@samyx/preview-stacks-ui 0.29.0 → 0.30.0

package/dist/assets/{useDeployment-DFOIiXrd.js → useDeployment-BDHMCIYu.js}

@@ -1,2 +1,2 @@
-import{W as l,j as i,n,C as d,P as p,X as u}from"./index-9Ra4jfL4.js";import{w as c,r as y}from"./useVars-VN9gYdR6.js";const e=l({id:"",detail:null,error:"",loading:!1,vars:[]}),f=i(()=>p(e.vars)),k=i(()=>u(e.id)),h=i(()=>{var a;return((a=e.detail)==null?void 0:a.kind)==="shared"}),b=i(()=>{var a;return(((a=e.detail)==null?void 0:a.axes)??[]).filter(s=>!s.verifiable).map(s=>s.name)});async function t(){const a=e.id;e.loading=!0;const s=await n.get(`/api/deployments/${encodeURIComponent(a)}${f.value}`);if(e.id!==a)return;if(e.loading=!1,!s.ok){e.detail=null,e.error=d(s,`GET /api/deployments/${a}`);return}e.error="";const r=s.body;e.detail={id:r.id??a,kind:r.kind==="shared"?"shared":"isolated",createdAt:r.createdAt,updatedAt:r.updatedAt,stack:typeof r.stack=="string"?r.stack:"",busy:r.busy??null,orchestrator:r.orchestrator??null,sleep:r.sleep??null,asleep:r.asleep??null,compose:r.compose?{file:r.compose.file??"?",profiles:r.compose.profiles??[],overlays:r.compose.overlays??[]}:null,requires:Array.isArray(r.requires)?r.requires:[],axes:(Array.isArray(r.axes)?r.axes:[]).map(o=>({name:o.name,hooks:Array.isArray(o.hooks)?o.hooks:[],verifiable:o.verifiable??(Array.isArray(o.hooks)&&o.hooks.includes("assert_gone"))})),env:Array.isArray(r.env)?r.env:[]}}function g(a){e.id===a&&(e.detail||e.error)||(e.id=a,e.detail=null,e.error="",e.vars=y(a),t())}function m(){c(e.id,e.vars)}function x(){m(),t()}export{x as a,e as d,h as i,t as l,g as o,m as p,k as r,b as u,f as v};
-//# sourceMappingURL=useDeployment-DFOIiXrd.js.map
+import{W as l,j as i,n,C as d,P as p,X as u}from"./index-BXPaPWhH.js";import{w as c,r as y}from"./useVars-VN9gYdR6.js";const e=l({id:"",detail:null,error:"",loading:!1,vars:[]}),f=i(()=>p(e.vars)),k=i(()=>u(e.id)),h=i(()=>{var a;return((a=e.detail)==null?void 0:a.kind)==="shared"}),b=i(()=>{var a;return(((a=e.detail)==null?void 0:a.axes)??[]).filter(s=>!s.verifiable).map(s=>s.name)});async function t(){const a=e.id;e.loading=!0;const s=await n.get(`/api/deployments/${encodeURIComponent(a)}${f.value}`);if(e.id!==a)return;if(e.loading=!1,!s.ok){e.detail=null,e.error=d(s,`GET /api/deployments/${a}`);return}e.error="";const r=s.body;e.detail={id:r.id??a,kind:r.kind==="shared"?"shared":"isolated",createdAt:r.createdAt,updatedAt:r.updatedAt,stack:typeof r.stack=="string"?r.stack:"",busy:r.busy??null,orchestrator:r.orchestrator??null,sleep:r.sleep??null,asleep:r.asleep??null,compose:r.compose?{file:r.compose.file??"?",profiles:r.compose.profiles??[],overlays:r.compose.overlays??[]}:null,requires:Array.isArray(r.requires)?r.requires:[],axes:(Array.isArray(r.axes)?r.axes:[]).map(o=>({name:o.name,hooks:Array.isArray(o.hooks)?o.hooks:[],verifiable:o.verifiable??(Array.isArray(o.hooks)&&o.hooks.includes("assert_gone"))})),env:Array.isArray(r.env)?r.env:[]}}function g(a){e.id===a&&(e.detail||e.error)||(e.id=a,e.detail=null,e.error="",e.vars=y(a),t())}function m(){c(e.id,e.vars)}function x(){m(),t()}export{x as a,e as d,h as i,t as l,g as o,m as p,k as r,b as u,f as v};
+//# sourceMappingURL=useDeployment-BDHMCIYu.js.map

package/dist/assets/{useDeployment-DFOIiXrd.js.map → useDeployment-BDHMCIYu.js.map}

@@ -1 +1 @@
-{"version":3,"file":"useDeployment-DFOIiXrd.js","sources":["../../src/composables/useDeployment.ts"],"sourcesContent":["/**\n * The deployment currently open in the detail view.\n *\n * A module singleton rather than provide/inject, because the six tabs are CHILD ROUTES: they are\n * siblings of each other and are mounted and unmounted independently, so passing the loaded\n * deployment down as a prop would mean re-fetching it on every tab change. Switching tabs must not\n * re-fetch or blank the panel — only opening a DIFFERENT deployment does.\n *\n * `vars` here are REQUEST-TIME variables, sent as `?query` on every route that resolves this\n * deployment. See `useVars.ts` for why they matter and what they can get wrong.\n */\n\nimport { computed, reactive } from 'vue';\nimport { api, problem, query } from '../api/client';\nimport type { Deployment, VarPair } from '../api/types';\nimport { readVars, writeVars } from './useVars';\nimport { rowFor } from './useControlPlane';\n\nexport const dep = reactive({\n  id: '',\n  detail: null as Deployment | null,\n  /** The resolve failure, verbatim. It is a 400 that NAMES the missing variable. */\n  error: '',\n  loading: false,\n  vars: [] as VarPair[],\n});\n\nexport const varsQuery = computed(() => query(dep.vars));\n\n/** The list row, which is the only place the server exposes stored `vars` and `specName` today. */\nexport const row = computed(() => rowFor(dep.id));\n\nexport const isShared = computed(() => dep.detail?.kind === 'shared');\n\nexport const unverifiableAxes = computed(() =>\n  (dep.detail?.axes ?? []).filter((a) => !a.verifiable).map((a) => a.name),\n);\n\nexport async function loadDetail(): Promise<void> {\n  const id = dep.id;\n  dep.loading = true;\n  const r = await api.get<Deployment>(`/api/deployments/${encodeURIComponent(id)}${varsQuery.value}`);\n  // Navigated to another deployment while this was in flight: drop the answer rather than render\n  // one deployment's spec under another's id.\n  if (dep.id !== id) return;\n  dep.loading = false;\n\n  if (!r.ok) {\n    dep.detail = null;\n    dep.error = problem(r, `GET /api/deployments/${id}`);\n    return;\n  }\n  dep.error = '';\n  const b = r.body;\n  dep.detail = {\n    id: b.id ?? id,\n    kind: b.kind === 'shared' ? 'shared' : 'isolated',\n    createdAt: b.createdAt,\n    updatedAt: b.updatedAt,\n    stack: typeof b.stack === 'string' ? b.stack : '',\n    busy: b.busy ?? null,\n    orchestrator: b.orchestrator ?? null,\n    sleep: b.sleep ?? null,\n    asleep: b.asleep ?? null,\n    compose: b.compose\n      ? {\n          file: b.compose.file ?? '?',\n          profiles: b.compose.profiles ?? [],\n          overlays: b.compose.overlays ?? [],\n        }\n      : null,\n    requires: Array.isArray(b.requires) ? b.requires : [],\n    axes: (Array.isArray(b.axes) ? b.axes : []).map((a) => ({\n      name: a.name,\n      hooks: Array.isArray(a.hooks) ? a.hooks : [],\n      // Derive it if an older build omits the field. Defaulting to `false` would claim an axis is\n      // unverifiable when it may define a perfectly good `assert_gone`.