@rubytech/create-maxy-code 0.1.307 → 0.1.309

package/payload/server/{chunk-4QFPGAUZ.js → chunk-J6WDAWFJ.js}

@@ -2756,23 +2756,9 @@ function websockifyLog(event, fields = {}) {
   console.error(`[websockify] ${formatKv({ event, ...fields })}`);
 }
 
-// app/lib/password-strength.ts
-function validatePasswordStrength(password) {
-  return [
-    { key: "length", label: "At least 8 characters", met: password.length >= 8 },
-    { key: "number", label: "Contains a number", met: /\d/.test(password) },
-    { key: "special", label: "Contains a special character", met: /[^A-Za-z0-9]/.test(password) },
-    { key: "whitespace", label: "No spaces", met: password.length > 0 && !/\s/.test(password) }
-  ];
-}
-function isPasswordValid(password) {
-  return validatePasswordStrength(password).every((r) => r.met);
-}
-
-// app/lib/remote-auth.ts
-import { scrypt, randomBytes, timingSafeEqual, createHmac } from "crypto";
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname } from "path";
+// ../lib/admin-access-password/src/index.ts
+import { scrypt, randomBytes, timingSafeEqual } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync, renameSync, unlinkSync } from "fs";
 var SCRYPT_N = 16384;
 var SCRYPT_R = 8;
 var SCRYPT_P = 1;
@@ -2785,56 +2771,170 @@ function scryptAsync(password, salt) {
     });
   });
 }
-async function hashPassword(password) {
+async function hashAccessPassword(password) {
   const salt = randomBytes(32);
   const hash = await scryptAsync(password, salt);
   return `${salt.toString("hex")}:${hash.toString("hex")}`;
 }
-async function verifyPassword(password, stored) {
-  const colonIndex = stored.indexOf(":");
-  if (colonIndex === -1) return { ok: false, why: "bad-hash-format", hashBytes: 0 };
-  const saltHex = stored.slice(0, colonIndex);
-  const hashHex = stored.slice(colonIndex + 1);
-  if (!saltHex || !hashHex) return { ok: false, why: "bad-hash-format", hashBytes: 0 };
-  const salt = Buffer.from(saltHex, "hex");
-  const storedHash = Buffer.from(hashHex, "hex");
-  if (storedHash.length !== SCRYPT_KEYLEN) {
-    return { ok: false, why: "hash-length", hashBytes: storedHash.length };
-  }
+async function matchesHash(password, stored) {
+  const colon = stored.indexOf(":");
+  if (colon === -1) return false;
+  const salt = Buffer.from(stored.slice(0, colon), "hex");
+  const storedHash = Buffer.from(stored.slice(colon + 1), "hex");
+  if (storedHash.length !== SCRYPT_KEYLEN) return false;
   let computed;
   try {
     computed = await scryptAsync(password, salt);
   } catch {
-    return { ok: false, why: "scrypt-throw", hashBytes: storedHash.length };
-  }
-  if (timingSafeEqual(computed, storedHash)) {
-    return { ok: true, hashBytes: storedHash.length };
+    return false;
   }
-  return { ok: false, why: "password-mismatch", hashBytes: storedHash.length };
+  return timingSafeEqual(computed, storedHash);
 }
-function isRemoteAuthConfigured() {
-  if (!existsSync2(REMOTE_PASSWORD_FILE)) return false;
-  const content = readFileSync2(REMOTE_PASSWORD_FILE, "utf-8").trim();
-  return content.length > 0 && content.includes(":");
+function readUsers(usersFile) {
+  if (!existsSync2(usersFile)) return [];
+  const raw2 = readFileSync2(usersFile, "utf-8").trim();
+  if (!raw2) return [];
+  const parsed = JSON.parse(raw2);
+  if (!Array.isArray(parsed)) throw new Error("users.json is not an array");
+  return parsed;
+}
+function writeUsersAtomic(usersFile, users) {
+  const tmp = `${usersFile}.tmp-${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(users, null, 2) + "\n", { mode: 384 });
+  renameSync(tmp, usersFile);
+}
+async function setAccessPassword(userId, password, usersFile) {
+  const users = readUsers(usersFile);
+  const idx = users.findIndex((u) => u.userId === userId);
+  if (idx === -1) throw new Error(`no users.json record for userId=${userId}`);
+  users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
+  writeUsersAtomic(usersFile, users);
 }
-function readPasswordHash() {
+async function verifyAccessPassword(password, usersFile) {
+  let users;
   try {
-    if (!existsSync2(REMOTE_PASSWORD_FILE)) return null;
-    const content = readFileSync2(REMOTE_PASSWORD_FILE, "utf-8").trim();
-    if (!content || !content.includes(":")) return null;
-    return content;
+    users = readUsers(usersFile);
   } catch {
     return null;
   }
+  for (const u of users) {
+    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
+      return u.userId;
+    }
+  }
+  return null;
+}
+async function accessPasswordCollides(password, usersFile, excludeUserId) {
+  let users;
+  try {
+    users = readUsers(usersFile);
+  } catch {
+    return false;
+  }
+  for (const u of users) {
+    if (u.userId === excludeUserId) continue;
+    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
+      return true;
+    }
+  }
+  return false;
+}
+function anyAccessPasswordConfigured(usersFile) {
+  let users;
+  try {
+    users = readUsers(usersFile);
+  } catch {
+    return false;
+  }
+  return users.some((u) => typeof u.accessHash === "string" && u.accessHash.length > 0);
+}
+function accessStoreUnreadable(usersFile) {
+  if (!existsSync2(usersFile)) return false;
+  try {
+    readUsers(usersFile);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId) {
+  if (!existsSync2(legacyFile)) return "noop-no-legacy";
+  const legacy = readFileSync2(legacyFile, "utf-8").trim();
+  const users = readUsers(usersFile);
+  const idx = users.findIndex((u) => u.userId === ownerUserId);
