@samyx/preview-stacks-ui 0.25.2 → 0.27.0

package/dist/assets/{SettingsView-C-xJVgVw.js → SettingsView-Bo-SQP0q.js}

@@ -1,2 +1,2 @@
-import{d as _,c as d,a as t,i as f,v as x,u as s,S as o,f as n,e as k,w as v,_ as c,a4 as S,t as u,g as m,x as B,F as E,y as l,r as y,C as g,a6 as L,L as T,o as r}from"./index-DVMQBHXF.js";import{_ as U}from"./ActionButton.vue_vue_type_script_setup_true_lang-D5wrEmB2.js";import{_ as b}from"./SelectMenu.vue_vue_type_script_setup_true_lang-D8NGgBfa.js";import"./Teleport-DfE2iP8c.js";const $={class:"panel settings-form"},A={class:"field"},D={class:"mute hint"},N={class:"field"},F=["type"],R={class:"row",style:{"margin-top":"var(--s2)"}},M={key:2,class:"mute",style:{"font-size":"var(--t-xs)"}},q={class:"mute hint"},H={class:"row",style:{gap:"8px","margin-top":"4px"}},I=["disabled"],P={key:0,class:"mute"},j={key:1,class:"bad"},z={class:"panel"},O={class:"field"},W={class:"field"},Y=_({__name:"SettingsView",setup(G){const p=y(!1),h=y(!1),w=g(()=>{const i=o.token;return i.startsWith("pstack_pat_")?"Looks like a personal token.":/^[0-9a-f]{40,}$/i.test(i)?"Looks like a machine token.":`${i.length} characters — this does not look like a pstack token.`}),C=g(()=>{var i;return((i=l.health)==null?void 0:i.authEnforced)??null});async function V(){p.value=!0;try{await L(),T(l.healthError?"error":"ok",l.healthError||"Control plane reachable")}finally{p.value=!1}}return(i,e)=>(r(),d("div",null,[e[19]||(e[19]=t("div",{class:"page-head"},[t("div",null,[t("h1",null,"Settings"),t("div",{class:"sub"},"Stored in this browser only. Nothing here is sent to the server.")])],-1)),t("section",$,[e[14]||(e[14]=t("h2",{class:"phead-title"},"Connection",-1)),t("div",A,[e[8]||(e[8]=t("label",{for:"apiBase"},"API base URL",-1)),f(t("input",{id:"apiBase","onUpdate:modelValue":e[0]||(e[0]=a=>s(o).apiBase=a),type:"url",spellcheck:"false",placeholder:"(same origin)"},null,512),[[x,s(o).apiBase,void 0,{trim:!0}]]),t("div",D,[e[7]||(e[7]=n(" Leave it empty unless you are pointing this page at another host. ",-1)),k(c,{label:"about the API base URL"},{default:v(()=>[...e[6]||(e[6]=[n(" Empty means same-origin, which is how the control stack serves this page — the browser never makes a cross-origin request, so there is no CORS to configure. Set an absolute URL only for a development session against a remote host. ",-1)])]),_:1})])]),t("div",N,[e[11]||(e[11]=t("label",{for:"token"},"Access token",-1)),f(t("input",{id:"token","onUpdate:modelValue":e[1]||(e[1]=a=>s(o).token=a),type:h.value||!s(o).token?"text":"password",name:"pstack-access-token",autocomplete:"off","data-1p-ignore":"","data-lpignore":"true","data-bwignore":"","data-form-type":"other",spellcheck:"false",placeholder:"paste the token from pstack init"},null,8,F),[[S,s(o).token,void 0,{trim:!0}]]),t("div",R,[s(o).token?(r(),d("button",{key:0,class:"ghost sm",onClick:e[2]||(e[2]=a=>h.value=!h.value)},u(h.value?"Hide":"Show"),1)):m("",!0),s(o).token?(r(),B(U,{key:1,variant:"ghost",class:"sm",confirm:"Clear it?",onRun:e[3]||(e[3]=a=>s(o).token="")},{default:v(()=>[...e[9]||(e[9]=[n(" Clear ",-1)])]),_:1})):m("",!0),s(o).token?(r(),d("span",M,u(w.value),1)):m("",!0)]),t("div",q,[e[10]||(e[10]=n(" Authenticates every request — signing in with an account does the same job, so set this only for token-based access (the machine token, or a personal token from your account). ",-1)),C.value===!1?(r(),d(E,{key:0},[n(" This server is not asking for one — it only accepts connections from this machine, so a token here is harmless but unnecessary. ")],64)):m("",!0)])]),t("div",H,[t("button",{class:"btn",disabled:p.value,onClick:V},u(p.value?"Checking…":"Test connection"),9,I),s(l).health?(r(),d("span",P,[n(" Connected to pstack "+u(s(l).health.version)+" ",1),k(c,{label:"where data is stored"},{default:v(()=>[e[12]||(e[12]=n(" Deployment records and stored specs live in ",-1)),t("code",null,u(s(l).health.dataDir),1),e[13]||(e[13]=n(" on the host. ",-1))]),_:1})])):s(l).healthError?(r(),d("span",j,u(s(l).healthError),1)):m("",!0)])]),t("section",z,[e[18]||(e[18]=t("h2",{class:"phead-title"},"Appearance",-1)),t("div",O,[e[15]||(e[15]=t("label",{for:"theme"},"Theme",-1)),k(b,{modelValue:s(o).theme,"onUpdate:modelValue":e[4]||(e[4]=a=>s(o).theme=a),id:"theme",label:"Theme",options:[{value:"system",label:"Follow the system"},{value:"dark",label:"Dark"},{value:"light",label:"Light"}]},null,8,["modelValue"])]),t("div",W,[e[16]||(e[16]=t("label",{for:"motion"},"Motion",-1)),k(b,{modelValue:s(o).motion,"onUpdate:modelValue":e[5]||(e[5]=a=>s(o).motion=a),id:"motion",label:"Motion",options:[{value:"system",label:"Follow the system"},{value:"full",label:"Always animate"},{value:"none",label:"No animation"}]},null,8,["modelValue"]),e[17]||(e[17]=t("div",{class:"mute hint"}," “Follow the system” uses your device's reduce-motion setting. The other two override it, in either direction. ",-1))])])]))}});export{Y as default};
-//# sourceMappingURL=SettingsView-C-xJVgVw.js.map
+import{d as _,c as d,a as t,i as f,v as x,u as s,V as o,f as n,e as k,w as v,_ as c,a5 as B,t as u,g as m,z as E,F as S,A as l,r as y,j as g,a7 as A,O as L,o as r}from"./index-9Ra4jfL4.js";import{_ as T}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as b}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BLfPhhAj.js";import"./Teleport-BUn4ayOo.js";const U={class:"panel settings-form"},$={class:"field"},D={class:"mute hint"},N={class:"field"},F=["type"],R={class:"row",style:{"margin-top":"var(--s2)"}},M={key:2,class:"mute",style:{"font-size":"var(--t-xs)"}},j={class:"mute hint"},q={class:"row",style:{gap:"8px","margin-top":"4px"}},z=["disabled"],H={key:0,class:"mute"},I={key:1,class:"bad"},O={class:"panel"},P={class:"field"},W={class:"field"},Y=_({__name:"SettingsView",setup(G){const p=y(!1),h=y(!1),w=g(()=>{const i=o.token;return i.startsWith("pstack_pat_")?"Looks like a personal token.":/^[0-9a-f]{40,}$/i.test(i)?"Looks like a machine token.":`${i.length} characters — this does not look like a pstack token.`}),V=g(()=>{var i;return((i=l.health)==null?void 0:i.authEnforced)??null});async function C(){p.value=!0;try{await A(),L(l.healthError?"error":"ok",l.healthError||"Control plane reachable")}finally{p.value=!1}}return(i,e)=>(r(),d("div",null,[e[19]||(e[19]=t("div",{class:"page-head"},[t("div",null,[t("h1",null,"Settings"),t("div",{class:"sub"},"Stored in this browser only. Nothing here is sent to the server.")])],-1)),t("section",U,[e[14]||(e[14]=t("h2",{class:"phead-title"},"Connection",-1)),t("div",$,[e[8]||(e[8]=t("label",{for:"apiBase"},"API base URL",-1)),f(t("input",{id:"apiBase","onUpdate:modelValue":e[0]||(e[0]=a=>s(o).apiBase=a),type:"url",spellcheck:"false",placeholder:"(same origin)"},null,512),[[x,s(o).apiBase,void 0,{trim:!0}]]),t("div",D,[e[7]||(e[7]=n(" Leave it empty unless you are pointing this page at another host. ",-1)),k(c,{label:"about the API base URL"},{default:v(()=>[...e[6]||(e[6]=[n(" Empty means same-origin, which is how the control stack serves this page — the browser never makes a cross-origin request, so there is no CORS to configure. Set an absolute URL only for a development session against a remote host. ",-1)])]),_:1})])]),t("div",N,[e[11]||(e[11]=t("label",{for:"token"},"Access token",-1)),f(t("input",{id:"token","onUpdate:modelValue":e[1]||(e[1]=a=>s(o).token=a),type:h.value||!s(o).token?"text":"password",name:"pstack-access-token",autocomplete:"off","data-1p-ignore":"","data-lpignore":"true","data-bwignore":"","data-form-type":"other",spellcheck:"false",placeholder:"paste the token from pstack init"},null,8,F),[[B,s(o).token,void 0,{trim:!0}]]),t("div",R,[s(o).token?(r(),d("button",{key:0,class:"ghost sm",onClick:e[2]||(e[2]=a=>h.value=!h.value)},u(h.value?"Hide":"Show"),1)):m("",!0),s(o).token?(r(),E(T,{key:1,variant:"ghost",class:"sm",confirm:"Clear it?",onRun:e[3]||(e[3]=a=>s(o).token="")},{default:v(()=>[...e[9]||(e[9]=[n(" Clear ",-1)])]),_:1})):m("",!0),s(o).token?(r(),d("span",M,u(w.value),1)):m("",!0)]),t("div",j,[e[10]||(e[10]=n(" Authenticates every request — signing in with an account does the same job, so set this only for token-based access (the machine token, or a personal token from your account). ",-1)),V.value===!1?(r(),d(S,{key:0},[n(" This server is not asking for one — it only accepts connections from this machine, so a token here is harmless but unnecessary. ")],64)):m("",!0)])]),t("div",q,[t("button",{class:"btn",disabled:p.value,onClick:C},u(p.value?"Checking…":"Test connection"),9,z),s(l).health?(r(),d("span",H,[n(" Connected to pstack "+u(s(l).health.version)+" ",1),k(c,{label:"where data is stored"},{default:v(()=>[e[12]||(e[12]=n(" Deployment records and stored specs live in ",-1)),t("code",null,u(s(l).health.dataDir),1),e[13]||(e[13]=n(" on the host. ",-1))]),_:1})])):s(l).healthError?(r(),d("span",I,u(s(l).healthError),1)):m("",!0)])]),t("section",O,[e[18]||(e[18]=t("h2",{class:"phead-title"},"Appearance",-1)),t("div",P,[e[15]||(e[15]=t("label",{for:"theme"},"Theme",-1)),k(b,{modelValue:s(o).theme,"onUpdate:modelValue":e[4]||(e[4]=a=>s(o).theme=a),id:"theme",label:"Theme",options:[{value:"system",label:"Follow the system"},{value:"dark",label:"Dark"},{value:"light",label:"Light"}]},null,8,["modelValue"])]),t("div",W,[e[16]||(e[16]=t("label",{for:"motion"},"Motion",-1)),k(b,{modelValue:s(o).motion,"onUpdate:modelValue":e[5]||(e[5]=a=>s(o).motion=a),id:"motion",label:"Motion",options:[{value:"system",label:"Follow the system"},{value:"full",label:"Always animate"},{value:"none",label:"No animation"}]},null,8,["modelValue"]),e[17]||(e[17]=t("div",{class:"mute hint"}," “Follow the system” uses your device's reduce-motion setting. The other two override it, in either direction. ",-1))])])]))}});export{Y as default};
+//# sourceMappingURL=SettingsView-Bo-SQP0q.js.map