\n      verifiable: a.verifiable ?? (Array.isArray(a.hooks) && a.hooks.includes('assert_gone')),\n    })),\n    env: Array.isArray(b.env) ? b.env : [],\n  };\n}\n\n/** Point the singleton at a deployment. Resets everything a stale id could leak into the new one. */\nexport function openDeployment(id: string): void {\n  if (dep.id === id && (dep.detail || dep.error)) return; // a tab change, not a navigation\n  dep.id = id;\n  dep.detail = null;\n  dep.error = '';\n  dep.vars = readVars(id);\n  void loadDetail();\n}\n\nexport function persistVars(): void {\n  writeVars(dep.id, dep.vars);\n}\n\nexport function applyVars(): void {\n  persistVars();\n  void loadDetail();\n}\n"],"names":["dep","reactive","varsQuery","computed","query","row","rowFor","isShared","_a","unverifiableAxes","a","loadDetail","id","r","api","problem","b","openDeployment","readVars","persistVars","writeVars","applyVars"],"mappings":"uHAkBO,MAAMA,EAAMC,EAAS,CAC1B,GAAI,GACJ,OAAQ,KAER,MAAO,GACP,QAAS,GACT,KAAM,CAAA,CACR,CAAC,EAEYC,EAAYC,EAAS,IAAMC,EAAMJ,EAAI,IAAI,CAAC,EAG1CK,EAAMF,EAAS,IAAMG,EAAON,EAAI,EAAE,CAAC,EAEnCO,EAAWJ,EAAS,IAAA,OAAM,QAAAK,EAAAR,EAAI,SAAJ,YAAAQ,EAAY,QAAS,SAAQ,EAEvDC,EAAmBN,EAAS,IAAA,OACtC,SAAAK,EAAAR,EAAI,SAAJ,YAAAQ,EAAY,OAAQ,CAAA,GAAI,OAAQE,GAAM,CAACA,EAAE,UAAU,EAAE,IAAKA,GAAMA,EAAE,IAAI,EACzE,EAEA,eAAsBC,GAA4B,CAChD,MAAMC,EAAKZ,EAAI,GACfA,EAAI,QAAU,GACd,MAAMa,EAAI,MAAMC,EAAI,IAAgB,oBAAoB,mBAAmBF,CAAE,CAAC,GAAGV,EAAU,KAAK,EAAE,EAGlG,GAAIF,EAAI,KAAOY,EAAI,OAGnB,GAFAZ,EAAI,QAAU,GAEV,CAACa,EAAE,GAAI,CACTb,EAAI,OAAS,KACbA,EAAI,MAAQe,EAAQF,EAAG,wBAAwBD,CAAE,EAAE,EACnD,MACF,CACAZ,EAAI,MAAQ,GACZ,MAAMgB,EAAIH,EAAE,KACZb,EAAI,OAAS,CACX,GAAIgB,EAAE,IAAMJ,EACZ,KAAMI,EAAE,OAAS,SAAW,SAAW,WACvC,UAAWA,EAAE,UACb,UAAWA,EAAE,UACb,MAAO,OAAOA,EAAE,OAAU,SAAWA,EAAE,MAAQ,GAC/C,KAAMA,EAAE,MAAQ,KAChB,aAAcA,EAAE,cAAgB,KAChC,MAAOA,EAAE,OAAS,KAClB,OAAQA,EAAE,QAAU,KACpB,QAASA,EAAE,QACP,CACE,KAAMA,EAAE,QAAQ,MAAQ,IACxB,SAAUA,EAAE,QAAQ,UAAY,CAAA,EAChC,SAAUA,EAAE,QAAQ,UAAY,CAAA,CAAC,EAEnC,KACJ,SAAU,MAAM,QAAQA,EAAE,QAAQ,EAAIA,EAAE,SAAW,CAAA,EACnD,MAAO,MAAM,QAAQA,EAAE,IAAI,EAAIA,EAAE,KAAO,CAAA,GAAI,IAAKN,IAAO,CACtD,KAAMA,EAAE,KACR,MAAO,MAAM,QAAQA,EAAE,KAAK,EAAIA,EAAE,MAAQ,CAAA,EAG1C,WAAYA,EAAE,aAAe,MAAM,QAAQA,EAAE,KAAK,GAAKA,EAAE,MAAM,SAAS,aAAa,EAAA,EACrF,EACF,IAAK,MAAM,QAAQM,EAAE,GAAG,EAAIA,EAAE,IAAM,CAAA,CAAC,CAEzC,CAGO,SAASC,EAAeL,EAAkB,CAC3CZ,EAAI,KAAOY,IAAOZ,EAAI,QAAUA,EAAI,SACxCA,EAAI,GAAKY,EACTZ,EAAI,OAAS,KACbA,EAAI,MAAQ,GACZA,EAAI,KAAOkB,EAASN,CAAE,EACjBD,EAAA,EACP,CAEO,SAASQ,GAAoB,CAClCC,EAAUpB,EAAI,GAAIA,EAAI,IAAI,CAC5B,CAEO,SAASqB,GAAkB,CAChCF,EAAA,EACKR,EAAA,CACP"}
+{"version":3,"file":"useDeployment-BDHMCIYu.js","sources":["../../src/composables/useDeployment.ts"],"sourcesContent":["/**\n * The deployment currently open in the detail view.\n *\n * A module singleton rather than provide/inject, because the six tabs are CHILD ROUTES: they are\n * siblings of each other and are mounted and unmounted independently, so passing the loaded\n * deployment down as a prop would mean re-fetching it on every tab change. Switching tabs must not\n * re-fetch or blank the panel — only opening a DIFFERENT deployment does.\n *\n * `vars` here are REQUEST-TIME variables, sent as `?query` on every route that resolves this\n * deployment. See `useVars.ts` for why they matter and what they can get wrong.\n */\n\nimport { computed, reactive } from 'vue';\nimport { api, problem, query } from '../api/client';\nimport type { Deployment, VarPair } from '../api/types';\nimport { readVars, writeVars } from './useVars';\nimport { rowFor } from './useControlPlane';\n\nexport const dep = reactive({\n  id: '',\n  detail: null as Deployment | null,\n  /** The resolve failure, verbatim. It is a 400 that NAMES the missing variable. */\n  error: '',\n  loading: false,\n  vars: [] as VarPair[],\n});\n\nexport const varsQuery = computed(() => query(dep.vars));\n\n/** The list row, which is the only place the server exposes stored `vars` and `specName` today. */\nexport const row = computed(() => rowFor(dep.id));\n\nexport const isShared = computed(() => dep.detail?.kind === 'shared');\n\nexport const unverifiableAxes = computed(() =>\n  (dep.detail?.axes ?? []).filter((a) => !a.verifiable).map((a) => a.name),\n);\n\nexport async function loadDetail(): Promise<void> {\n  const id = dep.id;\n  dep.loading = true;\n  const r = await api.get<Deployment>(`/api/deployments/${encodeURIComponent(id)}${varsQuery.value}`);\n  // Navigated to another deployment while this was in flight: drop the answer rather than render\n  // one deployment's spec under another's id.\n  if (dep.id !== id) return;\n  dep.loading = false;\n\n  if (!r.ok) {\n    dep.detail = null;\n    dep.error = problem(r, `GET /api/deployments/${id}`);\n    return;\n  }\n  dep.error = '';\n  const b = r.body;\n  dep.detail = {\n    id: b.id ?? id,\n    kind: b.kind === 'shared' ? 'shared' : 'isolated',\n    createdAt: b.createdAt,\n    updatedAt: b.updatedAt,\n    stack: typeof b.stack === 'string' ? b.stack : '',\n    busy: b.busy ?? null,\n    orchestrator: b.orchestrator ?? null,\n    sleep: b.sleep ?? null,\n    asleep: b.asleep ?? null,\n    compose: b.compose\n      ? {\n          file: b.compose.file ?? '?',\n          profiles: b.compose.profiles ?? [],\n          overlays: b.compose.overlays ?? [],\n        }\n      : null,\n    requires: Array.isArray(b.requires) ? b.requires : [],\n    axes: (Array.isArray(b.axes) ? b.axes : []).map((a) => ({\n      name: a.name,\n      hooks: Array.isArray(a.hooks) ? a.hooks : [],\n      // Derive it if an older build omits the field. Defaulting to `false` would claim an axis is\n      // unverifiable when it may define a perfectly good `assert_gone`.\n      verifiable: a.verifiable ?? (Array.isArray(a.hooks) && a.hooks.includes('assert_gone')),\n    })),\n    env: Array.isArray(b.env) ? b.env : [],\n  };\n}\n\n/** Point the singleton at a deployment. Resets everything a stale id could leak into the new one. */\nexport function openDeployment(id: string): void {\n  if (dep.id === id && (dep.detail || dep.error)) return; // a tab change, not a navigation\n  dep.id = id;\n  dep.detail = null;\n  dep.error = '';\n  dep.vars = readVars(id);\n  void loadDetail();\n}\n\nexport function persistVars(): void {\n  writeVars(dep.id, dep.vars);\n}\n\nexport function applyVars(): void {\n  persistVars();\n  void loadDetail();\n}\n"],"names":["dep","reactive","varsQuery","computed","query","row","rowFor","isShared","_a","unverifiableAxes","a","loadDetail","id","r","api","problem","b","openDeployment","readVars","persistVars","writeVars","applyVars"],"mappings":"uHAkBO,MAAMA,EAAMC,EAAS,CAC1B,GAAI,GACJ,OAAQ,KAER,MAAO,GACP,QAAS,GACT,KAAM,CAAA,CACR,CAAC,EAEYC,EAAYC,EAAS,IAAMC,EAAMJ,EAAI,IAAI,CAAC,EAG1CK,EAAMF,EAAS,IAAMG,EAAON,EAAI,EAAE,CAAC,EAEnCO,EAAWJ,EAAS,IAAA,OAAM,QAAAK,EAAAR,EAAI,SAAJ,YAAAQ,EAAY,QAAS,SAAQ,EAEvDC,EAAmBN,EAAS,IAAA,OACtC,SAAAK,EAAAR,EAAI,SAAJ,YAAAQ,EAAY,OAAQ,CAAA,GAAI,OAAQE,GAAM,CAACA,EAAE,UAAU,EAAE,IAAKA,GAAMA,EAAE,IAAI,EACzE,EAEA,eAAsBC,GAA4B,CAChD,MAAMC,EAAKZ,EAAI,GACfA,EAAI,QAAU,GACd,MAAMa,EAAI,MAAMC,EAAI,IAAgB,oBAAoB,mBAAmBF,CAAE,CAAC,GAAGV,EAAU,KAAK,EAAE,EAGlG,GAAIF,EAAI,KAAOY,EAAI,OAGnB,GAFAZ,EAAI,QAAU,GAEV,CAACa,EAAE,GAAI,CACTb,EAAI,OAAS,KACbA,EAAI,MAAQe,EAAQF,EAAG,wBAAwBD,CAAE,EAAE,EACnD,MACF,CACAZ,EAAI,MAAQ,GACZ,MAAMgB,EAAIH,EAAE,KACZb,EAAI,OAAS,CACX,GAAIgB,EAAE,IAAMJ,EACZ,KAAMI,EAAE,OAAS,SAAW,SAAW,WACvC,UAAWA,EAAE,UACb,UAAWA,EAAE,UACb,MAAO,OAAOA,EAAE,OAAU,SAAWA,EAAE,MAAQ,GAC/C,KAAMA,EAAE,MAAQ,KAChB,aAAcA,EAAE,cAAgB,KAChC,MAAOA,EAAE,OAAS,KAClB,OAAQA,EAAE,QAAU,KACpB,QAASA,EAAE,QACP,CACE,KAAMA,EAAE,QAAQ,MAAQ,IACxB,SAAUA,EAAE,QAAQ,UAAY,CAAA,EAChC,SAAUA,EAAE,QAAQ,UAAY,CAAA,CAAC,EAEnC,KACJ,SAAU,MAAM,QAAQA,EAAE,QAAQ,EAAIA,EAAE,SAAW,CAAA,EACnD,MAAO,MAAM,QAAQA,EAAE,IAAI,EAAIA,EAAE,KAAO,CAAA,GAAI,IAAKN,IAAO,CACtD,KAAMA,EAAE,KACR,MAAO,MAAM,QAAQA,EAAE,KAAK,EAAIA,EAAE,MAAQ,CAAA,EAG1C,WAAYA,EAAE,aAAe,MAAM,QAAQA,EAAE,KAAK,GAAKA,EAAE,MAAM,SAAS,aAAa,EAAA,EACrF,EACF,IAAK,MAAM,QAAQM,EAAE,GAAG,EAAIA,EAAE,IAAM,CAAA,CAAC,CAEzC,CAGO,SAASC,EAAeL,EAAkB,CAC3CZ,EAAI,KAAOY,IAAOZ,EAAI,QAAUA,EAAI,SACxCA,EAAI,GAAKY,EACTZ,EAAI,OAAS,KACbA,EAAI,MAAQ,GACZA,EAAI,KAAOkB,EAASN,CAAE,EACjBD,EAAA,EACP,CAEO,SAASQ,GAAoB,CAClCC,EAAUpB,EAAI,GAAIA,EAAI,IAAI,CAC5B,CAEO,SAASqB,GAAkB,CAChCF,EAAA,EACKR,EAAA,CACP"}

package/dist/index.html

@@ -27,7 +27,7 @@
         /* private mode: fall through to the OS preference */
       }
     </script>
-    <script type="module" crossorigin src="/assets/index-9Ra4jfL4.js"></script>