+  if (idx === -1) return "noop-no-owner";
+  const existing = users[idx].accessHash;
+  if (typeof existing === "string" && existing.length > 0) {
+    unlinkSync(legacyFile);
+    return "noop-owner-has-hash";
+  }
+  if (!legacy.includes(":")) {
+    unlinkSync(legacyFile);
+    return "noop-no-legacy";
+  }
+  users[idx] = { ...users[idx], accessHash: legacy };
+  writeUsersAtomic(usersFile, users);
+  unlinkSync(legacyFile);
+  return "migrated";
+}
+function readLegacyRemoteHash(legacyFile) {
+  if (!existsSync2(legacyFile)) return null;
+  const raw2 = readFileSync2(legacyFile, "utf-8").trim();
+  return raw2.includes(":") ? raw2 : null;
+}
+
+// app/lib/password-strength.ts
+function validatePasswordStrength(password) {
+  return [
+    { key: "length", label: "At least 8 characters", met: password.length >= 8 },
+    { key: "number", label: "Contains a number", met: /\d/.test(password) },
+    { key: "special", label: "Contains a special character", met: /[^A-Za-z0-9]/.test(password) },
+    { key: "whitespace", label: "No spaces", met: password.length > 0 && !/\s/.test(password) }
+  ];
+}
+function isPasswordValid(password) {
+  return validatePasswordStrength(password).every((r) => r.met);
+}
+
+// app/lib/remote-auth.ts
+import { scrypt as scrypt2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2, createHmac } from "crypto";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname } from "path";
+var SCRYPT_N2 = 16384;
+var SCRYPT_R2 = 8;
+var SCRYPT_P2 = 1;
+var SCRYPT_KEYLEN2 = 64;
+function scryptAsync2(password, salt) {
+  return new Promise((resolve7, reject) => {
+    scrypt2(password, salt, SCRYPT_KEYLEN2, { N: SCRYPT_N2, r: SCRYPT_R2, p: SCRYPT_P2 }, (err, key) => {
+      if (err) reject(err);
+      else resolve7(key);
+    });
+  });
+}
+async function hashPassword(password) {
+  const salt = randomBytes2(32);
+  const hash = await scryptAsync2(password, salt);
+  return `${salt.toString("hex")}:${hash.toString("hex")}`;
+}
+function isRemoteAuthConfigured() {
+  if (anyAccessPasswordConfigured(USERS_FILE)) return true;
+  if (accessStoreUnreadable(USERS_FILE)) return true;
+  return readLegacyRemoteHash(REMOTE_PASSWORD_FILE) !== null;
 }
 async function setRemotePassword(password) {
   const hash = await hashPassword(password);
-  writeFileSync(REMOTE_PASSWORD_FILE, hash, "utf-8");
+  writeFileSync2(REMOTE_PASSWORD_FILE, hash, "utf-8");
 }
 async function verifyRemotePassword(password) {
-  const stored = readPasswordHash();
-  if (!stored) return { ok: false, why: "no-password-file", hashBytes: 0 };
-  return verifyPassword(password, stored);
+  const matchedUserId = await verifyAccessPassword(password, USERS_FILE);
+  if (matchedUserId) return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: matchedUserId };
+  const legacy = readLegacyRemoteHash(REMOTE_PASSWORD_FILE);
+  if (legacy && await matchesHash(password, legacy)) {
+    return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: null };
+  }
+  const configured = anyAccessPasswordConfigured(USERS_FILE) || legacy !== null;
+  return { ok: false, why: configured ? "password-mismatch" : "no-password-file", hashBytes: 0 };
 }
 var SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
 var TOKEN_PREFIX = "v1.";
@@ -2844,20 +2944,20 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync2(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync3(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
     }
   } catch {
   }
-  const fresh = randomBytes(SECRET_BYTES).toString("hex");
+  const fresh = randomBytes2(SECRET_BYTES).toString("hex");
   try {
     mkdirSync2(dirname(REMOTE_SESSION_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync(REMOTE_SESSION_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    writeFileSync2(REMOTE_SESSION_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
   } catch {
   }
-  const hex = readFileSync2(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync3(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -2872,7 +2972,7 @@ function signPayload(payloadJson, secret) {
   return base64urlEncode(createHmac("sha256", secret).update(payloadJson).digest());
 }
 function createRemoteSession(opts = {}) {
-  const payload = { c: opts.now ?? Date.now(), n: randomBytes(NONCE_BYTES).toString("hex") };
+  const payload = { c: opts.now ?? Date.now(), n: randomBytes2(NONCE_BYTES).toString("hex") };
   const payloadJson = JSON.stringify(payload);
   const payloadB64 = base64urlEncode(Buffer.from(payloadJson, "utf-8"));
   const sig = signPayload(payloadJson, getSecret());
@@ -2895,7 +2995,7 @@ function parseToken(token) {
   const expected = signPayload(payloadJson, getSecret());
   const expectedBuf = Buffer.from(expected, "utf-8");
   const provBuf = Buffer.from(sigB64, "utf-8");
-  const signatureValid = expectedBuf.length === provBuf.length && timingSafeEqual(expectedBuf, provBuf);
+  const signatureValid = expectedBuf.length === provBuf.length && timingSafeEqual2(expectedBuf, provBuf);
   let payload;
   try {
     payload = JSON.parse(payloadJson);
@@ -3442,6 +3542,10 @@ var SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "brow
 var PUBLIC_ALLOWED_PREFIXES = [
   "/api/session",
   "/api/chat",
+  // Task 873 — the detooled public surface's visitor-authed reader (pointer +
+  // server-filtered SSE stream). Reached by the visitor browser on the public
+  // host; authenticated by the __access_session grant inside the route.
