()=>t.loadProjectPolicies(b.filter(c=>c.policyState==="error").map(c=>c.id),!0),children:"Try again loading project access"}),T&&(0,d.jsx)("p",{children:"This token may also use the service identity\u2019s organization permissions. Project policies only limit access within projects."}),(0,d.jsx)("p",{id:"access-help",children:"Your token can only use permissions its holder has and the project allows. Tokens cannot change project settings or delete packages. Publishing is not available in this version."})]}),!s&&(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-principal",children:"Service identity"}),(0,d.jsxs)(L,{className:"min-h-11","aria-invalid":!!E&&!q,"aria-describedby":E?"token-errors":void 0,id:"issue-principal",value:y.principal,onChange:c=>g({principal:c.target.value}),children:[(0,d.jsx)("option",{value:"",children:"Choose a service identity"}),K.map(c=>(0,d.jsx)("option",{value:c.id,children:c.name},c.id))]}),(0,d.jsx)("p",{children:"A service principal is an identity for automation. Its tokens keep working when the person who created them leaves."}),q&&(0,d.jsxs)("p",{children:["Permissions:"," ",(q.permissions??[]).map(c=>Me[c]??Y[c]?.[0]).filter(Boolean).join("; ")]}),e.principalsLoading?(0,d.jsx)("p",{children:"Loading service principals\u2026"}):e.principalsError?(0,d.jsxs)("p",{children:["Service principals could not be loaded."," ",(0,d.jsx)(C,{type:"button",onClick:()=>{t.loadPrincipals()},children:"Try again"})]}):(e.principalsRestricted||!K.length)&&(0,d.jsxs)("p",{children:[e.principalsRestricted&&"You cannot browse service principals here. ","Ask an organization administrator to create a service identity for this project."]})]}),(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-lifetime",children:"Expires after"}),(0,d.jsx)(L,{className:"min-h-11",id:"issue-lifetime","aria-invalid":E?.target==="issue-lifetime","aria-describedby":E?.target==="issue-lifetime"?"token-errors":void 0,value:ee,disabled:!O,onChange:c=>g({days:c.target.value}),children:O&&ie(O).map(c=>(0,d.jsxs)("option",{value:c,children:[J(c),c===O.defaultDays?" (organization default)":""]},c))}),!O&&!e.loading&&(0,d.jsx)(C,{type:"button",onClick:()=>{t.load()},children:"Try again"}),(0,d.jsx)("p",{children:O?`Maximum: ${J(O.maxDays)}. Create a replacement before this token expires.`:"Lifetime policy could not be loaded."})]}),(0,d.jsx)("p",{className:"lg:col-span-2 break-words",children:[y.name,V?"All projects I can access":b.map(c=>c.name).join(", "),W[y.scope],J(Number(ee)),s?"":q?.name].filter(Boolean).join(" \xB7 ")}),(0,d.jsxs)("div",{className:"flex flex-wrap gap-2 lg:col-span-2",children:[(0,d.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"submit",disabled:e.busy,children:e.busy?"Creating token\u2026":Fe}),(0,d.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",variant:"outline",disabled:e.busy,onClick:Re,children:"Cancel"})]})]}):null]})}function ce(e){return`'${e.replaceAll("'","'\\''")}'`}function Ee(e,t,n){let u=new URL(e),a=`${u.origin}/${encodeURIComponent(t)}`,p=`registry=${a}/npm/`,k=`//${u.host}/${encodeURIComponent(t)}/npm/:_authToken=`;return{composer:`composer config ${ce(`repositories.${t}`)} composer ${ce(a)}`,composerAuth:JSON.stringify({bearer:{[u.host]:n}},null,2),npm:`${p}
+import{a as be}from"./chunk.ab1a14143dc6.js";import"./chunk.e3b0c44298fc.js";import{b as je}from"./chunk.53134c7df4e5.js";import{b as ae}from"./chunk.f0fd799728ef.js";import{a as G}from"./chunk.304a2b5d1663.js";import{a as Q,b as ve,c as F}from"./chunk.56e058d97e0f.js";import"./chunk.75e1357175af.js";import{a as X}from"./chunk.dc41ee9219cf.js";import{a as L}from"./chunk.3f077ff17cea.js";import{D as ne,E as U,F as D,K as ye,c as B,d as te,g as H,h as me,i as ge,m as fe,n as he,p as C}from"./chunk.837eb41f53ef.js";var re=()=>({packageName:"",repository:"",workflow:"",environment:"",refPattern:""});function ke(e){let t={items:[],next:null,hasPrevious:!1,draft:re(),editing:null,loading:!1,loadError:!1,busy:!1,stale:!1,editDisabled:!1,notice:null},n=0,u=[void 0],a=new Set,p=f=>{t={...t,...f};for(let i of a)i()},k=f=>{let i=f.code==="conflict"||f.status===412||f.status===428;p({stale:i,notice:i?"This publisher changed. Reload the latest settings and review your draft before saving.":f.code==="github_credentials_required"?"Configure a GitHub source for this repository with a GitHub App installation or token first.":f.code==="ambiguous_trusted_publisher"?"A publisher already uses this package, repository, workflow and environment.":f.code==="name_not_claimed"?"Claim this package on an active hosted npm source first.":"The publisher could not be saved. Check your settings and try again."})},s={snapshot:()=>t,subscribe(f){return a.add(f),()=>{a.delete(f)}},draft(f){p({draft:f})},edit(f){p({draft:{packageName:f.packageName,repository:f.repository,workflow:f.workflow,environment:f.environment,refPattern:f.refPattern??""},editing:{id:f.id,revision:f.revision},notice:null,editDisabled:!1})},cancel(){p({draft:re(),editing:null,notice:null,editDisabled:!1})},clear(){n++,u=[void 0],p({draft:re(),editing:null,items:[],next:null,hasPrevious:!1,notice:null,busy:!1,loading:!1,stale:!1,editDisabled:!1,loadError:!1})},async load(){if(t.busy)return;let f=++n;p({loading:!0,loadError:!1});let i=u[u.length-1],x=await e.client.request("get","/_pb/trusted-publishers",{query:i===void 0?{}:{cursor:i}});if(f!==n)return;if(!x.ok){p({loading:!1,loadError:!0});return}let S=t.editing,N=!1;if(S!==null){let I=x.data.items.find(o=>o.id===S.id&&o.disabledAt===null);N=I===void 0,I!==void 0&&(S={id:I.id,revision:I.revision})}p({items:x.data.items,next:x.data.next??null,hasPrevious:u.length>1,loading:!1,stale:!1,editing:S,editDisabled:N,notice:N?"This publisher was disabled or is no longer available. Cancel this edit to create a new publisher.":t.stale?"Latest settings loaded. Review your draft before saving again.":t.notice})},async nextPage(){t.busy||t.loading||t.stale||t.loadError||t.editing!==null||t.next===null||(u.push(t.next),await s.load())},async previousPage(){t.busy||t.loading||t.stale||t.loadError||t.editing!==null||u.length<2||(u.pop(),await s.load())},async save(){if(t.busy||t.loading||t.stale||t.loadError||t.editDisabled)return;let f=n;p({busy:!0,notice:null});let{draft:i,editing:x}=t,S={packageName:i.packageName,repository:i.repository,workflow:i.workflow,environment:i.environment,...i.refPattern===""?{}:{refPattern:i.refPattern}},N=x===null?await e.client.request("post","/_pb/trusted-publishers",{body:S}):await e.client.request("put","/_pb/trusted-publishers/{id}",{params:{id:x.id},headers:{"If-Match":`"r${x.revision}"`},body:S});if(f===n){if(p({busy:!1}),!N.ok){k(N);return}p({draft:re(),editing:null,notice:"Trusted publisher saved."}),await s.load()}},async disable(f){if(t.busy||t.loading||t.stale||t.loadError)return;let i=n;p({busy:!0,notice:null});let x=await e.client.request("delete","/_pb/trusted-publishers/{id}",{params:{id:f.id},headers:{"If-Match":`"r${f.revision}"`}});if(i===n){if(p({busy:!1}),!x.ok){k(x);return}p({notice:"Publisher disabled. Its workload tokens have been revoked."}),await s.load()}}};return s}var R=B(te(),1);var j=B(H(),1),_e=e=>(window.addEventListener("hashchange",e),()=>window.removeEventListener("hashchange",e)),$e=()=>window.location.hash,qe=()=>"";function we({controller:e,permissions:t}){let n=(0,R.useSyncExternalStore)(e.subscribe,e.snapshot,e.snapshot),u=(0,R.useSyncExternalStore)(_e,$e,qe),a=new URLSearchParams(u.split("?")[1]??"").get("section")==="trusted-publishers",[p,k]=(0,R.useState)(a||n.editing!==null),[s,f]=(0,R.useState)(!1),[i,x]=(0,R.useState)(!1),S=(0,R.useRef)(null),N=(0,R.useRef)(null),I=s||n.editing!==null,o=n.busy||n.loading||n.stale||n.loadError;(0,R.useEffect)(()=>{(a||n.editing!==null)&&k(!0)},[a,n.editing]),(0,R.useEffect)(()=>{p&&I&&document.getElementById("publisher-packageName")?.focus()},[p,I,n.editing?.id]),(0,R.useEffect)(()=>{if(!i||I||o)return;(N.current?.isConnected?N.current:S.current)?.focus(),x(!1)},[i,I,o]);let h=t.includes("org:service-principals:write"),m=h&&t.includes("org:packages:publish");if((0,R.useEffect)(()=>(h&&e.load(),()=>e.clear()),[e,h]),!h)return null;let w=l=>{l.preventDefault(),e.save().then(()=>{e.snapshot().notice==="Trusted publisher saved."&&(f(!1),x(!0))})};return(0,j.jsxs)("details",{id:"trusted-publishers",className:"detail-group space-y-4",open:p,onToggle:l=>k(l.currentTarget.open),children:[(0,j.jsx)("summary",{className:"min-h-11 cursor-pointer font-semibold",children:"Trusted publishers"}),(0,j.jsx)("p",{children:"Organization \xB7 Let a GitHub Actions workflow publish one claimed npm package using short-lived credentials."}),(0,j.jsx)("p",{children:"Configure an organization GitHub source for the repository with a GitHub App installation or token so its numeric identity can be verified."}),n.notice===null?null:(0,j.jsx)("p",{role:"status",children:n.notice}),m&&!I?(0,j.jsx)(C,{ref:S,type:"button",className:"min-h-11",disabled:o,onClick:l=>{N.current=l.currentTarget,f(!0)},children:"Add trusted publisher"}):null,(0,j.jsx)(C,{type:"button",variant:"outline",className:"min-h-11",disabled:n.busy||n.loading,onClick:()=>{e.load()},children:"Reload trusted publishers"}),n.loading?(0,j.jsx)(F,{kind:"loading",title:"Loading trusted publishers\u2026"}):n.loadError?(0,j.jsx)(F,{kind:"error",title:"Trusted publishers could not be loaded."}):n.items.length===0?(0,j.jsx)(F,{kind:"empty",title:n.hasPrevious?"No trusted publishers on this page.":"No trusted publishers yet."