+    <script type="module" crossorigin src="/assets/index-BXPaPWhH.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B_k9b7xG.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samyx/preview-stacks-ui",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "private": false,
   "description": "The advanced web UI for preview-stacks — an opt-in SPA that talks to the pstack HTTP API.",
   "type": "module",

package/dist/assets/RuntimeTab-CeJS5wuv.js

@@ -1,2 +0,0 @@
-import{s as P}from"./useFormat-DIlTY5Dl.js";import{d as K,J as W,s as O,c as o,z as k,g as u,F as p,a as s,y as f,f as l,t as a,e as y,w as g,_ as x,r as $,j as R,k as H,o as n,D as z,E as T,u as S,n as U,C as L,O as A}from"./index-9Ra4jfL4.js";import{d as b,v as D}from"./useDeployment-DFOIiXrd.js";import{_ as M}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js";import{_ as I}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as j}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as J}from"./RefreshButton.vue_vue_type_script_setup_true_lang-DpeOKN8U.js";import"./useVars-VN9gYdR6.js";const Q={key:0,class:"banner warn"},q={key:0,class:"banner ok"},G={class:"panel"},X={class:"phead"},Y={class:"mute",style:{"font-size":"var(--t-sm)"}},Z={key:0,class:"cards"},ee={class:"stagger"},te={"data-label":"url"},se=["href"],ne={key:1,class:"mono mute"},oe={key:0,class:"mute"},ae={"data-label":"forwards to"},re={key:0,class:"mono"},le={key:1,class:"s-failed"},ie={class:"mute",style:{"font-size":"var(--t-sm)"}},de={"data-label":"router"},ue={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},me={"data-label":"tls"},pe={key:0,class:"badge ok"},he={key:1,class:"badge off"},ve={key:1,class:"banner warn"},fe={class:"panel"},ge={class:"phead"},ke={class:"mute",style:{"font-size":"var(--t-sm)"}},ye={key:0,class:"cards"},be={key:0},ce={class:"stagger"},_e={class:"name","data-label":"service"},we={class:"mute",style:{"font-size":"var(--t-sm)"}},$e={key:0,"data-label":"node"},Re={key:0,class:"badge",title:"runs on another swarm node — logs reach it through the manager; a shell and stop/start do not"},Se={"data-label":"state"},Ce={"data-label":"ports"},Te={class:"mono"},Ie={key:0,class:"mute"},Ne={key:0,class:"mute"},Pe={"data-label":"networks"},xe={key:0,class:"mute mono",style:{"font-size":"var(--t-sm)"}},ze={class:"dim","data-label":"image"},Ue={class:"row-actions","data-label":""},Le={key:0,class:"mute",style:{"font-size":"var(--t-sm)"},title:"runs on another swarm node — redeploy the stack, or act on the worker itself"},Ae=["href"],De={key:1,class:"mute"},je=K({__name:"RuntimeTab",setup(Be){const i=$(null),c=$(""),_=$(!0);async function w(){const r=await U.get(`/api/deployments/${encodeURIComponent(b.id)}/runtime${D.value}`);if(_.value=!1,!r.ok){c.value=L(r,"inspect what is running");return}c.value="",i.value=r.body}W(()=>b.id,()=>{_.value=!0,w()},{immediate:!0}),O(()=>void w(),8e3);const B=R(()=>{var r;return((r=i.value)==null?void 0:r.findings.filter(e=>e.level==="error"))??[]}),E=R(()=>{var r;return((r=i.value)==null?void 0:r.findings.filter(e=>e.level==="warn"))??[]}),V=R(()=>{var r;return((r=i.value)==null?void 0:r.findings.filter(e=>e.level==="info"))??[]}),F=R(()=>{var r;return((r=i.value)==null?void 0:r.containers.filter(e=>e.state==="running").length)??0}),v=$("");async function C(r,e){v.value=`${e}:${r.name}`;const m=await U.post(`/api/deployments/${encodeURIComponent(b.id)}/containers/${encodeURIComponent(r.name)}/${e}${D.value}`);if(v.value="",!m.ok){A("error",L(m,`${e} ${r.name}`));return}A("ok",m.body.note??`${r.name}: ${e} done.`),w()}function N(r){var m;const e=(m=i.value)==null?void 0:m.routes.filter(t=>t.container===r.name).flatMap(t=>t.hosts).find(t=>!t.startsWith("(pattern)"));return e?`https://${e}`:null}return(r,e)=>{const m=H("RouterLink");return n(),o("div",null,[c.value?(n(),k(j,{key:0,text:c.value,title:"Could not inspect this deployment."},null,8,["text"])):u("",!0),_.value&&!i.value?(n(),k(M,{key:1,rows:5})):i.value?(n(),o(p,{key:2},[i.value.reachable?(n(),o(p,{key:1},[(n(!0),o(p,null,f(B.value,(t,h)=>(n(),o("div",{key:`e${h}`,class:"banner failed"},[e[1]||(e[1]=s("b",null,"Blocking",-1)),s("p",null,a(t.message),1)]))),128)),(n(!0),o(p,null,f(E.value,(t,h)=>(n(),o("div",{key:`w${h}`,class:"banner warn"},[e[2]||(e[2]=s("b",null,"Worth checking",-1)),s("p",null,a(t.message),1)]))),128)),(n(!0),o(p,null,f(V.value,(t,h)=>(n(),o("div",{key:`i${h}`,class:"banner plain"},[s("p",null,a(t.message),1)]))),128)),!i.value.findings.length&&i.value.containers.length?(n(),o("div",q,[...e[3]||(e[3]=[s("b",null,"Nothing looks wrong.",-1),s("p",null," Every container is attached to the ingress network and every router has a rule and a port. If a hostname still fails, the next suspects are DNS and the certificate. ",-1)])])):u("",!0),s("section",G,[s("div",X,[e[5]||(e[5]=s("h2",{class:"section"},"Routing",-1)),e[6]||(e[6]=s("span",{class:"grow"},null,-1)),s("span",Y,[l(" TLS: "+a(i.value.challenge==="unknown"?"unknown":i.value.challenge)+" ",1),y(x,{label:"why the TLS mode matters here",align:"end"},{default:g(()=>[...e[4]||(e[4]=[l(" Under HTTP-01 every per-PR router needs ",-1),s("code",null,"tls.certresolver=le",-1),l(", because each hostname resolves its own certificate. Under DNS-01 that inverts — one always-on router holds the wildcard, and a per-PR certresolver makes each PR order its own and burn the weekly limit. Read from the running Traefik's own flags, not configured here. ",-1)])]),_:1})])]),i.value.routes.length?(n(),o("table",Z,[s("thead",null,[s("tr",null,[e[9]||(e[9]=s("th",null,"URL",-1)),s("th",null,[e[8]||(e[8]=l(" Forwards to ",-1)),y(x,{label:"how a URL reaches a port"},{default:g(()=>[...e[7]||(e[7]=[l(" Traefik's docker provider resolves the container's IP on ",-1),s("code",null,"preview-ingress",-1),l(" and dials it on the port from ",-1),s("code",null,"loadbalancer.server.port",-1),l(" — it does ",-1),s("em",null,"not",-1),l(" use ",-1),s("code",null,"service:port",-1),l(" DNS. So the port here is the one inside the container, and publishing a host port is unnecessary. ",-1)])]),_:1})]),e[10]||(e[10]=s("th",null,"Router",-1)),e[11]||(e[11]=s("th",null,"TLS",-1))])]),s("tbody",ee,[(n(!0),o(p,null,f(i.value.routes,(t,h)=>(n(),o("tr",{key:t.router,style:z({"--i":h})},[s("td",te,[(n(!0),o(p,null,f(t.hosts,d=>(n(),o("div",{key:d},[d.startsWith("(pattern)")?(n(),o("span",ne,a(d),1)):(n(),o("a",{key:0,href:`https://${d}`,target:"_blank",rel:"noreferrer"},a(d),9,se))]))),128)),t.hosts.length?u("",!0):(n(),o("span",oe,"no host in the rule"))]),s("td",ae,[t.target?(n(),o("span",re,a(t.target),1)):(n(),o("span",le,a(t.port===null?"no port declared":"not on the ingress network"),1)),s("div",ie,a(t.container),1)]),s("td",de,[l(a(t.router)+" ",1),t.priority?(n(),o("div",ue," priority "+a(t.priority),1)):u("",!0)]),s("td",me,[t.tls?(n(),o("span",pe,a(t.certresolver||"inherited"),1)):(n(),o("span",he,"off"))])],4))),128))])])):(n(),o("div",ve,[e[17]||(e[17]=s("b",null,"No routes. Traefik has not been told about this deployment.",-1)),s("p",null,[e[13]||(e[13]=l(" Routes come from labels in ",-1)),e[14]||(e[14]=s("em",null,"your",-1)),e[15]||(e[15]=l(" compose file, not from pstack and not from the ",-1)),y(m,{to:"/routing"},{default:g(()=>[...e[12]||(e[12]=[l("Routing",-1)])]),_:1}),e[16]||(e[16]=l(" page (that is Traefik's file provider — middleware and TLS options, not per-PR routers). A reachable service needs four things: ",-1))]),e[18]||(e[18]=s("pre",{class:"code"},"labels:\n  - traefik.enable=true                     # the host runs exposedbydefault=false\n  - traefik.docker.network=preview-ingress  # which network Traefik should dial\n  - traefik.http.routers.