+  "/api/public-reader/",
   "/api/access/",
   "/api/health",
   "/api/group/",
@@ -3473,13 +3577,13 @@ function classifyHost(host, operatorDomains2, isPublicHost) {
 import { watchFile } from "fs";
 
 // app/lib/operator-domains.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname2, resolve as resolve3 } from "path";
 var OPERATOR_DOMAINS_PATH = resolve3(MAXY_DIR, "operator-domains.json");
 function loadOperatorDomains() {
   if (!existsSync3(OPERATOR_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync3(OPERATOR_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(OPERATOR_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -3506,11 +3610,11 @@ function getOperatorDomains() {
 
 // app/lib/claude-agent/account.ts
 import { resolve as resolve4 } from "path";
-import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync5, statSync } from "fs";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, statSync } from "fs";
 
 // ../lib/brand-templating/src/index.ts
 import { join as join2 } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 var PLACEHOLDER = "{{productName}}";
 var cachedProductName = null;
 function brandJsonPath() {
@@ -3530,7 +3634,7 @@ function getBrandProductName() {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(path, "utf-8"));
+    parsed = JSON.parse(readFileSync5(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `[skill-loader] brand.json unreadable at ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -3594,7 +3698,7 @@ function listValidAccounts() {
     }
     let config;
     try {
-      config = JSON.parse(readFileSync5(configPath, "utf-8"));
+      config = JSON.parse(readFileSync6(configPath, "utf-8"));
     } catch {
       console.error(
         `[platform] accounts-state CORRUPT-JSON id=${entry.name} \u2014 account.json failed to parse; treating as stub`
@@ -3610,7 +3714,7 @@ function resolveAccount() {
   let usersJsonUserId = null;
   if (existsSync5(USERS_FILE)) {
     try {
-      const raw2 = readFileSync5(USERS_FILE, "utf-8").trim();
+      const raw2 = readFileSync6(USERS_FILE, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         if (users.length > 0) {
@@ -3626,7 +3730,7 @@ function resolveAccount() {
     if (!entry.isDirectory()) continue;
     const configPath = resolve4(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync5(configPath)) continue;
-    const raw2 = readFileSync5(configPath, "utf-8");
+    const raw2 = readFileSync6(configPath, "utf-8");
     let config;
     try {
       config = JSON.parse(raw2);
@@ -3661,7 +3765,7 @@ function resolveAccount() {
 function readAgentFile(accountDir, agentName, filename) {
   const filePath = resolve4(accountDir, "agents", agentName, filename);
   if (!existsSync5(filePath)) return null;
-  const raw2 = readFileSync5(filePath, "utf-8");
+  const raw2 = readFileSync6(filePath, "utf-8");
   if (filename.endsWith(".md")) {
     return substituteBrandPlaceholders(raw2, filePath);
   }
@@ -3690,7 +3794,7 @@ function resolveDefaultAgentSlug(accountDir) {
   }
   let config;
   try {
-    config = JSON.parse(readFileSync5(configPath, "utf-8"));
+    config = JSON.parse(readFileSync6(configPath, "utf-8"));
   } catch (err) {
     console.error("[agent-resolve] failed to read account.json:", err);
     return null;
@@ -3765,14 +3869,14 @@ function resolveAgentConfig(accountDir, agentName) {
     const knowledgeMtime = statSync(knowledgePath).mtimeMs;
     const summaryMtime = statSync(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
-      knowledge = readFileSync5(summaryPath, "utf-8");
+      knowledge = readFileSync6(summaryPath, "utf-8");
     } else {
       console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
-      knowledge = readFileSync5(knowledgePath, "utf-8");
+      knowledge = readFileSync6(knowledgePath, "utf-8");
     }
     knowledgeBaked = true;
   } else if (hasKnowledge) {
-    knowledge = readFileSync5(knowledgePath, "utf-8");
+    knowledge = readFileSync6(knowledgePath, "utf-8");
     knowledgeBaked = true;
   }
   let budget = null;
@@ -3808,7 +3912,7 @@ function resolveUserAccounts(userId) {
     if (!existsSync5(configPath)) continue;
     let config;
     try {
-      config = JSON.parse(readFileSync5(configPath, "utf-8"));
+      config = JSON.parse(readFileSync6(configPath, "utf-8"));
     } catch {
       console.error(`[session] account.json corrupt at ${configPath} \u2014 skipping`);
       continue;
@@ -3893,8 +3997,8 @@ function getSessionKeyBySessionId(_sessionId) {
 // app/lib/claude-agent/plugin-manifest.ts
 import { resolve as resolve5, join as join3 } from "path";
 import {
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync3,
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync4,
   readdirSync as readdirSync2,
   existsSync as existsSync6,
   statSync as statSync2,
@@ -3915,7 +4019,7 @@ function readBundleSubPlugins(bundlePath) {
   if (!existsSync6(bundlePath)) return [];
   let raw2;
   try {
-    raw2 = readFileSync6(bundlePath, "utf-8");
+    raw2 = readFileSync7(bundlePath, "utf-8");
   } catch {
     return [];
   }
@@ -3988,8 +4092,8 @@ function reapDuplicateFlatPremiumSubs(bundles, stagingRoot, pluginsDir) {
       const flatDir = resolve5(pluginsDir, sub);
       const flatManifest = resolve5(flatDir, "PLUGIN.md");
       if (!existsSync6(premiumManifest) || !existsSync6(flatManifest)) continue;
-      const premiumSha = createHash2("sha256").update(readFileSync6(premiumManifest)).digest("hex");
-      const flatSha = createHash2("sha256").update(readFileSync6(flatManifest)).digest("hex");