package/dist/assets/{SettingsView-C-xJVgVw.js.map → SettingsView-Bo-SQP0q.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SettingsView-C-xJVgVw.js","sources":["../../src/views/SettingsView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Settings: where the API is, how to authenticate to it, and how the app looks.\n *\n * Everything here is client-side and persisted to localStorage by `useSettings` — nothing is sent\n * to the server, and there is nothing to save. Bindings write through immediately.\n */\nimport { computed, ref } from 'vue';\nimport { settings } from '../composables/useSettings';\nimport { state, loadHealth } from '../composables/useControlPlane';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\n\nconst checking = ref(false);\nconst reveal = ref(false);\n\n/**\n * What is in the token box, described without printing it.\n *\n * The point is to make a WRONG value visible at a glance. A password autofilled into this field is\n * short and matches neither shape, and \"12 characters, not a pstack token\" is the sentence that\n * ends the mystery — before this, the only symptom was every page 401ing.\n */\nconst tokenShape = computed(() => {\n  const t = settings.token;\n  if (t.startsWith('pstack_pat_')) return 'Looks like a personal token.';\n  if (/^[0-9a-f]{40,}$/i.test(t)) return 'Looks like a machine token.';\n  return `${t.length} characters — this does not look like a pstack token.`;\n});\n\n/**\n * The server tells us whether it enforces auth. When it does not, it is bound to loopback and a\n * token would be pointless — worth saying, so nobody hunts for one that was never issued.\n */\nconst authEnforced = computed(() => state.health?.authEnforced ?? null);\n\nasync function recheck(): Promise<void> {\n  checking.value = true;\n  try {\n    await loadHealth();\n    toast(state.healthError ? 'error' : 'ok', state.healthError || 'Control plane reachable');\n  } finally {\n    checking.value = false;\n  }\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Settings</h1>\n        <div class=\"sub\">Stored in this browser only. Nothing here is sent to the server.</div>\n      </div>\n    </div>\n\n    <!-- `settings-form` caps the field widths: a URL input stretched to the panel's full 1500px\n         reads as a text editor, not a form — see the rule in app.css. -->\n    <section class=\"panel settings-form\">\n      <h2 class=\"phead-title\">Connection</h2>\n\n      <div class=\"field\">\n        <label for=\"apiBase\">API base URL</label>\n        <input\n          id=\"apiBase\"\n          v-model.trim=\"settings.apiBase\"\n          type=\"url\"\n          spellcheck=\"false\"\n          placeholder=\"(same origin)\"\n        />\n        <div class=\"mute hint\">\n          Leave it empty unless you are pointing this page at another host.\n          <InfoHint label=\"about the API base URL\">\n            Empty means same-origin, which is how the control stack serves this page — the browser\n            never makes a cross-origin request, so there is no CORS to configure. Set an absolute\n            URL only for a development session against a remote host.\n          </InfoHint>\n        </div>\n      </div>\n\n      <div class=\"field\">\n        <label for=\"token\">Access token</label>\n        <!--\n          NOT `type=\"password\"`, and none of these attributes are decorative.\n\n          This field is why \"opening Settings signs me out\" was a real bug. A password input is an\n          autofill magnet: Chrome and every password manager fill one on sight and ignore\n          `autocomplete=\"off\"` while doing it. The filled value went straight through `v-model` into\n          localStorage and onto every request as `Authorization: Bearer <someone's password>` — and\n          the server used to treat a bad bearer as a hard refusal rather than falling back to the\n          session cookie, so a perfectly good login 401'd on every route until site data was cleared.\n\n          The server now falls through (that is the real fix), and this field stops inviting the\n          fill: a text input that masks itself only while it holds a value, named nothing like a\n          password, with the ignore hints the managers respect.\n        -->\n        <input\n          id=\"token\"\n          v-model.trim=\"settings.token\"\n          :type=\"reveal || !settings.token ? 'text' : 'password'\"\n          name=\"pstack-access-token\"\n          autocomplete=\"off\"\n          data-1p-ignore\n          data-lpignore=\"true\"\n          data-bwignore\n          data-form-type=\"other\"\n          spellcheck=\"false\"\n          placeholder=\"paste the token from pstack init\"\n        />\n        <div class=\"row\" style=\"margin-top: var(--s2)\">\n          <button v-if=\"settings.token\" class=\"ghost sm\" @click=\"reveal = !reveal\">\n            {{ reveal ? 'Hide' : 'Show' }}\n          </button>\n          <ActionButton\n            v-if=\"settings.token\"\n            variant=\"ghost\"\n            class=\"sm\"\n            confirm=\"Clear it?\"\n            @run=\"settings.token = ''\"\n          >\n            Clear\n          </ActionButton>\n          <span v-if=\"settings.token\" class=\"mute\" style=\"font-size: var(--t-xs)\">\n            {{ tokenShape }}\n          </span>\n        </div>\n        <div class=\"mute hint\">\n          Authenticates every request — signing in with an account does the same job, so set this\n          only for token-based access (the machine token, or a personal token from your account).\n          <template v-if=\"authEnforced === false\">\n            This server is not asking for one — it only accepts connections from this machine, so a\n            token here is harmless but unnecessary.\n          </template>\n        </div>\n      </div>\n\n      <div class=\"row\" style=\"gap: 8px; margin-top: 4px\">\n        <button class=\"btn\" :disabled=\"checking\" @click=\"recheck\">\n          {{ checking ? 'Checking…' : 'Test connection' }}\n        </button>\n        <span v-if=\"state.health\" class=\"mute\">\n          Connected to pstack {{ state.health.version }}\n          <InfoHint label=\"where data is stored\">\n            Deployment records and stored specs live in\n            <code>{{ state.health.dataDir }}</code> on the host.\n          </InfoHint>\n        </span>\n        <span v-else-if=\"state.healthError\" class=\"bad\">{{ state.healthError }}</span>\n      </div>\n    </section>\n\n    <section class=\"panel\">\n      <h2 class=\"phead-title\">Appearance</h2>\n\n      <div class=\"field\">\n        <label for=\"theme\">Theme</label>\n        <SelectMenu\n            v-model=\"settings.theme\" id=\"theme\"\n            label=\"Theme\"\n            :options=\"[\n              { value: 'system', label: 'Follow the system' },\n              { value: 'dark', label: 'Dark' },\n              { value: 'light', label: 'Light' },\n            ]\"\n          />\n      </div>\n\n      <div class=\"field\">\n        <label for=\"motion\">Motion</label>\n        <SelectMenu\n            v-model=\"settings.motion\" id=\"motion\"\n            label=\"Motion\"\n            :options=\"[\n              { value: 'system', label: 'Follow the system' },\n              { value: 'full', label: 'Always animate' },\n              { value: 'none', label: 'No animation' },\n            ]\"\n          />\n        <div class=\"mute hint\">\n          “Follow the system” uses your device's reduce-motion setting. The other two override it,\n          in either direction.\n        </div>\n      </div>\n    </section>\n  </div>\n</template>\n"],"names":["checking","ref","reveal","tokenShape","computed","t","settings","authEnforced","_a","state","recheck","loadHealth","toast","_createElementBlock","_createElementVNode","_hoisted_1","_cache","_hoisted_2","$event","_unref","_hoisted_3","_createVNode","InfoHint","_hoisted_4","_hoisted_6","_createBlock","ActionButton","_hoisted_7","_toDisplayString","_hoisted_8","_Fragment","_hoisted_9","_hoisted_10","_openBlock","_hoisted_11","_createTextVNode","_hoisted_12","_hoisted_13","_hoisted_14","SelectMenu","_hoisted_15"],"mappings":"szBAeA,MAAMA,EAAWC,EAAI,EAAK,EACpBC,EAASD,EAAI,EAAK,EASlBE,EAAaC,EAAS,IAAM,CAChC,MAAMC,EAAIC,EAAS,MACnB,OAAID,EAAE,WAAW,aAAa,EAAU,+BACpC,mBAAmB,KAAKA,CAAC,EAAU,8BAChC,GAAGA,EAAE,MAAM,uDACpB,CAAC,EAMKE,EAAeH,EAAS,IAAA,OAAM,QAAAI,EAAAC,EAAM,SAAN,YAAAD,EAAc,eAAgB,KAAI,EAEtE,eAAeE,GAAyB,CACtCV,EAAS,MAAQ,GACjB,GAAI,CACF,MAAMW,EAAA,EACNC,EAAMH,EAAM,YAAc,QAAU,KAAMA,EAAM,aAAe,yBAAyB,CAC1F,QAAA,CACET,EAAS,MAAQ,EACnB,CACF,mBAIEa,EAwIM,MAAA,KAAA,eAvIJC,EAKM,MAAA,CALD,MAAM,aAAW,CACpBA,EAGM,MAAA,KAAA,CAFJA,EAAiB,UAAb,UAAQ,EACZA,EAAuF,MAAA,CAAlF,MAAM,KAAA,EAAM,kEAAgE,CAAA,SAMrFA,EA2FU,UA3FVC,EA2FU,CA1FRC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,KAAA,CAAnC,MAAM,aAAA,EAAc,aAAU,EAAA,GAElCA,EAiBM,MAjBNG,EAiBM,CAhBJD,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAyC,QAAA,CAAlC,IAAI,SAAA,EAAU,eAAY,EAAA,KACjCA,EAME,QAAA,CALA,GAAG,UACW,sBAAAE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,QAAOY,GAC9B,KAAK,MACL,WAAW,QACX,YAAY,eAAA,gBAHEC,EAAAb,CAAA,EAAS,eAAf,CAAA,KAAR,EAAA,CAA+B,IAKjCQ,EAOM,MAPNM,EAOM,eAPiB,sEAErB,EAAA,GAAAC,EAIWC,EAAA,CAJD,MAAM,0BAAwB,WAAC,IAIzC,CAAA,GAAAN,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJyC,2OAIzC,EAAA,CAAA,eAIJF,EAsDM,MAtDNS,EAsDM,CArDJP,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,QAAA,CAAhC,IAAI,OAAA,EAAQ,eAAY,EAAA,KAe/BA,EAYE,QAAA,CAXA,GAAG,QACW,sBAAAE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,MAAKY,GAC3B,KAAMhB,EAAA,OAAM,CAAKiB,EAAAb,CAAA,EAAS,MAAK,OAAA,WAChC,KAAK,sBACL,aAAa,MACb,iBAAA,GACA,gBAAc,OACd,gBAAA,GACA,iBAAe,QACf,WAAW,QACX,YAAY,kCAAA,gBATEa,EAAAb,CAAA,EAAS,aAAf,CAAA,KAAR,EAAA,CAA6B,IAW/BQ,EAgBM,MAhBNU,EAgBM,CAfUL,EAAAb,CAAA,EAAS,WAAvBO,EAES,SAAA,OAFqB,MAAM,WAAY,QAAKG,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAEhB,EAAA,MAAM,CAAIA,EAAA,MAAA,IAC5DA,EAAA,MAAM,OAAA,MAAA,EAAA,CAAA,YAGHiB,EAAAb,CAAA,EAAS,WADjBmB,EAQeC,EAAA,OANb,QAAQ,QACR,MAAM,KACN,QAAQ,YACP,MAAGV,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAEC,EAAAb,CAAA,EAAS,MAAK,GAAA,aACrB,IAED,CAAA,GAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAFC,UAED,EAAA,CAAA,qBACYG,EAAAb,CAAA,EAAS,WAArBO,EAEO,OAFPc,EAEOC,EADFzB,EAAA,KAAU,EAAA,CAAA,cAGjBW,EAOM,MAPNe,EAOM,iBAPiB,oLAGrB,EAAA,GAAgBtB,EAAA,QAAY,QAA5BM,EAGWiB,EAAA,CAAA,IAAA,GAAA,GAH6B,mIAGxC,CAAA,oBAIJhB,EAYM,MAZNiB,EAYM,CAXJjB,EAES,SAAA,CAFD,MAAM,MAAO,SAAUd,EAAA,MAAW,QAAOU,CAAA,IAC5CV,EAAA,MAAQ,YAAA,iBAAA,EAAA,EAAAgC,CAAA,EAEDb,EAAAV,CAAA,EAAM,QAAlBwB,IAAApB,EAMO,OANPqB,EAMO,CANgCC,EAAA,0BACdhB,EAAAV,CAAA,EAAM,OAAO,OAAO,EAAG,IAC9C,CAAA,EAAAY,EAGWC,EAAA,CAHD,MAAM,wBAAsB,WAAC,IAErC,iBAFqC,gDAErC,EAAA,GAAAR,EAAuC,OAAA,KAAAc,EAA9BT,EAAAV,CAAA,EAAM,OAAO,OAAO,EAAA,CAAA,kBAAU,iBACzC,EAAA,EAAA,YAEeU,EAAAV,CAAA,EAAM,aAAvBwB,EAAA,EAAApB,EAA8E,OAA9EuB,EAA8ER,EAA3BT,EAAAV,CAAA,EAAM,WAAW,EAAA,CAAA,gBAIxEK,EAgCU,UAhCVuB,EAgCU,CA/BRrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,KAAA,CAAnC,MAAM,aAAA,EAAc,aAAU,EAAA,GAElCA,EAWM,MAXNwB,EAWM,CAVJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgC,QAAA,CAAzB,IAAI,OAAA,EAAQ,QAAK,EAAA,GACxBO,EAQIkB,EAAA,CAPS,WAAApB,EAAAb,CAAA,EAAS,MAAT,sBAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,MAAKY,GAAE,GAAG,QAC5B,MAAM,QACL,QAAS,sGAIT,2BAIPJ,EAeM,MAfN0B,EAeM,CAdJxB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAkC,QAAA,CAA3B,IAAI,QAAA,EAAS,SAAM,EAAA,GAC1BO,EAQIkB,EAAA,CAPS,WAAApB,EAAAb,CAAA,EAAS,OAAT,sBAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,OAAMY,GAAE,GAAG,SAC7B,MAAM,SACL,QAAS,sHAIT,yBAELF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAGM,MAAA,CAHD,MAAM,aAAY,kHAGvB,EAAA,EAAA"}
+{"version":3,"file":"SettingsView-Bo-SQP0q.js","sources":["../../src/views/SettingsView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Settings: where the API is, how to authenticate to it, and how the app looks.\n *\n * Everything here is client-side and persisted to localStorage by `useSettings` — nothing is sent\n * to the server, and there is nothing to save. Bindings write through immediately.\n */\nimport { computed, ref } from 'vue';\nimport { settings } from '../composables/useSettings';\nimport { state, loadHealth } from '../composables/useControlPlane';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\n\nconst checking = ref(false);\nconst reveal = ref(false);\n\n/**\n * What is in the token box, described without printing it.\n *\n * The point is to make a WRONG value visible at a glance. A password autofilled into this field is\n * short and matches neither shape, and \"12 characters, not a pstack token\" is the sentence that\n * ends the mystery — before this, the only symptom was every page 401ing.\n */\nconst tokenShape = computed(() => {\n  const t = settings.token;\n  if (t.startsWith('pstack_pat_')) return 'Looks like a personal token.';\n  if (/^[0-9a-f]{40,}$/i.test(t)) return 'Looks like a machine token.';\n  return `${t.length} characters — this does not look like a pstack token.`;\n});\n\n/**\n * The server tells us whether it enforces auth. When it does not, it is bound to loopback and a\n * token would be pointless — worth saying, so nobody hunts for one that was never issued.\n */\nconst authEnforced = computed(() => state.health?.authEnforced ?? null);\n\nasync function recheck(): Promise<void> {\n  checking.value = true;\n  try {\n    await loadHealth();\n    toast(state.healthError ? 'error' : 'ok', state.healthError || 'Control plane reachable');\n  } finally {\n    checking.value = false;\n  }\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Settings</h1>\n        <div class=\"sub\">Stored in this browser only. Nothing here is sent to the server.</div>\n      </div>\n    </div>\n\n    <!-- `settings-form` caps the field widths: a URL input stretched to the panel's full 1500px\n         reads as a text editor, not a form — see the rule in app.css. -->\n    <section class=\"panel settings-form\">\n      <h2 class=\"phead-title\">Connection</h2>\n\n      <div class=\"field\">\n        <label for=\"apiBase\">API base URL</label>\n        <input\n          id=\"apiBase\"\n          v-model.trim=\"settings.apiBase\"\n          type=\"url\"\n          spellcheck=\"false\"\n          placeholder=\"(same origin)\"\n        />\n        <div class=\"mute hint\">\n          Leave it empty unless you are pointing this page at another host.\n          <InfoHint label=\"about the API base URL\">\n            Empty means same-origin, which is how the control stack serves this page — the browser\n            never makes a cross-origin request, so there is no CORS to configure. Set an absolute\n            URL only for a development session against a remote host.\n          </InfoHint>\n        </div>\n      </div>\n\n      <div class=\"field\">\n        <label for=\"token\">Access token</label>\n        <!--\n          NOT `type=\"password\"`, and none of these attributes are decorative.\n\n          This field is why \"opening Settings signs me out\" was a real bug. A password input is an\n          autofill magnet: Chrome and every password manager fill one on sight and ignore\n          `autocomplete=\"off\"` while doing it. The filled value went straight through `v-model` into\n          localStorage and onto every request as `Authorization: Bearer <someone's password>` — and\n          the server used to treat a bad bearer as a hard refusal rather than falling back to the\n          session cookie, so a perfectly good login 401'd on every route until site data was cleared.\n\n          The server now falls through (that is the real fix), and this field stops inviting the\n          fill: a text input that masks itself only while it holds a value, named nothing like a\n          password, with the ignore hints the managers respect.\n        -->\n        <input\n          id=\"token\"\n          v-model.trim=\"settings.token\"\n          :type=\"reveal || !settings.token ? 'text' : 'password'\"\n          name=\"pstack-access-token\"\n          autocomplete=\"off\"\n          data-1p-ignore\n          data-lpignore=\"true\"\n          data-bwignore\n          data-form-type=\"other\"\n          spellcheck=\"false\"\n          placeholder=\"paste the token from pstack init\"\n        />\n        <div class=\"row\" style=\"margin-top: var(--s2)\">\n          <button v-if=\"settings.token\" class=\"ghost sm\" @click=\"reveal = !reveal\">\n            {{ reveal ? 'Hide' : 'Show' }}\n          </button>\n          <ActionButton\n            v-if=\"settings.token\"\n            variant=\"ghost\"\n            class=\"sm\"\n            confirm=\"Clear it?\"\n            @run=\"settings.token = ''\"\n          >\n            Clear\n          </ActionButton>\n          <span v-if=\"settings.token\" class=\"mute\" style=\"font-size: var(--t-xs)\">\n            {{ tokenShape }}\n          </span>\n        </div>\n        <div class=\"mute hint\">\n          Authenticates every request — signing in with an account does the same job, so set this\n          only for token-based access (the machine token, or a personal token from your account).\n          <template v-if=\"authEnforced === false\">\n            This server is not asking for one — it only accepts connections from this machine, so a\n            token here is harmless but unnecessary.\n          </template>\n        </div>\n      </div>\n\n      <div class=\"row\" style=\"gap: 8px; margin-top: 4px\">\n        <button class=\"btn\" :disabled=\"checking\" @click=\"recheck\">\n          {{ checking ? 'Checking…' : 'Test connection' }}\n        </button>\n        <span v-if=\"state.health\" class=\"mute\">\n          Connected to pstack {{ state.health.version }}\n          <InfoHint label=\"where data is stored\">\n            Deployment records and stored specs live in\n            <code>{{ state.health.dataDir }}</code> on the host.\n          </InfoHint>\n        </span>\n        <span v-else-if=\"state.healthError\" class=\"bad\">{{ state.healthError }}</span>\n      </div>\n    </section>\n\n    <section class=\"panel\">\n      <h2 class=\"phead-title\">Appearance</h2>\n\n      <div class=\"field\">\n        <label for=\"theme\">Theme</label>\n        <SelectMenu\n            v-model=\"settings.theme\" id=\"theme\"\n            label=\"Theme\"\n            :options=\"[\n              { value: 'system', label: 'Follow the system' },\n              { value: 'dark', label: 'Dark' },\n              { value: 'light', label: 'Light' },\n            ]\"\n          />\n      </div>\n\n      <div class=\"field\">\n        <label for=\"motion\">Motion</label>\n        <SelectMenu\n            v-model=\"settings.motion\" id=\"motion\"\n            label=\"Motion\"\n            :options=\"[\n              { value: 'system', label: 'Follow the system' },\n              { value: 'full', label: 'Always animate' },\n              { value: 'none', label: 'No animation' },\n            ]\"\n          />\n        <div class=\"mute hint\">\n          “Follow the system” uses your device's reduce-motion setting. The other two override it,\n          in either direction.\n        </div>\n      </div>\n    </section>\n  </div>\n</template>\n"],"names":["checking","ref","reveal","tokenShape","computed","t","settings","authEnforced","_a","state","recheck","loadHealth","toast","_createElementBlock","_createElementVNode","_hoisted_1","_cache","_hoisted_2","$event","_unref","_hoisted_3","_createVNode","InfoHint","_hoisted_4","_hoisted_6","_createBlock","ActionButton","_hoisted_7","_toDisplayString","_hoisted_8","_Fragment","_hoisted_9","_hoisted_10","_openBlock","_hoisted_11","_createTextVNode","_hoisted_12","_hoisted_13","_hoisted_14","SelectMenu","_hoisted_15"],"mappings":"szBAeA,MAAMA,EAAWC,EAAI,EAAK,EACpBC,EAASD,EAAI,EAAK,EASlBE,EAAaC,EAAS,IAAM,CAChC,MAAMC,EAAIC,EAAS,MACnB,OAAID,EAAE,WAAW,aAAa,EAAU,+BACpC,mBAAmB,KAAKA,CAAC,EAAU,8BAChC,GAAGA,EAAE,MAAM,uDACpB,CAAC,EAMKE,EAAeH,EAAS,IAAA,OAAM,QAAAI,EAAAC,EAAM,SAAN,YAAAD,EAAc,eAAgB,KAAI,EAEtE,eAAeE,GAAyB,CACtCV,EAAS,MAAQ,GACjB,GAAI,CACF,MAAMW,EAAA,EACNC,EAAMH,EAAM,YAAc,QAAU,KAAMA,EAAM,aAAe,yBAAyB,CAC1F,QAAA,CACET,EAAS,MAAQ,EACnB,CACF,mBAIEa,EAwIM,MAAA,KAAA,eAvIJC,EAKM,MAAA,CALD,MAAM,aAAW,CACpBA,EAGM,MAAA,KAAA,CAFJA,EAAiB,UAAb,UAAQ,EACZA,EAAuF,MAAA,CAAlF,MAAM,KAAA,EAAM,kEAAgE,CAAA,SAMrFA,EA2FU,UA3FVC,EA2FU,CA1FRC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,KAAA,CAAnC,MAAM,aAAA,EAAc,aAAU,EAAA,GAElCA,EAiBM,MAjBNG,EAiBM,CAhBJD,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAyC,QAAA,CAAlC,IAAI,SAAA,EAAU,eAAY,EAAA,KACjCA,EAME,QAAA,CALA,GAAG,UACW,sBAAAE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,QAAOY,GAC9B,KAAK,MACL,WAAW,QACX,YAAY,eAAA,gBAHEC,EAAAb,CAAA,EAAS,eAAf,CAAA,KAAR,EAAA,CAA+B,IAKjCQ,EAOM,MAPNM,EAOM,eAPiB,sEAErB,EAAA,GAAAC,EAIWC,EAAA,CAJD,MAAM,0BAAwB,WAAC,IAIzC,CAAA,GAAAN,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJyC,2OAIzC,EAAA,CAAA,eAIJF,EAsDM,MAtDNS,EAsDM,CArDJP,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,QAAA,CAAhC,IAAI,OAAA,EAAQ,eAAY,EAAA,KAe/BA,EAYE,QAAA,CAXA,GAAG,QACW,sBAAAE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,MAAKY,GAC3B,KAAMhB,EAAA,OAAM,CAAKiB,EAAAb,CAAA,EAAS,MAAK,OAAA,WAChC,KAAK,sBACL,aAAa,MACb,iBAAA,GACA,gBAAc,OACd,gBAAA,GACA,iBAAe,QACf,WAAW,QACX,YAAY,kCAAA,gBATEa,EAAAb,CAAA,EAAS,aAAf,CAAA,KAAR,EAAA,CAA6B,IAW/BQ,EAgBM,MAhBNU,EAgBM,CAfUL,EAAAb,CAAA,EAAS,WAAvBO,EAES,SAAA,OAFqB,MAAM,WAAY,QAAKG,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAEhB,EAAA,MAAM,CAAIA,EAAA,MAAA,IAC5DA,EAAA,MAAM,OAAA,MAAA,EAAA,CAAA,YAGHiB,EAAAb,CAAA,EAAS,WADjBmB,EAQeC,EAAA,OANb,QAAQ,QACR,MAAM,KACN,QAAQ,YACP,MAAGV,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAEC,EAAAb,CAAA,EAAS,MAAK,GAAA,aACrB,IAED,CAAA,GAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAFC,UAED,EAAA,CAAA,qBACYG,EAAAb,CAAA,EAAS,WAArBO,EAEO,OAFPc,EAEOC,EADFzB,EAAA,KAAU,EAAA,CAAA,cAGjBW,EAOM,MAPNe,EAOM,iBAPiB,oLAGrB,EAAA,GAAgBtB,EAAA,QAAY,QAA5BM,EAGWiB,EAAA,CAAA,IAAA,GAAA,GAH6B,mIAGxC,CAAA,oBAIJhB,EAYM,MAZNiB,EAYM,CAXJjB,EAES,SAAA,CAFD,MAAM,MAAO,SAAUd,EAAA,MAAW,QAAOU,CAAA,IAC5CV,EAAA,MAAQ,YAAA,iBAAA,EAAA,EAAAgC,CAAA,EAEDb,EAAAV,CAAA,EAAM,QAAlBwB,IAAApB,EAMO,OANPqB,EAMO,CANgCC,EAAA,0BACdhB,EAAAV,CAAA,EAAM,OAAO,OAAO,EAAG,IAC9C,CAAA,EAAAY,EAGWC,EAAA,CAHD,MAAM,wBAAsB,WAAC,IAErC,iBAFqC,gDAErC,EAAA,GAAAR,EAAuC,OAAA,KAAAc,EAA9BT,EAAAV,CAAA,EAAM,OAAO,OAAO,EAAA,CAAA,kBAAU,iBACzC,EAAA,EAAA,YAEeU,EAAAV,CAAA,EAAM,aAAvBwB,EAAA,EAAApB,EAA8E,OAA9EuB,EAA8ER,EAA3BT,EAAAV,CAAA,EAAM,WAAW,EAAA,CAAA,gBAIxEK,EAgCU,UAhCVuB,EAgCU,CA/BRrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAuC,KAAA,CAAnC,MAAM,aAAA,EAAc,aAAU,EAAA,GAElCA,EAWM,MAXNwB,EAWM,CAVJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgC,QAAA,CAAzB,IAAI,OAAA,EAAQ,QAAK,EAAA,GACxBO,EAQIkB,EAAA,CAPS,WAAApB,EAAAb,CAAA,EAAS,MAAT,sBAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,MAAKY,GAAE,GAAG,QAC5B,MAAM,QACL,QAAS,sGAIT,2BAIPJ,EAeM,MAfN0B,EAeM,CAdJxB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAkC,QAAA,CAA3B,IAAI,QAAA,EAAS,SAAM,EAAA,GAC1BO,EAQIkB,EAAA,CAPS,WAAApB,EAAAb,CAAA,EAAS,OAAT,sBAAAU,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAE,GAAAC,EAAAb,CAAA,EAAS,OAAMY,GAAE,GAAG,SAC7B,MAAM,SACL,QAAS,sHAIT,yBAELF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAGM,MAAA,CAHD,MAAM,aAAY,kHAGvB,EAAA,EAAA"}

package/dist/assets/{SkeletonList.vue_vue_type_script_setup_true_lang-qMyLRAMp.js → SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js}

@@ -1,2 +1,2 @@
-import{d as s,o as e,c as a,F as o,s as r,D as n,E as i}from"./index-DVMQBHXF.js";const c={role:"status","aria-live":"polite","aria-label":"loading"},p=s({__name:"SkeletonList",props:{rows:{default:3},tall:{type:Boolean,default:!1}},setup(l){return(d,u)=>(e(),a("div",c,[(e(!0),a(o,null,r(l.rows,t=>(e(),a("div",{key:t,class:i(["skel",{tall:l.tall}]),style:n({width:`${100-t*7}%`})},null,6))),128))]))}});export{p as _};
-//# sourceMappingURL=SkeletonList.vue_vue_type_script_setup_true_lang-qMyLRAMp.js.map
+import{d as s,o as e,c as a,F as o,y as r,D as n,E as i}from"./index-9Ra4jfL4.js";const c={role:"status","aria-live":"polite","aria-label":"loading"},p=s({__name:"SkeletonList",props:{rows:{default:3},tall:{type:Boolean,default:!1}},setup(l){return(d,u)=>(e(),a("div",c,[(e(!0),a(o,null,r(l.rows,t=>(e(),a("div",{key:t,class:i(["skel",{tall:l.tall}]),style:n({width:`${100-t*7}%`})},null,6))),128))]))}});export{p as _};
+//# sourceMappingURL=SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js.map

package/dist/assets/{SkeletonList.vue_vue_type_script_setup_true_lang-qMyLRAMp.js.map → SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SkeletonList.vue_vue_type_script_setup_true_lang-qMyLRAMp.js","sources":["../../src/components/SkeletonList.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * A loading placeholder shaped like the thing that is coming.\n *\n * Deliberately not a spinner on an empty page: a spinner says \"wait\" and nothing else, while a\n * skeleton says what will be there and stops the layout jumping when it arrives. It also makes an\n * empty result visibly different from a slow one, which on this page is the difference between\n * \"nothing is deployed\" and \"the API is not answering\".\n */\nwithDefaults(defineProps<{ rows?: number; tall?: boolean }>(), { rows: 3, tall: false });\n</script>\n\n<template>\n  <div role=\"status\" aria-live=\"polite\" aria-label=\"loading\">\n    <div v-for=\"n in rows\" :key=\"n\" class=\"skel\" :class=\"{ tall }\" :style=\"{ width: `${100 - n * 7}%` }\" />\n  </div>\n</template>\n"],"names":["_openBlock","_createElementBlock","_hoisted_1","_Fragment","_renderList","__props","n","_normalizeClass"],"mappings":"gQAaEA,EAAA,EAAAC,EAEM,MAFNC,EAEM,QADJD,EAAuGE,EAAA,KAAAC,EAAtFC,EAAA,KAALC,QAAZL,EAAuG,MAAA,CAA/E,IAAKK,EAAG,MAAKC,EAAA,CAAC,OAAM,CAAA,KAAWF,EAAA,IAAA,CAAI,CAAA,EAAK,sBAAyBC,EAAC,CAAA,GAAA,CAAA,CAAA"}
+{"version":3,"file":"SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js","sources":["../../src/components/SkeletonList.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * A loading placeholder shaped like the thing that is coming.\n *\n * Deliberately not a spinner on an empty page: a spinner says \"wait\" and nothing else, while a\n * skeleton says what will be there and stops the layout jumping when it arrives. It also makes an\n * empty result visibly different from a slow one, which on this page is the difference between\n * \"nothing is deployed\" and \"the API is not answering\".\n */\nwithDefaults(defineProps<{ rows?: number; tall?: boolean }>(), { rows: 3, tall: false });\n</script>\n\n<template>\n  <div role=\"status\" aria-live=\"polite\" aria-label=\"loading\">\n    <div v-for=\"n in rows\" :key=\"n\" class=\"skel\" :class=\"{ tall }\" :style=\"{ width: `${100 - n * 7}%` }\" />\n  </div>\n</template>\n"],"names":["_openBlock","_createElementBlock","_hoisted_1","_Fragment","_renderList","__props","n","_normalizeClass"],"mappings":"gQAaEA,EAAA,EAAAC,EAEM,MAFNC,EAEM,QADJD,EAAuGE,EAAA,KAAAC,EAAtFC,EAAA,KAALC,QAAZL,EAAuG,MAAA,CAA/E,IAAKK,EAAG,MAAKC,EAAA,CAAC,OAAM,CAAA,KAAWF,EAAA,IAAA,CAAI,CAAA,EAAK,sBAAyBC,EAAC,CAAA,GAAA,CAAA,CAAA"}