<name>-${STACK}.rule=Host(`<name>-${STACK}.${PREVIEW_DOMAIN}`)\n  - traefik.http.services.<name>-${STACK}.loadbalancer.server.port=80\nnetworks: [default, preview-ingress]        # and preview-ingress: { external: true }",-1)),e[19]||(e[19]=s("p",{class:"mute"},[l(" Put "),s("code",null,"${STACK}"),l(" in the router and service names: Traefik's namespace is global across the host, so two deployments sharing a router name serve each other's containers. ")],-1))]))]),s("section",fe,[s("div",ge,[e[20]||(e[20]=s("h2",{class:"section"},"Containers",-1)),e[21]||(e[21]=s("span",{class:"grow"},null,-1)),s("span",ke,a(F.value)+" of "+a(i.value.containers.length)+" running ",1),y(J,{run:w,busy:_.value},null,8,["busy"])]),i.value.containers.length?(n(),o("table",ye,[s("thead",null,[s("tr",null,[e[22]||(e[22]=s("th",null,"Service",-1)),e[23]||(e[23]=s("th",null,"State",-1)),i.value.containers.some(t=>t.node)?(n(),o("th",be,"Node")):u("",!0),e[24]||(e[24]=s("th",null,"Ports",-1)),e[25]||(e[25]=s("th",null,"Networks",-1)),e[26]||(e[26]=s("th",null,"Image",-1)),e[27]||(e[27]=s("th",{"aria-label":"Actions"},null,-1))])]),s("tbody",ce,[(n(!0),o(p,null,f(i.value.containers,(t,h)=>(n(),o("tr",{key:t.id,style:z({"--i":h})},[s("td",_e,[l(a(t.service??t.name)+" ",1),s("div",we,a(t.name),1)]),i.value.containers.some(d=>d.node)?(n(),o("td",$e,[l(a(t.node??"—")+" ",1),t.remote?(n(),o("span",Re,"remote")):u("",!0)])):u("",!0),s("td",Se,[s("span",{class:T(t.state==="running"?"s-ok":"s-failed")},a(S(P)(t.state)),3),t.health&&t.state==="running"?(n(),o("div",{key:0,class:T(["mute",t.health==="healthy"?"s-ok":"s-failed"]),style:{"font-size":"var(--t-sm)"}},a(S(P)(t.health)),3)):u("",!0)]),s("td",Ce,[(n(!0),o(p,null,f(t.ports,d=>(n(),o("div",{key:`${d.containerPort}/${d.protocol}`},[s("span",Te,a(d.containerPort),1),d.hostPort?(n(),o("span",Ie," ← host "+a(d.hostPort),1)):u("",!0)]))),128)),t.ports.length?u("",!0):(n(),o("span",Ne,"none exposed"))]),s("td",Pe,[(n(!0),o(p,null,f(t.networks,d=>(n(),o("div",{key:d},[s("span",{class:T(d==="preview-ingress"?"s-ok":"")},a(d),3)]))),128)),t.ingressIp?(n(),o("div",xe,a(t.ingressIp),1)):u("",!0)]),s("td",ze,a(t.image),1),s("td",Ue,[t.remote?(n(),o("span",Le," on "+a(t.node),1)):t.state!=="running"?(n(),k(I,{key:1,class:"sm",variant:"ghost",pending:v.value===`start:${t.name}`,disabled:!!v.value,confirm:"Start it?",onRun:d=>C(t,"start")},{default:g(()=>[...e[28]||(e[28]=[l(" Start ",-1)])]),_:1},8,["pending","disabled","onRun"])):(n(),k(I,{key:2,class:"sm",variant:"ghost",pending:v.value===`stop:${t.name}`,disabled:!!v.value,confirm:"Stop it?",title:"Stops this container only. It stays stopped until something starts it.",onRun:d=>C(t,"stop")},{default:g(()=>[...e[29]||(e[29]=[l(" Stop ",-1)])]),_:1},8,["pending","disabled","onRun"])),t.remote?u("",!0):(n(),k(I,{key:3,class:"sm",variant:"ghost",pending:v.value===`restart:${t.name}`,disabled:!!v.value,confirm:"Restart it?",onRun:d=>C(t,"restart")},{default:g(()=>[...e[30]||(e[30]=[l(" Restart ",-1)])]),_:1},8,["pending","disabled","onRun"])),y(m,{class:"btn sm ghost",to:`/deployments/${encodeURIComponent(S(b).id)}/logs?container=${encodeURIComponent(t.name)}`},{default:g(()=>[...e[31]||(e[31]=[l(" Logs ",-1)])]),_:1},8,["to"]),t.state==="running"&&!t.remote?(n(),k(m,{key:4,class:"btn sm ghost",to:`/deployments/${encodeURIComponent(S(b).id)}/terminal?container=${encodeURIComponent(t.name)}`},{default:g(()=>[...e[32]||(e[32]=[l(" Shell ",-1)])]),_:1},8,["to"])):u("",!0),t.state==="running"&&N(t)?(n(),o("a",{key:5,class:"btn sm ghost",href:N(t),target:"_blank",rel:"noreferrer"}," Open ",8,Ae)):u("",!0)])],4))),128))])])):(n(),o("p",De," No containers for this stack. If you expected some, check that their profile is one the spec selects — a service behind a profile that is not enabled is never started. "))])],64)):(n(),o("div",Q,[...e[0]||(e[0]=[s("b",null,"Docker did not answer.",-1),s("p",null," Nothing below could be determined — this is not the same as nothing running. Check the daemon and the socket mount, then refresh. ",-1)])]))],64)):u("",!0)])}}});export{je as default};
-//# sourceMappingURL=RuntimeTab-CeJS5wuv.js.map

package/dist/assets/RuntimeTab-CeJS5wuv.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RuntimeTab-CeJS5wuv.js","sources":["../../src/views/tabs/RuntimeTab.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * What is actually running, and what Traefik was actually told about it.\n *\n * THE QUESTION THIS ANSWERS. \"The hostname does not work.\" Nothing in this UI could answer it: the\n * registry shows what was *submitted*, the logs show what the container *says*, and the reason a\n * request 404s is in neither — it is in the container's Traefik labels, which pstack never writes.\n *\n * The routing table is the direct answer to \"which URL maps to which port\". Traefik does **not** dial\n * `service_name:port`: its docker provider resolves the container's IP on the ingress network and\n * dials that, on the port from the `loadbalancer.server.port` label. That is why a service must be\n * attached to `preview-ingress`, why the port is the *container-internal* one, and why publishing a\n * host port is unnecessary. The `target` column shows the address Traefik assembled, so a missing\n * half is visible rather than inferred.\n *\n * Findings come first because they are the reason anyone opened this tab.\n */\nimport { computed, ref, watch } from 'vue';\nimport { sentence } from '../../composables/useFormat';\nimport { api, problem } from '../../api/client';\nimport type { RuntimeContainer, RuntimeResponse } from '../../api/types';\nimport { dep, varsQuery } from '../../composables/useDeployment';\nimport { usePolling } from '../../composables/usePolling';\nimport SkeletonList from '../../components/SkeletonList.vue';\nimport ActionButton from '../../components/ActionButton.vue';\nimport ErrorNote from '../../components/ErrorNote.vue';\nimport InfoHint from '../../components/InfoHint.vue';\nimport { toast } from '../../composables/useToasts';\nimport RefreshButton from '../../components/RefreshButton.vue';\n\nconst rt = ref<RuntimeResponse | null>(null);\nconst error = ref('');\nconst loading = ref(true);\n\nasync function load(): Promise<void> {\n  const r = await api.get<RuntimeResponse>(\n    `/api/deployments/${encodeURIComponent(dep.id)}/runtime${varsQuery.value}`,\n  );\n  loading.value = false;\n  if (!r.ok) {\n    error.value = problem(r, 'inspect what is running');\n    return;\n  }\n  error.value = '';\n  rt.value = r.body;\n}\n\nwatch(() => dep.id, () => { loading.value = true; void load(); }, { immediate: true });\n// Containers change state during a deploy; the poll pauses itself when the tab is hidden.\nusePolling(() => void load(), 8000);\n\nconst errors = computed(() => rt.value?.findings.filter((f) => f.level === 'error') ?? []);\nconst warns = computed(() => rt.value?.findings.filter((f) => f.level === 'warn') ?? []);\nconst infos = computed(() => rt.value?.findings.filter((f) => f.level === 'info') ?? []);\nconst running = computed(() => rt.value?.containers.filter((c) => c.state === 'running').length ?? 0);\n\n/**\n * One container action in flight, as `action:name`.\n *\n * A single ref rather than a per-row flag: two `docker restart`s racing on the same stack is not\n * something to make easy, and the readiness watch each one starts would fight the other.