+      const premiumSha = createHash2("sha256").update(readFileSync7(premiumManifest)).digest("hex");
+      const flatSha = createHash2("sha256").update(readFileSync7(flatManifest)).digest("hex");
       if (isBundle) {
         if (premiumSha === flatSha) {
           try {
@@ -4051,10 +4155,10 @@ function reconcileEnabledPlugins(accountDir, config, accountId) {
   const merged = [...currentSet];
   const configPath = resolve5(accountDir, "account.json");
   try {
-    const raw2 = readFileSync6(configPath, "utf-8");
+    const raw2 = readFileSync7(configPath, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = merged;
-    writeFileSync3(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    writeFileSync4(configPath, JSON.stringify(parsed, null, 2) + "\n");
     config.enabledPlugins = merged;
   } catch (err) {
     console.error(`${TAG} enabled-stamp write failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -4082,10 +4186,10 @@ function cleanupLeakedPremiumSubs(accountDir, config, accountId) {
   if (removed.length === 0) return;
   const configPath = resolve5(accountDir, "account.json");
   try {
-    const raw2 = readFileSync6(configPath, "utf-8");
+    const raw2 = readFileSync7(configPath, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = kept;
-    writeFileSync3(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    writeFileSync4(configPath, JSON.stringify(parsed, null, 2) + "\n");
     config.enabledPlugins = kept;
     console.log(`${TAG} cleanup accountId=${accountId ?? "unknown"} removed=[${removed.join(",")}]`);
   } catch (err) {
@@ -4133,7 +4237,7 @@ function requirePortEnv(envName, options = {}) {
 // app/lib/neo4j-store.ts
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync7, readdirSync as readdirSync3, existsSync as existsSync7, openSync, readSync, closeSync, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync3, existsSync as existsSync7, openSync, readSync, closeSync, statSync as statSync3 } from "fs";
 import { resolve as resolve6 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var driver = null;
@@ -4141,7 +4245,7 @@ function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve6(PLATFORM_ROOT3, "config/.neo4j-password");
   try {
-    return readFileSync7(passwordFile, "utf-8").trim();
+    return readFileSync8(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -5190,7 +5294,7 @@ function loadEnabledPluginProfileKeys(accountId) {
   if (!existsSync7(accountFile)) return {};
   let enabled;
   try {
-    const raw2 = readFileSync7(accountFile, "utf-8");
+    const raw2 = readFileSync8(accountFile, "utf-8");
     const parsed = JSON.parse(raw2);
     enabled = Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : [];
   } catch (err) {
@@ -5205,7 +5309,7 @@ function loadEnabledPluginProfileKeys(accountId) {
     if (!existsSync7(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync7(manifestPath, "utf-8");
+      manifest = readFileSync8(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -5461,11 +5565,11 @@ async function projectAgent(accountId, accountDir, slug) {
       );
       return;
     }
-    config = JSON.parse(readFileSync7(configPath, "utf-8"));
+    config = JSON.parse(readFileSync8(configPath, "utf-8"));
     for (const { filename, role } of AGENT_FILE_ROLES) {
       const filePath = resolve6(agentDir, filename);
       if (!existsSync7(filePath)) continue;
-      const body = readFileSync7(filePath, "utf-8");
+      const body = readFileSync8(filePath, "utf-8");
       presentRoles.push({ role, body, edge: ROLE_TO_EDGE[role] });
     }
   } catch (err) {
@@ -5726,6 +5830,7 @@ export {
   LID_MAP_FILE,
   LOG_DIR,
   BIN_DIR,
+  REMOTE_PASSWORD_FILE,
   INSTALL_OWNER_FILE,
   VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
@@ -5734,6 +5839,9 @@ export {
   sanitizeClientCorrId,
   httpLog,
   websockifyLog,
+  setAccessPassword,
+  accessPasswordCollides,
+  migrateLegacyRemotePassword,
   validatePasswordStrength,
   isPasswordValid,
   isRemoteAuthConfigured,

package/payload/server/maxy-edge.js

@@ -16,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-4QFPGAUZ.js";
+} from "./chunk-J6WDAWFJ.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/public/assets/AccessGate-CU4Qw6M6.js

@@ -0,0 +1 @@
+import{o as e}from"./chunk-CAM3fms7.js";import{o as t,u as n}from"./brand-C7kj0USi.js";import{c as r,d as i,l as a,u as o}from"./audio-attachment-mime-DOBET-W1.js";import{r as s}from"./useSelectionMode-CG_Iel5F.js";var c=e(n(),1);function l(){let[e,t]=(0,c.useState)(null),[n,s]=(0,c.useState)(null),[l,u]=(0,c.useState)(`loading`),[d,f]=(0,c.useState)(``),[p,m]=(0,c.useState)(null),[h,g]=(0,c.useState)(null),[_,v]=(0,c.useState)(!1),[y,b]=(0,c.useState)(null),x=(0,c.useMemo)(()=>r(),[]),S=(0,c.useMemo)(()=>a(),[]),[C,w]=(0,c.useState)(null),T=(0,c.useRef)(x||``),E=(0,c.useRef)(null),D=(0,c.useRef)(null),O=(0,c.useRef)(!1),k=(0,c.useRef)(null),[A,j]=(0,c.useState)(`request-link`),[M,N]=(0,c.useState)(null),P=(0,c.useRef)(null),F=(0,c.useRef)(null);(0,c.useEffect)(()=>{try{let e=sessionStorage.getItem(`maxy_session`);e&&(F.current=e)}catch{}},[]);let I=(0,c.useCallback)(e=>{E.current=e,t(e);try{sessionStorage.setItem(`maxy_session`,e)}catch{}u(`chat`)},[]),L=(0,c.useCallback)(()=>{E.current=null;try{sessionStorage.removeItem(`maxy_session`)}catch{}t(null),u(`auth-required`),j(`request-link`)},[]),R=(0,c.useCallback)(async e=>{j(`verifying`);try{let t=T.current,n=await fetch(`/api/access/verify-token`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({token:e,agentSlug:t})});if(window.history.replaceState({},``,window.location.pathname),n.ok){let e=await n.json().catch(()=>({}));return e?.displayName&&N({displayName:e.displayName,contactValue:``,expiresAt:null,status:`active`}),!0}return j(`verify-failed`),!1}catch{return j(`verify-failed`),!1}},[]),z=(0,c.useCallback)(async()=>{if(E.current)return E.current;if(D.current)return D.current;let e=(async()=>{try{let e=F.current,n=await fetch(`/api/session`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({session_id:o(),...x?