}):(0,j.jsx)(Q,{label:"Organization trusted publishers",items:n.items,columns:[{key:"package",label:"Package",value:l=>l.packageName,render:l=>(0,j.jsx)("strong",{className:"break-all",children:l.packageName})},{key:"workflow",label:"GitHub workflow",value:l=>l.repository,render:l=>(0,j.jsxs)("div",{className:"break-all",children:[(0,j.jsx)("p",{children:l.repository}),(0,j.jsx)("p",{children:l.workflow})]})},{key:"binding",label:"Conditions",value:l=>l.environment,render:l=>(0,j.jsxs)(j.Fragment,{children:[(0,j.jsxs)("p",{children:["Environment: ",l.environment||"No environment"]}),(0,j.jsxs)("p",{children:["Ref: ",l.refPattern??"Any ref"]}),(0,j.jsx)("p",{children:l.disabledAt===null?"Enabled":"Disabled"})]})},{key:"used",label:"Last used",value:l=>l.lastUsedAt??"",render:l=>l.lastUsedAt===null?"Never used":(0,j.jsx)(X,{value:l.lastUsedAt})},{key:"actions",label:"Actions",value:()=>"",sortable:!1,render:l=>!m||l.disabledAt!==null?null:(0,j.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o,onClick:v=>{N.current=v.currentTarget,f(!1),e.edit(l)},children:"Edit publisher"}),(0,j.jsx)(G,{action:"Disable publisher",target:`${l.packageName}: ${l.repository} / ${l.workflow}`,scope:"Organization",description:"This workflow will no longer be able to publish through this binding. Its workload tokens will be revoked immediately. The binding remains in the history and cannot be recreated.",disabled:o,onConfirm:()=>{e.disable(l)}})]})}]}),(0,j.jsxs)("p",{children:[n.items.length," trusted publishers on this page"]}),(0,j.jsxs)("div",{className:"flex gap-2",children:[(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o||I||!n.hasPrevious,onClick:()=>{e.previousPage()},children:"Previous publishers"}),(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:o||I||n.next===null,onClick:()=>{e.nextPage()},children:"Next publishers"})]}),m?I?(0,j.jsxs)("form",{onSubmit:w,className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2","aria-label":n.editing===null?"New trusted publisher":"Edit trusted publisher",children:[(0,j.jsx)("h3",{className:"lg:col-span-2 font-semibold",children:n.editing===null?"New trusted publisher":"Edit trusted publisher"}),[["packageName","npm package",!0],["repository","GitHub repository (owner/name)",!0],["workflow","Workflow filename",!0],["environment","Environment (optional)",!1],["refPattern","Ref pattern (optional)",!1]].map(([l,v,E])=>(0,j.jsxs)("div",{children:[(0,j.jsx)(D,{htmlFor:`publisher-${l}`,children:v}),(0,j.jsx)(U,{id:`publisher-${l}`,value:n.draft[l],required:E,maxLength:l==="packageName"?214:l==="repository"?140:255,disabled:n.busy,"aria-describedby":l==="refPattern"?"publisher-ref-help":l==="environment"?"publisher-environment-help":void 0,onChange:A=>e.draft({...n.draft,[l]:A.target.value})}),l==="refPattern"?(0,j.jsx)("p",{id:"publisher-ref-help",children:"Use a full ref such as refs/tags/v*. * crosses /, ? matches one character, and matching is case-sensitive. Leave blank to allow any ref."}):l==="environment"?(0,j.jsx)("p",{id:"publisher-environment-help",children:"ASCII letters are matched without case. Leave blank for a workflow job without an environment. A named environment must match."}):null]},l)),(0,j.jsx)("p",{className:"lg:col-span-2",children:"Saving creates or updates an organization service identity with permission to publish this package. Workflow identity is verified against GitHub's numeric repository and owner IDs."}),(0,j.jsxs)("div",{className:"lg:col-span-2 flex flex-wrap gap-2",children:[(0,j.jsx)(C,{type:"submit",className:"min-h-11 w-full sm:w-auto",disabled:o||n.editDisabled,children:n.busy?"Saving publisher\u2026":"Save trusted publisher"}),(0,j.jsx)(C,{type:"button",className:"min-h-11",variant:"outline",disabled:n.busy,onClick:()=>{e.cancel(),f(!1),x(!0)},children:n.editing===null?"Cancel":"Cancel edit"})]})]}):null:(0,j.jsx)("p",{children:"Publishing and service identity management permissions are both required to manage publishers."})]})}var M=B(te(),1);var $=B(te(),1);var _=B(te(),1);var P=B(H(),1),Y={"project:read":["Read project details","View project information."],"project:packages:read":["Install and download packages","Read package metadata and download packages."],"project:packages:write":["Include publish permission","Publishing is not available in this version."],"project:grants:read":["Read project grants","View who has access to this project."],"project:sources:read":["Read project sources","View this project's package sources."],"project:audit:read":["Read project audit records","View recorded changes in this project."],"org:packages:publish":["Include organization publish permission","Include permission to publish packages to the organization. Publishing is not available in this version."],"org:read":["Read organization details","View organization information."],"org:users:read":["Read organization users","Read user information allowed by the API."],"org:roles:read":["Read organization roles","View organization role definitions."],"org:grants:read":["Read organization grants","View organization access rules."],"org:sources:read":["Read organization sources","View organization package sources."],"org:import:write":["Create and read import runs","Plan and inspect imports; cannot approve or apply them."],"org:audit:read":["Read organization audit records","View recorded organization changes."]},se=Object.keys(Y),Z=["project:read","project:packages:read"],Pe=["project:read","project:grants:read","project:sources:read","project:audit:read"];function Ce({state:e,controller:t}){let[n,u]=(0,_.useState)(!1),[a,p]=(0,_.useState)(""),[k,s]=(0,_.useState)(""),[f,i]=(0,_.useState)(Z),[x,S]=(0,_.useState)("Install packages"),[N,I]=(0,_.useState)(""),[o,h]=(0,_.useState)("principal-name"),[m,w]=(0,_.useState)(null),l=e.projects.find(g=>g.id===k),v=k==="organization"?e.organizationPermissions:l?.permissions??[],E=se.filter(g=>k==="organization"||g.startsWith("project:")).map(g=>({name:g,scope:g.startsWith("org:")?"organization":"project",description:Y[g][0]})),A=e.organizationPermissions.includes("org:service-principals:write"),y=e.organizationPermissions.includes("org:settings:write")&&A;return(0,_.useEffect)(()=>{l&&t.loadProjectPolicies([l.id])},[t,l]),(0,_.useEffect)(()=>{!k||l&&l.policyState!=="loaded"||i(g=>(x==="Install packages"?Z:x==="Read project records"?Pe:g).filter(b=>v.includes(b)))},[k,l,x,e.organizationPermissions]),y?(0,P.jsxs)(P.Fragment,{children:[(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>{u(!0),w(null)},children:"New service principal"}),m&&(0,P.jsx)("div",{children:(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>{t.choosePrincipal(m.id,e.projects.find(g=>g.id===m.projectId)?.slug??null,m.projectId===null),w(null),document.getElementById("new-token")?.focus()},children:"Create token"})}),n&&(0,P.jsxs)("form",{noValidate:!0,"aria-label":"New service principal",className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2",onSubmit:g=>{g.preventDefault();let b=a.trim()?k?l?.policyState==="loading"||l?.policyState==="idle"?{target:"principal-project",message:"Project access is still loading."}:l?.policyState==="error"?{target:"principal-project",message:"Project access could not be loaded. Try again."}:f.length?f.every(T=>v.includes(T))?null:{target:"principal-permissions",message:"You cannot grant every selected permission here."}:{target:"principal-permissions",message:"Choose at least one permission."}:{target:"principal-project",message:"Choose a project."}:{target:"principal-name",message:"Enter a service identity name."};if(b){h(b.target),requestAnimationFrame(()=>document.getElementById("principal-errors")?.focus()),I(b.message);return}I(""),t.createPrincipal(a,k==="organization"?"":k,f).then(T=>{T&&(w(T),u(!1),p(""))})},children:[(0,P.jsx)("h2",{className:"lg:col-span-2",children:"New service principal"}),(0,P.jsx)("p",{className:"lg:col-span-2",children:"Create a service identity for automation, then issue a token for it."}),N&&(0,P.jsx)("div",{id:"principal-errors",tabIndex:-1,role:"alert",className:"lg:col-span-2",children:(0,P.jsx)("button",{type:"button",className:"min-h-11 underline",onClick:()=>document.getElementById(o)?.focus(),children:N})}),(0,P.jsxs)("div",{children:[(0,P.jsx)(D,{htmlFor:"principal-name",children:"Service identity name"}),(0,P.jsx)(U,{className:"min-h-11",id:"principal-name","aria-invalid":!!N&&o==="principal-name",value:a,placeholder:"e.g. ci-storefront","aria-describedby":"principal-name-help",onChange:g=>p(g.target.value)}),(0,P.jsx)("p",{id:"principal-name-help",children:"Use one identity for each CI pipeline so you can stop its access separately."})]}),(0,P.jsxs)("div",{children:[(0,P.jsx)(D,{htmlFor:"principal-project",children:"Project"}),(0,P.jsxs)(L,{className:"min-h-11",id:"principal-project","aria-invalid":!!N&&o==="principal-project",value:k,onChange:g=>{let b=g.target.value,T=f.filter(K=>b==="organization"||K.startsWith("project:"));s(b),i(T),T.length!==f.length&&t.announce("Project changed. Incompatible permissions were removed.")},children:[(0,P.jsx)("option",{value:"",children:"Choose a project"}),e.projects.map(g=>(0,P.jsx)("option",{value:g.id,children:g.name},g.id)),(0,P.jsx)("option",{value:"organization",children:"Organization-wide (advanced)"})]}),k==="organization"&&(0,P.jsx)("p",{children:"Can carry permissions across projects and for the organization. Choose a single project for a CI pipeline that only installs its packages."})]}),(0,P.jsxs)("fieldset",{id:"principal-permissions",tabIndex:-1,className:"lg:col-span-2",children:[(0,P.jsx)("legend",{children:"Permissions"}),(0,P.jsx)("div",{className:"flex flex-wrap gap-2",children:["Install packages","Read project records","Custom"].map(g=>(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button","aria-pressed":x===g,onClick:()=>{S(g),g!=="Custom"&&i((g==="Install packages"?Z:Pe).filter(b=>v.includes(b)))},children:g},g))}),x==="Read project records"&&(0,P.jsx)("p",{children:"To issue an Install and download token, also select Install and download packages."