\n */\nconst busy = ref('');\n\nasync function act(c: RuntimeContainer, action: 'start' | 'stop' | 'restart'): Promise<void> {\n  busy.value = `${action}:${c.name}`;\n  const r = await api.post<{ note?: string }>(\n    `/api/deployments/${encodeURIComponent(dep.id)}/containers/${encodeURIComponent(c.name)}/${action}${varsQuery.value}`,\n  );\n  busy.value = '';\n  if (!r.ok) {\n    // Docker's own words. \"Already started\" and \"no such container\" are different problems and it\n    // says both better than this layer could.\n    toast('error', problem(r, `${action} ${c.name}`));\n    return;\n  }\n  toast('ok', r.body.note ?? `${c.name}: ${action} done.`);\n  // Read the table back rather than assuming the new state: a container that exits again immediately\n  // is exactly the case worth seeing, and the 8s poll would show it a beat later anyway.\n  void load();\n}\n\n/**\n * The hostname Traefik actually routes to this container, or null.\n *\n * Built from the ROUTES rather than guessed from the container: a router's rule is the only thing\n * that decides what URL reaches it, and a link assembled from a service name and a domain would be\n * a plausible-looking 404. Pattern hosts (`HostRegexp`) are skipped for the same reason — there is\n * no single address to send someone to.\n */\nfunction urlFor(c: RuntimeContainer): string | null {\n  const host = rt.value?.routes\n    .filter((r) => r.container === c.name)\n    .flatMap((r) => r.hosts)\n    .find((h) => !h.startsWith('(pattern)'));\n  return host ? `https://${host}` : null;\n}\n</script>\n\n<template>\n  <div>\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Could not inspect this deployment.\" />\n    <SkeletonList v-if=\"loading && !rt\" :rows=\"5\" />\n\n    <template v-else-if=\"rt\">\n      <!--\n        `reachable: false` is not \"nothing is running\". The stack may be perfectly healthy while this\n        process cannot reach the Docker socket, and reporting that as empty is how a UI tells someone\n        their live preview is gone.\n      -->\n      <div v-if=\"!rt.reachable\" class=\"banner warn\">\n        <b>Docker did not answer.</b>\n        <p>\n          Nothing below could be determined — this is not the same as nothing running. Check the\n          daemon and the socket mount, then refresh.\n        </p>\n      </div>\n\n      <template v-else>\n        <!-- Findings first: this tab exists because something is not working. -->\n        <div v-for=\"(f, i) in errors\" :key=\"`e${i}`\" class=\"banner failed\">\n          <b>Blocking</b>\n          <p>{{ f.message }}</p>\n        </div>\n        <div v-for=\"(f, i) in warns\" :key=\"`w${i}`\" class=\"banner warn\">\n          <b>Worth checking</b>\n          <p>{{ f.message }}</p>\n        </div>\n        <div v-for=\"(f, i) in infos\" :key=\"`i${i}`\" class=\"banner plain\">\n          <p>{{ f.message }}</p>\n        </div>\n        <div v-if=\"!rt.findings.length && rt.containers.length\" class=\"banner ok\">\n          <b>Nothing looks wrong.</b>\n          <p>\n            Every container is attached to the ingress network and every router has a rule and a port.\n            If a hostname still fails, the next suspects are DNS and the certificate.\n          </p>\n        </div>\n\n        <!-- ============================ routing ============================ -->\n        <section class=\"panel\">\n          <div class=\"phead\">\n            <h2 class=\"section\">Routing</h2>\n            <span class=\"grow\" />\n            <span class=\"mute\" style=\"font-size: var(--t-sm)\">\n              TLS: {{ rt.challenge === 'unknown' ? 'unknown' : rt.challenge }}\n              <InfoHint label=\"why the TLS mode matters here\" align=\"end\">\n                Under HTTP-01 every per-PR router needs <code>tls.certresolver=le</code>, because each\n                hostname resolves its own certificate. Under DNS-01 that inverts — one always-on router\n                holds the wildcard, and a per-PR certresolver makes each PR order its own and burn the\n                weekly limit. Read from the running Traefik's own flags, not configured here.\n              </InfoHint>\n            </span>\n          </div>\n\n          <table v-if=\"rt.routes.length\" class=\"cards\">\n            <thead>\n              <tr>\n                <th>URL</th>\n                <th>\n                  Forwards to\n                  <InfoHint label=\"how a URL reaches a port\">\n                    Traefik's docker provider resolves the container's IP on\n                    <code>preview-ingress</code> and dials it on the port from\n                    <code>loadbalancer.server.port</code> — it does <em>not</em> use\n                    <code>service:port</code> DNS. So the port here is the one inside the container,\n                    and publishing a host port is unnecessary.\n                  </InfoHint>\n                </th>\n                <th>Router</th>\n                <th>TLS</th>\n              </tr>\n            </thead>\n            <tbody class=\"stagger\">\n              <tr v-for=\"(r, i) in rt.routes\" :key=\"r.router\" :style=\"{ '--i': i }\">\n                <td data-label=\"url\">\n                  <div v-for=\"h in r.hosts\" :key=\"h\">\n                    <a v-if=\"!h.startsWith('(pattern)')\" :href=\"`https://${h}`\" target=\"_blank\" rel=\"noreferrer\">\n                      {{ h }}\n                    </a>\n                    <span v-else class=\"mono mute\">{{ h }}</span>\n                  </div>\n                  <span v-if=\"!r.hosts.length\" class=\"mute\">no host in the rule</span>\n                </td>\n                <td data-label=\"forwards to\">\n                  <span v-if=\"r.target\" class=\"mono\">{{ r.target }}</span>\n                  <span v-else class=\"s-failed\">\n                    {{ r.port === null ? 'no port declared' : 'not on the ingress network' }}\n                  </span>\n                  <div class=\"mute\" style=\"font-size: var(--t-sm)\">{{ r.container }}</div>\n                </td>\n                <td data-label=\"router\">\n                  {{ r.router }}\n                  <div v-if=\"r.priority\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n                    priority {{ r.priority }}\n                  </div>\n                </td>\n                <td data-label=\"tls\">\n                  <span v-if=\"r.tls\" class=\"badge ok\">{{ r.certresolver || 'inherited' }}</span>\n                  <span v-else class=\"badge off\">off</span>\n                </td>\n              </tr>\n            </tbody>\n          </table>\n\n          <!--\n            The reported failure, stated where it will be looked for. pstack does not write these\n            labels — the deployment's own compose file does — so the fix is in the user's file.\n          -->\n          <div v-else class=\"banner warn\">\n            <b>No routes. Traefik has not been told about this deployment.</b>\n            <p>\n              Routes come from labels in <em>your</em> compose file, not from pstack and not from the\n              <RouterLink to=\"/routing\">Routing</RouterLink> page (that is Traefik's file provider —\n              middleware and TLS options, not per-PR routers). A reachable service needs four things:\n            </p>\n            <pre class=\"code\">labels:\n  - traefik.enable=true                     # the host runs exposedbydefault=false\n  - traefik.docker.network=preview-ingress  # which network Traefik should dial\n  - traefik.http.routers.