{agent:x}:{},...S?{group_slug:S}:{},...e?{session_key:e}:{}})});if(!n.ok){let e=await n.json().catch(()=>({error:``}));return i&&console.error(`[session] POST /api/session failed: ${n.status} ${n.statusText}`,e),n.status===404?s(e.error||`Agent not found`):n.status===503&&s(e.error||`Service unavailable`),null}let r=await n.json();if(r.auth_required){r.agent_id&&(T.current=r.agent_id),f(r.displayName||``),r.agentImage&&m(r.agentImage),r.agentImageShape&&g(r.agentImageShape),r.showAgentName&&v(r.showAgentName),r.branding&&b(r.branding),u(`auth-required`);let e=new URLSearchParams(window.location.search).get(`token`);return e?await R(e)&&window.location.reload():j(`request-link`),null}E.current=r.session_key,t(r.session_key),r.displayName&&f(r.displayName),r.agentImage&&m(r.agentImage),r.agentImageShape&&g(r.agentImageShape),r.showAgentName&&v(r.showAgentName),r.branding&&b(r.branding),u(`chat`),r.resumed&&r.messages&&(O.current=!0,k.current=r.messages),r.group&&w({groupSlug:r.groupSlug,groupName:r.groupName,participants:r.participants??[]});try{sessionStorage.setItem(`maxy_session`,r.session_key)}catch{}return r.session_key}catch(e){return i&&console.error(`[session] fetch /api/session threw:`,e),s(`Unable to connect. Please check your connection and try again.`),null}finally{D.current=null}})();return D.current=e,e},[x,S,R]);return{sessionId:e,cacheKeyRef:E,sessionError:n,pageState:l,setPageState:u,agentDisplayName:d,agentImage:p,agentImageShape:h,showAgentName:_,agentSlug:x,branding:y,resolvedSlugRef:T,ensureSession:z,startNewSession:(0,c.useCallback)(async()=>{E.current=null,D.current=null,F.current=null,O.current=!1,k.current=null,t(null),s(null);try{sessionStorage.removeItem(`maxy_session`)}catch{}await z()},[z]),enterChat:I,enterGate:L,resumedRef:O,resumeMessagesRef:k,gateState:A,setGateState:j,grantInfo:M,setGrantInfo:N,gateCacheKeyRef:P,groupContext:C,groupSlug:S}}var u=t();function d({gateState:e,setGateState:t,grantInfo:n,resolvedSlugRef:r}){let[i,a]=(0,c.useState)(``),[o,l]=(0,c.useState)(!1),[d,f]=(0,c.useState)(null);async function p(e){e.preventDefault();let n=i.trim().toLowerCase();if(!n){f(`Enter the email you were invited on.`);return}l(!0),f(null);try{let e=await fetch(`/api/access/request-magic-link`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({contactValue:n,agentSlug:r.current})});if(e.status===429){f((await e.json().catch(()=>({})))?.error||`Too many requests. Try again later.`);return}t(`request-sent`)}catch{f(`Could not reach the server. Check your connection and try again.`)}finally{l(!1)}}return(0,u.jsxs)(`div`,{className:`access-gate`,children:[e===`verifying`&&(0,u.jsxs)(`div`,{className:`access-gate-message`,children:[(0,u.jsx)(`h2`,{children:`Verifying your link…`}),(0,u.jsx)(`p`,{children:`This takes a moment.`})]}),e===`verify-failed`&&(0,u.jsxs)(`div`,{className:`access-gate-message`,children:[(0,u.jsx)(`h2`,{children:`That link did not work`}),(0,u.jsx)(`p`,{children:`It may have expired, already been used, or been for a different agent. You can request a fresh one below.`}),(0,u.jsx)(s,{onClick:()=>{t(`request-link`),f(null)},children:`Request a new link`})]}),e===`request-link`&&(0,u.jsxs)(`form`,{className:`access-gate-form`,onSubmit:p,children:[(0,u.jsx)(`h2`,{children:n?.displayName?`Welcome back, ${n.displayName}`:`Sign in`}),(0,u.jsx)(`p`,{children:`Enter the email you were invited on and we will send you a fresh link.`}),(0,u.jsx)(`label`,{htmlFor:`access-email`,children:`Email`}),(0,u.jsx)(`input`,{id:`access-email`,type:`email`,inputMode:`email`,autoComplete:`email`,value:i,onChange:e=>a(e.target.value),disabled:o}),d&&(0,u.jsx)(`p`,{className:`access-gate-error`,children:d}),(0,u.jsx)(s,{type:`submit`,disabled:o||!i.trim(),children:o?`Sending…`:`Send me a link`})]}),e===`request-sent`&&(0,u.jsxs)(`div`,{className:`access-gate-message`,children:[(0,u.jsx)(`h2`,{children:`Check your email`}),(0,u.jsx)(`p`,{children:`If that address is on the invite list, a fresh link is on the way. It expires in 15 minutes.`}),(0,u.jsx)(s,{onClick:()=>{t(`request-link`),a(``),f(null)},children:`Try a different email`})]})]})}export{l as n,d as t};

package/payload/server/public/assets/AdminLoginScreens-DUpRIM1h.js

@@ -0,0 +1 @@
+import{o as e}from"./chunk-CAM3fms7.js";import{a as t,o as n,t as r,u as i}from"./brand-C7kj0USi.js";import{S as a,g as o}from"./OperatorConversations-BIHiyyxU.js";import{s}from"./AdminShell-DkoQSsqo.js";import{r as c}from"./useSelectionMode-CG_Iel5F.js";import{t as l}from"./Checkbox-DMA1hVhn.js";new Set(`image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,audio/ogg,audio/opus,audio/mp4,audio/mpeg,audio/webm,audio/wav,.opus,.ogg,.m4a,.mp3,.wav,.webm`.split(`,`).filter(e=>!e.startsWith(`.