}),l?.policyState==="loading"&&(0,P.jsx)("p",{children:"Loading project access\u2026"}),l?.policyState==="error"&&(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",onClick:()=>t.loadProjectPolicies([l.id],!0),children:"Try again loading project access"}),(k==="organization"?["Packages","Project records","Organization"]:["Packages","Project records"]).map(g=>(0,P.jsxs)("fieldset",{children:[(0,P.jsx)("legend",{children:g}),E.filter(b=>g==="Organization"?b.scope==="organization":g==="Packages"?Z.includes(b.name)||b.name==="project:packages:write":b.scope==="project"&&!Z.includes(b.name)&&b.name!=="project:packages:write").map(b=>(0,P.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,P.jsx)("input",{type:"checkbox",checked:f.includes(b.name)&&v.includes(b.name),disabled:!v.includes(b.name),"aria-invalid":!!N&&o==="principal-permissions",onChange:T=>{S("Custom"),i(K=>T.target.checked?[...K,b.name]:K.filter(q=>q!==b.name))}}),Y[b.name]?.[0]??b.description," \u2014 ",Y[b.name]?.[1],!v.includes(b.name)&&" You cannot grant this permission here."]},b.name))]},g)),(0,P.jsx)("p",{children:"A token's access level and the project's access policy may limit these permissions further."})]}),(0,P.jsxs)("p",{className:"lg:col-span-2",children:[a," \xB7 ",k==="organization"?"Organization-wide":l?.name," \xB7"," ",f.length," ",f.length===1?"permission":"permissions"]}),(0,P.jsxs)("div",{className:"flex flex-wrap gap-2 lg:col-span-2",children:[(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"submit",disabled:e.busy,children:e.busy?"Creating service principal\u2026":"Create service principal"}),(0,P.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",variant:"outline",onClick:()=>u(!1),children:"Cancel"})]})]})]}):null}var d=B(H(),1),Fe="Create token",W={read:"Install and download",write:"Include publish permission",full:"Include grants, sources and audit access"},Me={"project:read":"Read project details","project:packages:read":"Install and download packages","project:packages:write":"Include publish permission","project:grants:read":"Read project grants","project:sources:read":"Read project sources","project:audit:read":"Read project audit records"},Oe={read:"Read project details and download packages.",write:"Also include the package publishing permission. Publish npm packages to an enabled hosted source that claims the package name.",full:"Also allow reading project grants, sources and audit records, plus the publish permission."},Ne={read:"project:packages:read",write:"project:packages:write",full:null},Ue={read:["project:read","project:packages:read"],write:["project:read","project:packages:read","project:packages:write"],full:null};function xe(e,t,n){let u=Ue[t];return[...new Set(e.filter(a=>se.includes(a)&&(u===null||u.includes(a))&&(n||a.startsWith("project:"))))].sort()}function Ke(e,t,n){if(!t)return"Choose a service identity first.";if(!t.length)return"This service identity has no permissions.";let u=xe(t,e,!0),a=Ne[e];return a!==null&&!u.includes(a)?"The service identity needs the required package permission.":u.length?u.some(p=>!n.includes(p))?"You cannot confer this service identity\u2019s permissions at this access level.":null:"This service identity has no token-eligible permissions at this access level."}function Ie(e,t,n,u){if(!t.length)return"Choose a project first.";let a={read:0,write:1,full:2};for(let p of t){if(p.policyState==="idle"||p.policyState==="loading")return"Loading project access\u2026";if(p.cap===null||p.permissions===null)return"Project policy or permissions could not be loaded. Try again.";if(a[e]>a[p.cap])return"This access level is not available for every selected project. Choose Install and download or change the selected projects.";let k=e==="read"?"project:packages:read":"project:packages:write";if(n&&!p.permissions.includes(k))return e==="full"?"Creating this access level requires package publishing permission on every selected project, even when you only need audit access.":"Your access does not include the required package permission for every selected project.";if(!n){if(!p.permissions.includes("project:tokens:create"))return"You need permission to create tokens for this project.";if(!u)return"Choose a service identity first.";if(!u.length)return"This service identity has no permissions. Choose another identity or ask an organization administrator to grant it access.";let s=xe(u,e,!1);if(e!=="full"&&!s.includes(Ne[e]))return"The service identity needs the required package permission.";if(!s.length||s.some(f=>!p.permissions.includes(f)))return"You cannot confer this service identity\u2019s permissions at this access level."}}return null}var le=()=>({name:"",scope:"read",days:"",project:"",ids:[],mode:"selected",principal:""});function Se(e){return e.length<1||e.length>200?"Choose between 1 and 200 projects.":null}function Ve(e,t){return e.principals.filter(n=>n.status==="active"&&n.projectId===t)}function Te({state:e,controller:t,initialAudience:n="ci",defaultOpen:u=!1}){let a=e.issuanceDraft,[p,k]=(0,$.useState)(u||a!==null),[s,f]=(0,$.useState)(a?a.target==="personal":n==="personal"),i=()=>a?{name:a.draft.name,scope:a.draft.scope,days:String(a.draft.lifetimeDays),project:a.target==="organization"?"__organization":a.project??"",ids:a.draft.projectIds,mode:a.draft.projectMode,principal:a.draft.servicePrincipalId}:le(),[x,S]=(0,$.useState)(()=>a&&a.target!=="personal"?i():{...le(),project:e.issuanceProject??""});(0,$.useEffect)(()=>{e.issuanceProject!==null&&S(c=>({...c,project:e.issuanceProject,principal:e.issuancePrincipal??c.principal,scope:e.issuanceProject==="__organization"?"full":c.scope})),e.issuancePrincipal&&(k(!0),f(!1))},[e.issuanceProject,e.issuancePrincipal,e.issuanceNonce]);let[N,I]=(0,$.useState)(()=>a?.target==="personal"?i():le());(0,$.useEffect)(()=>{if(!a)return;let c={name:a.draft.name,scope:a.draft.scope,days:String(a.draft.lifetimeDays),project:a.target==="organization"?"__organization":a.project??"",ids:a.draft.projectIds,mode:a.draft.projectMode,principal:a.draft.servicePrincipalId};(a.target==="personal"?I:S)(c),f(a.target==="personal"),k(!0)},[a]);let[o,h]=(0,$.useState)(""),[m,w]=(0,$.useState)(null),[l,v]=(0,$.useState)(null),E=s?l:m,A=s?v:w,y=s?N:x,g=c=>(s?I:S)(z=>({...z,...c})),b=s?e.projects.filter(c=>y.mode==="all"?c.permissions===null||c.permissions.some(z=>z==="project:packages:read"||z==="project:packages:write"):y.ids.includes(c.id)):e.projects.filter(c=>c.slug===y.project),T=!s&&y.project==="__organization",K=Ve(e,T?null:b[0]?.id),q=K.find(c=>c.id===y.principal),O=e.lifetime?.[s?"personal":"service"],ee=y.days||String(O?.defaultDays??""),V=s&&y.mode==="all",de=c=>q?Ke(c,q.permissions,e.organizationPermissions):"Choose a service identity first.",ue=V?null:T?de(y.scope):Ie(y.scope,b,s,q?.permissions),oe=b.map(c=>c.id).join(",");(0,$.useEffect)(()=>{p&&!V&&t.loadProjectPolicies(oe?oe.split(","):[])},[t,p,V,oe,e.projects]);function Le(){return y.name.trim()?e.projectsError&&!V?{message:"Projects could not be loaded. Try again.",target:s?"project-search":"issue-project"}:s&&y.mode==="selected"&&Se(y.ids)?{message:Se(y.ids),target:"project-search"}:!s&&!y.project?{message:"Choose a project first.",target:"issue-project"}:!s&&!q?{message:"Choose a service identity first.",target:"issue-principal"}:ue?{message:ue,target:"issue-access"}:!O||!ie(O).includes(Number(ee))?{message:"Choose an available lifetime.",target:"issue-lifetime"}:null:{message:"Enter a token name.",target:"issue-name"}}function Re(){k(!1),document.getElementById("new-token")?.focus()}return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(C,{className:"min-h-11",id:"new-token",type:"button",onClick:()=>k(!0),children:"New token"}),p?(0,d.jsxs)("form",{noValidate:!0,className:"grid max-w-5xl items-start gap-x-6 gap-y-4 lg:grid-cols-2",onSubmit:c=>{c.preventDefault();let z=Le();if(z){A(z),requestAnimationFrame(()=>document.getElementById("token-errors")?.focus());return}A(null),t.issueFor(s?"personal":T?"organization":"project",s||T?null:y.project,{name:y.name,scope:y.scope,lifetimeDays:Number(ee),servicePrincipalId:s?"":y.principal,projectMode:s?y.mode:"selected",projectIds:s&&y.mode==="selected"?y.ids:[]})},children:[(0,d.jsx)("h2",{className:"lg:col-span-2",children:"New token"}),(0,d.jsxs)("fieldset",{className:"lg:col-span-2",children:[(0,d.jsx)("legend",{children:"Who is this token for?"}),(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"audience",checked:!s,onChange:()=>{f(!1)}}),"A CI pipeline or service"]}),(0,d.jsx)("p",{children:"Keeps working when the person who created it leaves."}),(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"audience",checked:s,onChange:()=>{f(!0)}}),"Me"]}),(0,d.jsx)("p",{children:"Uses your access. Stops working if you leave or your account is suspended."})]}),E&&(0,d.jsx)("div",{id:"token-errors",role:"alert",tabIndex:-1,className:"lg:col-span-2",children:(0,d.jsx)("button",{type:"button",className:"min-h-11 underline",onClick:()=>document.getElementById(E.target)?.focus(),children:E.message})}),(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-name",children:"Token name"}),(0,d.jsx)(U,{className:"min-h-11",id:"issue-name",value:y.name,"aria-invalid":!!E&&!y.name.trim(),"aria-describedby":E?"token-errors":void 0,placeholder:s?"e.g. My laptop":"e.g. Storefront CI",onChange:c=>g({name:c.target.value})})]}),s?(0,d.jsxs)("fieldset",{children:[(0,d.jsx)("legend",{children:"Which projects?"}),["selected","all"].map(c=>(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"projects-mode",checked:y.mode===c,onChange:()=>g({mode:c})}),c==="selected"?"Choose projects":"All projects I can access"]},c)),y.mode==="all"?(0,d.jsx)("p",{children:"Includes projects you can access now and projects you gain access to later."