&lt;name&gt;-${STACK}.rule=Host(`&lt;name&gt;-${STACK}.${PREVIEW_DOMAIN}`)\n  - traefik.http.services.&lt;name&gt;-${STACK}.loadbalancer.server.port=80\nnetworks: [default, preview-ingress]        # and preview-ingress: { external: true }</pre>\n            <p class=\"mute\">\n              Put <code>${STACK}</code> in the router and service names: Traefik's namespace is global\n              across the host, so two deployments sharing a router name serve each other's containers.\n            </p>\n          </div>\n        </section>\n\n        <!-- ============================ containers ============================ -->\n        <section class=\"panel\">\n          <div class=\"phead\">\n            <h2 class=\"section\">Containers</h2>\n            <span class=\"grow\" />\n            <span class=\"mute\" style=\"font-size: var(--t-sm)\">\n              {{ running }} of {{ rt.containers.length }} running\n            </span>\n            <RefreshButton :run=\"load\" :busy=\"loading\" />\n          </div>\n\n          <table v-if=\"rt.containers.length\" class=\"cards\">\n            <thead>\n              <tr>\n                <th>Service</th>\n                <th>State</th>\n                <th v-if=\"rt.containers.some((c) => c.node)\">Node</th>\n                <th>Ports</th>\n                <th>Networks</th>\n                <th>Image</th>\n                <th aria-label=\"Actions\" />\n              </tr>\n            </thead>\n            <tbody class=\"stagger\">\n              <tr v-for=\"(c, i) in rt.containers\" :key=\"c.id\" :style=\"{ '--i': i }\">\n                <td class=\"name\" data-label=\"service\">\n                  {{ c.service ?? c.name }}\n                  <div class=\"mute\" style=\"font-size: var(--t-sm)\">{{ c.name }}</div>\n                </td>\n                <td v-if=\"rt.containers.some((x) => x.node)\" data-label=\"node\">\n                  {{ c.node ?? '—' }}\n                  <!-- A task on another node: listed from the manager, out of reach of exec/stop. -->\n                  <span v-if=\"c.remote\" class=\"badge\" title=\"runs on another swarm node — logs reach it through the manager; a shell and stop/start do not\">remote</span>\n                </td>\n                <td data-label=\"state\">\n                  <span :class=\"c.state === 'running' ? 's-ok' : 's-failed'\">{{ sentence(c.state) }}</span>\n                  <!--\n                    Health is only reported while it is RUNNING. Docker keeps the last probe result on\n                    a stopped container, so an exited one rendered \"Exited / Healthy\" — a stale reading\n                    presented beside the fact that contradicts it.\n                  -->\n                  <div\n                    v-if=\"c.health && c.state === 'running'\"\n                    class=\"mute\"\n                    style=\"font-size: var(--t-sm)\"\n                    :class=\"c.health === 'healthy' ? 's-ok' : 's-failed'\"\n                  >\n                    {{ sentence(c.health) }}\n                  </div>\n                </td>\n                <td data-label=\"ports\">\n                  <div v-for=\"p in c.ports\" :key=\"`${p.containerPort}/${p.protocol}`\">\n                    <span class=\"mono\">{{ p.containerPort }}</span>\n                    <span v-if=\"p.hostPort\" class=\"mute\"> ← host {{ p.hostPort }}</span>\n                  </div>\n                  <span v-if=\"!c.ports.length\" class=\"mute\">none exposed</span>\n                </td>\n                <td data-label=\"networks\">\n                  <div v-for=\"n in c.networks\" :key=\"n\">\n                    <span :class=\"n === 'preview-ingress' ? 's-ok' : ''\">{{ n }}</span>\n                  </div>\n                  <div v-if=\"c.ingressIp\" class=\"mute mono\" style=\"font-size: var(--t-sm)\">\n                    {{ c.ingressIp }}\n                  </div>\n                </td>\n                <td class=\"dim\" data-label=\"image\">{{ c.image }}</td>\n                <!--\n                  The three things anyone wants from a container row, without hunting for the tab\n                  that does it. Open goes to the URL Traefik actually assembled for THIS container\n                  (see `urlFor`), so it is absent rather than wrong when no router points here.\n                -->\n                <td class=\"row-actions\" data-label=\"\">\n                  <!--\n                    One container, not the service and not the stack. Start appears only when it is\n                    not running and Stop only when it is, so the control on screen is the one that\n                    would do something. Both destructive ones confirm in place.\n                  -->\n                  <!-- None of these reach a task on another node; docker's verbs are node-local. -->\n                  <span v-if=\"c.remote\" class=\"mute\" style=\"font-size: var(--t-sm)\" title=\"runs on another swarm node — redeploy the stack, or act on the worker itself\">\n                    on {{ c.node }}\n                  </span>\n                  <ActionButton\n                    v-else-if=\"c.state !== 'running'\"\n                    class=\"sm\"\n                    variant=\"ghost\"\n                    :pending=\"busy === `start:${c.name}`\"\n                    :disabled=\"!!busy\"\n                    confirm=\"Start it?\"\n                    @run=\"act(c, 'start')\"\n                  >\n                    Start\n                  </ActionButton>\n                  <ActionButton\n                    v-else\n                    class=\"sm\"\n                    variant=\"ghost\"\n                    :pending=\"busy === `stop:${c.name}`\"\n                    :disabled=\"!!busy\"\n                    confirm=\"Stop it?\"\n                    title=\"Stops this container only. It stays stopped until something starts it.\"\n                    @run=\"act(c, 'stop')\"\n                  >\n                    Stop\n                  </ActionButton>\n                  <ActionButton\n                    v-if=\"!c.remote\"\n                    class=\"sm\"\n                    variant=\"ghost\"\n                    :pending=\"busy === `restart:${c.name}`\"\n                    :disabled=\"!!busy\"\n                    confirm=\"Restart it?\"\n                    @run=\"act(c, 'restart')\"\n                  >\n                    Restart\n                  </ActionButton>\n                  <RouterLink\n                    class=\"btn sm ghost\"\n                    :to=\"`/deployments/${encodeURIComponent(dep.id)}/logs?container=${encodeURIComponent(c.name)}`\"\n                  >\n                    Logs\n                  </RouterLink>\n                  <RouterLink\n                    v-if=\"c.state === 'running' && !c.remote\"\n                    class=\"btn sm ghost\"\n                    :to=\"`/deployments/${encodeURIComponent(dep.id)}/terminal?container=${encodeURIComponent(c.name)}`\"\n                  >\n                    Shell\n                  </RouterLink>\n                  <!--\n                    Only while running: the router label survives a stopped container, so the URL\n                    still exists and answers 502. A link that is certain to fail is worse than no link.