`)));function u(e){switch(e){case`expanded`:return!0;case`collapsed`:return!1;default:return}}var d=`admin-landing-redirected`,f=`/graph`;function p(e){return e.variant===`operator`?!1:e.appState===`chat`&&!e.alreadyRedirected}var m=e(i(),1);function h(e=`admin`){let[t,n]=(0,m.useState)(`loading`),[r,i]=(0,m.useState)(``),[o,c]=(0,m.useState)(``),[l,h]=(0,m.useState)(``),[g,_]=(0,m.useState)(!1),[v,y]=(0,m.useState)(!1),[b,x]=(0,m.useState)(!1),[S,C]=(0,m.useState)(!1),[w,T]=(0,m.useState)(!1),[E,D]=(0,m.useState)(null),[O,k]=(0,m.useState)(null),[A,j]=(0,m.useState)(void 0),[M,N]=(0,m.useState)(null),[P,F]=(0,m.useState)(void 0),[I,L]=(0,m.useState)(null),[ee,R]=(0,m.useState)(null),[z,B]=(0,m.useState)([]),[V,H]=(0,m.useState)(!1),[U,W]=(0,m.useState)(void 0),G=(0,m.useRef)(void 0),[K,q]=(0,m.useState)(!1);(0,m.useEffect)(()=>{typeof window>`u`||fetch(`/api/remote-auth/status`).then(e=>e.ok?e.json():null).then(e=>{e?.configured&&q(!0)}).catch(()=>{})},[]);let J=(0,m.useRef)(null),Y=(0,m.useRef)(null);(0,m.useEffect)(()=>{async function e(){let e=null;try{e=sessionStorage.getItem(`maxy-admin-session-key`)}catch{}if(!e)return!1;try{let t=await fetch(`/api/admin/session?session_key=${encodeURIComponent(e)}`);if(t.status===401){try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return!1}if(!t.ok)return!1;let r=await t.json();D(r.session_key),R(r.sessionId??null),j(r.businessName),N(r.role??null),F(r.userName===void 0?null:r.userName),L(r.avatar??null);let i=u(r.thinkingView);return G.current=i,W(i),n(`chat`),!0}catch(e){return console.error(`[admin] session restore failed:`,e),!1}}async function t(r=2){try{let i=await fetch(`/api/health`);if(!i.ok){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check returned ${i.status} after retries`),n(`set-pin`);return}let a=await i.json();if(!a.pin_configured){n(`set-pin`);return}if(!a.claude_authenticated){n(`connect-claude`);return}if(await e())return;n(`enter-pin`)}catch(e){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check failed:`,e),n(`set-pin`)}}t()},[]),(0,m.useEffect)(()=>{t===`chat`&&fetch(`/api/admin/claude-info`).then(e=>{if(e.ok)return e.json()}).then(e=>{e&&k(e)}).catch(()=>{})},[t]),(0,m.useEffect)(()=>{if(typeof window>`u`)return;let n=!1;try{n=sessionStorage.getItem(d)===`1`}catch{}if(p({appState:t,alreadyRedirected:n,variant:e})){try{sessionStorage.setItem(d,`1`)}catch{}console.info(`[admin-ui] landing-redirect target=${f}`),window.location.replace(f)}},[t,e]);let X=(0,m.useRef)(null);(0,m.useEffect)(()=>{if(t!==`chat`)return;let e=setInterval(async()=>{try{let e=await fetch(`/api/health`);if(e.ok){let t=await e.json();if(t.auth_status===`dead`||t.auth_status===`missing`){n(`connect-claude`);return}}}catch{}if(E)try{let e=await fetch(`/api/admin/session?session_key=${encodeURIComponent(E)}`);if(e.status!==401)return;let t=(await e.clone().json().catch(()=>null))?.code??`unknown-401`;if(t===`remote-auth-required`){a(`heartbeat`,`/api/admin/session`);return}console.warn(`[admin-auth] outcome=heartbeat-detected-expiry code=${t}`),X.current?.()}catch{}},300*1e3);return()=>clearInterval(e)},[t,E]),(0,m.useEffect)(()=>{t===`connect-claude`&&fetch(`/api/health`).then(e=>e.ok?e.json():null).then(e=>{e?.claude_authenticated&&n(`enter-pin`)}).catch(()=>{})},[t]);async function Z(e,t){y(!0);try{let r=await fetch(`/api/admin/session`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:e,...t?{accountId:t}:{}})});if(!r.ok){h((await r.json().catch(()=>({}))).error||`Invalid PIN`);return}let a=await r.json();if(a.accounts&&!a.session_key){console.log(`[admin] account picker shown: userId=${a.userId} accountCount=${a.accounts.length}`),B(a.accounts),n(`account-picker`);return}D(a.session_key),R(a.sessionId??null),j(a.businessName),N(a.role??null),F(a.userName===void 0?null:a.userName),L(a.avatar??null);let o=u(a.thinkingView);if(G.current=o,W(o),t)try{sessionStorage.setItem(`maxy-account-id`,t)}catch{}try{sessionStorage.setItem(`maxy-admin-session-key`,a.session_key)}catch{}i(``),n(`chat`)}catch(e){console.error(`[admin] connection error:`,e),h(`Could not connect.`)}finally{y(!1),H(!1)}}let Q=(0,m.useCallback)(async e=>{if(e.preventDefault(),v)return;h(``);let t=o.trim();if(!t){h(`Please enter your name.`);return}if(r.length<4){h(`PIN must be at least 4 characters.`);return}let a=r;y(!0);try{let e=await fetch(`/api/onboarding/set-pin`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:a,name:t})});if(!e.ok){let t=await e.json().catch(()=>({}));if(e.status===409){console.log(`[admin] PIN already configured — re-checking health`);try{let e=await fetch(`/api/health`);if(e.ok){let r=await e.json();r.pin_configured&&r.claude_authenticated?n(`enter-pin`):r.pin_configured?n(`connect-claude`):h(t.error||`Failed to set PIN.`)}else n(`enter-pin`)}catch{n(`enter-pin`)}return}h(t.error||`Failed to set PIN.`);return}let r=await fetch(`/api/health`);if((r.ok?await r.json():null)?.claude_authenticated){await Z(a);return}i(``),n(`connect-claude`)}catch(e){console.error(`[admin] connection error:`,e),h(`Could not connect.`)}finally{y(!1)}},[r,v,o]),te=(0,m.useCallback)(async e=>{e.preventDefault(),h(``),await Z(r)},[r]),ne=(0,m.useCallback)(async()=>{T(!0);try{if(!await s())return console.warn(`[admin-ui] claude-disconnect not verified — credentials may persist; staying put`),!1;D(null),N(null),F(void 0),L(null);try{sessionStorage.removeItem(`maxy-admin-session-key`),sessionStorage.removeItem(`maxy-account-id`),sessionStorage.removeItem(d)}catch{}return n(`connect-claude`),!0}finally{T(!1)}},[]),$=(0,m.useCallback)(()=>{D(null),N(null),F(void 0),L(null);try{sessionStorage.removeItem(`maxy-admin-session-key`),sessionStorage.removeItem(`maxy-account-id`),sessionStorage.removeItem(d)}catch{}i(``),h(``),n(`enter-pin`)},[]);return(0,m.useEffect)(()=>{X.current=$},[$]),{appState:t,setAppState:n,pin:r,setPin:i,operatorName:o,setOperatorName:c,pinError:l,setPinError:h,showPin:g,setShowPin:_,pinLoading:v,authPolling:b,setAuthPolling:x,authLoading:S,setAuthLoading:C,disconnecting:w,cacheKey:E,setCacheKey:D,claudeInfo:O,setClaudeInfo:k,businessName:A,role:M,userName:P,userAvatar:I,sessionId:ee,setSessionId:R,accounts:z,accountPickerLoading:V,expandAll:U,setExpandAll:W,expandAllDefaultRef:G,remoteAuthEnabled:K,pinInputRef:J,setPinFormRef:Y,handleSetPin:Q,handleLogin:te,handleAccountSelect:(0,m.useCallback)(async e=>{H(!0),h(``),await Z(r,e)},[r]),handleDisconnect:ne,handleLogout:$,handleChangePin:(0,m.useCallback)(async()=>{if(!r){h(`Enter your current PIN first.