}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(D,{htmlFor:"project-search",children:"Search projects"}),(0,d.jsx)(U,{className:"min-h-11",id:"project-search",value:o,onChange:c=>h(c.target.value)}),(0,d.jsx)("p",{id:"project-help",children:"Choose up to 200 projects. This does not give you access you do not already have."}),(0,d.jsxs)("p",{children:[y.ids.length," ",y.ids.length===1?"project selected":"projects selected"]}),(0,d.jsx)("div",{className:"max-h-60 overflow-y-auto",children:e.projects.filter(c=>c.name.toLowerCase().includes(o.toLowerCase())).map(c=>(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"checkbox",checked:y.ids.includes(c.id),disabled:!y.ids.includes(c.id)&&y.ids.length>=200,"aria-describedby":"project-help",onChange:z=>g({ids:z.target.checked?[...y.ids,c.id]:y.ids.filter(ze=>ze!==c.id)})}),c.name]},c.id))})]})]}):(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-project",children:"Project"}),(0,d.jsxs)(L,{className:"min-h-11","aria-invalid":!!E&&!y.project,"aria-describedby":E?"token-errors":void 0,id:"issue-project",value:y.project,onChange:c=>g({project:c.target.value,principal:"",scope:c.target.value==="__organization"?"full":"read"}),children:[(0,d.jsx)("option",{value:"",children:"Choose a project"}),e.projects.map(c=>(0,d.jsx)("option",{value:c.slug,children:c.name},c.id)),e.organizationPermissions.includes("org:settings:write")&&e.organizationPermissions.includes("org:service-principals:write")&&(0,d.jsx)("option",{value:"__organization",children:"Organization-wide (advanced)"})]}),y.project===""&&y.principal!==""&&e.principals.some(c=>c.id===y.principal&&c.projectId!==null)&&(0,d.jsx)("p",{children:"Project name unavailable. You may not have access to this service identity\u2019s project."})]}),e.projectsError&&(0,d.jsxs)("p",{className:"lg:col-span-2",children:["Projects could not be loaded."," ",(0,d.jsx)(C,{type:"button",onClick:()=>{t.identity()},children:"Try again"})]}),(0,d.jsxs)("fieldset",{id:"issue-access",tabIndex:-1,className:"lg:col-span-2","aria-describedby":"access-help",children:[(0,d.jsx)("legend",{children:"What can this token do?"}),["read","write","full"].map(c=>{let z=V?null:T?de(c):Ie(c,b,s,q?.permissions);return(0,d.jsxs)("div",{children:[(0,d.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,d.jsx)("input",{type:"radio",name:"access",checked:y.scope===c,disabled:z!==null,"aria-invalid":E?.target==="issue-access",onChange:()=>g({scope:c}),"aria-describedby":`help-${c}`}),W[c]]}),(0,d.jsxs)("p",{id:`help-${c}`,children:[Oe[c]," ",z]})]},c)}),b.filter(c=>!V||c.policyState==="error").map(c=>(0,d.jsx)("p",{children:c.cap&&!V?`${c.name} allows ${{read:"install and download only",write:"install, download and publish permission",full:"all token-eligible project permissions"}[c.cap]}.`:`${c.name}: ${c.policyState==="loading"?"Loading project access\u2026":c.policyState==="error"?"Project access could not be loaded.":"Project access has not been loaded."}`},c.id)),b.some(c=>c.policyState==="error")&&(0,d.jsx)(C,{type:"button",onClick:()=>t.loadProjectPolicies(b.filter(c=>c.policyState==="error").map(c=>c.id),!0),children:"Try again loading project access"}),T&&(0,d.jsx)("p",{children:"This token may also use the service identity\u2019s organization permissions. Project policies only limit access within projects."}),(0,d.jsx)("p",{id:"access-help",children:"Your token can only use permissions its holder has and the project allows. Tokens cannot change project settings or delete packages. Publishing is not available in this version."})]}),!s&&(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-principal",children:"Service identity"}),(0,d.jsxs)(L,{className:"min-h-11","aria-invalid":!!E&&!q,"aria-describedby":E?"token-errors":void 0,id:"issue-principal",value:y.principal,onChange:c=>g({principal:c.target.value}),children:[(0,d.jsx)("option",{value:"",children:"Choose a service identity"}),K.map(c=>(0,d.jsx)("option",{value:c.id,children:c.name},c.id))]}),(0,d.jsx)("p",{children:"A service principal is an identity for automation. Its tokens keep working when the person who created them leaves."}),q&&(0,d.jsxs)("p",{children:["Permissions:"," ",(q.permissions??[]).map(c=>Me[c]??Y[c]?.[0]).filter(Boolean).join("; ")]}),e.principalsLoading?(0,d.jsx)("p",{children:"Loading service principals\u2026"}):e.principalsError?(0,d.jsxs)("p",{children:["Service principals could not be loaded."," ",(0,d.jsx)(C,{type:"button",onClick:()=>{t.loadPrincipals()},children:"Try again"})]}):(e.principalsRestricted||!K.length)&&(0,d.jsxs)("p",{children:[e.principalsRestricted&&"You cannot browse service principals here. ","Ask an organization administrator to create a service identity for this project."]})]}),(0,d.jsxs)("div",{children:[(0,d.jsx)(D,{htmlFor:"issue-lifetime",children:"Expires after"}),(0,d.jsx)(L,{className:"min-h-11",id:"issue-lifetime","aria-invalid":E?.target==="issue-lifetime","aria-describedby":E?.target==="issue-lifetime"?"token-errors":void 0,value:ee,disabled:!O,onChange:c=>g({days:c.target.value}),children:O&&ie(O).map(c=>(0,d.jsxs)("option",{value:c,children:[J(c),c===O.defaultDays?" (organization default)":""]},c))}),!O&&!e.loading&&(0,d.jsx)(C,{type:"button",onClick:()=>{t.load()},children:"Try again"}),(0,d.jsx)("p",{children:O?`Maximum: ${J(O.maxDays)}. Create a replacement before this token expires.`:"Lifetime policy could not be loaded."})]}),(0,d.jsx)("p",{className:"lg:col-span-2 break-words",children:[y.name,V?"All projects I can access":b.map(c=>c.name).join(", "),W[y.scope],J(Number(ee)),s?"":q?.name].filter(Boolean).join(" \xB7 ")}),(0,d.jsxs)("div",{className:"flex flex-wrap gap-2 lg:col-span-2",children:[(0,d.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"submit",disabled:e.busy,children:e.busy?"Creating token\u2026":Fe}),(0,d.jsx)(C,{className:"min-h-11 w-full sm:w-auto",type:"button",variant:"outline",disabled:e.busy,onClick:Re,children:"Cancel"})]})]}):null]})}function ce(e){return`'${e.replaceAll("'","'\\''")}'`}function Ee(e,t,n){let u=new URL(e),a=`${u.origin}/${encodeURIComponent(t)}`,p=`registry=${a}/npm/`,k=`//${u.host}/${encodeURIComponent(t)}/npm/:_authToken=`;return{composer:`composer config ${ce(`repositories.${t}`)} composer ${ce(a)}`,composerAuth:JSON.stringify({bearer:{[u.host]:n}},null,2),npm:`${p}
 ${k}${n}`,ciComposer:`export COMPOSER_AUTH="$(printf ${ce(JSON.stringify({bearer:{[u.host]:"%s"}}).replaceAll("%","%%").replace("%%s","%s"))} "$PACKAGE_BROKER_TOKEN")"
 composer install --no-interaction`,ciNpm:`${p}
 ${k}\${PACKAGE_BROKER_TOKEN}`}}var r=B(H(),1),J=e=>`${e} ${e===1?"day":"days"}`;function ie(e){return[...new Set([30,90,180,365,e.maxDays,e.defaultDays])].filter(t=>t>0&&t<=e.maxDays).sort((t,n)=>t-n)}function He(e,t){return t.type==="navigate"?{...e,secret:null,secretProject:null,result:null,issuedId:null,oldPersonalId:null,pending:null,renewal:null,busy:!1,notice:null}:e}function De(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function We(e){if(!De(e)||!De(e.draft))return null;let t=e.draft;return!["personal","project","organization"].includes(String(e.target))||!(e.project===null||typeof e.project=="string")||typeof e.key!="string"||typeof t.name!="string"||!["read","write","full"].includes(String(t.scope))||!Number.isInteger(t.lifetimeDays)||Number(t.lifetimeDays)<1||typeof t.servicePrincipalId!="string"||!["all","selected"].includes(String(t.projectMode))||!Array.isArray(t.projectIds)||!t.projectIds.every(n=>typeof n=="string")||e.rotate!==void 0&&typeof e.rotate!="string"||e.replace!==void 0&&typeof e.replace!="string"||t.overlapDays!==void 0&&![0,1,7].includes(Number(t.overlapDays))?null:{target:e.target,project:e.project,key:e.key,...e.refresh===!0?{refresh:!0}:{},...["personal","project","organization"].includes(String(e.listTarget))?{listTarget:e.listTarget,listProject:typeof e.listProject=="string"?e.listProject:null}:{},...typeof e.rotate=="string"?{rotate:e.rotate}:{},...typeof e.replace=="string"?{replace:e.replace}:{},draft:{name:t.name,scope:t.scope,lifetimeDays:Number(t.lifetimeDays),servicePrincipalId:t.servicePrincipalId,projectMode:t.projectMode,projectIds:[...t.projectIds],...t.overlapDays===void 0?{}:{overlapDays:Number(t.overlapDays)}}}}function Ge(e){return{id:e.id,kind:e.kind,name:e.name,scope:e.scope,readOnly:e.readOnly,status:e.status,projectMode:e.projectMode,projectCount:e.projectCount,projectId:e.projectId,userId:e.userId,createdByUserId:e.createdByUserId,servicePrincipalId:e.servicePrincipalId,createdAt:e.createdAt,expiresAt:e.expiresAt,lastUsedAt:e.lastUsedAt,revokedAt:e.revokedAt}}function Ae(e,t){return e?e.target==="project"?t.slug===e.project:e.target==="personal"?e.draft.projectMode!=="selected"||e.draft.projectIds.includes(t.id):!0:!0}function pe(e,t){let n=e.result;if(!n)return!1;let u=n.target==="personal"?t.permissions:e.principals.find(a=>a.id===n.draft.servicePrincipalId)?.permissions;return u?.includes("project:packages:read")===!0||n.draft.scope!=="read"&&t.cap!=="read"&&u?.includes("project:packages:write")===!0}function Ye(e,t){let n={target:"personal",project:null,issuanceProject:null,items:[],next:null,principals:[],principalsNext:null,principalsRestricted:!1,principalsLoading:!0,principalsError:!1,organizationPermissions:[],issuanceDraft:null,issuancePrincipal:null,issuanceNonce:0,names:{},projectSlugs:{},projects:[],projectsError:!1,result:null,lifetime:null,userId:null,secret:null,secretProject:null,issuedId:null,oldPersonalId:null,pending:null,renewal:null,busy:!1,loading:!1,listError:!1,notice:null},u=0,a=0,p=0,k=[],s=0,f=new Set,i=o=>{n={...n,...o};for(let h of f)h()},x=be(t.storage);function S(o){o.code==="reauth_required"?e.requireReauth(o.request,{credential:!1,secretFields:[]}):i({notice:o.status===412||o.status===428?"The record changed. Reload before trying again.":"Unable to update tokens. Try again."