\n                  -->\n                  <a\n                    v-if=\"c.state === 'running' && urlFor(c)\"\n                    class=\"btn sm ghost\"\n                    :href=\"urlFor(c)!\"\n                    target=\"_blank\"\n                    rel=\"noreferrer\"\n                  >\n                    Open\n                  </a>\n                </td>\n              </tr>\n            </tbody>\n          </table>\n          <p v-else class=\"mute\">\n            No containers for this stack. If you expected some, check that their profile is one the\n            spec selects — a service behind a profile that is not enabled is never started.\n          </p>\n        </section>\n      </template>\n    </template>\n  </div>\n</template>\n"],"names":["rt","ref","error","loading","load","api","dep","varsQuery","problem","watch","usePolling","errors","computed","_a","f","warns","infos","running","c","busy","act","action","r","toast","urlFor","host","h","_createElementBlock","_createBlock","ErrorNote","SkeletonList","_Fragment","_openBlock","_renderList","i","_cache","_createElementVNode","_toDisplayString","_hoisted_2","_hoisted_3","_hoisted_4","_hoisted_5","_createVNode","InfoHint","_hoisted_6","_hoisted_7","_hoisted_8","_hoisted_10","_hoisted_9","_hoisted_11","_hoisted_12","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_component_RouterLink","_hoisted_22","_hoisted_23","_hoisted_24","RefreshButton","_hoisted_25","_hoisted_27","_hoisted_28","_createTextVNode","_hoisted_29","x","_hoisted_30","_hoisted_31","_hoisted_32","_normalizeClass","_unref","sentence","_hoisted_33","p","_hoisted_34","_hoisted_35","_hoisted_36","_hoisted_37","n","_hoisted_38","_hoisted_39","_hoisted_40","_hoisted_41","ActionButton","$event","_hoisted_42","_hoisted_43","_hoisted_1"],"mappings":"ooEA8BA,MAAMA,EAAKC,EAA4B,IAAI,EACrCC,EAAQD,EAAI,EAAE,EACdE,EAAUF,EAAI,EAAI,EAExB,eAAeG,GAAsB,CACnC,MAAM,EAAI,MAAMC,EAAI,IAClB,oBAAoB,mBAAmBC,EAAI,EAAE,CAAC,WAAWC,EAAU,KAAK,EAAA,EAG1E,GADAJ,EAAQ,MAAQ,GACZ,CAAC,EAAE,GAAI,CACTD,EAAM,MAAQM,EAAQ,EAAG,yBAAyB,EAClD,MACF,CACAN,EAAM,MAAQ,GACdF,EAAG,MAAQ,EAAE,IACf,CAEAS,EAAM,IAAMH,EAAI,GAAI,IAAM,CAAEH,EAAQ,MAAQ,GAAWC,EAAA,CAAQ,EAAG,CAAE,UAAW,GAAM,EAErFM,EAAW,IAAM,KAAKN,EAAA,EAAQ,GAAI,EAElC,MAAMO,EAASC,EAAS,WAAM,QAAAC,EAAAb,EAAG,QAAH,YAAAa,EAAU,SAAS,OAAQC,GAAMA,EAAE,QAAU,WAAY,CAAA,EAAE,EACnFC,EAAQH,EAAS,WAAM,QAAAC,EAAAb,EAAG,QAAH,YAAAa,EAAU,SAAS,OAAQC,GAAMA,EAAE,QAAU,UAAW,CAAA,EAAE,EACjFE,EAAQJ,EAAS,WAAM,QAAAC,EAAAb,EAAG,QAAH,YAAAa,EAAU,SAAS,OAAQC,GAAMA,EAAE,QAAU,UAAW,CAAA,EAAE,EACjFG,EAAUL,EAAS,IAAA,OAAM,QAAAC,EAAAb,EAAG,QAAH,YAAAa,EAAU,WAAW,OAAQK,GAAMA,EAAE,QAAU,WAAW,SAAU,EAAC,EAQ9FC,EAAOlB,EAAI,EAAE,EAEnB,eAAemB,EAAIF,EAAqBG,EAAqD,CAC3FF,EAAK,MAAQ,GAAGE,CAAM,IAAIH,EAAE,IAAI,GAChC,MAAMI,EAAI,MAAMjB,EAAI,KAClB,oBAAoB,mBAAmBC,EAAI,EAAE,CAAC,eAAe,mBAAmBY,EAAE,IAAI,CAAC,IAAIG,CAAM,GAAGd,EAAU,KAAK,EAAA,EAGrH,GADAY,EAAK,MAAQ,GACT,CAACG,EAAE,GAAI,CAGTC,EAAM,QAASf,EAAQc,EAAG,GAAGD,CAAM,IAAIH,EAAE,IAAI,EAAE,CAAC,EAChD,MACF,CACAK,EAAM,KAAMD,EAAE,KAAK,MAAQ,GAAGJ,EAAE,IAAI,KAAKG,CAAM,QAAQ,EAGlDjB,EAAA,CACP,CAUA,SAASoB,EAAON,EAAoC,OAClD,MAAMO,GAAOZ,EAAAb,EAAG,QAAH,YAAAa,EAAU,OACpB,OAAQS,GAAMA,EAAE,YAAcJ,EAAE,MAChC,QAASI,GAAMA,EAAE,OACjB,KAAMI,GAAM,CAACA,EAAE,WAAW,WAAW,GACxC,OAAOD,EAAO,WAAWA,CAAI,GAAK,IACpC,kDAIEE,EAyRM,MAAA,KAAA,CAxRazB,EAAA,WAAjB0B,EAAmFC,EAAA,OAA1D,KAAM3B,EAAA,MAAO,MAAM,oCAAA,6BACxBC,EAAA,QAAYH,EAAA,WAAhC4B,EAAgDE,EAAA,OAAX,KAAM,CAAA,IAEtB9B,EAAA,WAArB2B,EAoRWI,EAAA,CAAA,IAAA,GAAA,CA9QG/B,EAAA,MAAG,eAQf2B,EAqQWI,EAAA,CAAA,IAAA,GAAA,EAnQTC,EAAA,EAAA,EAAAL,EAGMI,EAAA,KAAAE,EAHgBtB,EAAA,MAAM,CAAfG,EAAGoB,SAAhBP,EAGM,MAAA,CAHyB,QAASO,CAAC,GAAI,MAAM,eAAA,GACjDC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAC,EAAe,SAAZ,WAAQ,EAAA,GACXA,EAAsB,IAAA,KAAAC,EAAhBvB,EAAE,OAAO,EAAA,CAAA,CAAA,YAEjBkB,EAAA,EAAA,EAAAL,EAGMI,EAAA,KAAAE,EAHgBlB,EAAA,MAAK,CAAdD,EAAGoB,SAAhBP,EAGM,MAAA,CAHwB,QAASO,CAAC,GAAI,MAAM,aAAA,GAChDC,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAC,EAAqB,SAAlB,iBAAc,EAAA,GACjBA,EAAsB,IAAA,KAAAC,EAAhBvB,EAAE,OAAO,EAAA,CAAA,CAAA,YAEjBkB,EAAA,EAAA,EAAAL,EAEMI,EAAA,KAAAE,EAFgBjB,EAAA,MAAK,CAAdF,EAAGoB,SAAhBP,EAEM,MAAA,CAFwB,QAASO,CAAC,GAAI,MAAM,cAAA,GAChDE,EAAsB,IAAA,KAAAC,EAAhBvB,EAAE,OAAO,EAAA,CAAA,CAAA,YAELd,EAAA,MAAG,SAAS,QAAUA,EAAA,MAAG,WAAW,QAAhDgC,EAAA,EAAAL,EAMM,MANNW,EAMM,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,CALJC,EAA2B,SAAxB,uBAAoB,EAAA,EACvBA,EAGI,SAHD,yKAGH,EAAA,CAAA,eAIFA,EAuFU,UAvFVG,EAuFU,CAtFRH,EAYM,MAZNI,EAYM,CAXJL,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAC,EAAgC,KAAA,CAA5B,MAAM,SAAA,EAAU,UAAO,EAAA,eAC3BA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAQO,OARPK,EAQO,GAR2C,SAC3CJ,EAAGrC,QAAG,gCAAsCA,EAAA,MAAG,SAAS,EAAG,IAChE,CAAA,EAAA0C,EAKWC,EAAA,CALD,MAAM,gCAAgC,MAAM,KAAA,aAAM,IAClB,CAAA,GAAAR,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GADkB,4CAClB,EAAA,EAAAC,EAAgC,YAA1B,sBAAmB,EAAA,IAAO,+QAI1E,EAAA,CAAA,eAISpC,EAAA,MAAG,OAAO,QAAvBgC,IAAAL,EAgDQ,QAhDRiB,EAgDQ,CA/CNR,EAgBQ,QAAA,KAAA,CAfNA,EAcK,KAAA,KAAA,CAbHD,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAC,EAAY,UAAR,MAAG,EAAA,GACPA,EASK,KAAA,KAAA,eATD,gBAEF,EAAA,GAAAM,EAMWC,EAAA,CAND,MAAM,4BAA0B,WAAC,IAEzC,CAAA,GAAAR,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAFyC,6DAEzC,EAAA,EAAAC,EAA4B,YAAtB,kBAAe,EAAA,IAAO,kCAC5B,EAAA,EAAAA,EAAqC,YAA/B,2BAAwB,EAAA,IAAO,cAAW,EAAA,EAAAA,EAAY,UAAR,MAAG,EAAA,IAAK,QAC5D,EAAA,EAAAA,EAAyB,YAAnB,eAAY,EAAA,IAAO,sGAE3B,EAAA,CAAA,aAEFD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAe,UAAX,SAAM,EAAA,GACVD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAY,UAAR,MAAG,EAAA,EAAA,KAGXA,EA6BQ,QA7BRS,GA6BQ,EA5BNb,EAAA,EAAA,EAAAL,EA2BKI,SA3BgB/B,EAAA,MAAG,OAAM,CAAlBsB,EAAGY,SAAfP,EA2BK,KAAA,CA3B4B,IAAKL,EAAE,OAAS,eAAgBY,EAAC,CAAA,GAChEE,EAQK,KARLU,GAQK,EAPHd,EAAA,EAAA,EAAAL,EAKMI,EAAA,KAAAE,EALWX,EAAE,MAAPI,QAAZC,EAKM,MAAA,CALqB,IAAKD,GAAC,CACrBA,EAAE,WAAU,WAAA,OAGtBC,EAA6C,OAA7CoB,GAA6CV,EAAXX,CAAC,EAAA,CAAA,QAHnCC,EAEI,IAAA,OAFkC,gBAAiBD,CAAC,GAAI,OAAO,SAAS,IAAI,YAAA,IAC3EA,CAAC,EAAA,EAAAsB,EAAA,EAE6B,WAExB1B,EAAE,MAAM,qBAArBK,EAAoE,OAApEsB,GAA0C,qBAAmB,KAE/Db,EAMK,KANLc,GAMK,CALS5B,EAAE,QAAdU,EAAA,EAAAL,EAAwD,OAAxDwB,GAAwDd,EAAlBf,EAAE,MAAM,EAAA,CAAA,IAC9CU,EAAA,EAAAL,EAEO,OAFPyB,GAEOf,EADFf,EAAE,OAAI,KAAA,mBAAA,4BAAA,EAAA,CAAA,GAEXc,EAAwE,MAAxEiB,GAAwEhB,EAApBf,EAAE,SAAS,EAAA,CAAA,CAAA,GAEjEc,EAKK,KALLkB,GAKK,KAJAhC,EAAE,MAAM,EAAG,IACd,CAAA,EAAWA,EAAE,UAAbU,EAAA,EAAAL,EAEM,MAFN4B,GAAmE,aACxDlB,EAAGf,EAAE,QAAQ,EAAA,CAAA,cAG1Bc,EAGK,KAHLoB,GAGK,CAFSlC,EAAE,KAAdU,EAAA,EAAAL,EAA8E,OAA9E8B,GAA8EpB,EAAvCf,EAAE,cAAY,WAAA,EAAA,CAAA,QACrDK,EAAyC,OAAzC+B,GAA+B,KAAG,EAAA,qBAU1C1B,EAAA,EAAAL,EAiBM,MAjBNgC,GAiBM,CAhBJxB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAkE,SAA/D,8DAA2D,EAAA,GAC9DA,EAII,IAAA,KAAA,iBAJD,+BAC0B,EAAA,GAAAD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAa,UAAT,OAAI,EAAA,mBAAK,mDACxC,EAAA,GAAAM,EAA8CkB,EAAA,CAAlC,GAAG,YAAU,WAAC,IAAO,CAAA,GAAAzB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAP,UAAO,EAAA,CAAA,2BAAa,oIAEhD,EAAA,EAAA,GACAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAK+E,MAAA,CAL1E,MAAM,MAAA,EAAO,saAKuD,EAAA,iBACzEA,EAGI,IAAA,CAHD,MAAM,QAAM,GAAC,OACV,EAAAA,EAAqB,YAAf,UAAQ,IAAO,2JAE3B,CAAA,YAKJA,EAoJU,UApJVyB,GAoJU,CAnJRzB,EAOM,MAPN0B,GAOM,CANJ3B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAmC,KAAA,CAA/B,MAAM,SAAA,EAAU,aAAU,EAAA,iBAC9BA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAEO,OAFP2B,GAEO1B,EADFpB,EAAA,KAAO,EAAG,OAAIoB,EAAGrC,EAAA,MAAG,WAAW,MAAM,EAAG,YAC7C,CAAA,EACA0C,EAA6CsB,EAAA,CAA7B,IAAK5D,EAAO,KAAMD,EAAA,KAAA,qBAGvBH,EAAA,MAAG,WAAW,QAA3BgC,