`);return}y(!0),h(``);try{let e=await fetch(`/api/onboarding/set-pin`,{method:`DELETE`,headers:{"Content-Type":`application/json`},body:JSON.stringify({currentPin:r})});if(!e.ok){h((await e.json().catch(()=>({error:`Incorrect PIN.`}))).error||`Incorrect PIN.`);return}i(``),h(``),n(`set-pin`)}catch(e){console.error(`[admin-auth] change pin failed:`,e),h(e instanceof Error?e.message:String(e))}finally{y(!1)}},[r])}}var g=n();function _({inputRef:e,value:t,onChange:n,onComplete:r,showPin:i,autoFocus:a}){let o=(0,m.useRef)([]);function s(e,r){r.key===`Backspace`?(r.preventDefault(),t[e]?n(t.slice(0,e)+t.slice(e+1)):e>0&&(n(t.slice(0,e-1)+t.slice(e)),o.current[e-1]?.focus())):r.key===`ArrowLeft`&&e>0?o.current[e-1]?.focus():r.key===`ArrowRight`&&e<5?o.current[e+1]?.focus():r.key===`Enter`&&(r.preventDefault(),r.currentTarget.form?.requestSubmit())}function c(e,i){let a=i.nativeEvent.data;if(!a||!/^\d$/.test(a))return;let s=t.split(``);for(s[e]=a;s.length<e;)s.push(``);let c=s.join(``).replace(/\D/g,``).slice(0,6);n(c),c.length===6?r?.(c):e<5&&o.current[e+1]?.focus()}function l(e){e.preventDefault();let t=e.clipboardData.getData(`text`).replace(/\D/g,``).slice(0,6);t&&(n(t),t.length===6?r?.(t):o.current[t.length]?.focus())}return(0,g.jsx)(`div`,{className:`pin-field`,children:Array.from({length:6}).map((n,r)=>(0,g.jsx)(`input`,{ref:t=>{o.current[r]=t,r===0&&e&&(e.current=t)},type:`text`,inputMode:`numeric`,className:`pin-box${t[r]?` pin-box-filled`:``}`,value:t[r]?i?t[r]:`•`:``,onKeyDown:e=>s(r,e),onInput:e=>c(r,e),onPaste:l,onFocus:e=>e.target.select(),autoFocus:a&&r===0,autoComplete:`off`,maxLength:1,"aria-label":`PIN digit ${r+1}`},r))})}function v(e){let{pin:n,setPin:i,showPin:a,setShowPin:o,pinLoading:s,pinError:u,pinInputRef:d,setPinFormRef:f,onSubmit:p,operatorName:m,setOperatorName:h}=e;return(0,g.jsx)(`div`,{className:`connect-page`,children:(0,g.jsxs)(`div`,{className:`connect-content`,children:[(0,g.jsx)(`img`,{src:t,alt:r.productName,className:`connect-logo connect-logo--maxy`}),!r.logoContainsName&&(0,g.jsxs)(`h1`,{className:`connect-title`,children:[`Welcome to `,r.productName]}),(0,g.jsxs)(`p`,{className:`connect-subtitle`,children:[`Tell `,r.productName,` who you are, then choose a PIN.`]}),(0,g.jsxs)(`form`,{ref:f,onSubmit:p,className:`connect-pin-form`,children:[(0,g.jsxs)(`div`,{className:`pin-input-row`,children:[(0,g.jsx)(`input`,{type:`text`,className:`connect-name-input`,placeholder:`Your full name`,value:m,onChange:e=>h(e.target.value),autoComplete:`name`,autoFocus:!0,required:!0,"aria-label":`Your full name`}),(0,g.jsx)(`div`,{style:{width:38,flexShrink:0},"aria-hidden":`true`})]}),(0,g.jsxs)(`div`,{className:`pin-input-row`,children:[(0,g.jsx)(_,{inputRef:d,value:n,onChange:i,onComplete:()=>{},showPin:a}),(0,g.jsx)(c,{variant:`send`,type:`submit`,disabled:!n||!m.trim(),loading:s,"aria-label":`Set PIN`,children:(0,g.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,g.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,g.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,g.jsx)(l,{checked:a,onChange:()=>o(e=>!e),label:`Show PIN`})]}),u&&(0,g.jsx)(`p`,{className:`admin-pin-error`,children:u})]})})}function y(e){let{pin:n,setPin:i,showPin:a,setShowPin:o,pinLoading:s,pinError:u,pinInputRef:d,onSubmit:f,onChangePin:p,remoteAuthEnabled:m,onSignOutRemote:h}=e;return(0,g.jsxs)(`div`,{className:`connect-page`,children:[m&&h&&(0,g.jsx)(`button`,{type:`button`,className:`connect-signout`,onClick:h,children:`Sign out`}),(0,g.jsxs)(`div`,{className:`connect-content`,children:[(0,g.jsx)(`img`,{src:t,alt:r.productName,className:`connect-logo connect-logo--maxy`}),!r.logoContainsName&&(0,g.jsx)(`h1`,{className:`connect-title`,children:r.productName}),(0,g.jsxs)(`form`,{onSubmit:f,className:`connect-pin-form`,children:[(0,g.jsxs)(`div`,{className:`pin-input-row`,children:[(0,g.jsx)(_,{inputRef:d,value:n,onChange:i,onComplete:()=>{},showPin:a,autoFocus:!0}),(0,g.jsx)(c,{variant:`send`,type:`submit`,disabled:!n,loading:s,children:(0,g.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,g.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,g.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,g.jsxs)(`div`,{className:`pin-options`,children:[(0,g.jsx)(l,{checked:a,onChange:()=>o(e=>!e),label:`Show PIN`}),(0,g.jsx)(c,{type:`button`,variant:`ghost`,onClick:p,children:`Change PIN`})]})]}),u&&(0,g.jsx)(`p`,{className:`admin-pin-error`,children:u})]})]})}function b(e){let{accounts:n,loading:i,error:a,onSelect:s}=e;return(0,g.jsx)(`div`,{className:`connect-page`,children:(0,g.jsxs)(`div`,{className:`connect-content`,children:[(0,g.jsx)(`img`,{src:t,alt:r.productName,className:`connect-logo connect-logo--maxy`}),!r.logoContainsName&&(0,g.jsx)(`h1`,{className:`connect-title`,children:r.productName}),(0,g.jsx)(`p`,{className:`connect-subtitle`,children:`Select an account`}),(0,g.jsx)(`div`,{className:`account-picker-list`,children:n.map(e=>(0,g.jsxs)(`button`,{className:`account-picker-card`,onClick:()=>s(e.accountId),disabled:i,type:`button`,children:[(0,g.jsx)(`span`,{className:`account-picker-name`,children:e.businessName||e.accountId}),(0,g.jsx)(`span`,{className:`account-picker-role`,children:e.role}),i&&(0,g.jsx)(o,{className:`account-picker-spinner`,size:16})]},e.accountId))}),a&&(0,g.jsx)(`p`,{className:`admin-pin-error`,children:a})]})})}function x(e){let{authPolling:n,setAuthPolling:i,authLoading:a,setAuthLoading:o,pinError:s,setPinError:l,setAppState:u}=e,[d,f]=(0,m.useState)(!1),[p,h]=(0,m.useState)(!1);async function _(){h(!0),l(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`launch-browser`})})).json();e.launched?f(!0):e.error&&l(e.error)}catch(e){console.error(`[admin] browser launch error:`,e),l(`Could not launch browser.