package/dist/assets/SpecDetailView-C68gpDhO.js

@@ -0,0 +1,2 @@
+import{d as z,J as V,A,G as B,c as n,a as s,e as c,w as d,t as o,E as D,u as h,g as m,z as b,F as g,f as l,_ as N,y as I,r as v,j as L,k as R,o as t,V as U,n as E,C as S}from"./index-9Ra4jfL4.js";import{s as j,c as $}from"./useFormat-DIlTY5Dl.js";import{_ as q}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js";import{_ as F}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";const T={class:"page-head"},G={class:"mute",style:{"font-size":"var(--t-sm)"}},H={style:{"font-size":"var(--t-xl)"}},J={class:"sub"},P={key:0},W={key:1},K={key:2},M={key:3,class:"mute"},O={key:1,class:"panel"},Q={class:"banner failed"},X={class:"panel"},Y={key:1,class:"kvlist"},Z={class:"k"},ee={class:"v"},se={key:0},te={key:1,class:"mute"},ne={class:"v"},ae={key:1,class:"mute"},oe={class:"v"},le={class:"v"},ie={key:0,class:"panel"},de={key:0,class:"banner plain"},re={key:1,class:"code"},ue={key:2,class:"mute"},ye=z({__name:"SpecDetailView",props:{name:{}},setup(y){const k=y,a=v(null),r=v(!0),u=v(""),p=v(!1);async function w(){r.value=!0,p.value=!1;const i=await E.getAuthed(`/api/specs/${encodeURIComponent(k.name)}`);if(r.value=!1,i.status===404){p.value=!0;return}if(!i.ok){u.value=S(i,"load this spec");return}u.value="",a.value=i.body}V(()=>k.name,w,{immediate:!0}),V(()=>U.token,w),A.deploymentsLoaded||B();const C=L(()=>A.deployments.filter(i=>i.specName===k.name));return(i,e)=>{var x;const f=R("RouterLink");return t(),n("div",null,[s("div",T,[s("div",null,[s("div",G,[c(f,{to:"/specs"},{default:d(()=>[...e[0]||(e[0]=[l("← specs",-1)])]),_:1})]),s("h1",H,o(y.name),1),s("div",J,[(x=a.value)!=null&&x.description?(t(),n("span",P,o(a.value.description),1)):p.value?(t(),n("span",W,"not found")):r.value?(t(),n("span",K,"loading…")):(t(),n("span",M,"no description"))])]),e[1]||(e[1]=s("span",{class:"grow"},null,-1)),a.value?(t(),n("span",{key:0,class:D(["badge",a.value.kind])},o(h(j)(a.value.kind)),3)):m("",!0)]),u.value?(t(),b(F,{key:0,text:u.value,title:"Could not load this spec."},null,8,["text"])):m("",!0),p.value?(t(),n("section",O,[s("div",Q,[s("b",null,"No spec named “"+o(y.name)+"”.",1),e[2]||(e[2]=s("p",null,"It may have been deleted, or this is an older link.",-1))])])):(t(),n(g,{key:2},[s("section",X,[r.value?(t(),b(q,{key:0,rows:4})):a.value?(t(),n("ul",Y,[s("li",null,[s("span",Z,[e[4]||(e[4]=l(" Needs ",-1)),c(N,{label:"what needs means"},{default:d(()=>[...e[3]||(e[3]=[l(" Variables the spec uses but does not set. Every deployment referencing it supplies these, which is how one spec serves many stacks — and a missing one is refused by name rather than filled in blank. ",-1)])]),_:1})]),s("span",ee,[a.value.requiredVars.length?(t(),n("b",se,o(a.value.requiredVars.join(", ")),1)):(t(),n("span",te,"nothing — every value is fixed by the spec"))])]),s("li",null,[e[6]||(e[6]=s("span",{class:"k"},"Used by",-1)),s("span",ne,[C.value.length?(t(),n(g,{key:0},[(t(!0),n(g,null,I(C.value,_=>(t(),b(f,{key:_.id,to:`/deployments/${encodeURIComponent(_.id)}`,style:{"margin-right":"10px"}},{default:d(()=>[l(o(_.id),1)]),_:2},1032,["to"]))),128)),c(N,{label:"why this matters"},{default:d(()=>[...e[5]||(e[5]=[l(" Deleting a spec while a deployment still references it is refused: that deployment could no longer be resolved, and one that cannot be resolved can never be torn down. ",-1)])]),_:1})],64)):(t(),n("span",ae,"no deployments reference it"))])]),s("li",null,[e[7]||(e[7]=s("span",{class:"k"},"Created",-1)),s("span",oe,o(h($)(a.value.createdAt)),1)]),s("li",null,[e[8]||(e[8]=s("span",{class:"k"},"Updated",-1)),s("span",le,o(h($)(a.value.updatedAt)),1)])])):m("",!0)]),a.value?(t(),n("section",ie,[e[13]||(e[13]=s("div",{class:"phead"},[s("h2",{class:"section"},"Source")],-1)),a.value.sourceWithheld?(t(),n("div",de,[e[12]||(e[12]=s("b",null,"Hidden without an access token.",-1)),s("p",null,[e[10]||(e[10]=l(" A spec's hooks are shell commands, and they often carry a password or an API token inline — so the server does not send the file to an unauthenticated reader. ",-1)),c(f,{to:"/settings"},{default:d(()=>[...e[9]||(e[9]=[l("Add your token",-1)])]),_:1}),e[11]||(e[11]=l(" to see it. ",-1))])])):a.value.source?(t(),n("pre",re,o(a.value.source),1)):(t(),n("p",ue,"The server returned no source for this spec."))])):m("",!0)],64))])}}});export{ye as default};
+//# sourceMappingURL=SpecDetailView-C68gpDhO.js.map

package/dist/assets/{SpecDetailView-CGQZS7NU.js.map → SpecDetailView-C68gpDhO.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SpecDetailView-CGQZS7NU.js","sources":["../../src/views/SpecDetailView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * One stored spec: what it needs, who uses it, and its source.\n *\n * THE SOURCE IS A RESTRICTED READ. Everything else on this API can be read without a token, but a\n * spec's hook bodies are shell strings that routinely carry a credential inline, so the server sends\n * `source` only to an authenticated request and sets `sourceWithheld` otherwise. That is why this\n * one view uses `getAuthed`, and why \"no token\" renders an explanation rather than an empty editor —\n * a blank box would read as an empty spec, which is a different and much more alarming fact.\n */\nimport { computed, ref, watch } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { SpecDetail } from '../api/types';\nimport { state, loadDeployments } from '../composables/useControlPlane';\nimport { settings } from '../composables/useSettings';\nimport { sentence, stamp } from '../composables/useFormat';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport InfoHint from '../components/InfoHint.vue';\n\nconst props = defineProps<{ name: string }>();\n\nconst spec = ref<SpecDetail | null>(null);\nconst loading = ref(true);\nconst error = ref('');\nconst missing = ref(false);\n\nasync function load(): Promise<void> {\n  loading.value = true;\n  missing.value = false;\n  const r = await api.getAuthed<SpecDetail>(`/api/specs/${encodeURIComponent(props.name)}`);\n  loading.value = false;\n  if (r.status === 404) {\n    missing.value = true;\n    return;\n  }\n  if (!r.ok) {\n    error.value = problem(r, 'load this spec');\n    return;\n  }\n  error.value = '';\n  spec.value = r.body;\n}\n\nwatch(() => props.name, load, { immediate: true });\n// Re-fetch when a token is pasted: the same URL returns strictly more with one.\nwatch(() => settings.token, load);\n\nif (!state.deploymentsLoaded) void loadDeployments();\n\n/** Deployments that would become unresolvable if this spec were deleted. */\nconst users = computed(() => state.deployments.filter((d) => d.specName === props.name));\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <div class=\"mute\" style=\"font-size: var(--t-sm)\">\n          <RouterLink to=\"/specs\">← specs</RouterLink>\n        </div>\n        <h1 style=\"font-size: var(--t-xl)\">{{ name }}</h1>\n        <div class=\"sub\">\n          <span v-if=\"spec?.description\">{{ spec.description }}</span>\n          <span v-else-if=\"missing\">not found</span>\n          <span v-else-if=\"loading\">loading…</span>\n          <span v-else class=\"mute\">no description</span>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <span v-if=\"spec\" class=\"badge\" :class=\"spec.kind\">{{ sentence(spec.kind) }}</span>\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Could not load this spec.\" />\n\n    <section v-if=\"missing\" class=\"panel\">\n      <div class=\"banner failed\">\n        <b>No spec named “{{ name }}”.</b>\n        <p>It may have been deleted, or this is an older link.</p>\n      </div>\n    </section>\n\n    <template v-else>\n      <section class=\"panel\">\n        <SkeletonList v-if=\"loading\" :rows=\"4\" />\n        <ul v-else-if=\"spec\" class=\"kvlist\">\n          <li>\n            <span class=\"k\">\n              Needs\n              <InfoHint label=\"what needs means\">\n                Variables the spec uses but does not set. Every deployment referencing it supplies\n                these, which is how one spec serves many stacks — and a missing one is refused by\n                name rather than filled in blank.\n              </InfoHint>\n            </span>\n            <span class=\"v\">\n              <b v-if=\"spec.requiredVars.length\">{{ spec.requiredVars.join(', ') }}</b>\n              <span v-else class=\"mute\">nothing — every value is fixed by the spec</span>\n            </span>\n          </li>\n          <li>\n            <span class=\"k\">Used by</span>\n            <span class=\"v\">\n              <template v-if=\"users.length\">\n                <RouterLink\n                  v-for=\"d in users\"\n                  :key=\"d.id\"\n                  :to=\"`/deployments/${encodeURIComponent(d.id)}`\"\n                  style=\"margin-right: 10px\"\n                  >{{ d.id }}</RouterLink\n                >\n                <InfoHint label=\"why this matters\">\n                  Deleting a spec while a deployment still references it is refused: that deployment\n                  could no longer be resolved, and one that cannot be resolved can never be torn\n                  down.\n                </InfoHint>\n              </template>\n              <span v-else class=\"mute\">no deployments reference it</span>\n            </span>\n          </li>\n          <li><span class=\"k\">Created</span><span class=\"v\">{{ stamp(spec.createdAt) }}</span></li>\n          <li><span class=\"k\">Updated</span><span class=\"v\">{{ stamp(spec.updatedAt) }}</span></li>\n        </ul>\n      </section>\n\n      <section v-if=\"spec\" class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">Source</h2>\n        </div>\n\n        <!--\n          Withheld, not empty. The server never sent the source, so there is nothing here to reveal —\n          the same reasoning as the masked variables: an affordance that promises plaintext the page\n          does not have would be a lie.\n        -->\n        <div v-if=\"spec.sourceWithheld\" class=\"banner plain\">\n          <b>Hidden without an access token.</b>\n          <p>\n            A spec's hooks are shell commands, and they often carry a password or an API token\n            inline — so the server does not send the file to an unauthenticated reader.\n            <RouterLink to=\"/settings\">Add your token</RouterLink> to see it.\n          </p>\n        </div>\n        <pre v-else-if=\"spec.source\" class=\"code\">{{ spec.source }}</pre>\n        <p v-else class=\"mute\">The server returned no source for this spec.</p>\n      </section>\n    </template>\n  </div>\n</template>\n"],"names":["props","__props","spec","ref","loading","error","missing","load","r","api","problem","watch","settings","state","loadDeployments","users","computed","d","_createElementBlock","_createElementVNode","_hoisted_1","_hoisted_2","_createVNode","_component_RouterLink","_cache","_hoisted_3","_toDisplayString","_hoisted_4","_a","_hoisted_5","_openBlock","_hoisted_8","_normalizeClass","_unref","sentence","_createBlock","ErrorNote","_hoisted_9","_hoisted_10","_Fragment","_hoisted_11","SkeletonList","_hoisted_12","_hoisted_13","InfoHint","_hoisted_14","_hoisted_15","_hoisted_16","_hoisted_17","_renderList","_createTextVNode","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_23","_hoisted_24"],"mappings":"29BAoBA,MAAMA,EAAQC,EAERC,EAAOC,EAAuB,IAAI,EAClCC,EAAUD,EAAI,EAAI,EAClBE,EAAQF,EAAI,EAAE,EACdG,EAAUH,EAAI,EAAK,EAEzB,eAAeI,GAAsB,CACnCH,EAAQ,MAAQ,GAChBE,EAAQ,MAAQ,GAChB,MAAME,EAAI,MAAMC,EAAI,UAAsB,cAAc,mBAAmBT,EAAM,IAAI,CAAC,EAAE,EAExF,GADAI,EAAQ,MAAQ,GACZI,EAAE,SAAW,IAAK,CACpBF,EAAQ,MAAQ,GAChB,MACF,CACA,GAAI,CAACE,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,gBAAgB,EACzC,MACF,CACAH,EAAM,MAAQ,GACdH,EAAK,MAAQM,EAAE,IACjB,CAEAG,EAAM,IAAMX,EAAM,KAAMO,EAAM,CAAE,UAAW,GAAM,EAEjDI,EAAM,IAAMC,EAAS,MAAOL,CAAI,EAE3BM,EAAM,mBAAwBC,EAAA,EAGnC,MAAMC,EAAQC,EAAS,IAAMH,EAAM,YAAY,OAAQI,GAAMA,EAAE,WAAajB,EAAM,IAAI,CAAC,yDAIrFkB,EA4FM,MAAA,KAAA,CA3FJC,EAeM,MAfNC,EAeM,CAdJD,EAWM,MAAA,KAAA,CAVJA,EAEM,MAFNE,EAEM,CADJC,EAA4CC,EAAA,CAAhC,GAAG,UAAQ,WAAC,IAAO,CAAA,GAAAC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAP,UAAO,EAAA,CAAA,aAEjCL,EAAkD,KAAlDM,EAAkDC,EAAZzB,EAAA,IAAI,EAAA,CAAA,EAC1CkB,EAKM,MALNQ,EAKM,EAJQC,EAAA1B,EAAA,QAAA,MAAA0B,EAAM,iBAAlBV,EAA4D,OAAAW,EAAAH,EAA1BxB,EAAA,MAAK,WAAW,EAAA,CAAA,GACjCI,EAAA,OAAjBwB,EAAA,EAAAZ,EAA0C,SAAhB,WAAS,GAClBd,EAAA,OAAjB0B,IAAAZ,EAAyC,SAAf,UAAQ,QAClCA,EAA+C,OAA/Ca,EAA0B,gBAAc,EAAA,iBAG5CZ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACNjB,EAAA,WAAZgB,EAAmF,OAAA,OAAjE,MAAKc,EAAA,CAAC,QAAgB9B,EAAA,MAAK,IAAI,CAAA,CAAA,IAAK+B,EAAAC,CAAA,EAAShC,EAAA,MAAK,IAAI,CAAA,EAAA,CAAA,cAGzDG,EAAA,WAAjB8B,EAA0EC,EAAA,OAAjD,KAAM/B,EAAA,MAAO,MAAM,2BAAA,6BAE7BC,EAAA,OAAfwB,EAAA,EAAAZ,EAKU,UALVmB,EAKU,CAJRlB,EAGM,MAHNmB,EAGM,CAFJnB,EAAkC,IAAA,KAA/B,kBAAeO,EAAGzB,EAAA,IAAI,EAAG,KAAE,CAAA,EAC9BuB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA0D,SAAvD,sDAAmD,EAAA,EAAA,WAI1DD,EAgEWqB,EAAA,CAAA,IAAA,GAAA,CA/DTpB,EAwCU,UAxCVqB,EAwCU,CAvCYpC,EAAA,WAApB+B,EAAyCM,EAAA,OAAX,KAAM,CAAA,IACrBvC,EAAA,OAAf4B,IAAAZ,EAqCK,KArCLwB,EAqCK,CApCHvB,EAaK,KAAA,KAAA,CAZHA,EAOO,OAPPwB,EAOO,eAPS,UAEd,EAAA,GAAArB,EAIWsB,EAAA,CAJD,MAAM,oBAAkB,WAAC,IAInC,CAAA,GAAApB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJmC,2MAInC,EAAA,CAAA,aAEFL,EAGO,OAHP0B,GAGO,CAFI3C,EAAA,MAAK,aAAa,QAA3B4B,EAAA,EAAAZ,EAAyE,IAAA4B,GAAApB,EAAnCxB,EAAA,MAAK,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,QAC5DgB,EAA2E,OAA3E6B,GAA0B,4CAA0C,EAAA,KAGxE5B,EAmBK,KAAA,KAAA,CAlBHK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GACvBA,EAgBO,OAhBP6B,GAgBO,CAfWjC,EAAA,MAAM,YAAtBG,EAaWqB,EAAA,CAAA,IAAA,GAAA,QAZTrB,EAMCqB,EAAA,KAAAU,EALalC,EAAA,MAALE,QADTkB,EAMCZ,EAAA,CAJE,IAAKN,EAAE,GACP,GAAE,gBAAkB,mBAAmBA,EAAE,EAAE,CAAA,GAC5C,MAAA,CAAA,eAAA,MAAA,CAAA,aACC,IAAU,CAAPiC,EAAAxB,EAAAT,EAAE,EAAE,EAAA,CAAA,CAAA,6BAEVK,EAIWsB,EAAA,CAJD,MAAM,oBAAkB,WAAC,IAInC,CAAA,GAAApB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJmC,4KAInC,EAAA,CAAA,sBAEFN,EAA4D,OAA5DiC,GAA0B,6BAA2B,EAAA,KAGzDhC,EAAyF,KAAA,KAAA,CAArFK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GAAOA,EAAkD,OAAlDiC,GAAkD1B,EAA/BO,KAAM/B,EAAA,MAAK,SAAS,CAAA,EAAA,CAAA,CAAA,GACzEiB,EAAyF,KAAA,KAAA,CAArFK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GAAOA,EAAkD,OAAlDkC,GAAkD3B,EAA/BO,KAAM/B,EAAA,MAAK,SAAS,CAAA,EAAA,CAAA,CAAA,iBAI9DA,EAAA,OAAf4B,EAAA,EAAAZ,EAoBU,UApBVoC,GAoBU,eAnBRnC,EAEM,MAAA,CAFD,MAAM,SAAO,CAChBA,EAA+B,KAAA,CAA3B,MAAM,SAAA,EAAU,QAAM,CAAA,OAQjBjB,EAAA,MAAK,gBAAhB4B,IAAAZ,EAOM,MAPNqC,GAOM,CANJ/B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,EAAsC,SAAnC,kCAA+B,EAAA,GAClCA,EAII,IAAA,KAAA,iBAJD,mKAGD,EAAA,GAAAG,EAAsDC,EAAA,CAA1C,GAAG,aAAW,WAAC,IAAc,CAAA,GAAAC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAd,iBAAc,EAAA,CAAA,2BAAa,eACxD,EAAA,EAAA,MAEctB,EAAA,MAAK,QAArB4B,EAAA,EAAAZ,EAAiE,MAAjEsC,GAAiE9B,EAApBxB,EAAA,MAAK,MAAM,EAAA,CAAA,QACxDgB,EAAuE,IAAvEuC,GAAuB,8CAA4C,EAAA"}
+{"version":3,"file":"SpecDetailView-C68gpDhO.js","sources":["../../src/views/SpecDetailView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * One stored spec: what it needs, who uses it, and its source.\n *\n * THE SOURCE IS A RESTRICTED READ. Everything else on this API can be read without a token, but a\n * spec's hook bodies are shell strings that routinely carry a credential inline, so the server sends\n * `source` only to an authenticated request and sets `sourceWithheld` otherwise. That is why this\n * one view uses `getAuthed`, and why \"no token\" renders an explanation rather than an empty editor —\n * a blank box would read as an empty spec, which is a different and much more alarming fact.\n */\nimport { computed, ref, watch } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { SpecDetail } from '../api/types';\nimport { state, loadDeployments } from '../composables/useControlPlane';\nimport { settings } from '../composables/useSettings';\nimport { sentence, stamp } from '../composables/useFormat';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport InfoHint from '../components/InfoHint.vue';\n\nconst props = defineProps<{ name: string }>();\n\nconst spec = ref<SpecDetail | null>(null);\nconst loading = ref(true);\nconst error = ref('');\nconst missing = ref(false);\n\nasync function load(): Promise<void> {\n  loading.value = true;\n  missing.value = false;\n  const r = await api.getAuthed<SpecDetail>(`/api/specs/${encodeURIComponent(props.name)}`);\n  loading.value = false;\n  if (r.status === 404) {\n    missing.value = true;\n    return;\n  }\n  if (!r.ok) {\n    error.value = problem(r, 'load this spec');\n    return;\n  }\n  error.value = '';\n  spec.value = r.body;\n}\n\nwatch(() => props.name, load, { immediate: true });\n// Re-fetch when a token is pasted: the same URL returns strictly more with one.\nwatch(() => settings.token, load);\n\nif (!state.deploymentsLoaded) void loadDeployments();\n\n/** Deployments that would become unresolvable if this spec were deleted. */\nconst users = computed(() => state.deployments.filter((d) => d.specName === props.name));\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <div class=\"mute\" style=\"font-size: var(--t-sm)\">\n          <RouterLink to=\"/specs\">← specs</RouterLink>\n        </div>\n        <h1 style=\"font-size: var(--t-xl)\">{{ name }}</h1>\n        <div class=\"sub\">\n          <span v-if=\"spec?.description\">{{ spec.description }}</span>\n          <span v-else-if=\"missing\">not found</span>\n          <span v-else-if=\"loading\">loading…</span>\n          <span v-else class=\"mute\">no description</span>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <span v-if=\"spec\" class=\"badge\" :class=\"spec.kind\">{{ sentence(spec.kind) }}</span>\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Could not load this spec.\" />\n\n    <section v-if=\"missing\" class=\"panel\">\n      <div class=\"banner failed\">\n        <b>No spec named “{{ name }}”.</b>\n        <p>It may have been deleted, or this is an older link.</p>\n      </div>\n    </section>\n\n    <template v-else>\n      <section class=\"panel\">\n        <SkeletonList v-if=\"loading\" :rows=\"4\" />\n        <ul v-else-if=\"spec\" class=\"kvlist\">\n          <li>\n            <span class=\"k\">\n              Needs\n              <InfoHint label=\"what needs means\">\n                Variables the spec uses but does not set. Every deployment referencing it supplies\n                these, which is how one spec serves many stacks — and a missing one is refused by\n                name rather than filled in blank.\n              </InfoHint>\n            </span>\n            <span class=\"v\">\n              <b v-if=\"spec.requiredVars.length\">{{ spec.requiredVars.join(', ') }}</b>\n              <span v-else class=\"mute\">nothing — every value is fixed by the spec</span>\n            </span>\n          </li>\n          <li>\n            <span class=\"k\">Used by</span>\n            <span class=\"v\">\n              <template v-if=\"users.length\">\n                <RouterLink\n                  v-for=\"d in users\"\n                  :key=\"d.id\"\n                  :to=\"`/deployments/${encodeURIComponent(d.id)}`\"\n                  style=\"margin-right: 10px\"\n                  >{{ d.id }}</RouterLink\n                >\n                <InfoHint label=\"why this matters\">\n                  Deleting a spec while a deployment still references it is refused: that deployment\n                  could no longer be resolved, and one that cannot be resolved can never be torn\n                  down.\n                </InfoHint>\n              </template>\n              <span v-else class=\"mute\">no deployments reference it</span>\n            </span>\n          </li>\n          <li><span class=\"k\">Created</span><span class=\"v\">{{ stamp(spec.createdAt) }}</span></li>\n          <li><span class=\"k\">Updated</span><span class=\"v\">{{ stamp(spec.updatedAt) }}</span></li>\n        </ul>\n      </section>\n\n      <section v-if=\"spec\" class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">Source</h2>\n        </div>\n\n        <!--\n          Withheld, not empty. The server never sent the source, so there is nothing here to reveal —\n          the same reasoning as the masked variables: an affordance that promises plaintext the page\n          does not have would be a lie.\n        -->\n        <div v-if=\"spec.sourceWithheld\" class=\"banner plain\">\n          <b>Hidden without an access token.</b>\n          <p>\n            A spec's hooks are shell commands, and they often carry a password or an API token\n            inline — so the server does not send the file to an unauthenticated reader.\n            <RouterLink to=\"/settings\">Add your token</RouterLink> to see it.\n          </p>\n        </div>\n        <pre v-else-if=\"spec.source\" class=\"code\">{{ spec.source }}</pre>\n        <p v-else class=\"mute\">The server returned no source for this spec.</p>\n      </section>\n    </template>\n  </div>\n</template>\n"],"names":["props","__props","spec","ref","loading","error","missing","load","r","api","problem","watch","settings","state","loadDeployments","users","computed","d","_createElementBlock","_createElementVNode","_hoisted_1","_hoisted_2","_createVNode","_component_RouterLink","_cache","_hoisted_3","_toDisplayString","_hoisted_4","_a","_hoisted_5","_openBlock","_hoisted_8","_normalizeClass","_unref","sentence","_createBlock","ErrorNote","_hoisted_9","_hoisted_10","_Fragment","_hoisted_11","SkeletonList","_hoisted_12","_hoisted_13","InfoHint","_hoisted_14","_hoisted_15","_hoisted_16","_hoisted_17","_renderList","_createTextVNode","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_23","_hoisted_24"],"mappings":"s9BAoBA,MAAMA,EAAQC,EAERC,EAAOC,EAAuB,IAAI,EAClCC,EAAUD,EAAI,EAAI,EAClBE,EAAQF,EAAI,EAAE,EACdG,EAAUH,EAAI,EAAK,EAEzB,eAAeI,GAAsB,CACnCH,EAAQ,MAAQ,GAChBE,EAAQ,MAAQ,GAChB,MAAME,EAAI,MAAMC,EAAI,UAAsB,cAAc,mBAAmBT,EAAM,IAAI,CAAC,EAAE,EAExF,GADAI,EAAQ,MAAQ,GACZI,EAAE,SAAW,IAAK,CACpBF,EAAQ,MAAQ,GAChB,MACF,CACA,GAAI,CAACE,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,gBAAgB,EACzC,MACF,CACAH,EAAM,MAAQ,GACdH,EAAK,MAAQM,EAAE,IACjB,CAEAG,EAAM,IAAMX,EAAM,KAAMO,EAAM,CAAE,UAAW,GAAM,EAEjDI,EAAM,IAAMC,EAAS,MAAOL,CAAI,EAE3BM,EAAM,mBAAwBC,EAAA,EAGnC,MAAMC,EAAQC,EAAS,IAAMH,EAAM,YAAY,OAAQI,GAAMA,EAAE,WAAajB,EAAM,IAAI,CAAC,yDAIrFkB,EA4FM,MAAA,KAAA,CA3FJC,EAeM,MAfNC,EAeM,CAdJD,EAWM,MAAA,KAAA,CAVJA,EAEM,MAFNE,EAEM,CADJC,EAA4CC,EAAA,CAAhC,GAAG,UAAQ,WAAC,IAAO,CAAA,GAAAC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAP,UAAO,EAAA,CAAA,aAEjCL,EAAkD,KAAlDM,EAAkDC,EAAZzB,EAAA,IAAI,EAAA,CAAA,EAC1CkB,EAKM,MALNQ,EAKM,EAJQC,EAAA1B,EAAA,QAAA,MAAA0B,EAAM,iBAAlBV,EAA4D,OAAAW,EAAAH,EAA1BxB,EAAA,MAAK,WAAW,EAAA,CAAA,GACjCI,EAAA,OAAjBwB,EAAA,EAAAZ,EAA0C,SAAhB,WAAS,GAClBd,EAAA,OAAjB0B,IAAAZ,EAAyC,SAAf,UAAQ,QAClCA,EAA+C,OAA/Ca,EAA0B,gBAAc,EAAA,iBAG5CZ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACNjB,EAAA,WAAZgB,EAAmF,OAAA,OAAjE,MAAKc,EAAA,CAAC,QAAgB9B,EAAA,MAAK,IAAI,CAAA,CAAA,IAAK+B,EAAAC,CAAA,EAAShC,EAAA,MAAK,IAAI,CAAA,EAAA,CAAA,cAGzDG,EAAA,WAAjB8B,EAA0EC,EAAA,OAAjD,KAAM/B,EAAA,MAAO,MAAM,2BAAA,6BAE7BC,EAAA,OAAfwB,EAAA,EAAAZ,EAKU,UALVmB,EAKU,CAJRlB,EAGM,MAHNmB,EAGM,CAFJnB,EAAkC,IAAA,KAA/B,kBAAeO,EAAGzB,EAAA,IAAI,EAAG,KAAE,CAAA,EAC9BuB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA0D,SAAvD,sDAAmD,EAAA,EAAA,WAI1DD,EAgEWqB,EAAA,CAAA,IAAA,GAAA,CA/DTpB,EAwCU,UAxCVqB,EAwCU,CAvCYpC,EAAA,WAApB+B,EAAyCM,EAAA,OAAX,KAAM,CAAA,IACrBvC,EAAA,OAAf4B,IAAAZ,EAqCK,KArCLwB,EAqCK,CApCHvB,EAaK,KAAA,KAAA,CAZHA,EAOO,OAPPwB,EAOO,eAPS,UAEd,EAAA,GAAArB,EAIWsB,EAAA,CAJD,MAAM,oBAAkB,WAAC,IAInC,CAAA,GAAApB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJmC,2MAInC,EAAA,CAAA,aAEFL,EAGO,OAHP0B,GAGO,CAFI3C,EAAA,MAAK,aAAa,QAA3B4B,EAAA,EAAAZ,EAAyE,IAAA4B,GAAApB,EAAnCxB,EAAA,MAAK,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,QAC5DgB,EAA2E,OAA3E6B,GAA0B,4CAA0C,EAAA,KAGxE5B,EAmBK,KAAA,KAAA,CAlBHK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GACvBA,EAgBO,OAhBP6B,GAgBO,CAfWjC,EAAA,MAAM,YAAtBG,EAaWqB,EAAA,CAAA,IAAA,GAAA,QAZTrB,EAMCqB,EAAA,KAAAU,EALalC,EAAA,MAALE,QADTkB,EAMCZ,EAAA,CAJE,IAAKN,EAAE,GACP,GAAE,gBAAkB,mBAAmBA,EAAE,EAAE,CAAA,GAC5C,MAAA,CAAA,eAAA,MAAA,CAAA,aACC,IAAU,CAAPiC,EAAAxB,EAAAT,EAAE,EAAE,EAAA,CAAA,CAAA,6BAEVK,EAIWsB,EAAA,CAJD,MAAM,oBAAkB,WAAC,IAInC,CAAA,GAAApB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAJmC,4KAInC,EAAA,CAAA,sBAEFN,EAA4D,OAA5DiC,GAA0B,6BAA2B,EAAA,KAGzDhC,EAAyF,KAAA,KAAA,CAArFK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GAAOA,EAAkD,OAAlDiC,GAAkD1B,EAA/BO,KAAM/B,EAAA,MAAK,SAAS,CAAA,EAAA,CAAA,CAAA,GACzEiB,EAAyF,KAAA,KAAA,CAArFK,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,EAA8B,OAAA,CAAxB,MAAM,GAAA,EAAI,UAAO,EAAA,GAAOA,EAAkD,OAAlDkC,GAAkD3B,EAA/BO,KAAM/B,EAAA,MAAK,SAAS,CAAA,EAAA,CAAA,CAAA,iBAI9DA,EAAA,OAAf4B,EAAA,EAAAZ,EAoBU,UApBVoC,GAoBU,eAnBRnC,EAEM,MAAA,CAFD,MAAM,SAAO,CAChBA,EAA+B,KAAA,CAA3B,MAAM,SAAA,EAAU,QAAM,CAAA,OAQjBjB,EAAA,MAAK,gBAAhB4B,IAAAZ,EAOM,MAPNqC,GAOM,CANJ/B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,EAAsC,SAAnC,kCAA+B,EAAA,GAClCA,EAII,IAAA,KAAA,iBAJD,mKAGD,EAAA,GAAAG,EAAsDC,EAAA,CAA1C,GAAG,aAAW,WAAC,IAAc,CAAA,GAAAC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAd,iBAAc,EAAA,CAAA,2BAAa,eACxD,EAAA,EAAA,MAEctB,EAAA,MAAK,QAArB4B,EAAA,EAAAZ,EAAiE,MAAjEsC,GAAiE9B,EAApBxB,EAAA,MAAK,MAAM,EAAA,CAAA,QACxDgB,EAAuE,IAAvEuC,GAAuB,8CAA4C,EAAA"}