})}async function N(o){if(n.busy)return;let h=++u;i({busy:!0,secret:null,secretProject:null,result:null,issuedId:null,oldPersonalId:null,pending:null,notice:null});let{draft:m,target:w,project:l,key:v}=o,E={name:m.name,scope:m.scope,lifetimeDays:m.lifetimeDays},A={...E,servicePrincipalId:m.servicePrincipalId},y={name:m.name,lifetimeDays:m.lifetimeDays,overlapDays:m.overlapDays??0},g=o.rotate!==void 0?w==="project"?await e.client.request("post","/_pb/projects/{project}/tokens/{token}/rotate",{params:{project:l,token:o.rotate},body:y,idempotencyKey:v}):await e.client.request("post","/_pb/tokens/{token}/rotate",{params:{token:o.rotate},body:y,idempotencyKey:v}):w==="personal"?await e.client.request("post","/_pb/me/tokens",{body:{...E,projectMode:m.projectMode,projectIds:m.projectIds},idempotencyKey:v}):w==="project"?await e.client.request("post","/_pb/projects/{project}/tokens",{params:{project:l},body:A,idempotencyKey:v}):await e.client.request("post","/_pb/tokens",{body:A,idempotencyKey:v});if(h===u)if(i({busy:!1}),g.ok)i({secret:g.data.token,secretProject:w==="project"?l:m.projectMode==="selected"&&m.projectIds.length===1?n.projectSlugs[m.projectIds[0]]??null:null,result:o,oldPersonalId:o.replace??null,issuedId:g.data.id,notice:"Token created."});else if(g.code==="reauth_required"){let b=me(x,{method:"POST",path:"/_pb/me/tokens",body:o,idempotencyKey:v,credential:!1,secretFields:[]});i({secret:null,notice:b.ok?"Confirm your identity, then confirm token issue.":"Unable to save the pending action."}),b.ok&&t.navigate(`#/reauth?return=${encodeURIComponent(`/tokens${l===null?"":`?project=${encodeURIComponent(l)}`}`)}`)}else g.code==="already_issued"?i({notice:"already issued, create a new token"}):S(g)}let I={trustedPublishers:ke(e),snapshot:()=>n,announce(o){i({notice:o})},subscribe(o){return f.add(o),()=>{f.delete(o)}},navigate(){I.trustedPublishers.clear(),u++,p++,a++,k.length=0,i({...He(n,{type:"navigate"}),principalsLoading:!1,projects:n.projects.map(o=>o.policyState==="loading"?{...o,policyState:"idle"}:o)})},dispose(){I.navigate(),f.clear()},closeSecret(){n.busy||(u++,i({secret:null,secretProject:null,result:null,issuedId:null,oldPersonalId:null,notice:null,renewal:null,issuanceDraft:n.pending===null?null:n.issuanceDraft}))},restore(){let o=ge(x,t.now()),h=o.ok?We(o.action?.body):null;h!==null&&i({pending:h,issuanceDraft:h.refresh?h:null,secret:null})},async start(o,h){i({issuanceProject:h}),I.restore();let m=n.pending;await I.load(m?.listTarget??m?.target??o,m?m.listTarget?m.listProject??null:m.project:h)},async selectTarget(o,h){n.busy||(i({pending:null,renewal:null}),await I.load(o,h))},decline(){i({pending:null})},async confirm(){let o=n.pending;o===null||n.busy||n.loading||n.lifetime===null&&(await I.load(),n.pending!==o||n.lifetime===null||n.loading)||(await N(o),o.refresh&&n.secret!==null&&await I.load())},async issueFor(o,h,m){let w={target:o,project:h,draft:m,key:t.newKey(),refresh:!0,listTarget:n.target,listProject:n.project};i({issuanceDraft:w}),await N(w),n.secret!==null&&await I.load()},configureProject(o){let h=n.result,m=n.projects.find(w=>w.slug===o);!m||!h||h.target==="project"&&h.project!==o||h.target==="personal"&&h.draft.projectMode==="selected"&&!h.draft.projectIds.includes(m.id)||i({secretProject:o})},async issue(o){await N({target:n.renewal?.kind==="pat"?"personal":n.renewal?.projectId?"project":n.target,project:n.renewal?.kind==="svc"&&n.renewal.projectId!==null?n.projectSlugs[n.renewal.projectId]??n.project:n.project,draft:o,key:t.newKey(),...n.renewal?.kind==="svc"?{rotate:n.renewal.id}:{},...n.renewal?.kind==="pat"?{replace:n.renewal.id}:{}})},renew(o){if(!(n.busy||o.kind==="pat"&&o.userId!==n.userId)){if(o.kind==="svc"&&o.projectId!==null&&n.projectSlugs[o.projectId]===void 0&&n.target!=="project"){i({notice:"Choose this token\u2019s project scope before renewing."});return}i({renewal:o,secret:null,issuedId:null,oldPersonalId:null,notice:null})}},invalidProjects(){i({notice:"Choose between 1 and 200 projects."})},registryOrigin:()=>new URL(t.origin).origin,clientConfig(){return n.secret===null||n.secretProject===null?null:Ee(t.origin,n.secretProject,n.secret)},async copy(o){if(n.secret===null)return;let h=o===void 0?n.secret:I.clientConfig()?.[o];if(h===void 0)return;let m=o===void 0?"Token":"Configuration",w=u;try{await t.clipboard(h),w===u&&i({...t.clearAfterCopy?{secret:null}:{},notice:`${m} copied.`})}catch{w===u&&i({notice:o===void 0?"Could not copy. Select and copy the token manually.":"Could not copy. Select and copy the configuration manually."})}},async load(o=n.target,h=n.project,m){let w=++a;i({target:o,project:h,loading:!0,listError:!1,notice:n.secret===null?null:n.notice,items:[],next:null,lifetime:null});let l=o==="personal"?await e.client.request("get","/_pb/me/tokens",{query:{after:m}}):o==="project"&&h!==null?await e.client.request("get","/_pb/projects/{project}/tokens",{params:{project:h},query:{after:m}}):await e.client.request("get","/_pb/tokens",{query:{after:m}});w===a&&i(l.ok?{items:l.data.items.map(Ge),next:l.data.next,lifetime:l.data.lifetime,loading:!1}:{loading:!1,listError:!0,lifetime:null,notice:"Unable to load tokens."})},async loadPrincipals(o){let h=p;i({principalsLoading:!0,principalsError:!1});let m=[],w=o;do{let l=await e.client.request("get","/_pb/service-principals",{query:{after:w}});if(h!==p)return;if(!l.ok){i({principalsLoading:!1,principalsError:l.status!==403,principalsRestricted:l.status===403,principals:[],principalsNext:null});return}m.push(...l.data.items.map(v=>({id:v.id,name:v.name,projectId:v.projectId,status:v.status,revision:v.revision,createdByUserId:v.createdByUserId,permissions:v.permissions}))),w=l.data.next??void 0}while(w!==void 0);i({principals:m,principalsNext:null,principalsRestricted:!1,principalsLoading:!1})},loadProjectPolicies(o,h=!1){let m=new Set;for(let l of o){let v=n.projects.find(E=>E.id===l);!v||v.policyState==="loading"||v.policyState==="loaded"||!h&&v.policyState==="error"||(m.add(l),k.push(l))}m.size&&i({projects:n.projects.map(l=>m.has(l.id)?{...l,policyState:"loading"}:l)});async function w(){s++;try{for(;k.length;){let l=k.shift(),v=n.projects.find(g=>g.id===l);if(!v)continue;let E=p,A=await e.client.request("get","/_pb/projects/{project}",{params:{project:v.slug}}),y=await e.client.request("get","/_pb/projects/{project}/permissions",{params:{project:v.slug}});E===p&&i({projects:n.projects.map(g=>g.id===l?{...g,cap:A.ok?A.data.tokenMaxScope:null,permissions:y.ok?y.data.project:null,policyState:A.ok&&y.ok?"loaded":"error"}:g)})}}finally{s--}}for(;k.length&&s<4;)w()},choosePrincipal(o,h,m=h===null){i({issuancePrincipal:o,issuanceProject:m?"__organization":h??"",issuanceNonce:n.issuanceNonce+1})},async identity(){let o=p,h=e.client.request("get","/_pb/session"),m={},w=[],l=!1,v;do{let b=await e.client.request("get","/_pb/projects",{query:{after:v}});if(o!==p)return;if(!b.ok){l=!0;break}for(let T of b.data.items)m[T.id]=T.slug,T.status!=="archived"&&w.push({id:T.id,slug:T.slug,name:T.name??T.slug,cap:null,permissions:null,policyState:"idle"});v=b.data.next??void 0,i({projectSlugs:{...m},projects:[...w],projectsError:l})}while(v!==void 0);i({projectSlugs:m,projects:w,projectsError:l});let E=await h;if(o!==p)return;E.ok&&i({userId:E.data.user.id});let A=await e.client.request("get","/_pb/me/permissions");if(o!==p)return;if(i({organizationPermissions:A.ok?A.data.organization:[]}),!A.ok||!A.data.organization.includes("org:users:read")){i({names:{}});return}let y,g={};do{let b=await e.client.request("get","/_pb/users",{query:{after:y}});if(o!==p)return;if(!b.ok)break;for(let T of b.data.items)T.displayName!==null&&(g[T.id]=T.displayName);y=b.data.next??void 0}while(y!==void 0);o===p&&i({names:g})},async revoke(o,h=!1){if(n.busy)return;let m=u;i({busy:!0,secret:null,issuedId:null});let w=n.target==="personal"||h?await e.client.request("delete","/_pb/me/tokens/{token}",{params:{token:o}}):n.target==="project"?await e.client.request("delete","/_pb/projects/{project}/tokens/{token}",{params:{project:n.project,token:o}}):await e.client.request("delete","/_pb/tokens/{token}",{params:{token:o}});m===u&&(i({busy:!1}),w.ok?(await I.load(),i({notice:"Token revoked.",renewal:null})):S(w))},async createPrincipal(o,h,m){if(n.busy)return;let w=u;i({busy:!0,secret:null,issuedId:null});let l={name:o,permissions:m,...h===""?{}:{project:h}},v=await e.client.request("post","/_pb/service-principals",{body:l,idempotencyKey:t.newKey()});if(w===u)if(i({busy:!1}),!v.ok)S(v);else return await I.loadPrincipals(),i({notice:"Service principal created. Create a token to use it."}),v.data},async suspendPrincipal(o){if(n.busy)return;let h=u;i({busy:!0,secret:null,issuedId:null});let m=o.projectId===null?void 0:n.projectSlugs[o.projectId],w=m!==void 0?await e.client.request("post","/_pb/projects/{project}/service-principals/{principal}/suspend",{params:{project:m,principal:o.id}}):await e.client.request("post","/_pb/service-principals/{principal}/suspend",{params:{principal:o.id}});h===u&&(i({busy:!1}),w.ok?(await I.loadPrincipals(),i({notice:"Service principal suspended; its tokens no longer work."})):S(w))}};return I}function Je(e,t){return e.filter(n=>n.name.toLowerCase().includes(t.q.toLowerCase())&&(!t.scope||n.scope===t.scope||W[n.scope]===t.scope)&&(!t.status||n.status===t.status))}function Qe({state:e,controller:t}){let[n,u]=(0,M.useState)({q:"",scope:"",status:""}),a=!!(n.q||n.scope||n.status),p=Je(e.items,n),k=e.target==="personal"?"My personal tokens":e.target==="project"?