`)}h(!1)}async function v(){o(!0),l(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`})).json();if(e.started){i(!0),f(!0),o(!1);for(let e=0;e<120;e++)if(await new Promise(e=>setTimeout(e,2e3)),(await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`wait`})})).json()).authenticated){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),u(`enter-pin`);return}l(`Timed out waiting for sign-in. Try again.`),i(!1)}else e.error&&l(e.error)}catch(e){console.error(`[admin] auth flow error:`,e),l(`Could not start auth flow.`)}o(!1)}async function y(){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),i(!1),l(``)}return n||d?(0,g.jsxs)(`div`,{style:{display:`flex`,flexDirection:`column`,height:`100dvh`,overflow:`auto`},children:[(0,g.jsxs)(`header`,{className:`chat-header`,style:{paddingBottom:`12px`,flexShrink:0,position:`relative`,maxWidth:`680px`,width:`100%`,margin:`0 auto`,padding:`24px 20px 12px`},children:[n?(0,g.jsx)(`button`,{onClick:y,style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Cancel`,children:`✕`}):(0,g.jsx)(`button`,{onClick:()=>f(!1),style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Close browser`,children:`✕`}),(0,g.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`chat-logo`}),(0,g.jsx)(`h1`,{className:`chat-tagline`,children:`Connect Claude`}),(0,g.jsx)(`p`,{className:`chat-intro`,children:n?`Sign in and authorize in the browser below.`:`Open your email or prepare your accounts, then sign in.`}),!n&&(0,g.jsx)(`div`,{style:{marginTop:`12px`},children:(0,g.jsx)(c,{variant:`primary`,onClick:v,disabled:a,children:a?(0,g.jsxs)(g.Fragment,{children:[(0,g.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`})})]}),(0,g.jsx)(`div`,{style:{flex:1,display:`flex`,flexDirection:`column`,minHeight:0,gap:`10px`,padding:`0 0 16px`},children:(0,g.jsx)(`iframe`,{src:`/vnc-viewer.html`,style:{flex:1,width:`100%`,minHeight:0,border:`none`,background:`#111`,display:`block`},title:`Claude Sign-in`})}),s&&(0,g.jsx)(`p`,{className:`admin-pin-error`,style:{textAlign:`center`,padding:`0 20px 16px`},children:s})]}):(0,g.jsx)(`div`,{className:`connect-page`,children:(0,g.jsxs)(`div`,{className:`connect-content`,children:[(0,g.jsxs)(`div`,{className:`connect-logos`,children:[(0,g.jsx)(`div`,{className:`connect-logo-wrap`,children:(0,g.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`connect-logo`})}),(0,g.jsx)(`svg`,{className:`connect-arrow`,viewBox:`0 0 48 24`,fill:`none`,xmlns:`http://www.w3.org/2000/svg`,children:(0,g.jsx)(`path`,{d:`M0 12h44m0 0l-8-8m8 8l-8 8`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`})}),(0,g.jsxs)(`div`,{className:`connect-logo-wrap`,children:[(0,g.jsx)(`img`,{src:t,alt:r.productName,className:`connect-logo connect-logo--maxy`}),!r.logoContainsName&&(0,g.jsx)(`span`,{className:`connect-logo-label`,children:r.productName})]})]}),(0,g.jsxs)(`h1`,{className:`connect-title`,children:[`Connect Claude to power `,r.productName]}),(0,g.jsx)(`p`,{className:`connect-subtitle`,children:`Sign in with your Anthropic account to get started.`}),(0,g.jsx)(c,{variant:`primary`,onClick:v,disabled:a,children:a?(0,g.jsxs)(g.Fragment,{children:[(0,g.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`}),(0,g.jsx)(`p`,{style:{marginTop:`6px`,fontSize:`11px`,color:`#999`,maxWidth:`300px`,textAlign:`center`,lineHeight:`1.4`},children:`First time? You may need to sign into your email and Anthropic account in the browser before connecting.`}),(0,g.jsx)(`button`,{onClick:_,disabled:p,style:{marginTop:`12px`,background:`none`,border:`none`,color:`var(--color-primary, #666)`,fontSize:`13px`,cursor:`pointer`,textDecoration:`underline`,textUnderlineOffset:`3px`},children:p?`Launching…`:`Open browser first`}),s&&(0,g.jsx)(`p`,{className:`admin-pin-error`,children:s})]})})}function S({auth:e}){return e.appState===`loading`?(0,g.jsx)(`div`,{className:`connect-page`}):e.appState===`set-pin`?(0,g.jsx)(v,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,setPinFormRef:e.setPinFormRef,onSubmit:e.handleSetPin,operatorName:e.operatorName,setOperatorName:e.setOperatorName}):e.appState===`connect-claude`?(0,g.jsx)(x,{authPolling:e.authPolling,setAuthPolling:e.setAuthPolling,authLoading:e.authLoading,setAuthLoading:e.setAuthLoading,pinError:e.pinError,setPinError:e.setPinError,setAppState:e.setAppState}):e.appState===`enter-pin`?(0,g.jsx)(y,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,onSubmit:e.handleLogin,onChangePin:e.handleChangePin,remoteAuthEnabled:e.remoteAuthEnabled,onSignOutRemote:()=>{console.info(`[admin-ui] remote-auth sign-out → /__remote-auth/logout`),window.location.href=`/__remote-auth/logout`}}):e.appState===`account-picker`?(0,g.jsx)(b,{accounts:e.accounts,loading:e.accountPickerLoading,error:e.pinError,onSelect:e.handleAccountSelect}):null}export{h as n,S as t};