package/dist/assets/{SpecsView-D9mKql2j.js → SpecsView-mr3zSd-0.js}

@@ -1,2 +1,2 @@
-import{d as q,y as k,G as L,c as a,a as t,f as l,e as i,w as y,_ as C,x,g as f,F as N,i as U,v as T,s as $,t as r,r as p,A as B,B as E,C as V,j as D,o as s,D as z,E as A,u as R}from"./index-DVMQBHXF.js";import{s as j}from"./useFormat-DVXTfIS-.js";import{_ as F}from"./SkeletonList.vue_vue_type_script_setup_true_lang-qMyLRAMp.js";import{_ as I}from"./ErrorNote.vue_vue_type_script_setup_true_lang-B3hfwyPR.js";import{_ as M}from"./RelativeTime.vue_vue_type_script_setup_true_lang-BGissyps.js";import{E as P}from"./EquivalentCommand-C45BzkNz.js";import{_ as G}from"./RefreshButton.vue_vue_type_script_setup_true_lang-CXCY3Vlc.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";const K={class:"page-head"},W={class:"sub"},H={key:1,class:"panel"},J={key:2,class:"panel"},O={class:"field",style:{"max-width":"320px","margin-bottom":"var(--s4)"}},Q={class:"cards","data-testid":"specs.list"},X={class:"stagger"},Y={class:"name","data-label":"name"},Z={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},ee={"data-label":"kind"},te={"data-label":"needs"},se={key:0},ne={key:1,class:"mute"},oe={"data-label":"used by"},ae={key:0},le={key:1,class:"mute"},ie={class:"dim nowrap","data-label":"updated"},re={key:0},de={colspan:"5",class:"mute"},pe={key:2,class:"banner plain"},we=q({__name:"SpecsView",setup(ue){const u=p([]),v=p(!1),m=p(""),h=p(!1),c=p("");async function b(){const o=await B.get("/api/specs");if(v.value=!0,o.status===404){h.value=!0;return}if(!o.ok){m.value=E(o,"load specs");return}m.value="",u.value=o.body.specs??[]}b(),k.deploymentsLoaded||L();const _=V(()=>{const o=new Map;for(const e of k.deployments){if(!e.specName)continue;const d=o.get(e.specName)??[];d.push(e.id),o.set(e.specName,d)}return o}),w=V(()=>{const o=c.value.trim().toLowerCase();return o?u.value.filter(e=>e.name.toLowerCase().includes(o)||(e.description??"").toLowerCase().includes(o)):u.value});return(o,e)=>{const d=D("RouterLink");return s(),a("div",null,[t("div",K,[t("div",null,[e[3]||(e[3]=t("h1",null,"Specs",-1)),t("div",W,[e[2]||(e[2]=l(" Stored once, used by any number of deployments ",-1)),i(C,{label:"why store a spec"},{default:y(()=>[...e[1]||(e[1]=[l(" Without this, every deployment carries its own copy — 50 open pull requests meant 50 identical files, and fixing a teardown step meant re-submitting it 50 times. ",-1)])]),_:1})])]),e[4]||(e[4]=t("span",{class:"grow"},null,-1)),i(G,{run:b})]),m.value?(s(),x(I,{key:0,text:m.value,title:"Could not load the specs."},null,8,["text"])):f("",!0),h.value?(s(),a("section",H,[...e[5]||(e[5]=[t("div",{class:"banner plain"},[t("b",null,"This server has no stored specs."),t("p",null," It is an older build of pstack — every deployment carries its own copy of its spec, which still works. Upgrade the host to store specs and reference them by name. ")],-1)])])):(s(),a("section",J,[v.value?u.value.length?(s(),a(N,{key:1},[t("div",O,[e[6]||(e[6]=t("label",{for:"q"},"Search",-1)),U(t("input",{id:"q","onUpdate:modelValue":e[0]||(e[0]=n=>c.value=n),type:"search",placeholder:"name or description"},null,512),[[T,c.value]])]),t("table",Q,[t("thead",null,[t("tr",null,[e[9]||(e[9]=t("th",null,"Name",-1)),e[10]||(e[10]=t("th",null,"Kind",-1)),t("th",null,[e[8]||(e[8]=l(" needs ",-1)),i(C,{label:"what needs means"},{default:y(()=>[...e[7]||(e[7]=[l(" Variables the spec uses but does not set. Every deployment referencing it must supply these, which is how one spec serves many stacks. ",-1)])]),_:1})]),e[11]||(e[11]=t("th",null,"Used by",-1)),e[12]||(e[12]=t("th",null,"Updated",-1))])]),t("tbody",X,[(s(!0),a(N,null,$(w.value,(n,S)=>{var g;return s(),a("tr",{key:n.name,style:z({"--i":S})},[t("td",Y,[i(d,{to:`/specs/${encodeURIComponent(n.name)}`},{default:y(()=>[l(r(n.name),1)]),_:2},1032,["to"]),n.description?(s(),a("div",Z,r(n.description),1)):f("",!0)]),t("td",ee,[t("span",{class:A(["badge",n.kind])},r(R(j)(n.kind)),3)]),t("td",te,[n.requiredVars.length?(s(),a("span",se,r(n.requiredVars.join(", ")),1)):(s(),a("span",ne,"nothing"))]),t("td",oe,[(g=_.value.get(n.name))!=null&&g.length?(s(),a("span",ae,r(_.value.get(n.name).length)+" deployment(s) ",1)):(s(),a("span",le,"nothing yet"))]),t("td",ie,[i(M,{at:n.updatedAt},null,8,["at"])])],4)}),128)),w.value.length?f("",!0):(s(),a("tr",re,[t("td",de,"No spec matches “"+r(c.value)+"”.",1)]))])])],64)):(s(),a("div",pe,[e[16]||(e[16]=t("b",null,"No specs stored yet.",-1)),t("p",null,[e[14]||(e[14]=l(" A deployment can carry its own spec inline — see ",-1)),i(d,{to:"/submit"},{default:y(()=>[...e[13]||(e[13]=[l("Submit",-1)])]),_:1}),e[15]||(e[15]=l(" — and that is all you need for a one-off. Storing one here pays off when several deployments share it. ",-1))]),e[17]||(e[17]=t("p",{class:"mute"},"This page cannot store one yet — the command below does.",-1)),i(P,{what:"storing a spec",method:"PUT",path:"/api/specs/my-spec",body:{spec:"…the contents of your preview.yml…"},cli:"pstack validate -f preview.yml   # then PUT it with the curl above"})])):(s(),x(F,{key:0,rows:3}))]))])}}});export{we as default};
-//# sourceMappingURL=SpecsView-D9mKql2j.js.map
+import{d as q,A as k,G as L,c as a,a as t,f as l,e as i,w as y,_ as C,z as x,g as f,F as N,i as U,v as T,y as $,t as r,r as p,n as E,C as z,j as V,k as B,o as s,D,E as A,u as R}from"./index-9Ra4jfL4.js";import{s as j}from"./useFormat-DIlTY5Dl.js";import{_ as F}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js";import{_ as I}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as M}from"./RelativeTime.vue_vue_type_script_setup_true_lang-Dm9XnXF7.js";import{E as P}from"./EquivalentCommand-GFG6rkn5.js";import{_ as G}from"./RefreshButton.vue_vue_type_script_setup_true_lang-DpeOKN8U.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";const K={class:"page-head"},W={class:"sub"},H={key:1,class:"panel"},J={key:2,class:"panel"},O={class:"field",style:{"max-width":"320px","margin-bottom":"var(--s4)"}},Q={class:"cards","data-testid":"specs.list"},X={class:"stagger"},Y={class:"name","data-label":"name"},Z={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},ee={"data-label":"kind"},te={"data-label":"needs"},se={key:0},ne={key:1,class:"mute"},oe={"data-label":"used by"},ae={key:0},le={key:1,class:"mute"},ie={class:"dim nowrap","data-label":"updated"},re={key:0},de={colspan:"5",class:"mute"},pe={key:2,class:"banner plain"},we=q({__name:"SpecsView",setup(ue){const u=p([]),v=p(!1),m=p(""),h=p(!1),c=p("");async function b(){const o=await E.get("/api/specs");if(v.value=!0,o.status===404){h.value=!0;return}if(!o.ok){m.value=z(o,"load specs");return}m.value="",u.value=o.body.specs??[]}b(),k.deploymentsLoaded||L();const _=V(()=>{const o=new Map;for(const e of k.deployments){if(!e.specName)continue;const d=o.get(e.specName)??[];d.push(e.id),o.set(e.specName,d)}return o}),w=V(()=>{const o=c.value.trim().toLowerCase();return o?u.value.filter(e=>e.name.toLowerCase().includes(o)||(e.description??"").toLowerCase().includes(o)):u.value});return(o,e)=>{const d=B("RouterLink");return s(),a("div",null,[t("div",K,[t("div",null,[e[3]||(e[3]=t("h1",null,"Specs",-1)),t("div",W,[e[2]||(e[2]=l(" Stored once, used by any number of deployments ",-1)),i(C,{label:"why store a spec"},{default:y(()=>[...e[1]||(e[1]=[l(" Without this, every deployment carries its own copy — 50 open pull requests meant 50 identical files, and fixing a teardown step meant re-submitting it 50 times. ",-1)])]),_:1})])]),e[4]||(e[4]=t("span",{class:"grow"},null,-1)),i(G,{run:b})]),m.value?(s(),x(I,{key:0,text:m.value,title:"Could not load the specs."},null,8,["text"])):f("",!0),h.value?(s(),a("section",H,[...e[5]||(e[5]=[t("div",{class:"banner plain"},[t("b",null,"This server has no stored specs."),t("p",null," It is an older build of pstack — every deployment carries its own copy of its spec, which still works. Upgrade the host to store specs and reference them by name. ")],-1)])])):(s(),a("section",J,[v.value?u.value.length?(s(),a(N,{key:1},[t("div",O,[e[6]||(e[6]=t("label",{for:"q"},"Search",-1)),U(t("input",{id:"q","onUpdate:modelValue":e[0]||(e[0]=n=>c.value=n),type:"search",placeholder:"name or description"},null,512),[[T,c.value]])]),t("table",Q,[t("thead",null,[t("tr",null,[e[9]||(e[9]=t("th",null,"Name",-1)),e[10]||(e[10]=t("th",null,"Kind",-1)),t("th",null,[e[8]||(e[8]=l(" needs ",-1)),i(C,{label:"what needs means"},{default:y(()=>[...e[7]||(e[7]=[l(" Variables the spec uses but does not set. Every deployment referencing it must supply these, which is how one spec serves many stacks. ",-1)])]),_:1})]),e[11]||(e[11]=t("th",null,"Used by",-1)),e[12]||(e[12]=t("th",null,"Updated",-1))])]),t("tbody",X,[(s(!0),a(N,null,$(w.value,(n,S)=>{var g;return s(),a("tr",{key:n.name,style:D({"--i":S})},[t("td",Y,[i(d,{to:`/specs/${encodeURIComponent(n.name)}`},{default:y(()=>[l(r(n.name),1)]),_:2},1032,["to"]),n.description?(s(),a("div",Z,r(n.description),1)):f("",!0)]),t("td",ee,[t("span",{class:A(["badge",n.kind])},r(R(j)(n.kind)),3)]),t("td",te,[n.requiredVars.length?(s(),a("span",se,r(n.requiredVars.join(", ")),1)):(s(),a("span",ne,"nothing"))]),t("td",oe,[(g=_.value.get(n.name))!=null&&g.length?(s(),a("span",ae,r(_.value.get(n.name).length)+" deployment(s) ",1)):(s(),a("span",le,"nothing yet"))]),t("td",ie,[i(M,{at:n.updatedAt},null,8,["at"])])],4)}),128)),w.value.length?f("",!0):(s(),a("tr",re,[t("td",de,"No spec matches “"+r(c.value)+"”.",1)]))])])],64)):(s(),a("div",pe,[e[16]||(e[16]=t("b",null,"No specs stored yet.",-1)),t("p",null,[e[14]||(e[14]=l(" A deployment can carry its own spec inline — see ",-1)),i(d,{to:"/submit"},{default:y(()=>[...e[13]||(e[13]=[l("Submit",-1)])]),_:1}),e[15]||(e[15]=l(" — and that is all you need for a one-off. Storing one here pays off when several deployments share it. ",-1))]),e[17]||(e[17]=t("p",{class:"mute"},"This page cannot store one yet — the command below does.",-1)),i(P,{what:"storing a spec",method:"PUT",path:"/api/specs/my-spec",body:{spec:"…the contents of your preview.yml…"},cli:"pstack validate -f preview.yml   # then PUT it with the curl above"})])):(s(),x(F,{key:0,rows:3}))]))])}}});export{we as default};
+//# sourceMappingURL=SpecsView-mr3zSd-0.js.map