`Project: ${e.project}`:"Organization";return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(je,{values:n,fields:[{key:"q",label:"Name (this page)"},{key:"scope",label:"Scope",options:Object.values(W)},{key:"status",label:"Status",options:["active","expired","revoked"]}],onChange:u}),(0,r.jsxs)("div",{className:"my-3 flex flex-wrap items-center justify-between gap-3",children:[(0,r.jsxs)("p",{className:"text-sm text-neutral-600",children:[p.length," tokens on this page \xB7"," ",p.filter(s=>s.status==="active").length," active"]}),(0,r.jsx)(C,{type:"button",variant:"outline",disabled:e.loading||e.busy,onClick:()=>{t.load()},children:"Reload tokens"})]}),e.loading?(0,r.jsx)(F,{kind:"loading",title:"Loading tokens\u2026"}):e.listError?(0,r.jsx)(F,{kind:"error",title:"Unable to load tokens."}):p.length===0?(0,r.jsx)(F,{kind:a?"filtered-empty":"empty",title:a?"No tokens match these filters on this page.":"No tokens on this page."}):(0,r.jsx)(Q,{label:"Tokens",items:p,columns:[{key:"name",label:"Token",value:s=>s.name,render:s=>(0,r.jsxs)("div",{className:"grid gap-1",children:[(0,r.jsx)("strong",{children:s.name}),(0,r.jsx)(ne,{value:s.id,label:"token ID"})]})},{key:"status",label:"Status",value:s=>s.status,render:s=>(0,r.jsx)(ae,{status:s.status})},{key:"scope",label:"Scope",value:s=>s.scope,render:s=>(0,r.jsx)(ve,{variant:"outline",children:W[s.scope]})},{key:"project",label:"Project",value:s=>s.projectId===null?s.kind==="pat"?s.projectMode==="all"?"All accessible projects":`${s.projectCount} selected projects`:"Organization":e.projectSlugs[s.projectId]??s.projectId,priority:2,render:s=>s.projectId!==null&&!e.projectSlugs[s.projectId]?(0,r.jsx)(ne,{value:s.projectId,label:"project ID"}):s.projectId!==null?e.projectSlugs[s.projectId]:s.kind==="pat"?s.projectMode==="all"?"All accessible projects":`${s.projectCount} selected projects`:"Organization"},{key:"lastUsedAt",label:"Last used",value:s=>s.lastUsedAt??"",priority:2,render:s=>(0,r.jsx)(X,{value:s.lastUsedAt,fallback:"Never"})},{key:"expiresAt",label:"Expires",value:s=>s.expiresAt??"",priority:3,render:s=>(0,r.jsx)(X,{value:s.expiresAt,fallback:"None"})},{key:"issuer",label:"Issued by",value:s=>s.kind==="svc"&&s.createdByUserId!==null?e.names[s.createdByUserId]??"a member":"a member",priority:3},{key:"actions",label:"Actions",value:()=>"",sortable:!1,render:s=>(0,r.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,r.jsx)(C,{type:"button",size:"sm",variant:"outline",disabled:e.busy||s.status!=="active"||s.kind==="pat"&&s.userId!==e.userId,onClick:()=>t.renew(s),children:"Renew"}),(0,r.jsx)(G,{action:"Revoke",target:`${s.name} (${s.id})`,scope:k,description:"Revoking this token stops clients using it from authenticating. This cannot be undone. Create a new token to restore client access.",disabled:e.busy||s.status==="revoked",onConfirm:()=>{t.revoke(s.id)}},`${s.id}:${s.status}`)]})}]}),e.next===null?null:(0,r.jsx)(C,{type:"button",disabled:e.busy||e.loading,onClick:()=>{t.load(e.target,e.project,e.next)},children:"Next tokens"}),(0,r.jsx)("p",{className:"mt-3 text-xs text-neutral-600",children:"Secrets are never listed. Only tokens in your accessible scope appear here."})]})}function Xe(e){e?.focus()}function Ze({state:e,controller:t}){let[n,u]=(0,M.useState)(""),a=e.projects.find(p=>p.id===n);return(0,M.useEffect)(()=>{e.secret&&a?.policyState==="loaded"&&pe(e,a)&&t.configureProject(a.slug)},[t,e.secret,a]),(0,r.jsxs)(r.Fragment,{children:[" ",e.projects.some(p=>p.permissions===null)&&(0,r.jsxs)("details",{children:[(0,r.jsx)("summary",{className:"min-h-11 cursor-pointer",children:"Check another project's package access"}),(0,r.jsx)(D,{htmlFor:"setup-candidate",children:"Project to configure"}),(0,r.jsxs)(L,{id:"setup-candidate",className:"min-h-11",value:n,onChange:p=>{u(p.target.value),t.loadProjectPolicies([p.target.value])},children:[(0,r.jsx)("option",{value:"",children:"Choose a project"}),e.projects.filter(p=>Ae(e.result,p)).map(p=>(0,r.jsx)("option",{value:p.id,children:p.name},p.id))]}),a?.policyState==="loading"&&(0,r.jsx)("p",{children:"Loading project access\u2026"}),a?.policyState==="error"&&(0,r.jsx)(C,{type:"button",onClick:()=>t.loadProjectPolicies([a.id],!0),children:"Try again loading project access"}),a?.policyState==="loaded"&&!pe(e,a)&&(0,r.jsx)("p",{children:"This token does not have package access to this project."})]})]})}function et({state:e,controller:t}){let n=e.renewal!==null?e.renewal.kind==="pat":e.target==="personal",u=e.lifetime?.[n?"personal":"service"],a=e.renewal,p=t.clientConfig(),k=a?.kind==="svc"?a.projectId:e.target==="project"?Object.keys(e.projectSlugs).find(i=>e.projectSlugs[i]===e.project):null,s=e.principals.filter(i=>i.status==="active");function f(i){if(i.preventDefault(),e.busy)return;let x=i.currentTarget,S=new FormData(x),N=S.getAll("projectIds").map(String);if(n&&S.get("projectMode")==="selected"&&(N.length<1||N.length>200)){t.invalidProjects();return}let I=a?.kind==="svc"?a.scope:String(S.get("scope"));t.issue({name:String(S.get("name")),scope:I,lifetimeDays:Number(S.get("lifetimeDays")),servicePrincipalId:String(S.get("principal")??""),projectMode:S.get("projectMode")==="selected"?"selected":"all",projectIds:S.getAll("projectIds").map(String),overlapDays:Number(S.get("overlap")??0)})}return(0,r.jsxs)("section",{"aria-labelledby":"page-heading",className:"space-y-4",children:[(0,r.jsx)("h1",{tabIndex:-1,id:"page-heading",className:"text-xl font-semibold",children:"Tokens"}),(0,r.jsx)("p",{className:"text-neutral-600",children:"Connect your tools and CI pipelines to your packages."}),e.notice===null||e.listError?null:(0,r.jsx)(fe,{role:"status","aria-live":"polite",children:(0,r.jsx)(he,{children:e.notice})}),e.pending===null?null:(0,r.jsxs)("section",{"aria-label":"Confirm token issue",className:"space-y-2",children:[(0,r.jsx)("h2",{children:"Confirm token issue"}),(0,r.jsx)("p",{children:"Your identity was checked. Issue this token now?"}),(0,r.jsx)(C,{type:"button",disabled:e.busy||e.loading||e.lifetime===null,onClick:()=>{t.confirm()},children:"Confirm token issue"}),(0,r.jsx)(C,{type:"button",variant:"outline",onClick:()=>t.decline(),children:"Cancel"})]}),e.secret===null?null:(0,r.jsxs)("section",{"aria-label":"Token secret",className:"detail-group space-y-3 border-emerald-200",children:[(0,r.jsx)("h2",{tabIndex:-1,ref:Xe,children:"Token created"}),e.result&&(0,r.jsxs)("p",{className:"break-words",children:[e.result.draft.name," \xB7"," ",e.result.target==="project"?e.projects.find(i=>i.slug===e.result?.project)?.name??"Project name unavailable":e.result.target==="organization"?"Organization-wide":e.result.draft.projectMode==="all"?"All accessible projects":e.result.draft.projectIds.length===1?e.projects.find(i=>i.id===e.result?.draft.projectIds[0])?.name??"1 selected project":`${e.result.draft.projectIds.length} selected projects`," ","\xB7 ",W[e.result.draft.scope]," \xB7 Expires after"," ",J(e.result.draft.lifetimeDays)]}),(0,r.jsx)("p",{children:"Copy this token now. You cannot view it again. Closing this panel keeps it active."}),(0,r.jsx)("pre",{className:"rounded-md border bg-neutral-50 p-3 overflow-x-auto whitespace-pre-wrap break-all",children:(0,r.jsx)("code",{role:"region","aria-label":"Created token",children:e.secret})}),(0,r.jsx)(C,{className:"min-h-11",type:"button",onClick:()=>{t.copy()},children:"Copy token"}),(0,r.jsx)(C,{type:"button",variant:"outline",className:"min-h-11",onClick:()=>{t.closeSecret(),requestAnimationFrame(()=>document.getElementById("new-token")?.focus())},children:"Done"}),(0,r.jsx)(Ze,{state:e,controller:t}),(0,r.jsx)(D,{htmlFor:"configure-project",children:"Configure for project"}),(0,r.jsxs)(L,{className:"min-h-11",id:"configure-project",value:e.secretProject??"",onChange:i=>t.configureProject(i.target.value),children:[(0,r.jsx)("option",{value:"",children:"Choose a project"}),e.projects.filter(i=>pe(e,i)).filter(i=>Ae(e.result,i)).map(i=>(0,r.jsx)("option",{value:i.slug,children:i.name},i.id))]}),p===null?(0,r.jsx)("p",{children:"Choose a project this token can access to configure Composer or npm."}):(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)("p",{children:"Composer sends this credential to this registry host. The token still limits which projects it can access."}),[["Composer",["composer","composerAuth"]],["npm",["npm"]],["CI environment",["ciComposer","ciNpm"]]].map(([i,x],S)=>(0,r.jsxs)("details",{open:S===0,className:"min-w-0",children:[(0,r.jsx)("summary",{className:"min-h-11 cursor-pointer",children:i}),x.map(N=>(0,r.jsxs)("div",{children:[(0,r.jsx)("p",{children:{composer:"Composer repository command",composerAuth:"Merge this into your local auth.json. Do not commit credentials.",npm:"Use this on your computer. For CI, use the environment-variable version below.",ciComposer:"Save PACKAGE_BROKER_TOKEN as a secret in your CI settings. These examples install packages; they do not publish them.",ciNpm:"Save this as .npmrc, then run npm ci."}[N]}),(0,r.jsx)("pre",{className:"whitespace-pre-wrap break-all rounded-md border bg-neutral-50 p-3",children:(0,r.jsx)("code",{children:p[N]})}),(0,r.jsx)(C,{type:"button",variant:"outline",className:"min-h-11",onClick:()=>{t.copy(N)},children:{composer:"Copy Composer configuration",composerAuth:"Copy auth.json",npm:"Copy npm configuration",ciComposer:"Copy CI Composer",ciNpm:"Copy CI npm"}[N]})]},N))]},i))]}),e.oldPersonalId!==null?(0,r.jsx)(G,{action:"Revoke old personal token",target:e.oldPersonalId,scope:"My personal tokens",description:"Clients using the old token will lose access immediately. This cannot be undone. Update clients to the new token before revoking.",disabled:e.busy,onConfirm:()=>{t.revoke(e.oldPersonalId,!0)}}):null]}),(0,r.jsx)("div",{hidden:e.pending!==null||e.secret!==null||a!==null,children:(0,r.jsx)(Te,{state:e,controller:t})}),e.pending!==null||e.secret!==null||a===null?null:(0,r.jsxs)("details",{open:a!