package/dist/assets/{SpecsView-D9mKql2j.js.map → SpecsView-mr3zSd-0.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SpecsView-D9mKql2j.js","sources":["../../src/views/SpecsView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Stored specs: what is on this host, and who is using each one.\n *\n * The \"used by\" count is computed from the deployments already in shared state rather than asked\n * for: every row carries `specName`, so the join is free. It matters because deleting a spec that\n * deployments still reference is refused — a deployment that cannot resolve its spec can never be\n * torn down — so knowing the count before you try is the difference between a plan and a 409.\n *\n * A server built before named specs answers 404 here. That is a capability difference, not an\n * error, so it gets its own explanation instead of a red banner.\n */\nimport { computed, ref } from 'vue';\nimport { sentence } from '../composables/useFormat';\nimport { api, problem } from '../api/client';\nimport type { SpecMeta, SpecsResponse } from '../api/types';\nimport { state, loadDeployments } from '../composables/useControlPlane';\n\nimport SkeletonList from '../components/SkeletonList.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport EquivalentCommand from '../components/EquivalentCommand.vue';\nimport RefreshButton from '../components/RefreshButton.vue';\n\nconst specs = ref<SpecMeta[]>([]);\nconst loaded = ref(false);\nconst error = ref('');\nconst unsupported = ref(false);\nconst needle = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SpecsResponse>('/api/specs');\n  loaded.value = true;\n  if (r.status === 404) {\n    unsupported.value = true;\n    return;\n  }\n  if (!r.ok) {\n    error.value = problem(r, 'load specs');\n    return;\n  }\n  error.value = '';\n  specs.value = r.body.specs ?? [];\n}\n\nvoid load();\n// The deployment list is what the \"used by\" column joins against; a deep link straight here may\n// arrive before the shell's poll has filled it.\nif (!state.deploymentsLoaded) void loadDeployments();\n\n/** Deployment ids referencing each spec, by spec name. */\nconst users = computed(() => {\n  const m = new Map<string, string[]>();\n  for (const d of state.deployments) {\n    if (!d.specName) continue;\n    const list = m.get(d.specName) ?? [];\n    list.push(d.id);\n    m.set(d.specName, list);\n  }\n  return m;\n});\n\nconst shown = computed(() => {\n  const q = needle.value.trim().toLowerCase();\n  if (!q) return specs.value;\n  return specs.value.filter(\n    (s) => s.name.toLowerCase().includes(q) || (s.description ?? '').toLowerCase().includes(q),\n  );\n});\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Specs</h1>\n        <div class=\"sub\">\n          Stored once, used by any number of deployments\n          <InfoHint label=\"why store a spec\">\n            Without this, every deployment carries its own copy — 50 open pull requests meant 50\n            identical files, and fixing a teardown step meant re-submitting it 50 times.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <RefreshButton :run=\"load\" />\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Could not load the specs.\" />\n\n    <section v-if=\"unsupported\" class=\"panel\">\n      <div class=\"banner plain\">\n        <b>This server has no stored specs.</b>\n        <p>\n          It is an older build of pstack — every deployment carries its own copy of its spec, which\n          still works. Upgrade the host to store specs and reference them by name.\n        </p>\n      </div>\n    </section>\n\n    <section v-else class=\"panel\">\n      <SkeletonList v-if=\"!loaded\" :rows=\"3\" />\n\n      <template v-else-if=\"specs.length\">\n        <div class=\"field\" style=\"max-width: 320px; margin-bottom: var(--s4)\">\n          <label for=\"q\">Search</label>\n          <input id=\"q\" v-model=\"needle\" type=\"search\" placeholder=\"name or description\" />\n        </div>\n\n        <table class=\"cards\" data-testid=\"specs.list\">\n          <thead>\n            <tr>\n              <th>Name</th>\n              <th>Kind</th>\n              <th>\n                needs\n                <InfoHint label=\"what needs means\">\n                  Variables the spec uses but does not set. Every deployment referencing it must\n                  supply these, which is how one spec serves many stacks.\n                </InfoHint>\n              </th>\n              <th>Used by</th>\n              <th>Updated</th>\n            </tr>\n          </thead>\n          <tbody class=\"stagger\">\n            <tr v-for=\"(s, i) in shown\" :key=\"s.name\" :style=\"{ '--i': i }\">\n              <td class=\"name\" data-label=\"name\">\n                <RouterLink :to=\"`/specs/${encodeURIComponent(s.name)}`\">{{ s.name }}</RouterLink>\n                <div v-if=\"s.description\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n                  {{ s.description }}\n                </div>\n              </td>\n              <td data-label=\"kind\">\n                <span class=\"badge\" :class=\"s.kind\">{{ sentence(s.kind) }}</span>\n              </td>\n              <td data-label=\"needs\">\n                <span v-if=\"s.requiredVars.length\">{{ s.requiredVars.join(', ') }}</span>\n                <span v-else class=\"mute\">nothing</span>\n              </td>\n              <td data-label=\"used by\">\n                <span v-if=\"users.get(s.name)?.length\">\n                  {{ users.get(s.name)!.length }} deployment(s)\n                </span>\n                <span v-else class=\"mute\">nothing yet</span>\n              </td>\n              <td class=\"dim nowrap\" data-label=\"updated\"><RelativeTime :at=\"s.updatedAt\" /></td>\n            </tr>\n            <tr v-if=\"!shown.length\">\n              <td colspan=\"5\" class=\"mute\">No spec matches “{{ needle }}”.</td>\n            </tr>\n          </tbody>\n        </table>\n      </template>\n\n      <!--\n        Honest empty state. This page cannot create a spec yet, so pointing at \"New spec\" would be a\n        dead end — it names the way that does work instead.\n      -->\n      <div v-else class=\"banner plain\">\n        <b>No specs stored yet.</b>\n        <p>\n          A deployment can carry its own spec inline — see\n          <RouterLink to=\"/submit\">Submit</RouterLink> — and that is all you need for a one-off.\n          Storing one here pays off when several deployments share it.\n        </p>\n        <p class=\"mute\">This page cannot store one yet — the command below does.</p>\n        <EquivalentCommand\n          what=\"storing a spec\"\n          method=\"PUT\"\n          path=\"/api/specs/my-spec\"\n          :body=\"{ spec: '…the contents of your preview.yml…' }\"\n          cli=\"pstack validate -f preview.yml   # then PUT it with the curl above\"\n        />\n      </div>\n    </section>\n  </div>\n</template>\n"],"names":["specs","ref","loaded","error","unsupported","needle","load","r","api","problem","state","loadDeployments","users","computed","m","d","list","shown","q","s","_createElementBlock","_createElementVNode","_hoisted_1","_cache","_hoisted_2","_createVNode","InfoHint","RefreshButton","_createBlock","ErrorNote","_openBlock","_hoisted_3","_hoisted_4","_Fragment","_hoisted_5","$event","_hoisted_6","_hoisted_7","_renderList","i","_hoisted_8","_component_RouterLink","_createTextVNode","_toDisplayString","_hoisted_9","_hoisted_10","_normalizeClass","_unref","sentence","_hoisted_11","_hoisted_12","_hoisted_13","_hoisted_14","_a","_hoisted_15","_hoisted_16","_hoisted_17","RelativeTime","_hoisted_18","_hoisted_19","_hoisted_20","EquivalentCommand","SkeletonList"],"mappings":"0xCAyBA,MAAMA,EAAQC,EAAgB,EAAE,EAC1BC,EAASD,EAAI,EAAK,EAClBE,EAAQF,EAAI,EAAE,EACdG,EAAcH,EAAI,EAAK,EACvBI,EAASJ,EAAI,EAAE,EAErB,eAAeK,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAmB,YAAY,EAEnD,GADAN,EAAO,MAAQ,GACXK,EAAE,SAAW,IAAK,CACpBH,EAAY,MAAQ,GACpB,MACF,CACA,GAAI,CAACG,EAAE,GAAI,CACTJ,EAAM,MAAQM,EAAQF,EAAG,YAAY,EACrC,MACF,CACAJ,EAAM,MAAQ,GACdH,EAAM,MAAQO,EAAE,KAAK,OAAS,CAAA,CAChC,CAEKD,EAAA,EAGAI,EAAM,mBAAwBC,EAAA,EAGnC,MAAMC,EAAQC,EAAS,IAAM,CAC3B,MAAMC,MAAQ,IACd,UAAWC,KAAKL,EAAM,YAAa,CACjC,GAAI,CAACK,EAAE,SAAU,SACjB,MAAMC,EAAOF,EAAE,IAAIC,EAAE,QAAQ,GAAK,CAAA,EAClCC,EAAK,KAAKD,EAAE,EAAE,EACdD,EAAE,IAAIC,EAAE,SAAUC,CAAI,CACxB,CACA,OAAOF,CACT,CAAC,EAEKG,EAAQJ,EAAS,IAAM,CAC3B,MAAMK,EAAIb,EAAO,MAAM,KAAA,EAAO,YAAA,EAC9B,OAAKa,EACElB,EAAM,MAAM,OAChBmB,GAAMA,EAAE,KAAK,cAAc,SAASD,CAAC,IAAMC,EAAE,aAAe,IAAI,YAAA,EAAc,SAASD,CAAC,CAAA,EAF5ElB,EAAM,KAIvB,CAAC,mDAICoB,EAwGM,MAAA,KAAA,CAvGJC,EAaM,MAbNC,EAaM,CAZJD,EASM,MAAA,KAAA,CARJE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAc,UAAV,QAAK,EAAA,GACTA,EAMM,MANNG,EAMM,eANW,mDAEf,EAAA,GAAAC,EAGWC,EAAA,CAHD,MAAM,oBAAkB,WAAC,IAGnC,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAHmC,sKAGnC,EAAA,CAAA,2BAGJF,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBI,EAA6BE,EAAA,CAAb,IAAKrB,EAAI,CAAA,GAGVH,EAAA,WAAjByB,EAA0EC,EAAA,OAAjD,KAAM1B,EAAA,MAAO,MAAM,2BAAA,6BAE7BC,EAAA,OAAf0B,IAAAV,EAQU,UARVW,EAQU,CAAA,GAAAR,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,CAPRF,EAMM,MAAA,CAND,MAAM,gBAAc,CACvBA,EAAuC,SAApC,kCAAgC,EACnCA,EAGI,SAHD,sKAGH,CAAA,YAIJS,IAAAV,EA2EU,UA3EVY,EA2EU,CA1Ea9B,EAAA,MAEAF,EAAA,MAAM,YAA3BoB,EAkDWa,EAAA,CAAA,IAAA,GAAA,CAjDTZ,EAGM,MAHNa,EAGM,CAFJX,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAA6B,QAAA,CAAtB,IAAI,GAAA,EAAI,SAAM,EAAA,KACrBA,EAAiF,QAAA,CAA1E,GAAG,yCAAahB,EAAM,MAAA8B,GAAE,KAAK,SAAS,YAAY,qBAAA,gBAAlC9B,EAAA,KAAM,CAAA,KAG/BgB,EA2CQ,QA3CRe,EA2CQ,CA1CNf,EAcQ,QAAA,KAAA,CAbNA,EAYK,KAAA,KAAA,CAXHE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAa,UAAT,OAAI,EAAA,GACRE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAa,UAAT,OAAI,EAAA,GACRA,EAMK,KAAA,KAAA,eAND,UAEF,EAAA,GAAAI,EAGWC,EAAA,CAHD,MAAM,oBAAkB,WAAC,IAGnC,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAHmC,2IAGnC,EAAA,CAAA,aAEFA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgB,UAAZ,UAAO,EAAA,GACXE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgB,UAAZ,UAAO,EAAA,EAAA,KAGfA,EA0BQ,QA1BRgB,EA0BQ,EAzBNP,EAAA,EAAA,EAAAV,EAqBKa,EAAA,KAAAK,EArBgBrB,EAAA,MAAK,CAAdE,EAAGoB,IAAC,kBAAhBnB,EAqBK,KAAA,CArBwB,IAAKD,EAAE,KAAO,eAAgBoB,EAAC,CAAA,GAC1DlB,EAKK,KALLmB,EAKK,CAJHf,EAAkFgB,EAAA,CAArE,GAAE,UAAY,mBAAmBtB,EAAE,IAAI,CAAA,EAAA,aAAK,IAAY,CAATuB,EAAAC,EAAAxB,EAAE,IAAI,EAAA,CAAA,CAAA,qBACvDA,EAAE,aAAbW,EAAA,EAAAV,EAEM,MAFNwB,EAEMD,EADDxB,EAAE,WAAW,EAAA,CAAA,cAGpBE,EAEK,KAFLwB,GAEK,CADHxB,EAAiE,OAAA,CAA3D,MAAKyB,EAAA,CAAC,QAAgB3B,EAAE,IAAI,CAAA,CAAA,IAAK4B,EAAAC,CAAA,EAAS7B,EAAE,IAAI,CAAA,EAAA,CAAA,CAAA,GAExDE,EAGK,KAHL4B,GAGK,CAFS9B,EAAE,aAAa,QAA3BW,EAAA,EAAAV,EAAyE,OAAA8B,GAAAP,EAAnCxB,EAAE,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,QACzDC,EAAwC,OAAxC+B,GAA0B,SAAO,EAAA,GAEnC9B,EAKK,KALL+B,GAKK,EAJSC,EAAAzC,EAAA,MAAM,IAAIO,EAAE,IAAI,IAAhB,MAAAkC,EAAmB,YAA/BjC,EAEO,OAAAkC,GAAAX,EADF/B,EAAA,MAAM,IAAIO,EAAE,IAAI,EAAG,MAAM,EAAG,kBACjC,CAAA,QACAC,EAA4C,OAA5CmC,GAA0B,aAAW,EAAA,GAEvClC,EAAmF,KAAnFmC,GAAmF,CAAvC/B,EAAkCgC,EAAA,CAAnB,GAAItC,EAAE,SAAA,+BAExDF,EAAA,MAAM,qBAAjBG,EAEK,KAAAsC,GAAA,CADHrC,EAAiE,KAAjEsC,GAA6B,oBAAiBhB,EAAGtC,EAAA,KAAM,EAAG,KAAE,CAAA,CAAA,eAUpEyB,IAAAV,EAeM,MAfNwC,GAeM,CAdJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAA2B,SAAxB,uBAAoB,EAAA,GACvBA,EAII,IAAA,KAAA,iBAJD,qDAED,EAAA,GAAAI,EAA4CgB,EAAA,CAAhC,GAAG,WAAS,WAAC,IAAM,CAAA,GAAAlB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAN,SAAM,EAAA,CAAA,2BAAa,2GAE9C,EAAA,EAAA,GACAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAA4E,IAAA,CAAzE,MAAM,MAAA,EAAO,2DAAwD,EAAA,GACxEI,EAMEoC,EAAA,CALA,KAAK,iBACL,OAAO,MACP,KAAK,qBACJ,KAAM,CAAA,KAAA,oCAAA,EACP,IAAI,oEAAA,WAvERjC,EAAyCkC,EAAA,OAAX,KAAM,CAAA"}
+{"version":3,"file":"SpecsView-mr3zSd-0.js","sources":["../../src/views/SpecsView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Stored specs: what is on this host, and who is using each one.\n *\n * The \"used by\" count is computed from the deployments already in shared state rather than asked\n * for: every row carries `specName`, so the join is free. It matters because deleting a spec that\n * deployments still reference is refused — a deployment that cannot resolve its spec can never be\n * torn down — so knowing the count before you try is the difference between a plan and a 409.\n *\n * A server built before named specs answers 404 here. That is a capability difference, not an\n * error, so it gets its own explanation instead of a red banner.\n */\nimport { computed, ref } from 'vue';\nimport { sentence } from '../composables/useFormat';\nimport { api, problem } from '../api/client';\nimport type { SpecMeta, SpecsResponse } from '../api/types';\nimport { state, loadDeployments } from '../composables/useControlPlane';\n\nimport SkeletonList from '../components/SkeletonList.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport EquivalentCommand from '../components/EquivalentCommand.vue';\nimport RefreshButton from '../components/RefreshButton.vue';\n\nconst specs = ref<SpecMeta[]>([]);\nconst loaded = ref(false);\nconst error = ref('');\nconst unsupported = ref(false);\nconst needle = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SpecsResponse>('/api/specs');\n  loaded.value = true;\n  if (r.status === 404) {\n    unsupported.value = true;\n    return;\n  }\n  if (!r.ok) {\n    error.value = problem(r, 'load specs');\n    return;\n  }\n  error.value = '';\n  specs.value = r.body.specs ?? [];\n}\n\nvoid load();\n// The deployment list is what the \"used by\" column joins against; a deep link straight here may\n// arrive before the shell's poll has filled it.\nif (!state.deploymentsLoaded) void loadDeployments();\n\n/** Deployment ids referencing each spec, by spec name. */\nconst users = computed(() => {\n  const m = new Map<string, string[]>();\n  for (const d of state.deployments) {\n    if (!d.specName) continue;\n    const list = m.get(d.specName) ?? [];\n    list.push(d.id);\n    m.set(d.specName, list);\n  }\n  return m;\n});\n\nconst shown = computed(() => {\n  const q = needle.value.trim().toLowerCase();\n  if (!q) return specs.value;\n  return specs.value.filter(\n    (s) => s.name.toLowerCase().includes(q) || (s.description ?? '').toLowerCase().includes(q),\n  );\n});\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Specs</h1>\n        <div class=\"sub\">\n          Stored once, used by any number of deployments\n          <InfoHint label=\"why store a spec\">\n            Without this, every deployment carries its own copy — 50 open pull requests meant 50\n            identical files, and fixing a teardown step meant re-submitting it 50 times.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <RefreshButton :run=\"load\" />\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Could not load the specs.\" />\n\n    <section v-if=\"unsupported\" class=\"panel\">\n      <div class=\"banner plain\">\n        <b>This server has no stored specs.</b>\n        <p>\n          It is an older build of pstack — every deployment carries its own copy of its spec, which\n          still works. Upgrade the host to store specs and reference them by name.\n        </p>\n      </div>\n    </section>\n\n    <section v-else class=\"panel\">\n      <SkeletonList v-if=\"!loaded\" :rows=\"3\" />\n\n      <template v-else-if=\"specs.length\">\n        <div class=\"field\" style=\"max-width: 320px; margin-bottom: var(--s4)\">\n          <label for=\"q\">Search</label>\n          <input id=\"q\" v-model=\"needle\" type=\"search\" placeholder=\"name or description\" />\n        </div>\n\n        <table class=\"cards\" data-testid=\"specs.list\">\n          <thead>\n            <tr>\n              <th>Name</th>\n              <th>Kind</th>\n              <th>\n                needs\n                <InfoHint label=\"what needs means\">\n                  Variables the spec uses but does not set. Every deployment referencing it must\n                  supply these, which is how one spec serves many stacks.\n                </InfoHint>\n              </th>\n              <th>Used by</th>\n              <th>Updated</th>\n            </tr>\n          </thead>\n          <tbody class=\"stagger\">\n            <tr v-for=\"(s, i) in shown\" :key=\"s.name\" :style=\"{ '--i': i }\">\n              <td class=\"name\" data-label=\"name\">\n                <RouterLink :to=\"`/specs/${encodeURIComponent(s.name)}`\">{{ s.name }}</RouterLink>\n                <div v-if=\"s.description\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n                  {{ s.description }}\n                </div>\n              </td>\n              <td data-label=\"kind\">\n                <span class=\"badge\" :class=\"s.kind\">{{ sentence(s.kind) }}</span>\n              </td>\n              <td data-label=\"needs\">\n                <span v-if=\"s.requiredVars.length\">{{ s.requiredVars.join(', ') }}</span>\n                <span v-else class=\"mute\">nothing</span>\n              </td>\n              <td data-label=\"used by\">\n                <span v-if=\"users.get(s.name)?.length\">\n                  {{ users.get(s.name)!.length }} deployment(s)\n                </span>\n                <span v-else class=\"mute\">nothing yet</span>\n              </td>\n              <td class=\"dim nowrap\" data-label=\"updated\"><RelativeTime :at=\"s.updatedAt\" /></td>\n            </tr>\n            <tr v-if=\"!shown.length\">\n              <td colspan=\"5\" class=\"mute\">No spec matches “{{ needle }}”.</td>\n            </tr>\n          </tbody>\n        </table>\n      </template>\n\n      <!--\n        Honest empty state. This page cannot create a spec yet, so pointing at \"New spec\" would be a\n        dead end — it names the way that does work instead.\n      -->\n      <div v-else class=\"banner plain\">\n        <b>No specs stored yet.</b>\n        <p>\n          A deployment can carry its own spec inline — see\n          <RouterLink to=\"/submit\">Submit</RouterLink> — and that is all you need for a one-off.\n          Storing one here pays off when several deployments share it.\n        </p>\n        <p class=\"mute\">This page cannot store one yet — the command below does.</p>\n        <EquivalentCommand\n          what=\"storing a spec\"\n          method=\"PUT\"\n          path=\"/api/specs/my-spec\"\n          :body=\"{ spec: '…the contents of your preview.yml…' }\"\n          cli=\"pstack validate -f preview.yml   # then PUT it with the curl above\"\n        />\n      </div>\n    </section>\n  </div>\n</template>\n"],"names":["specs","ref","loaded","error","unsupported","needle","load","r","api","problem","state","loadDeployments","users","computed","m","d","list","shown","q","s","_createElementBlock","_createElementVNode","_hoisted_1","_cache","_hoisted_2","_createVNode","InfoHint","RefreshButton","_createBlock","ErrorNote","_openBlock","_hoisted_3","_hoisted_4","_Fragment","_hoisted_5","$event","_hoisted_6","_hoisted_7","_renderList","i","_hoisted_8","_component_RouterLink","_createTextVNode","_toDisplayString","_hoisted_9","_hoisted_10","_normalizeClass","_unref","sentence","_hoisted_11","_hoisted_12","_hoisted_13","_hoisted_14","_a","_hoisted_15","_hoisted_16","_hoisted_17","RelativeTime","_hoisted_18","_hoisted_19","_hoisted_20","EquivalentCommand","SkeletonList"],"mappings":"0xCAyBA,MAAMA,EAAQC,EAAgB,EAAE,EAC1BC,EAASD,EAAI,EAAK,EAClBE,EAAQF,EAAI,EAAE,EACdG,EAAcH,EAAI,EAAK,EACvBI,EAASJ,EAAI,EAAE,EAErB,eAAeK,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAmB,YAAY,EAEnD,GADAN,EAAO,MAAQ,GACXK,EAAE,SAAW,IAAK,CACpBH,EAAY,MAAQ,GACpB,MACF,CACA,GAAI,CAACG,EAAE,GAAI,CACTJ,EAAM,MAAQM,EAAQF,EAAG,YAAY,EACrC,MACF,CACAJ,EAAM,MAAQ,GACdH,EAAM,MAAQO,EAAE,KAAK,OAAS,CAAA,CAChC,CAEKD,EAAA,EAGAI,EAAM,mBAAwBC,EAAA,EAGnC,MAAMC,EAAQC,EAAS,IAAM,CAC3B,MAAMC,MAAQ,IACd,UAAWC,KAAKL,EAAM,YAAa,CACjC,GAAI,CAACK,EAAE,SAAU,SACjB,MAAMC,EAAOF,EAAE,IAAIC,EAAE,QAAQ,GAAK,CAAA,EAClCC,EAAK,KAAKD,EAAE,EAAE,EACdD,EAAE,IAAIC,EAAE,SAAUC,CAAI,CACxB,CACA,OAAOF,CACT,CAAC,EAEKG,EAAQJ,EAAS,IAAM,CAC3B,MAAMK,EAAIb,EAAO,MAAM,KAAA,EAAO,YAAA,EAC9B,OAAKa,EACElB,EAAM,MAAM,OAChBmB,GAAMA,EAAE,KAAK,cAAc,SAASD,CAAC,IAAMC,EAAE,aAAe,IAAI,YAAA,EAAc,SAASD,CAAC,CAAA,EAF5ElB,EAAM,KAIvB,CAAC,mDAICoB,EAwGM,MAAA,KAAA,CAvGJC,EAaM,MAbNC,EAaM,CAZJD,EASM,MAAA,KAAA,CARJE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAc,UAAV,QAAK,EAAA,GACTA,EAMM,MANNG,EAMM,eANW,mDAEf,EAAA,GAAAC,EAGWC,EAAA,CAHD,MAAM,oBAAkB,WAAC,IAGnC,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAHmC,sKAGnC,EAAA,CAAA,2BAGJF,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBI,EAA6BE,EAAA,CAAb,IAAKrB,EAAI,CAAA,GAGVH,EAAA,WAAjByB,EAA0EC,EAAA,OAAjD,KAAM1B,EAAA,MAAO,MAAM,2BAAA,6BAE7BC,EAAA,OAAf0B,IAAAV,EAQU,UARVW,EAQU,CAAA,GAAAR,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,CAPRF,EAMM,MAAA,CAND,MAAM,gBAAc,CACvBA,EAAuC,SAApC,kCAAgC,EACnCA,EAGI,SAHD,sKAGH,CAAA,YAIJS,IAAAV,EA2EU,UA3EVY,EA2EU,CA1Ea9B,EAAA,MAEAF,EAAA,MAAM,YAA3BoB,EAkDWa,EAAA,CAAA,IAAA,GAAA,CAjDTZ,EAGM,MAHNa,EAGM,CAFJX,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAA6B,QAAA,CAAtB,IAAI,GAAA,EAAI,SAAM,EAAA,KACrBA,EAAiF,QAAA,CAA1E,GAAG,yCAAahB,EAAM,MAAA8B,GAAE,KAAK,SAAS,YAAY,qBAAA,gBAAlC9B,EAAA,KAAM,CAAA,KAG/BgB,EA2CQ,QA3CRe,EA2CQ,CA1CNf,EAcQ,QAAA,KAAA,CAbNA,EAYK,KAAA,KAAA,CAXHE,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAF,EAAa,UAAT,OAAI,EAAA,GACRE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAa,UAAT,OAAI,EAAA,GACRA,EAMK,KAAA,KAAA,eAND,UAEF,EAAA,GAAAI,EAGWC,EAAA,CAHD,MAAM,oBAAkB,WAAC,IAGnC,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAHmC,2IAGnC,EAAA,CAAA,aAEFA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgB,UAAZ,UAAO,EAAA,GACXE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAAgB,UAAZ,UAAO,EAAA,EAAA,KAGfA,EA0BQ,QA1BRgB,EA0BQ,EAzBNP,EAAA,EAAA,EAAAV,EAqBKa,EAAA,KAAAK,EArBgBrB,EAAA,MAAK,CAAdE,EAAGoB,IAAC,kBAAhBnB,EAqBK,KAAA,CArBwB,IAAKD,EAAE,KAAO,eAAgBoB,EAAC,CAAA,GAC1DlB,EAKK,KALLmB,EAKK,CAJHf,EAAkFgB,EAAA,CAArE,GAAE,UAAY,mBAAmBtB,EAAE,IAAI,CAAA,EAAA,aAAK,IAAY,CAATuB,EAAAC,EAAAxB,EAAE,IAAI,EAAA,CAAA,CAAA,qBACvDA,EAAE,aAAbW,EAAA,EAAAV,EAEM,MAFNwB,EAEMD,EADDxB,EAAE,WAAW,EAAA,CAAA,cAGpBE,EAEK,KAFLwB,GAEK,CADHxB,EAAiE,OAAA,CAA3D,MAAKyB,EAAA,CAAC,QAAgB3B,EAAE,IAAI,CAAA,CAAA,IAAK4B,EAAAC,CAAA,EAAS7B,EAAE,IAAI,CAAA,EAAA,CAAA,CAAA,GAExDE,EAGK,KAHL4B,GAGK,CAFS9B,EAAE,aAAa,QAA3BW,EAAA,EAAAV,EAAyE,OAAA8B,GAAAP,EAAnCxB,EAAE,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,QACzDC,EAAwC,OAAxC+B,GAA0B,SAAO,EAAA,GAEnC9B,EAKK,KALL+B,GAKK,EAJSC,EAAAzC,EAAA,MAAM,IAAIO,EAAE,IAAI,IAAhB,MAAAkC,EAAmB,YAA/BjC,EAEO,OAAAkC,GAAAX,EADF/B,EAAA,MAAM,IAAIO,EAAE,IAAI,EAAG,MAAM,EAAG,kBACjC,CAAA,QACAC,EAA4C,OAA5CmC,GAA0B,aAAW,EAAA,GAEvClC,EAAmF,KAAnFmC,GAAmF,CAAvC/B,EAAkCgC,EAAA,CAAnB,GAAItC,EAAE,SAAA,+BAExDF,EAAA,MAAM,qBAAjBG,EAEK,KAAAsC,GAAA,CADHrC,EAAiE,KAAjEsC,GAA6B,oBAAiBhB,EAAGtC,EAAA,KAAM,EAAG,KAAE,CAAA,CAAA,eAUpEyB,IAAAV,EAeM,MAfNwC,GAeM,CAdJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAA2B,SAAxB,uBAAoB,EAAA,GACvBA,EAII,IAAA,KAAA,iBAJD,qDAED,EAAA,GAAAI,EAA4CgB,EAAA,CAAhC,GAAG,WAAS,WAAC,IAAM,CAAA,GAAAlB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAN,SAAM,EAAA,CAAA,2BAAa,2GAE9C,EAAA,EAAA,GACAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAF,EAA4E,IAAA,CAAzE,MAAM,MAAA,EAAO,2DAAwD,EAAA,GACxEI,EAMEoC,EAAA,CALA,KAAK,iBACL,OAAO,MACP,KAAK,qBACJ,KAAM,CAAA,KAAA,oCAAA,EACP,IAAI,oEAAA,WAvERjC,EAAyCkC,EAAA,OAAX,KAAM,CAAA"}