==null,className:"detail-group",children:[(0,r.jsx)("summary",{className:"min-h-11 cursor-pointer font-semibold",children:a===null?"Issue token":"Renew token"}),(0,r.jsxs)("form",{onSubmit:f,className:"grid gap-2",children:[(0,r.jsx)(D,{htmlFor:"token-name",children:"Name"}),(0,r.jsx)(U,{id:"token-name",name:"name",defaultValue:a?.name??"",required:!0}),(0,r.jsx)(D,{htmlFor:"token-scope",children:"Scope"}),(0,r.jsxs)(L,{id:"token-scope",name:"scope",defaultValue:a?.scope??"read",disabled:a?.kind==="svc",children:[(0,r.jsx)("option",{value:"read",children:"Install and download"}),(0,r.jsx)("option",{value:"write",children:"Include publish permission"}),(0,r.jsx)("option",{value:"full",children:"Include grants, sources and audit access"})]}),(0,r.jsx)(D,{htmlFor:"token-lifetime",children:"Lifetime"}),(0,r.jsx)(L,{id:"token-lifetime",name:"lifetimeDays",defaultValue:u?.defaultDays,required:!0,children:u===void 0?null:ie(u).map(i=>(0,r.jsx)("option",{value:i,children:J(i)},i))}),n?(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(D,{htmlFor:"token-project-mode",children:"Projects"}),(0,r.jsxs)(L,{id:"token-project-mode",name:"projectMode",defaultValue:a?.projectMode??"all",children:[(0,r.jsx)("option",{value:"all",children:"All accessible projects"}),(0,r.jsx)("option",{value:"selected",children:"Selected projects"})]}),(0,r.jsxs)("fieldset",{children:[(0,r.jsx)("legend",{children:"Choose projects again when renewing a selected token"}),e.projects.map(i=>(0,r.jsxs)("label",{className:"flex min-h-11 items-center gap-2",children:[(0,r.jsx)("input",{type:"checkbox",name:"projectIds",value:i.id}),i.name]},i.id))]})]}):(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(D,{htmlFor:"token-principal",children:"Service principal"}),(0,r.jsxs)(L,{id:"token-principal",name:"principal",defaultValue:a?.servicePrincipalId??"",disabled:a?.kind==="svc",required:a?.kind!=="svc",children:[(0,r.jsx)("option",{value:"",disabled:!0,children:"Select a principal"}),s.filter(i=>i.projectId===k).map(i=>(0,r.jsx)("option",{value:i.id,children:i.name},i.id))]}),e.principalsRestricted?(0,r.jsx)("p",{children:"Ask an organization administrator to create a service identity for this project."}):null]}),a?.kind!=="svc"?null:(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(D,{htmlFor:"token-overlap",children:"Overlap"}),(0,r.jsxs)(L,{id:"token-overlap",name:"overlap",defaultValue:"0",children:[(0,r.jsx)("option",{value:"0",children:"None"}),(0,r.jsx)("option",{value:"1",children:"1 day"}),(0,r.jsx)("option",{value:"7",children:"7 days"})]}),(0,r.jsx)("p",{children:"The old token stops at the end of the overlap or when the new token expires, whichever is first."})]}),(0,r.jsx)(C,{type:"submit",disabled:e.busy||e.loading||u===void 0,children:a===null?"Issue token":"Renew token"}),a===null?null:(0,r.jsx)(C,{type:"button",variant:"outline",disabled:e.busy,onClick:()=>t.closeSecret(),children:"Cancel renewal"})]},`${e.target}:${a?.id??""}:${u?.defaultDays}`)]},`${e.target}:${a?.id??""}`),(0,r.jsx)(D,{htmlFor:"token-list",children:"Token list"}),(0,r.jsxs)(L,{id:"token-list",value:e.target,disabled:e.busy,onChange:i=>{t.selectTarget(i.target.value,e.project)},children:[(0,r.jsx)("option",{value:"personal",children:"My personal tokens"}),e.project===null?null:(0,r.jsx)("option",{value:"project",children:"Project tokens"}),(0,r.jsx)("option",{value:"organization",children:"Organization tokens"})]}),(0,r.jsxs)("details",{className:"detail-group",children:[(0,r.jsx)("summary",{children:"How token access works"}),(0,r.jsx)("p",{children:"Personal tokens use your access and stop working if you leave or your account is suspended. Service tokens use a service identity and keep working when their creator leaves. Each project's access policy can limit a token further."})]}),(0,r.jsx)(Qe,{state:e,controller:t},`${e.target}:${e.project}`),e.project===null&&e.organizationPermissions.includes("org:service-principals:write")?(0,r.jsx)(we,{controller:t.trustedPublishers,permissions:e.organizationPermissions}):null,(0,r.jsxs)("details",{className:"detail-group",children:[(0,r.jsx)("summary",{className:"min-h-11 cursor-pointer font-semibold",children:"Service principals"}),(0,r.jsx)(Ce,{state:e,controller:t}),(0,r.jsx)(C,{type:"button",variant:"outline",disabled:e.busy,onClick:()=>{t.loadPrincipals()},children:"Reload service principals"}),e.principalsRestricted?(0,r.jsx)(F,{kind:"placeholder",title:"You cannot browse service principals here."}):e.principalsLoading?(0,r.jsx)(F,{kind:"loading",title:"Loading service principals\u2026"}):e.principals.length===0?(0,r.jsx)(F,{kind:"empty",title:"No service principals loaded."}):(0,r.jsx)(Q,{label:"Service principals",items:e.principals,columns:[{key:"name",label:"Name",value:i=>i.name,render:i=>(0,r.jsxs)("div",{className:"grid gap-1",children:[(0,r.jsx)("strong",{children:i.name}),(0,r.jsx)(ne,{value:i.id,label:"principal ID"})]})},{key:"status",label:"Status",value:i=>i.status,render:i=>(0,r.jsx)(ae,{status:i.status})},{key:"actions",label:"Actions",value:()=>"",sortable:!1,render:i=>(0,r.jsx)(G,{action:"Revoke principal access",target:`${i.name} (${i.id})`,scope:i.projectId===null?"Organization":`Project: ${e.projectSlugs[i.projectId]??i.projectId}`,description:"Suspending this principal stops all of its tokens from working. Update clients before continuing.",disabled:e.busy||i.status!=="active",onConfirm:()=>{t.suspendPrincipal(i)}},`${i.id}:${i.status}`)}]}),e.principalsNext===null?null:(0,r.jsx)(C,{type:"button",disabled:e.busy,onClick:()=>{t.loadPrincipals(e.principalsNext)},children:"Next service principals"})]})]})}function tt(e,t,n){let u=()=>{e.navigate(),n()},a=()=>e.navigate(),p=k=>{a(),k.persisted===!0&&(n(),e.snapshot().organizationPermissions.includes("org:service-principals:write")&&e.trustedPublishers.load())};return t.addEventListener("hashchange",u),t.addEventListener("pagehide",a),t.addEventListener("pageshow",p),()=>{t.removeEventListener("hashchange",u),t.removeEventListener("pagehide",a),t.removeEventListener("pageshow",p),e.dispose()}}function nt(e,t){return t.subscribeReplay?.(n=>{n.ok&&(/^\/_pb\/(?:me\/)?tokens\/[^/]+$/.test(n.path)||/^\/_pb\/projects\/[^/]+\/tokens\/[^/]+$/.test(n.path)||/^\/_pb\/service-principals(?:\/[^/]+\/suspend)?$/.test(n.path)||/^\/_pb\/projects\/[^/]+\/service-principals\/[^/]+\/suspend$/.test(n.path))&&(e.load(),e.loadPrincipals())})}function Wt(){let e=ye(),t=(0,M.useMemo)(()=>Ye(e,{storage:{getItem:u=>window.sessionStorage.getItem(u),setItem:(u,a)=>window.sessionStorage.setItem(u,a),removeItem:u=>window.sessionStorage.removeItem(u)},origin:window.location.origin,clipboard:u=>navigator.clipboard.writeText(u),navigate:u=>{window.location.hash=u},newKey:()=>crypto.randomUUID(),now:Date.now}),[e]),n=(0,M.useSyncExternalStore)(t.subscribe,t.snapshot,t.snapshot);return(0,M.useEffect)(()=>{function u(){let p=new URLSearchParams(window.location.hash.split("?")[1]??"").get("project");window.location.hash.startsWith("#/tokens")&&t.start(p===null?"personal":"project",p)}function a(){window.location.hash.startsWith("#/tokens")&&(t.identity(),t.loadPrincipals())}return u(),t.identity(),t.loadPrincipals(),tt(t,window,()=>{u(),a()})},[t]),(0,M.useEffect)(()=>nt(t,e),[t,e]),(0,r.jsx)(et,{state:n,controller:t})}export{Qe as TokenList,Wt as TokensPage,et as TokensView,tt as bindTokensLifecycle,nt as bindTokensReplay,Ye as createTokensController,J as dayLabel,Je as filterTokens,pe as hasSetupAccess,Ae as inResultScope,ie as lifetimeChoices,He as tokensReducer};

package/dist/auth.d.ts

@@ -39,6 +39,7 @@ export interface ReauthState {
     readonly outcome: 'replayed' | 'failed' | 'save-failed' | 'credential-required' | null;
 }
 export interface ReplayResult {
+    readonly cancelled?: boolean;
     readonly createdSourceId?: string;
     readonly path: string;
     readonly ok: boolean;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.tsx"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAa,MAAM,UAAU,CAAC;AAC1F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkBlD,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AA6BD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmB7D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA8BjD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GAAG,QAAQ,EAC3B,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAiBrB;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE;;gCAjH5D,IAAI;kBAsHV,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;EAqBjD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,GAAG,qBAAqB,GAAG,IAAI,CAAC;CACxF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;;gCAjK6B,IAAI;8BA6KJ,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI;2BAQ7C,qBAAqB,WACrB;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAA;KAAE,cAC/E,MAAM,GACjB,IAAI;eAmBI,IAAI;aAWN,IAAI;eAKF,IAAI;eAIE,OAAO,CAAC,IAAI,CAAC;uBA0CL;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;EAO/C;AAED,MAAM,MAAM,WAAW,GACnB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAUnE,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvF;AAoBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE;;gCApU7D,IAAI;uBAgVL,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;kBAuC3B;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;EA+C/F;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACpF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAA;KAAE,KACxF,IAAI,CAAC;CACX;AAED,eAAO,MAAM,eAAe,+CAA4C,CAAC;AAEzE,wBAAgB,WAAW,IAAI,aAAa,CAI3C;AA6HD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM/D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,+BAwBA;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC7C,QAAQ,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,+BAwEA;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC9D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