package/dist/assets/SsoView-D2yf-noE.js

@@ -0,0 +1,2 @@
+import{d as B,c as d,a as s,f as a,e as f,w as y,_ as O,z as C,g as p,F as V,t as k,i,I as N,v as r,y as H,r as u,n as S,C as R,O as w,j as W,o as n}from"./index-9Ra4jfL4.js";import{_ as z}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as G}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as P}from"./HelpModal.vue_vue_type_script_setup_true_lang-DEjnzS2A.js";import{_ as E}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BLfPhhAj.js";import{_ as F}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js";import"./Teleport-BUn4ayOo.js";const Y={class:"page-head"},K={class:"sub"},q={class:"panel"},J={class:"row",style:{gap:"var(--s3)","align-items":"center"}},Q={class:"code",style:{flex:"1","overflow-x":"auto","white-space":"nowrap"}},X={class:"panel"},Z={class:"phead"},ee={class:"check"},se={class:"row",style:{gap:"var(--s4)","flex-wrap":"wrap"}},le={class:"field inline"},oe={key:0,class:"field inline"},te={class:"field inline"},ae={key:0,class:"hint"},ie={key:1,class:"field"},ne={class:"field"},re={class:"field"},de={class:"hint"},ue={class:"field"},pe={class:"field"},ve={class:"field"},me={class:"field"},ce={class:"field"},fe=["placeholder"],he={key:3},ye={class:"section",style:{"margin-top":"var(--s4)"}},be={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},ge=["for"],ke=["id","onUpdate:modelValue"],we={class:"panel"},Ue={class:"field"},xe={class:"row",style:{gap:"var(--s3)"}},Ie={key:0,class:"mute",style:{"font-size":"var(--t-sm)","margin-top":"var(--s3)"}},Ee=B({__name:"SsoView",setup(Ce){const A={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},U=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"github",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",scopes:"",claimMap:{...A},allowedEmailDomains:[],defaultRole:"admin"}),l=u(U()),m=u(""),h=u(""),b=u([]),x=u(""),c=u(!1),L=u(!1),v=u(""),g=u(!1);async function I(){const t=await S.get("/api/sso/config");if(L.value=!0,!t.ok){v.value=R(t,"read the sign-on settings");return}v.value="",b.value=t.body.presets??[],x.value=t.body.callbackUrl,c.value=t.body.configured,t.body.config&&(l.value={...U(),...t.body.config},h.value=(t.body.config.allowedEmailDomains??[]).join(", ")),m.value=t.body.clientSecret}I();function T(t){l.value.provider=t;const e=b.value.find(o=>o.key===t);if(!e){l.value.authorizeUrl="",l.value.tokenUrl="",l.value.userInfoUrl="",l.value.emailsUrl="",l.value.claimMap={...A};return}l.value.authorizeUrl=e.authorizeUrl,l.value.tokenUrl=e.tokenUrl,l.value.userInfoUrl=e.userInfoUrl??"",l.value.emailsUrl="",l.value.scopes=e.scopes,l.value.claimMap={...e.claimMap},(!l.value.label||b.value.some(o=>o.label===l.value.label))&&(l.value.label=e.label)}async function j(){g.value=!0;const t=await S.put("/api/sso/config",{...l.value,clientSecret:m.value,allowedEmailDomains:h.value.split(",").map(e=>e.trim()).filter(Boolean)});if(g.value=!1,!t.ok){v.value=R(t,"save the provider");return}v.value="",w("ok","Saved. The provider answered, so the settings are known good."),I()}async function D(){const t=await S.del("/api/sso/config");if(!t.ok){v.value=R(t,"remove the provider");return}w("ok","Removed. Existing accounts keep working."),l.value=U(),m.value="",h.value="",c.value=!1,I()}async function M(){try{await navigator.clipboard.writeText(x.value),w("ok","Copied.")}catch{w("error","Could not reach the clipboard — select the text and copy it.")}}const _=W(()=>!l.value.clientId.trim()||!m.value?!1:l.value.mode==="oidc"?!!l.value.discoveryUrl.trim():!!l.value.authorizeUrl.trim()&&!!l.value.tokenUrl.trim());return(t,e)=>(n(),d("div",null,[s("div",Y,[s("div",null,[s("h1",null,[e[14]||(e[14]=a(" Single sign-on ",-1)),f(P,{title:"How single sign-on works here"},{default:y(()=>[...e[13]||(e[13]=[s("p",null,[s("b",null,"This service is the relying party and nothing more."),a(" You register an OAuth or OIDC application in your own organisation and paste its client id and secret here. Your directory stays yours — no accounts are copied, and nothing is synchronised. ")],-1),s("p",null,[s("b",null,"Anyone who authenticates gets an account"),a(", created on their first sign-in. That is deliberate: your provider already decides who may authenticate (Workspace restricts to internal users, a GitHub app can be org-approved), and duplicating that policy here would just be a second list to keep in step. Narrow it with the allowed email domains below if you need to. ")],-1),s("p",null,[s("b",null,"Identity is the provider's subject, not the email."),a(" Someone changing their address keeps their account, their history and their tokens. An address is only used to adopt an account that already exists here, and only when the provider says it is verified. ")],-1),s("p",null,[s("b",null,"Nothing about local accounts changes."),a(" The admin credential, manually created users and personal API tokens all keep working exactly as they do now. ")],-1)])]),_:1})]),s("div",K,[e[16]||(e[16]=a(" Let people sign in with the identity provider you already run ",-1)),f(O,{label:"what is stored"},{default:y(()=>[...e[15]||(e[15]=[a(" One row: the endpoints, the client id, and the client secret. The secret has no read path — this page is shown a mask, and leaving it alone keeps what is stored. ",-1)])]),_:1})])])]),v.value?(n(),C(G,{key:0,text:v.value,title:"Single sign-on."},null,8,["text"])):p("",!0),L.value?(n(),d(V,{key:2},[s("section",q,[e[17]||(e[17]=s("div",{class:"phead"},[s("h2",{class:"section"},"Register this callback URL")],-1)),e[18]||(e[18]=s("p",{class:"dim"}," Paste this into your provider's application as the redirect / callback URL. It has to match exactly, and it is the same for every provider — a mismatch is the single most common reason the exchange fails, and the provider's error rarely says so. ",-1)),s("div",J,[s("code",Q,k(x.value),1),s("button",{onClick:M},"Copy")])]),s("section",X,[s("div",Z,[e[20]||(e[20]=s("h2",{class:"section"},"Provider",-1)),e[21]||(e[21]=s("span",{class:"grow"},null,-1)),s("label",ee,[i(s("input",{"onUpdate:modelValue":e[0]||(e[0]=o=>l.value.enabled=o),type:"checkbox"},null,512),[[N,l.value.enabled]]),e[19]||(e[19]=a(" Enabled",-1))])]),s("div",se,[s("div",le,[e[22]||(e[22]=s("label",{for:"sso-mode"},"Kind",-1)),f(E,{id:"sso-mode","model-value":l.value.mode,label:"Which protocol",options:[{value:"oidc",label:"OpenID Connect"},{value:"oauth2",label:"OAuth 2.0"}],"onUpdate:modelValue":e[1]||(e[1]=o=>l.value.mode=o)},null,8,["model-value"])]),l.value.mode==="oauth2"?(n(),d("div",oe,[e[23]||(e[23]=s("label",{for:"sso-preset"},"Provider",-1)),f(E,{id:"sso-preset","model-value":l.value.provider,label:"Which provider",options:[...b.value.map(o=>({value:o.key,label:o.label})),{value:"custom",label:"Custom"}],"onUpdate:modelValue":e[2]||(e[2]=o=>T(String(o)))},null,8,["model-value","options"])])):p("",!0),s("div",te,[e[24]||(e[24]=s("label",{for:"sso-label"},"Button text",-1)),i(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=o=>l.value.label=o),type:"text",placeholder:"Acme SSO"},null,512),[[r,l.value.label]])])]),l.value.mode==="oidc"?(n(),d("p",ae," Everything but the client id and secret is discovered from the issuer. GitHub is the one exception you may reach for and cannot use here: its OIDC document signs Actions job tokens, not user logins — use OAuth 2.0 for GitHub. ")):p("",!0),l.value.mode==="oidc"?(n(),d("div",ie,[e[25]||(e[25]=s("label",{for:"sso-issuer"},"Issuer",-1)),i(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=o=>l.value.discoveryUrl=o),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[r,l.value.discoveryUrl]]),e[26]||(e[26]=s("p",{class:"hint"},[a("Or the full "),s("code",null,"…/.well-known/openid-configuration"),a(" URL. It is fetched when you save, so a typo is refused here rather than at someone's first login.")],-1))])):p("",!0),s("div",ne,[e[27]||(e[27]=s("label",{for:"sso-client"},"Client id",-1)),i(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=o=>l.value.clientId=o),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[r,l.value.clientId]])]),s("div",re,[e[28]||(e[28]=s("label",{for:"sso-secret"},"Client secret",-1)),i(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=o=>m.value=o),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[r,m.value]]),s("p",de," Write-only. "+k(c.value?"A secret is stored — leave this as it is to keep it.":"Stored on save and never returned by any route."),1)]),l.value.mode==="oauth2"?(n(),d(V,{key:2},[s("div",ue,[e[29]||(e[29]=s("label",{for:"sso-auth"},"Authorize URL",-1)),i(s("input",{id:"sso-auth","onUpdate:modelValue":e[7]||(e[7]=o=>l.value.authorizeUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.authorizeUrl]])]),s("div",pe,[e[30]||(e[30]=s("label",{for:"sso-token"},"Token URL",-1)),i(s("input",{id:"sso-token","onUpdate:modelValue":e[8]||(e[8]=o=>l.value.tokenUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.tokenUrl]])]),s("div",ve,[e[31]||(e[31]=s("label",{for:"sso-userinfo"},"User info URL",-1)),i(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[9]||(e[9]=o=>l.value.userInfoUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.userInfoUrl]]),e[32]||(e[32]=s("p",{class:"hint"},"Leave empty to take the identity from the token response alone — a subject and nothing else.",-1))]),s("div",me,[e[33]||(e[33]=s("label",{for:"sso-emails"},[a("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),i(s("input",{id:"sso-emails","onUpdate:modelValue":e[10]||(e[10]=o=>l.value.emailsUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.emailsUrl]]),e[34]||(e[34]=s("p",{class:"hint"}," Only consulted when the profile carries no address — which is GitHub's default. Filled in automatically for a preset, and needed only if you pointed the user info URL at your own host. ",-1))])],64)):p("",!0),s("div",ce,[e[35]||(e[35]=s("label",{for:"sso-scopes"},"Scopes",-1)),i(s("input",{id:"sso-scopes","onUpdate:modelValue":e[11]||(e[11]=o=>l.value.scopes=o),type:"text",spellcheck:"false",placeholder:l.value.mode==="oidc"?"openid profile email":""},null,8,fe),[[r,l.value.scopes]])]),l.value.mode==="oauth2"?(n(),d("div",he,[s("h3",ye,[e[37]||(e[37]=a(" Claim mapping ",-1)),f(O,{label:"what this is"},{default:y(()=>[...e[36]||(e[36]=[a(" Which key of the provider's user response holds each field. Flat lookups, not expressions. A preset fills these in; you only touch them for a provider nobody has written a preset for. ",-1)])]),_:1})]),s("div",be,[(n(),d(V,null,H(["subject","username","email","name","avatar"],o=>s("div",{key:o,class:"field inline"},[s("label",{for:`cm-${o}`},k(o),9,ge),i(s("input",{id:`cm-${o}`,"onUpdate:modelValue":$=>l.value.claimMap[o]=$,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,ke),[[r,l.value.claimMap[o]]])])),64))])])):p("",!0)]),s("section",we,[e[40]||(e[40]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets an account")],-1)),e[41]||(e[41]=s("p",{class:"dim"}," By default, anyone your provider lets authenticate. It already owns that decision; this is only here for the case where the application you registered is broader than the people who should reach this control plane. ",-1)),s("div",Ue,[e[38]||(e[38]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),i(s("input",{id:"sso-domains","onUpdate:modelValue":e[12]||(e[12]=o=>h.value=o),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[r,h.value]]),e[39]||(e[39]=s("p",{class:"hint"},[a(" Comma-separated; subdomains count. Empty means no restriction. "),s("b",null,"Non-empty means a login with no email address at all is refused too"),a(" — a provider that hides the address (a private GitHub profile with no "),s("code",null,"user:email"),a(" scope) cannot be checked, so it is not waved through. ")],-1))])]),s("div",xe,[f(z,{variant:"primary",pending:g.value,disabled:g.value||!_.value,onClick:j},{default:y(()=>[a(k(c.value?"Save changes":"Enable single sign-on"),1)]),_:1},8,["pending","disabled"]),e[43]||(e[43]=s("span",{class:"grow"},null,-1)),c.value?(n(),C(z,{key:0,variant:"danger",confirm:`Remove ${l.value.label||"the provider"}?`,onRun:D},{default:y(()=>[...e[42]||(e[42]=[a(" Remove provider ",-1)])]),_:1},8,["confirm"])):p("",!0)]),c.value?(n(),d("p",Ie," Removing the provider does not delete anyone. Those accounts keep their personal tokens, and pointing the same provider back at this host re-links them by subject. ")):p("",!0)],64)):(n(),C(F,{key:1,rows:5}))]))}});export{Ee as default};
+//# sourceMappingURL=SsoView-D2yf-noE.js.map