,+BA2EA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,+BAaA;AAMD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;;;;EAuCpE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,+BAmFA;AA4BD,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACrF,+BAgFA;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU;YAEnC,UAAU;eACP,YAAY,EAAE;WAClB,OAAO;kBACA,SAAS,GAAG,OAAO,GAAG,OAAO;;;;;EAkC9C;AAMD,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE,+BA2BhF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,YAAY,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;CACpC,+BAwBA;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE,+BAmBhF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB,+BAsCA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;CAAE,+BA8BjF;AAED,wBAAgB,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,+BAO/D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.tsx"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAa,MAAM,UAAU,CAAC;AAC1F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkBlD,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AA6BD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmB7D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA8BjD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GAAG,QAAQ,EAC3B,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAiBrB;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE;;gCAjH5D,IAAI;kBAsHV,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;EAqBjD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,GAAG,qBAAqB,GAAG,IAAI,CAAC;CACxF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;;gCAlK6B,IAAI;8BA8KJ,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI;2BAQ7C,qBAAqB,WACrB;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAA;KAAE,cAC/E,MAAM,GACjB,IAAI;eAmBI,IAAI;aAWN,IAAI;eAKF,IAAI;eASE,OAAO,CAAC,IAAI,CAAC;uBA0CL;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;EAO/C;AAED,MAAM,MAAM,WAAW,GACnB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAUnE,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvF;AAoBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE;;gCA1U7D,IAAI;uBAsVL,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;kBAuC3B;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;EA+C/F;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACpF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAA;KAAE,KACxF,IAAI,CAAC;CACX;AAED,eAAO,MAAM,eAAe,+CAA4C,CAAC;AAEzE,wBAAgB,WAAW,IAAI,aAAa,CAI3C;AA6HD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM/D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,+BAwBA;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC7C,QAAQ,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,+BAwEA;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC9D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,+BA2EA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,+BAaA;AAMD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;;;;EA6CpE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,+BAmFA;AA4BD,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACrF,+BAgFA;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU;YAEnC,UAAU;eACP,YAAY,EAAE;WAClB,OAAO;kBACA,SAAS,GAAG,OAAO,GAAG,OAAO;;;;;EAkC9C;AAMD,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE,+BA2BhF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,YAAY,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,SAAS,YAAY,EAAE,CAAC;CACpC,+BAwBA;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,IAAI,CAAA;CAAE,+BAmBhF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB,+BAsCA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;CAAE,+BA8BjF;AAED,wBAAgB,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,+BAO/D"}

package/dist/auth.js

@@ -179,7 +179,12 @@ export function createReauthFlow(deps) {
             store.set({ dialog: 'closed', action: null, busy: false, outcome: null });
         },
         decline() {
+            const { action } = store.get();
             store.set({ dialog: 'closed', action: null, outcome: null });
+            if (action?.path.startsWith('/_pb/sources/discovery/rules')) {
+                for (const listener of replayListeners)
+                    listener({ path: action.path, ok: false, status: 0, cancelled: true });
+            }
         },
         async confirm() {
             const { action, busy } = store.get();
@@ -473,6 +478,12 @@ function restoredProjectSlug(action) {
     return action?.path.match(/^\/_pb\/projects\/([^/]+)\/restore$/)?.[1];
 }
 export function pendingActionDescription(action) {
+    if (action?.display && 'label' in action.display)
+        return {
+            label: action.display.label,
+            effect: action.display.effect,
+            destructive: action.method === 'DELETE',
+        };
     if (restoredProjectSlug(action)) {
         return {
             label: 'Restore project',
@@ -515,8 +526,8 @@ export function ReauthConfirmContent(props) {
     const packageIds = props.action?.path.match(/\/packages\/([^/]+)\/versions\/([^/]+)/);
     const runId = props.action?.path.match(/\/import-runs\/([^/]+)/)?.[1];
     const request = props.action ? `${props.action.method} ${props.action.path}` : '';
-    return (_jsxs(_Fragment, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: "Send the held action now?" }), _jsx(DialogDescription, { children: "You confirmed your identity. The action below was held while you signed in and has not been sent yet." })] }), _jsxs("dl", { className: "detail-list", children: [_jsx("dt", { children: "Action" }), _jsx("dd", { className: "font-medium", children: description.label }), projectSlug ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Project" }), _jsx("dd", { children: projectSlug })] })) : null, display ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Package" }), _jsx("dd", { children: display.packageName }), _jsx("dt", { children: "Version" }), _jsx("dd", { className: "font-mono", children: display.version })] })) : packageIds ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Package ID" }), _jsx("dd", { children: _jsx(IdText, { value: packageIds[1], label: "package ID" }) }), _jsx("dt", { children: "Version ID" }), _jsx("dd", { children: _jsx(IdText, { value: packageIds[2], label: "version ID" }) })] })) : null, runId ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Run" }), _jsx("dd", { children: _jsx(IdText, { value: runId, label: "run ID" }) })] })) : null, _jsx("dt", { children: "Scope" }), _jsx("dd", { children: display?.scope ??
-                            (props.action?.path.startsWith('/_pb/projects/') ? 'Project' : 'Organization') }), _jsx("dt", { children: "Effect" }), _jsx("dd", { children: description.effect })] }), request ? (_jsxs("details", { children: [_jsx("summary", { className: "cursor-pointer text-sm text-blue-700", children: "Request details" }), _jsxs("div", { className: "mt-2 flex min-w-0 items-start gap-2 rounded-md border border-neutral-200 bg-neutral-50 p-3", children: [_jsx("code", { className: "min-w-0 break-all text-xs", children: request }), _jsx(CopyButton, { value: request, label: "Copy request" })] })] })) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { type: "button", variant: "outline", onClick: props.onDecline, children: "Discard" }), _jsx(Button, { type: "button", variant: description.destructive ? 'destructive' : 'default', onClick: props.onConfirm, children: description.label })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: "Send the held action now?" }), _jsx(DialogDescription, { children: "You confirmed your identity. The action below was held while you signed in and has not been sent yet." })] }), _jsxs("dl", { className: "detail-list", children: [_jsx("dt", { children: "Action" }), _jsx("dd", { className: "font-medium", children: description.label }), projectSlug ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Project" }), _jsx("dd", { children: projectSlug })] })) : null, display && 'packageName' in display ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Package" }), _jsx("dd", { children: display.packageName }), _jsx("dt", { children: "Version" }), _jsx("dd", { className: "font-mono", children: display.version })] })) : packageIds ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Package ID" }), _jsx("dd", { children: _jsx(IdText, { value: packageIds[1], label: "package ID" }) }), _jsx("dt", { children: "Version ID" }), _jsx("dd", { children: _jsx(IdText, { value: packageIds[2], label: "version ID" }) })] })) : null, runId ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Run" }), _jsx("dd", { children: _jsx(IdText, { value: runId, label: "run ID" }) })] })) : null, _jsx("dt", { children: "Scope" }), _jsx("dd", { children: display?.scope ??
+                            (props.action?.path.startsWith('/_pb/projects/') ? 'Project' : 'Organization') }), _jsx("dt", { children: "Effect" }), _jsx("dd", { children: description.effect })] }), request && !(display && 'label' in display) ? (_jsxs("details", { children: [_jsx("summary", { className: "cursor-pointer text-sm text-blue-700", children: "Request details" }), _jsxs("div", { className: "mt-2 flex min-w-0 items-start gap-2 rounded-md border border-neutral-200 bg-neutral-50 p-3", children: [_jsx("code", { className: "min-w-0 break-all text-xs", children: request }), _jsx(CopyButton, { value: request, label: "Copy request" })] })] })) : null, _jsxs(DialogFooter, { children: [_jsx(Button, { type: "button", variant: "outline", onClick: props.onDecline, children: "Discard" }), _jsx(Button, { type: "button", variant: description.destructive ? 'destructive' : 'default', onClick: props.onConfirm, children: description.label })] })] }));
 }
 const QR_QUIET_ZONE = 4;
 function QrImage({ matrix }) {