package/dist/assets/SsoView-D2yf-noE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SsoView-D2yf-noE.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: point this control plane at the identity provider the operator already runs.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * TWO THINGS THIS FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname.\n *   2. The client secret is write-only. The server answers with a mask; submitting the mask back\n *      unchanged keeps the stored secret, so an operator editing the label cannot silently wipe it.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { ClaimMap, SsoConfig, SsoConfigResponse, SsoPreset } from '../api/types';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: 'github',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  defaultRole: 'admin',\n});\n\nconst form = ref<SsoConfig>(blank());\nconst secret = ref('');\nconst domains = ref('');\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst configured = ref(false);\nconst loaded = ref(false);\nconst error = ref('');\nconst saving = ref(false);\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    error.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  error.value = '';\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n  configured.value = r.body.configured;\n  if (r.body.config) {\n    form.value = { ...blank(), ...r.body.config };\n    domains.value = (r.body.config.allowedEmailDomains ?? []).join(', ');\n  }\n  // The mask, so leaving the field alone re-submits it and the server keeps what it has.\n  secret.value = r.body.clientSecret;\n}\nvoid load();\n\n/** Picking a preset fills the endpoints in. Everything stays editable — a self-hosted GitLab is\n *  this preset with three URLs replaced, not a `custom` provider with five fields typed by hand. */\nfunction applyPreset(key: string): void {\n  form.value.provider = key;\n  const p = presets.value.find((x) => x.key === key);\n  if (!p) {\n    form.value.authorizeUrl = '';\n    form.value.tokenUrl = '';\n    form.value.userInfoUrl = '';\n    form.value.emailsUrl = '';\n    form.value.claimMap = { ...OIDC_CLAIMS };\n    return;\n  }\n  form.value.authorizeUrl = p.authorizeUrl;\n  form.value.tokenUrl = p.tokenUrl;\n  form.value.userInfoUrl = p.userInfoUrl ?? '';\n  // Left blank on purpose: the server fills the preset's own emails endpoint back in, and only\n  // while userInfoUrl is still the preset's.\n  form.value.emailsUrl = '';\n  form.value.scopes = p.scopes;\n  form.value.claimMap = { ...p.claimMap };\n  if (!form.value.label || presets.value.some((x) => x.label === form.value.label)) form.value.label = p.label;\n}\n\nasync function save(): Promise<void> {\n  saving.value = true;\n  const r = await api.put<{ ok: boolean; callbackUrl: string }>('/api/sso/config', {\n    ...form.value,\n    clientSecret: secret.value,\n    allowedEmailDomains: domains.value.split(',').map((d) => d.trim()).filter(Boolean),\n  });\n  saving.value = false;\n  if (!r.ok) {\n    error.value = problem(r, 'save the provider');\n    return;\n  }\n  error.value = '';\n  toast('ok', 'Saved. The provider answered, so the settings are known good.');\n  void load();\n}\n\nasync function remove(): Promise<void> {\n  const r = await api.del('/api/sso/config');\n  if (!r.ok) {\n    error.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', 'Removed. Existing accounts keep working.');\n  form.value = blank();\n  secret.value = '';\n  domains.value = '';\n  configured.value = false;\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\nconst canSave = computed(() => {\n  if (!form.value.clientId.trim() || !secret.value) return false;\n  if (form.value.mode === 'oidc') return !!form.value.discoveryUrl.trim();\n  return !!form.value.authorizeUrl.trim() && !!form.value.tokenUrl.trim();\n});\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the allowed email domains\n              below if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Nothing about local accounts changes.</b> The admin credential, manually created\n              users and personal API tokens all keep working exactly as they do now.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity provider you already run\n          <InfoHint label=\"what is stored\">\n            One row: the endpoints, the client id, and the client secret. The secret has no read\n            path — this page is shown a mask, and leaving it alone keeps what is stored.\n          </InfoHint>\n        </div>\n      </div>\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"5\" />\n\n    <template v-else>\n      <!-- ============================ the callback URL ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Register this callback URL</h2></div>\n        <p class=\"dim\">\n          Paste this into your provider's application as the redirect / callback URL. It has to match\n          exactly, and it is the same for every provider — a mismatch is the single most common\n          reason the exchange fails, and the provider's error rarely says so.\n        </p>\n        <div class=\"row\" style=\"gap: var(--s3); align-items: center\">\n          <code class=\"code\" style=\"flex: 1; overflow-x: auto; white-space: nowrap\">{{ callbackUrl }}</code>\n          <button @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n\n      <!-- ============================ the provider ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">Provider</h2>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <div class=\"row\" style=\"gap: var(--s4); flex-wrap: wrap\">\n          <div class=\"field inline\">\n            <label for=\"sso-mode\">Kind</label>\n            <SelectMenu\n              id=\"sso-mode\"\n              :model-value=\"form.mode\"\n              label=\"Which protocol\"\n              :options=\"[\n                { value: 'oidc', label: 'OpenID Connect' },\n                { value: 'oauth2', label: 'OAuth 2.0' },\n              ]\"\n              @update:model-value=\"(v) => (form.mode = v as 'oidc' | 'oauth2')\"\n            />\n          </div>\n          <div v-if=\"form.mode === 'oauth2'\" class=\"field inline\">\n            <label for=\"sso-preset\">Provider</label>\n            <SelectMenu\n              id=\"sso-preset\"\n              :model-value=\"form.provider\"\n              label=\"Which provider\"\n              :options=\"[...presets.map((p) => ({ value: p.key, label: p.label })), { value: 'custom', label: 'Custom' }]\"\n              @update:model-value=\"(v) => applyPreset(String(v))\"\n            />\n          </div>\n          <div class=\"field inline\">\n            <label for=\"sso-label\">Button text</label>\n            <input id=\"sso-label\" v-model=\"form.label\" type=\"text\" placeholder=\"Acme SSO\" />\n          </div>\n        </div>\n\n        <p v-if=\"form.mode === 'oidc'\" class=\"hint\">\n          Everything but the client id and secret is discovered from the issuer. GitHub is the one\n          exception you may reach for and cannot use here: its OIDC document signs Actions job\n          tokens, not user logins — use OAuth 2.0 for GitHub.\n        </p>\n\n        <div v-if=\"form.mode === 'oidc'\" class=\"field\">\n          <label for=\"sso-issuer\">Issuer</label>\n          <input id=\"sso-issuer\" v-model=\"form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n          <p class=\"hint\">Or the full <code>…/.well-known/openid-configuration</code> URL. It is fetched when you save, so a typo is refused here rather than at someone's first login.</p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only. {{ configured ? 'A secret is stored — leave this as it is to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <template v-if=\"form.mode === 'oauth2'\">\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <div v-if=\"form.mode === 'oauth2'\">\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </div>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account</h2></div>\n        <p class=\"dim\">\n          By default, anyone your provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n      </section>\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !canSave\" @click=\"save\">\n          {{ configured ? 'Save changes' : 'Enable single sign-on' }}\n        </ActionButton>\n        <span class=\"grow\" />\n        <ActionButton v-if=\"configured\" variant=\"danger\" :confirm=\"`Remove ${form.label || 'the provider'}?`\" @run=\"remove\">\n          Remove provider\n        </ActionButton>\n      </div>\n      <p v-if=\"configured\" class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n        Removing the provider does not delete anyone. Those accounts keep their personal tokens, and\n        pointing the same provider back at this host re-links them by subject.\n      </p>\n    </template>\n  </div>\n</template>\n"],"names":["OIDC_CLAIMS","blank","form","ref","secret","domains","presets","callbackUrl","configured","loaded","error","saving","load","r","api","problem","applyPreset","key","p","x","save","d","toast","remove","copyCallback","canSave","computed","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","_hoisted_8","$event","_vModelCheckbox","_hoisted_9","_hoisted_10","SelectMenu","v","_openBlock","_hoisted_11","_hoisted_12","_vModelText","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_24","_hoisted_25","_hoisted_26","_renderList","k","_hoisted_27","_hoisted_29","_hoisted_30","_hoisted_31","ActionButton","_hoisted_32","SkeletonList"],"mappings":"4jDA6BA,MAAMA,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,SACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,YAAa,OAAA,GAGTE,EAAOC,EAAeF,GAAO,EAC7BG,EAASD,EAAI,EAAE,EACfE,EAAUF,EAAI,EAAE,EAChBG,EAAUH,EAAiB,EAAE,EAC7BI,EAAcJ,EAAI,EAAE,EACpBK,EAAaL,EAAI,EAAK,EACtBM,EAASN,EAAI,EAAK,EAClBO,EAAQP,EAAI,EAAE,EACdQ,EAASR,EAAI,EAAK,EAExB,eAAeS,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAuB,iBAAiB,EAE5D,GADAL,EAAO,MAAQ,GACX,CAACI,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,2BAA2B,EACpD,MACF,CACAH,EAAM,MAAQ,GACdJ,EAAQ,MAAQO,EAAE,KAAK,SAAW,CAAA,EAClCN,EAAY,MAAQM,EAAE,KAAK,YAC3BL,EAAW,MAAQK,EAAE,KAAK,WACtBA,EAAE,KAAK,SACTX,EAAK,MAAQ,CAAE,GAAGD,EAAA,EAAS,GAAGY,EAAE,KAAK,MAAA,EACrCR,EAAQ,OAASQ,EAAE,KAAK,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,GAGrET,EAAO,MAAQS,EAAE,KAAK,YACxB,CACKD,EAAA,EAIL,SAASI,EAAYC,EAAmB,CACtCf,EAAK,MAAM,SAAWe,EACtB,MAAMC,EAAIZ,EAAQ,MAAM,KAAMa,GAAMA,EAAE,MAAQF,CAAG,EACjD,GAAI,CAACC,EAAG,CACNhB,EAAK,MAAM,aAAe,GAC1BA,EAAK,MAAM,SAAW,GACtBA,EAAK,MAAM,YAAc,GACzBA,EAAK,MAAM,UAAY,GACvBA,EAAK,MAAM,SAAW,CAAE,GAAGF,CAAA,EAC3B,MACF,CACAE,EAAK,MAAM,aAAegB,EAAE,aAC5BhB,EAAK,MAAM,SAAWgB,EAAE,SACxBhB,EAAK,MAAM,YAAcgB,EAAE,aAAe,GAG1ChB,EAAK,MAAM,UAAY,GACvBA,EAAK,MAAM,OAASgB,EAAE,OACtBhB,EAAK,MAAM,SAAW,CAAE,GAAGgB,EAAE,QAAA,GACzB,CAAChB,EAAK,MAAM,OAASI,EAAQ,MAAM,KAAMa,GAAMA,EAAE,QAAUjB,EAAK,MAAM,KAAK,KAAGA,EAAK,MAAM,MAAQgB,EAAE,MACzG,CAEA,eAAeE,GAAsB,CACnCT,EAAO,MAAQ,GACf,MAAME,EAAI,MAAMC,EAAI,IAA0C,kBAAmB,CAC/E,GAAGZ,EAAK,MACR,aAAcE,EAAO,MACrB,oBAAqBC,EAAQ,MAAM,MAAM,GAAG,EAAE,IAAKgB,GAAMA,EAAE,MAAM,EAAE,OAAO,OAAO,CAAA,CAClF,EAED,GADAV,EAAO,MAAQ,GACX,CAACE,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,mBAAmB,EAC5C,MACF,CACAH,EAAM,MAAQ,GACdY,EAAM,KAAM,+DAA+D,EACtEV,EAAA,CACP,CAEA,eAAeW,GAAwB,CACrC,MAAMV,EAAI,MAAMC,EAAI,IAAI,iBAAiB,EACzC,GAAI,CAACD,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,qBAAqB,EAC9C,MACF,CACAS,EAAM,KAAM,0CAA0C,EACtDpB,EAAK,MAAQD,EAAA,EACbG,EAAO,MAAQ,GACfC,EAAQ,MAAQ,GAChBG,EAAW,MAAQ,GACdI,EAAA,CACP,CAEA,eAAeY,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAUjB,EAAY,KAAK,EACrDe,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAEA,MAAMG,EAAUC,EAAS,IACnB,CAACxB,EAAK,MAAM,SAAS,QAAU,CAACE,EAAO,MAAc,GACrDF,EAAK,MAAM,OAAS,OAAe,CAAC,CAACA,EAAK,MAAM,aAAa,KAAA,EAC1D,CAAC,CAACA,EAAK,MAAM,aAAa,QAAU,CAAC,CAACA,EAAK,MAAM,SAAS,KAAA,CAClE,oBAICyB,EA0MM,MAAA,KAAA,CAzMJC,EAqCM,MArCNC,EAqCM,CApCJD,EAmCM,MAAA,KAAA,CAlCJA,EA0BK,KAAA,KAAA,iBA1BD,mBAEF,EAAA,GAAAE,EAuBYC,EAAA,CAvBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,mUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAGI,IAAA,KAAA,CAFFA,EAA4C,SAAzC,uCAAqC,IAAI,iHAE9C,CAAA,kBAGJA,EAMM,MANNK,EAMM,iBANW,kEAEf,EAAA,GAAAH,EAGWI,EAAA,CAHD,MAAM,kBAAgB,WAAC,IAGjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAHiC,sKAGjC,EAAA,CAAA,iBAKWtB,EAAA,WAAjByB,EAAgEC,EAAA,OAAvC,KAAM1B,EAAA,MAAO,MAAM,iBAAA,6BACvBD,EAAA,WAErBkB,EA8JWU,EAAA,CAAA,IAAA,GAAA,CA5JTT,EAWU,UAXVU,EAWU,eAVRV,EAA4E,MAAA,CAAvE,MAAM,SAAO,CAACA,EAAmD,KAAA,CAA/C,MAAM,SAAA,EAAU,4BAA0B,CAAA,OACjEI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAGM,MAHNW,EAGM,CAFJX,EAAkG,OAAlGY,EAAkGC,EAArBlC,EAAA,KAAW,EAAA,CAAA,EACxFqB,EAA2C,SAAA,CAAlC,QAAOJ,CAAA,EAAc,MAAI,CAAA,KAKtCI,EA2GU,UA3GVc,EA2GU,CA1GRd,EAIM,MAJNe,EAIM,CAHJX,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAiC,KAAA,CAA7B,MAAM,SAAA,EAAU,WAAQ,EAAA,iBAC5BA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAAqF,QAArFgB,GAAqF,GAAhEhB,EAAgD,QAAA,CAAhC,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,QAAO2C,GAAE,KAAK,UAAA,aAAnB,CAAAC,EAAA5C,EAAA,MAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAG/E0B,EA4BM,MA5BNmB,GA4BM,CA3BJnB,EAYM,MAZNoB,GAYM,CAXJhB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAkC,QAAA,CAA3B,IAAI,UAAA,EAAW,OAAI,EAAA,GAC1BE,EASEmB,EAAA,CARA,GAAG,WACF,cAAa/C,EAAA,MAAK,KACnB,MAAM,iBACL,QAAS,2EAIT,kCAAqBgD,GAAOhD,QAAK,KAAOgD,EAAA,4BAGlChD,EAAA,MAAK,OAAI,UAApBiD,IAAAxB,EASM,MATNyB,GASM,CARJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,YAAA,EAAa,WAAQ,EAAA,GAChCE,EAMEmB,EAAA,CALA,GAAG,aACF,cAAa/C,EAAA,MAAK,SACnB,MAAM,iBACL,QAAO,CAAA,GAAMI,EAAA,MAAQ,IAAKY,IAAC,CAAA,MAAeA,EAAE,IAAG,MAASA,EAAE,OAAK,EAAA,CAAA,MAAA,SAAA,MAAA,SAAA,EAC/D,kCAAqBgC,GAAMlC,EAAY,OAAOkC,CAAC,CAAA,EAAA,gDAGpDtB,EAGM,MAHNyB,GAGM,CAFJrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAgF,QAAA,CAAzE,GAAG,YAAqB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,MAAK2C,GAAE,KAAK,OAAO,YAAY,UAAA,aAApC,CAAAS,EAAApD,EAAA,MAAK,KAAK,CAAA,OAIpCA,EAAA,MAAK,OAAI,YAAlByB,EAII,IAJJ4B,GAA4C,qOAI5C,YAEWrD,EAAA,MAAK,OAAI,QAApBiD,IAAAxB,EAIM,MAJN6B,GAIM,CAHJxB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAA8H,QAAA,CAAvH,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,aAAY2C,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,aAA9D,CAAAS,EAAApD,EAAA,MAAK,YAAY,CAAA,iBACjD0B,EAAiL,IAAA,CAA9K,MAAM,QAAM,GAAC,cAAY,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,oGAAkG,CAAA,mBAG/KA,EAGM,MAHN6B,GAGM,CAFJzB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAAmG,QAAA,CAA5F,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,SAAQ2C,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,aAA3D,CAAAS,EAAApD,EAAA,MAAK,QAAQ,CAAA,KAE/C0B,EAMM,MANN8B,GAMM,CALJ1B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAyG,QAAA,CAAlG,GAAG,kDAAsBxB,EAAM,MAAAyC,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,gBAAxDzC,EAAA,KAAM,CAAA,GACtCwB,EAEI,IAFJ+B,GAAgB,kBACCnD,EAAA,MAAU,uDAAA,iDAAA,EAAA,CAAA,CAAA,GAIbN,EAAA,MAAK,OAAI,cAAzByB,EAuBWU,EAAA,CAAA,IAAA,GAAA,CAtBTT,EAGM,MAHNgC,GAGM,CAFJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAAkF,QAAA,CAA3E,GAAG,WAAoB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,aAAY2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAA1C,CAAAS,EAAApD,EAAA,MAAK,YAAY,CAAA,KAEjD0B,EAGM,MAHNiC,GAGM,CAFJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAA+E,QAAA,CAAxE,GAAG,YAAqB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,SAAQ2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAtC,CAAAS,EAAApD,EAAA,MAAK,QAAQ,CAAA,KAE9C0B,EAIM,MAJNkC,GAIM,CAHJ9B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAAqF,QAAA,CAA9E,GAAG,eAAwB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,YAAW2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAzC,CAAAS,EAAApD,EAAA,MAAK,WAAW,CAAA,GAClD8B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARNmC,GAQM,eAPJnC,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAiF,QAAA,CAA1E,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA3C,EAAA,MAAK,UAAS2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAvC,CAAAS,EAAApD,EAAA,MAAK,SAAS,CAAA,GAC9C8B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,kBAIJA,EAGM,MAHNoC,GAGM,CAFJhC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgJ,QAAA,CAAzI,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA3C,EAAA,MAAK,OAAM2C,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa3C,EAAA,MAAK,OAAI,OAAA,uBAAA,EAAA,cAAnE,CAAAoD,EAAApD,EAAA,MAAK,MAAM,CAAA,KAGlCA,EAAA,MAAK,OAAI,cAApByB,EAeM,MAAAsC,GAAA,CAdJrC,EAOK,KAPLsC,GAOK,iBAP6C,kBAEhD,EAAA,GAAApC,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALNuC,GAKM,MAJJxC,EAGMU,EAAA,KAAA+B,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALC,GAAZzC,EAGM,MAAA,CAH2E,IAAKyC,EAAG,MAAM,cAAA,GAC7FzC,EAAuC,QAAA,CAA/B,UAAWyC,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5B1C,EAAwG,QAAA,CAAhG,SAAUyC,CAAC,4BAAanE,EAAA,MAAK,SAASmE,CAAC,EAAAxB,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,iBAAjD3C,EAAA,MAAK,SAASmE,CAAC,CAAA,CAAA,2BAOvDzC,EAiBU,UAjBV2C,GAiBU,eAhBR3C,EAAqE,MAAA,CAAhE,MAAM,SAAO,CAACA,EAA4C,KAAA,CAAxC,MAAM,SAAA,EAAU,qBAAmB,CAAA,OAC1DI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,2NAIf,EAAA,GACAA,EASM,MATN4C,GASM,CARJxC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAAmH,QAAA,CAA5G,GAAG,qDAAuBvB,EAAO,MAAAwC,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,gBAApDxC,EAAA,KAAO,CAAA,iBACxCuB,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,WAIJA,EAQM,MARN6C,GAQM,CAPJ3C,EAEe4C,EAAA,CAFD,QAAQ,UAAW,QAAS/D,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAKc,EAAA,MAAU,QAAOL,CAAA,aACvF,IAA2D,KAAxDZ,EAAA,MAAU,eAAA,uBAAA,EAAA,CAAA,CAAA,gDAEfoB,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACEpB,EAAA,WAApB2B,EAEeuC,EAAA,OAFiB,QAAQ,SAAU,QAAO,UAAYxE,EAAA,MAAK,OAAK,cAAA,IAAwB,MAAKqB,CAAA,aAAQ,IAEpH,CAAA,GAAAS,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFoH,oBAEpH,EAAA,CAAA,qCAEOxB,EAAA,WAATmB,EAGI,IAHJgD,GAAwF,uKAGxF,uBA/JFxC,EAAyCyC,EAAA,OAAX,KAAM,CAAA"}

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-BgbZLzlL.js → StateBadge.vue_vue_type_script_setup_true_lang-BqldkWlT.js}

@@ -1,2 +1,2 @@
-import{s}from"./useFormat-DVXTfIS-.js";import{d as t,c as n,E as o,a as r,f as c,t as l,u as m,o as p}from"./index-DVMQBHXF.js";const u=t({__name:"StateBadge",props:{state:{}},setup(e){return(d,a)=>(p(),n("span",{class:o(["badge",e.state])},[a[0]||(a[0]=r("span",{class:"dot"},null,-1)),c(" "+l(m(s)(e.state)),1)],2))}});export{u as _};
-//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-BgbZLzlL.js.map
+import{s}from"./useFormat-DIlTY5Dl.js";import{d as t,c as n,E as o,a as r,f as c,t as l,u as m,o as p}from"./index-9Ra4jfL4.js";const u=t({__name:"StateBadge",props:{state:{}},setup(e){return(d,a)=>(p(),n("span",{class:o(["badge",e.state])},[a[0]||(a[0]=r("span",{class:"dot"},null,-1)),c(" "+l(m(s)(e.state)),1)],2))}});export{u as _};
+//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-BqldkWlT.js.map

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-BgbZLzlL.js.map → StateBadge.vue_vue_type_script_setup_true_lang-BqldkWlT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-BgbZLzlL.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing · cancelled  grey\n *\n * `cancelled` is deliberately quiet: someone meant to stop it, so it is not an alarm — but it is\n * not `ok` either, because whatever the job had already done was left exactly as it was.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2MAqBEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}
+{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-BqldkWlT.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing · cancelled  grey\n *\n * `cancelled` is deliberately quiet: someone meant to stop it, so it is not an alarm — but it is\n * not `ok` either, because whatever the job had already done was left exactly as it was.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2MAqBEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}

package/dist/assets/{SubmitView-DuGtFMgF.js → SubmitView-Cdxo6Chq.js}

@@ -1,4 +1,4 @@
-import{d as X,r as h,A as N,J as j,c as n,a as t,t as m,f as o,F as V,e as p,w as y,g as v,E as Q,i as T,v as E,_ as R,a1 as D,s as Y,x as Z,C as A,j as _,o as a,l as ee,G as te,L as se,B as oe,V as O}from"./index-DVMQBHXF.js";import{a as le,w as ae,p as F,r as ne}from"./useVars-VN9gYdR6.js";import{_ as ie}from"./ActionButton.vue_vue_type_script_setup_true_lang-D5wrEmB2.js";import{_ as re}from"./ErrorNote.vue_vue_type_script_setup_true_lang-B3hfwyPR.js";import{_ as de}from"./VarEditor.vue_vue_type_script_setup_true_lang-SKwJUsNC.js";import{_ as ue}from"./SelectMenu.vue_vue_type_script_setup_true_lang-D8NGgBfa.js";import"./Teleport-DfE2iP8c.js";const pe={class:"page-head"},ve={class:"sub"},me={class:"panel"},ye={key:0,class:"banner warn"},ce={key:0},he={key:1},fe={key:2},ke={key:3},be={key:2,class:"banner warn"},ge={class:"row",style:{"margin-bottom":"var(--s4)"}},we={class:"field",style:{"max-width":"280px"}},Se={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},xe={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},$e={class:"check"},Ce={class:"check"},Ve={class:"field",style:{"max-width":"340px"}},Te={key:0,class:"hint"},Re={key:0},Ae={key:1},Le={key:2},Ue={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Ne={class:"hint"},Ee={class:"hint"},Pe={class:"row",style:{"margin-top":"var(--s5)"}},We={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},je={key:1,class:"s-ok"},De={key:6,class:"banner warn"},Oe={key:0},Fe=`services:
+import{d as J,r as h,n as N,J as j,c as n,a as t,t as m,f as o,F as T,e as p,w as y,g as v,E as Y,i as V,v as E,_ as R,Y as O,y as Q,z as Z,j as A,k as _,o as a,m as ee,G as te,O as se,C as oe,X as D}from"./index-9Ra4jfL4.js";import{a as le,w as ae,p as F,r as ne}from"./useVars-VN9gYdR6.js";import{_ as ie}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as re}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as de}from"./VarEditor.vue_vue_type_script_setup_true_lang-CyOlKVt5.js";import{_ as ue}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BLfPhhAj.js";import"./Teleport-BUn4ayOo.js";const pe={class:"page-head"},ve={class:"sub"},me={class:"panel"},ye={key:0,class:"banner warn"},ce={key:0},he={key:1},fe={key:2},ke={key:3},be={key:2,class:"banner warn"},ge={class:"row",style:{"margin-bottom":"var(--s4)"}},we={class:"field",style:{"max-width":"280px"}},Se={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},xe={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},$e={class:"check"},Ce={class:"check"},Te={class:"field",style:{"max-width":"340px"}},Ve={key:0,class:"hint"},Re={key:0},Ae={key:1},Le={key:2},Ue={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Ne={class:"hint"},Ee={class:"hint"},Pe={class:"row",style:{"margin-top":"var(--s5)"}},We={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},je={key:1,class:"s-ok"},Oe={key:6,class:"banner warn"},De={key:0},Fe=`services:
   app:
     image: nginx:alpine
     profiles: [app]
@@ -7,7 +7,7 @@ import{d as X,r as h,A as N,J as j,c as n,a as t,t as m,f as o,F as V,e as p,w a
       # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the
       # service entirely alone, so only do that when you need something the shorthand cannot say.
       - pstack.routing.port=80
-`,Je=X({__name:"SubmitView",props:{id:{}},setup(P){const L=P,l=h({id:L.id??"",spec:"",compose:""}),f=h([{k:"",v:""}]),k=h("inline"),w=h(""),S=h(!1),g=h(""),d=h(null),x=h([]),q=A(()=>[{value:"",label:"— choose —"},...x.value.map(s=>({value:s.name,label:s.name,hint:s.kind}))]);N.get("/api/specs").then(s=>{s.ok&&Array.isArray(s.body.specs)&&(x.value=s.body.specs)});const $=A(()=>x.value.find(s=>s.name===w.value)),U=A(()=>!!L.id),M=ee(),C=A(()=>{const s=M.query.from;return typeof s=="string"&&s?s:null}),c=h("idle"),b=h(null);async function W(s){c.value="loading",b.value=null;const e=await N.getAuthed(`/api/deployments/${encodeURIComponent(s)}/source`);if(e.status===404||!e.ok){c.value="failed";return}if(e.body.sourceWithheld){c.value="withheld",e.body.specName&&(b.value=e.body.specName);return}l.value.spec||(l.value.spec=e.body.spec??""),l.value.compose||(l.value.compose=e.body.compose??""),e.body.specName&&(b.value=e.body.specName),c.value="loaded"}j(C,async s=>{var r;if(!s||L.id)return;g.value="",d.value=null,l.value.spec="",l.value.compose="";const e=(r=O(s))==null?void 0:r.vars;e&&(f.value=F(e)),await W(s),l.value.id=""},{immediate:!0}),j(()=>L.id,s=>{var u;if(g.value="",d.value=null,c.value="idle",b.value=null,!s)return;s!==l.value.id&&(l.value.spec="",l.value.compose=""),l.value.id=s;const e=(u=O(s))==null?void 0:u.vars,r=e?F(e):ne(s);r.some(I=>I.k)&&(f.value=r),W(s)},{immediate:!0});const B=A(()=>!!l.value.id&&(k.value==="stored"?!!w.value:!!l.value.spec.trim())&&!S.value);async function K(){S.value=!0,g.value="",d.value=null;const s=l.value.id,e=le(f.value),r={vars:e,env:e};k.value==="stored"?r.specName=w.value:(r.spec=l.value.spec,l.value.compose.trim()&&(r.compose=l.value.compose));const u=await N.put(`/api/deployments/${encodeURIComponent(s)}`,r);if(S.value=!1,u.status===200||u.status===201){d.value={id:u.body.id??s,stack:u.body.stack??"?",created:u.status===201,stackSharedWith:u.body.stackSharedWith},ae(s,f.value),te(),se("ok",`${u.status===201?"Created":"Replaced"} ${s} → ${d.value.stack}`,{to:`/deployments/${encodeURIComponent(s)}`,toLabel:"Open"});return}g.value=oe(u,"save this deployment")}function z(){const s=location.hostname;if(s==="localhost"||s.endsWith(".localhost")||/^[\d.]+$/.test(s)||s.includes(":"))return"preview.example.com";const e=s.split(".");return e.length>=3?e.slice(1).join("."):s}const H=s=>`version: 1
+`,Ge=J({__name:"SubmitView",props:{id:{}},setup(P){const L=P,l=h({id:L.id??"",spec:"",compose:""}),f=h([{k:"",v:""}]),k=h("inline"),w=h(""),S=h(!1),g=h(""),d=h(null),x=h([]),q=A(()=>[{value:"",label:"— choose —"},...x.value.map(s=>({value:s.name,label:s.name,hint:s.kind}))]);N.get("/api/specs").then(s=>{s.ok&&Array.isArray(s.body.specs)&&(x.value=s.body.specs)});const $=A(()=>x.value.find(s=>s.name===w.value)),U=A(()=>!!L.id),M=ee(),C=A(()=>{const s=M.query.from;return typeof s=="string"&&s?s:null}),c=h("idle"),b=h(null);async function W(s){c.value="loading",b.value=null;const e=await N.getAuthed(`/api/deployments/${encodeURIComponent(s)}/source`);if(e.status===404||!e.ok){c.value="failed";return}if(e.body.sourceWithheld){c.value="withheld",e.body.specName&&(b.value=e.body.specName);return}l.value.spec||(l.value.spec=e.body.spec??""),l.value.compose||(l.value.compose=e.body.compose??""),e.body.specName&&(b.value=e.body.specName),c.value="loaded"}j(C,async s=>{var r;if(!s||L.id)return;g.value="",d.value=null,l.value.spec="",l.value.compose="";const e=(r=D(s))==null?void 0:r.vars;e&&(f.value=F(e)),await W(s),l.value.id=""},{immediate:!0}),j(()=>L.id,s=>{var u;if(g.value="",d.value=null,c.value="idle",b.value=null,!s)return;s!==l.value.id&&(l.value.spec="",l.value.compose=""),l.value.id=s;const e=(u=D(s))==null?void 0:u.vars,r=e?F(e):ne(s);r.some(I=>I.k)&&(f.value=r),W(s)},{immediate:!0});const z=A(()=>!!l.value.id&&(k.value==="stored"?!!w.value:!!l.value.spec.trim())&&!S.value);async function K(){S.value=!0,g.value="",d.value=null;const s=l.value.id,e=le(f.value),r={vars:e,env:e};k.value==="stored"?r.specName=w.value:(r.spec=l.value.spec,l.value.compose.trim()&&(r.compose=l.value.compose));const u=await N.put(`/api/deployments/${encodeURIComponent(s)}`,r);if(S.value=!1,u.status===200||u.status===201){d.value={id:u.body.id??s,stack:u.body.stack??"?",created:u.status===201,stackSharedWith:u.body.stackSharedWith},ae(s,f.value),te(),se("ok",`${u.status===201?"Created":"Replaced"} ${s} → ${d.value.stack}`,{to:`/deployments/${encodeURIComponent(s)}`,toLabel:"Open"});return}g.value=oe(u,"save this deployment")}function B(){const s=location.hostname;if(s==="localhost"||s.endsWith(".localhost")||/^[\d.]+$/.test(s)||s.includes(":"))return"preview.example.com";const e=s.split(".");return e.length>=3?e.slice(1).join("."):s}const H=s=>`version: 1
 kind: isolated
 
 # The stack identity: the compose project name, and $STACK inside every hook.
@@ -43,8 +43,8 @@ axes:
     assert_gone: |
       test -d /tmp || exit 1
       ! test -d /tmp/$STACK
-`;function G(){k.value="inline",l.value.spec=H(z()),l.value.compose.trim()||(l.value.compose=Fe),l.value.id||(l.value.id="pr-123"),f.value.some(s=>s.k)||(f.value=[{k:"PR",v:"123"}])}return(s,e)=>{var u,I;const r=_("RouterLink");return a(),n("div",null,[t("div",pe,[t("div",null,[t("h1",null,m(U.value?"Edit a deployment":C.value?"Duplicate a deployment":"Submit a deployment"),1),t("div",ve,m(U.value?"Loaded from what is stored; saving replaces the record":C.value?`Copied from ${C.value} — give it a new id, then edit`:"Stores a spec so it can be deployed"),1)]),e[7]||(e[7]=t("span",{class:"grow"},null,-1)),t("button",{class:"ghost",onClick:G},"Load example spec")]),t("section",me,[C.value&&!U.value?(a(),n("div",ye,[e[20]||(e[20]=t("b",null,"Change the stack, not just the id.",-1)),t("p",null,[e[11]||(e[11]=o(" Two deployments that resolve to the same ",-1)),e[12]||(e[12]=t("code",null,"stack",-1)),e[13]||(e[13]=o(" drive the same compose project — ",-1)),e[14]||(e[14]=t("code",null,"down",-1)),e[15]||(e[15]=o(" on either stops the other's containers. If the stack interpolates a variable (",-1)),e[16]||(e[16]=t("code",null,"pr-${PR}",-1)),e[17]||(e[17]=o(") give it a different value below; if it is a literal, edit the ",-1)),e[18]||(e[18]=t("code",null,"stack:",-1)),e[19]||(e[19]=o(" line. ",-1)),c.value==="withheld"?(a(),n(V,{key:0},[e[9]||(e[9]=o(" The spec could not be copied without an access token — ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[8]||(e[8]=[o("add yours",-1)])]),_:1}),e[10]||(e[10]=o(". ",-1))],64)):v("",!0)])])):v("",!0),U.value?(a(),n("div",{key:1,class:Q(["banner",c.value==="loaded"?"info":"warn"])},[t("b",null,"Replacing "+m(P.id)+".",1),c.value==="loading"?(a(),n("p",ce,"Loading what is stored…")):c.value==="loaded"?(a(),n("p",he," Loaded from the stored record — edit it and save. Saving replaces the record outright, so anything you delete here stops being tracked while whatever it created keeps running. ")):c.value==="withheld"?(a(),n("p",fe,[e[22]||(e[22]=o(" The stored spec was not loaded: reading it needs an access token, because hooks routinely carry a credential inline. ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[21]||(e[21]=[o("Add your token",-1)])]),_:1}),e[23]||(e[23]=o(" to edit in place — otherwise paste the ",-1)),e[24]||(e[24]=t("b",null,"complete",-1)),e[25]||(e[25]=o(" spec, since anything you leave out stops being tracked. ",-1))])):(a(),n("p",ke,[...e[26]||(e[26]=[o(" The stored spec could not be loaded, so this form is empty. Paste the ",-1),t("b",null,"complete",-1),o(" spec you want stored — anything you leave out stops being tracked while whatever it created keeps running. ",-1)])]))],2)):v("",!0),b.value?(a(),n("div",be,[t("b",null,"This deployment tracks the stored spec “"+m(b.value)+"”.",1),t("p",null,[e[28]||(e[28]=o(" Saving here writes a private copy and stops it following that spec. To change every deployment using it, edit ",-1)),p(r,{to:`/specs/${encodeURIComponent(b.value)}`},{default:y(()=>[...e[27]||(e[27]=[o("the spec",-1)])]),_:1},8,["to"]),e[29]||(e[29]=o(" instead. ",-1))])])):v("",!0),t("div",ge,[t("div",we,[e[30]||(e[30]=t("label",{for:"did"},"Deployment id",-1)),T(t("input",{id:"did","onUpdate:modelValue":e[0]||(e[0]=i=>l.value.id=i),type:"text",placeholder:"pr-123",spellcheck:"false",autocomplete:"off"},null,512),[[E,l.value.id,void 0,{trim:!0}]])]),t("span",Se,[e[32]||(e[32]=o(" Lower case ",-1)),p(R,{label:"allowed characters in a deployment id"},{default:y(()=>[...e[31]||(e[31]=[o(" Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64 characters — ",-1),t("code",null,"[a-z0-9][a-z0-9._-]{0,63}",-1),o(". ",-1)])]),_:1})])]),x.value.length?(a(),n("div",xe,[t("label",$e,[T(t("input",{"onUpdate:modelValue":e[1]||(e[1]=i=>k.value=i),type:"radio",value:"inline"},null,512),[[D,k.value]]),e[33]||(e[33]=o(" inline spec ",-1))]),t("label",Ce,[T(t("input",{"onUpdate:modelValue":e[2]||(e[2]=i=>k.value=i),type:"radio",value:"stored"},null,512),[[D,k.value]]),e[34]||(e[34]=o(" reference a stored spec ",-1))])])):v("",!0),k.value==="stored"&&x.value.length?(a(),n(V,{key:4},[t("div",Ve,[e[35]||(e[35]=t("label",{for:"sn"},"Stored spec",-1)),p(ue,{modelValue:w.value,"onUpdate:modelValue":e[3]||(e[3]=i=>w.value=i),id:"sn",label:"Stored spec",options:q.value},null,8,["modelValue","options"])]),$.value?(a(),n("p",Te,[$.value.description?(a(),n("span",Re,m($.value.description)+" — ",1)):v("",!0),e[37]||(e[37]=o(" needs ",-1)),$.value.requiredVars.length?(a(),n("b",Ae,m($.value.requiredVars.join(", ")),1)):(a(),n("span",Le,"no variables")),e[38]||(e[38]=o(". ",-1)),p(R,{label:"why variables are required"},{default:y(()=>[...e[36]||(e[36]=[o(" A missing variable is refused by name. It is never filled in with a blank, which would silently give every deployment the same stack name. ",-1)])]),_:1})])):v("",!0)],64)):(a(),n(V,{key:5},[t("div",Ue,[e[39]||(e[39]=t("label",{for:"spec"},"Spec.yml",-1)),T(t("textarea",{id:"spec","onUpdate:modelValue":e[4]||(e[4]=i=>l.value.spec=i),rows:"12",spellcheck:"false",placeholder:`version: 1
+`;function X(){k.value="inline",l.value.spec=H(B()),l.value.compose.trim()||(l.value.compose=Fe),l.value.id||(l.value.id="pr-123"),f.value.some(s=>s.k)||(f.value=[{k:"PR",v:"123"}])}return(s,e)=>{var u,I;const r=_("RouterLink");return a(),n("div",null,[t("div",pe,[t("div",null,[t("h1",null,m(U.value?"Edit a deployment":C.value?"Duplicate a deployment":"Submit a deployment"),1),t("div",ve,m(U.value?"Loaded from what is stored; saving replaces the record":C.value?`Copied from ${C.value} — give it a new id, then edit`:"Stores a spec so it can be deployed"),1)]),e[7]||(e[7]=t("span",{class:"grow"},null,-1)),t("button",{class:"ghost",onClick:X},"Load example spec")]),t("section",me,[C.value&&!U.value?(a(),n("div",ye,[e[20]||(e[20]=t("b",null,"Change the stack, not just the id.",-1)),t("p",null,[e[11]||(e[11]=o(" Two deployments that resolve to the same ",-1)),e[12]||(e[12]=t("code",null,"stack",-1)),e[13]||(e[13]=o(" drive the same compose project — ",-1)),e[14]||(e[14]=t("code",null,"down",-1)),e[15]||(e[15]=o(" on either stops the other's containers. If the stack interpolates a variable (",-1)),e[16]||(e[16]=t("code",null,"pr-${PR}",-1)),e[17]||(e[17]=o(") give it a different value below; if it is a literal, edit the ",-1)),e[18]||(e[18]=t("code",null,"stack:",-1)),e[19]||(e[19]=o(" line. ",-1)),c.value==="withheld"?(a(),n(T,{key:0},[e[9]||(e[9]=o(" The spec could not be copied without an access token — ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[8]||(e[8]=[o("add yours",-1)])]),_:1}),e[10]||(e[10]=o(". ",-1))],64)):v("",!0)])])):v("",!0),U.value?(a(),n("div",{key:1,class:Y(["banner",c.value==="loaded"?"info":"warn"])},[t("b",null,"Replacing "+m(P.id)+".",1),c.value==="loading"?(a(),n("p",ce,"Loading what is stored…")):c.value==="loaded"?(a(),n("p",he," Loaded from the stored record — edit it and save. Saving replaces the record outright, so anything you delete here stops being tracked while whatever it created keeps running. ")):c.value==="withheld"?(a(),n("p",fe,[e[22]||(e[22]=o(" The stored spec was not loaded: reading it needs an access token, because hooks routinely carry a credential inline. ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[21]||(e[21]=[o("Add your token",-1)])]),_:1}),e[23]||(e[23]=o(" to edit in place — otherwise paste the ",-1)),e[24]||(e[24]=t("b",null,"complete",-1)),e[25]||(e[25]=o(" spec, since anything you leave out stops being tracked. ",-1))])):(a(),n("p",ke,[...e[26]||(e[26]=[o(" The stored spec could not be loaded, so this form is empty. Paste the ",-1),t("b",null,"complete",-1),o(" spec you want stored — anything you leave out stops being tracked while whatever it created keeps running. ",-1)])]))],2)):v("",!0),b.value?(a(),n("div",be,[t("b",null,"This deployment tracks the stored spec “"+m(b.value)+"”.",1),t("p",null,[e[28]||(e[28]=o(" Saving here writes a private copy and stops it following that spec. To change every deployment using it, edit ",-1)),p(r,{to:`/specs/${encodeURIComponent(b.value)}`},{default:y(()=>[...e[27]||(e[27]=[o("the spec",-1)])]),_:1},8,["to"]),e[29]||(e[29]=o(" instead. ",-1))])])):v("",!0),t("div",ge,[t("div",we,[e[30]||(e[30]=t("label",{for:"did"},"Deployment id",-1)),V(t("input",{id:"did","onUpdate:modelValue":e[0]||(e[0]=i=>l.value.id=i),type:"text",placeholder:"pr-123",spellcheck:"false",autocomplete:"off"},null,512),[[E,l.value.id,void 0,{trim:!0}]])]),t("span",Se,[e[32]||(e[32]=o(" Lower case ",-1)),p(R,{label:"allowed characters in a deployment id"},{default:y(()=>[...e[31]||(e[31]=[o(" Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64 characters — ",-1),t("code",null,"[a-z0-9][a-z0-9._-]{0,63}",-1),o(". ",-1)])]),_:1})])]),x.value.length?(a(),n("div",xe,[t("label",$e,[V(t("input",{"onUpdate:modelValue":e[1]||(e[1]=i=>k.value=i),type:"radio",value:"inline"},null,512),[[O,k.value]]),e[33]||(e[33]=o(" inline spec ",-1))]),t("label",Ce,[V(t("input",{"onUpdate:modelValue":e[2]||(e[2]=i=>k.value=i),type:"radio",value:"stored"},null,512),[[O,k.value]]),e[34]||(e[34]=o(" reference a stored spec ",-1))])])):v("",!0),k.value==="stored"&&x.value.length?(a(),n(T,{key:4},[t("div",Te,[e[35]||(e[35]=t("label",{for:"sn"},"Stored spec",-1)),p(ue,{modelValue:w.value,"onUpdate:modelValue":e[3]||(e[3]=i=>w.value=i),id:"sn",label:"Stored spec",options:q.value},null,8,["modelValue","options"])]),$.value?(a(),n("p",Ve,[$.value.description?(a(),n("span",Re,m($.value.description)+" — ",1)):v("",!0),e[37]||(e[37]=o(" needs ",-1)),$.value.requiredVars.length?(a(),n("b",Ae,m($.value.requiredVars.join(", ")),1)):(a(),n("span",Le,"no variables")),e[38]||(e[38]=o(". ",-1)),p(R,{label:"why variables are required"},{default:y(()=>[...e[36]||(e[36]=[o(" A missing variable is refused by name. It is never filled in with a blank, which would silently give every deployment the same stack name. ",-1)])]),_:1})])):v("",!0)],64)):(a(),n(T,{key:5},[t("div",Ue,[e[39]||(e[39]=t("label",{for:"spec"},"Spec.yml",-1)),V(t("textarea",{id:"spec","onUpdate:modelValue":e[4]||(e[4]=i=>l.value.spec=i),rows:"12",spellcheck:"false",placeholder:`version: 1
 kind: isolated
 stack: pr-\${PR}
-axes: []`},null,512),[[E,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),T(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[E,l.value.compose]])]),t("p",Ne,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[55]||(e[55]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(de,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",Ee,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",Pe,[p(ie,{variant:"primary",pending:S.value,disabled:!B.value,onClick:K},{default:y(()=>[o(m(S.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),d.value?v("",!0):(a(),n("span",We,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),d.value?(a(),n("span",je,[o(m(d.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(d.value.stack),1),p(r,{to:`/deployments/${encodeURIComponent(d.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(I=(u=d.value)==null?void 0:u.stackSharedWith)!=null&&I.length?(a(),n("div",De,[t("b",null,"Another deployment already resolves to stack “"+m(d.value.stack)+"”.",1),t("p",null,[(a(!0),n(V,null,Y(d.value.stackSharedWith,(i,J)=>(a(),n(V,{key:i},[p(r,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),J<d.value.stackSharedWith.length-1?(a(),n("span",Oe,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),g.value?(a(),Z(re,{key:7,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{Je as default};
-//# sourceMappingURL=SubmitView-DuGtFMgF.js.map
+axes: []`},null,512),[[E,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),V(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[E,l.value.compose]])]),t("p",Ne,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[55]||(e[55]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(de,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",Ee,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",Pe,[p(ie,{variant:"primary",pending:S.value,disabled:!z.value,onClick:K},{default:y(()=>[o(m(S.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),d.value?v("",!0):(a(),n("span",We,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),d.value?(a(),n("span",je,[o(m(d.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(d.value.stack),1),p(r,{to:`/deployments/${encodeURIComponent(d.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(I=(u=d.value)==null?void 0:u.stackSharedWith)!=null&&I.length?(a(),n("div",Oe,[t("b",null,"Another deployment already resolves to stack “"+m(d.value.stack)+"”.",1),t("p",null,[(a(!0),n(T,null,Q(d.value.stackSharedWith,(i,G)=>(a(),n(T,{key:i},[p(r,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),G<d.value.stackSharedWith.length-1?(a(),n("span",De,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),g.value?(a(),Z(re,{key:7,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{Ge as default};
+//# sourceMappingURL=SubmitView-Cdxo6Chq.js.map