IAAAL,EAqIQ,QArIRsC,GAqIQ,CApIN7B,EAUQ,QAAA,KAAA,CATNA,EAQK,KAAA,KAAA,CAPHD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAgB,UAAZ,UAAO,EAAA,GACXD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAc,UAAV,QAAK,EAAA,GACCpC,EAAA,MAAG,WAAW,KAAMkB,GAAMA,EAAE,IAAI,GAA1Cc,EAAA,EAAAL,EAAsD,QAAT,MAAI,YACjDQ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAc,UAAV,QAAK,EAAA,GACTD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAiB,UAAb,WAAQ,EAAA,GACZD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAC,EAAc,UAAV,QAAK,EAAA,iBACTA,EAA2B,KAAA,CAAvB,aAAW,WAAS,KAAA,EAAA,EAAA,KAG5BA,EAwHQ,QAxHR8B,GAwHQ,EAvHNlC,EAAA,EAAA,EAAAL,EAsHKI,SAtHgB/B,EAAA,MAAG,WAAU,CAAtBkB,EAAGgB,SAAfP,EAsHK,KAAA,CAtHgC,IAAKT,EAAE,GAAK,eAAgBgB,EAAC,CAAA,GAChEE,EAGK,KAHL+B,GAGK,CAFAC,EAAA/B,EAAAnB,EAAE,SAAWA,EAAE,IAAI,EAAG,IACzB,CAAA,EAAAkB,EAAmE,MAAnEiC,GAAmEhC,EAAfnB,EAAE,IAAI,EAAA,CAAA,CAAA,GAElDlB,EAAA,MAAG,WAAW,KAAMsE,GAAMA,EAAE,IAAI,GAA1CtC,EAAA,EAAAL,EAIK,KAJL4C,GAIK,KAHArD,EAAE,MAAI,GAAA,EAAU,IAEnB,CAAA,EAAYA,EAAE,YAAdS,EAAuJ,OAAvJ6C,GAA0I,QAAM,wBAElJpC,EAeK,KAfLqC,GAeK,CAdHrC,EAAyF,OAAA,CAAlF,MAAKsC,EAAExD,EAAE,QAAK,UAAA,OAAA,UAAA,CAAA,IAAyCyD,EAAAC,CAAA,EAAS1D,EAAE,KAAK,CAAA,EAAA,CAAA,EAOtEA,EAAE,QAAUA,EAAE,QAAK,eAD3BS,EAOM,MAAA,OALJ,MAAK+C,EAAA,CAAC,OAEExD,EAAE,SAAM,UAAA,OAAA,UAAA,CAAA,EADhB,MAAA,CAAA,YAAA,aAAA,CAAA,IAGGyD,EAAAC,CAAA,EAAS1D,EAAE,MAAM,CAAA,EAAA,CAAA,cAGxBkB,EAMK,KANLyC,GAMK,EALH7C,EAAA,EAAA,EAAAL,EAGMI,EAAA,KAAAE,EAHWf,EAAE,MAAP4D,QAAZnD,EAGM,MAAA,CAHqB,OAAQmD,EAAE,aAAa,IAAIA,EAAE,QAAQ,EAAA,GAC9D1C,EAA+C,OAA/C2C,GAA+C1C,EAAzByC,EAAE,aAAa,EAAA,CAAA,EACzBA,EAAE,UAAd9C,EAAA,EAAAL,EAAoE,OAApEqD,GAAqC,WAAQ3C,EAAGyC,EAAE,QAAQ,EAAA,CAAA,sBAE/C5D,EAAE,MAAM,qBAArBS,EAA6D,OAA7DsD,GAA0C,cAAY,KAExD7C,EAOK,KAPL8C,GAOK,EANHlD,EAAA,EAAA,EAAAL,EAEMI,EAAA,KAAAE,EAFWf,EAAE,SAAPiE,QAAZxD,EAEM,MAAA,CAFwB,IAAKwD,GAAC,CAClC/C,EAAmE,OAAA,CAA5D,QAAO+C,IAAC,kBAAA,OAAA,EAAA,CAAA,IAAyCA,CAAC,EAAA,CAAA,CAAA,WAEhDjE,EAAE,WAAbc,EAAA,EAAAL,EAEM,MAFNyD,GAEM/C,EADDnB,EAAE,SAAS,EAAA,CAAA,cAGlBkB,EAAqD,KAArDiD,GAAqDhD,EAAfnB,EAAE,KAAK,EAAA,CAAA,EAM7CkB,EAsEK,KAtELkD,GAsEK,CA/DSpE,EAAE,QAAdc,IAAAL,EAEO,OAFP4D,GAAuJ,OAClJlD,EAAGnB,EAAE,IAAI,EAAA,CAAA,GAGDA,EAAE,QAAK,eADpBU,EAUe4D,EAAA,OARb,MAAM,KACN,QAAQ,QACP,QAASrE,EAAA,QAAI,SAAcD,EAAE,IAAI,GACjC,WAAYC,EAAA,MACb,QAAQ,YACP,MAAGsE,GAAErE,EAAIF,EAAC,OAAA,CAAA,aACZ,IAED,CAAA,GAAAiB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFC,UAED,EAAA,CAAA,kDACAP,EAWe4D,EAAA,OATb,MAAM,KACN,QAAQ,QACP,QAASrE,EAAA,QAAI,QAAaD,EAAE,IAAI,GAChC,WAAYC,EAAA,MACb,QAAQ,WACR,MAAM,yEACL,MAAGsE,GAAErE,EAAIF,EAAC,MAAA,CAAA,aACZ,IAED,CAAA,GAAAiB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFC,SAED,EAAA,CAAA,6CAESjB,EAAE,qBADXU,EAUe4D,EAAA,OARb,MAAM,KACN,QAAQ,QACP,QAASrE,EAAA,QAAI,WAAgBD,EAAE,IAAI,GACnC,WAAYC,EAAA,MACb,QAAQ,cACP,MAAGsE,GAAErE,EAAIF,EAAC,SAAA,CAAA,aACZ,IAED,CAAA,GAAAiB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFC,YAED,EAAA,CAAA,6CACAO,EAKakB,EAAA,CAJX,MAAM,eACL,GAAE,gBAAkB,mBAAmBe,EAAArE,CAAA,EAAI,EAAE,CAAA,mBAAoB,mBAAmBY,EAAE,IAAI,CAAA,EAAA,aAC5F,IAED,CAAA,GAAAiB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFC,SAED,EAAA,CAAA,oBAEQjB,EAAE,QAAK,WAAA,CAAmBA,EAAE,YADpCU,EAMagC,EAAA,OAJX,MAAM,eACL,GAAE,gBAAkB,mBAAmBe,EAAArE,CAAA,EAAI,EAAE,CAAA,uBAAwB,mBAAmBY,EAAE,IAAI,CAAA,EAAA,aAChG,IAED,CAAA,GAAAiB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFC,UAED,EAAA,CAAA,8BAMQjB,EAAE,QAAK,WAAkBM,EAAON,CAAC,OADzCS,EAQI,IAAA,OANF,MAAM,eACL,KAAMH,EAAON,CAAC,EACf,OAAO,SACP,IAAI,YAAA,EACL,SAED,EAAAwE,EAAA,oCAKR/D,EAGI,IAHJgE,GAAuB,2KAGvB,EAAA,UA3QJ3D,EAAA,EAAAL,EAMM,MANNiE,EAMM,CAAA,GAAAzD,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,CALJC,EAA6B,SAA1B,yBAAsB,EAAA,EACzBA,EAGI,SAHD,sIAGH,EAAA,CAAA"}

package/dist/assets/SsoView-D2yf-noE.js

@@ -1,2 +0,0 @@
-import{d as B,c as d,a as s,f as a,e as f,w as y,_ as O,z as C,g as p,F as V,t as k,i,I as N,v as r,y as H,r as u,n as S,C as R,O as w,j as W,o as n}from"./index-9Ra4jfL4.js";import{_ as z}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as G}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as P}from"./HelpModal.vue_vue_type_script_setup_true_lang-DEjnzS2A.js";import{_ as E}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BLfPhhAj.js";import{_ as F}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DjfNq2KM.js";import"./Teleport-BUn4ayOo.js";const Y={class:"page-head"},K={class:"sub"},q={class:"panel"},J={class:"row",style:{gap:"var(--s3)","align-items":"center"}},Q={class:"code",style:{flex:"1","overflow-x":"auto","white-space":"nowrap"}},X={class:"panel"},Z={class:"phead"},ee={class:"check"},se={class:"row",style:{gap:"var(--s4)","flex-wrap":"wrap"}},le={class:"field inline"},oe={key:0,class:"field inline"},te={class:"field inline"},ae={key:0,class:"hint"},ie={key:1,class:"field"},ne={class:"field"},re={class:"field"},de={class:"hint"},ue={class:"field"},pe={class:"field"},ve={class:"field"},me={class:"field"},ce={class:"field"},fe=["placeholder"],he={key:3},ye={class:"section",style:{"margin-top":"var(--s4)"}},be={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},ge=["for"],ke=["id","onUpdate:modelValue"],we={class:"panel"},Ue={class:"field"},xe={class:"row",style:{gap:"var(--s3)"}},Ie={key:0,class:"mute",style:{"font-size":"var(--t-sm)","margin-top":"var(--s3)"}},Ee=B({__name:"SsoView",setup(Ce){const A={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},U=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"github",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",scopes:"",claimMap:{...A},allowedEmailDomains:[],defaultRole:"admin"}),l=u(U()),m=u(""),h=u(""),b=u([]),x=u(""),c=u(!1),L=u(!1),v=u(""),g=u(!1);async function I(){const t=await S.get("/api/sso/config");if(L.value=!0,!t.ok){v.value=R(t,"read the sign-on settings");return}v.value="",b.value=t.body.presets??[],x.value=t.body.callbackUrl,c.value=t.body.configured,t.body.config&&(l.value={...U(),...t.body.config},h.value=(t.body.config.allowedEmailDomains??[]).join(", ")),m.value=t.body.clientSecret}I();function T(t){l.value.provider=t;const e=b.value.find(o=>o.key===t);if(!e){l.value.authorizeUrl="",l.value.tokenUrl="",l.value.userInfoUrl="",l.value.emailsUrl="",l.value.claimMap={...A};return}l.value.authorizeUrl=e.authorizeUrl,l.value.tokenUrl=e.tokenUrl,l.value.userInfoUrl=e.userInfoUrl??"",l.value.emailsUrl="",l.value.scopes=e.scopes,l.value.claimMap={...e.claimMap},(!l.value.label||b.value.some(o=>o.label===l.value.label))&&(l.value.label=e.label)}async function j(){g.value=!0;const t=await S.put("/api/sso/config",{...l.value,clientSecret:m.value,allowedEmailDomains:h.value.split(",").map(e=>e.trim()).filter(Boolean)});if(g.value=!1,!t.ok){v.value=R(t,"save the provider");return}v.value="",w("ok","Saved. The provider answered, so the settings are known good."),I()}async function D(){const t=await S.del("/api/sso/config");if(!t.ok){v.value=R(t,"remove the provider");return}w("ok","Removed. Existing accounts keep working."),l.value=U(),m.value="",h.value="",c.value=!1,I()}async function M(){try{await navigator.clipboard.writeText(x.value),w("ok","Copied.")}catch{w("error","Could not reach the clipboard — select the text and copy it.")}}const _=W(()=>!l.value.clientId.trim()||!m.value?!1:l.value.mode==="oidc"?!!l.value.discoveryUrl.trim():!!l.value.authorizeUrl.trim()&&!!l.value.tokenUrl.trim());return(t,e)=>(n(),d("div",null,[s("div",Y,[s("div",null,[s("h1",null,[e[14]||(e[14]=a(" Single sign-on ",-1)),f(P,{title:"How single sign-on works here"},{default:y(()=>[...e[13]||(e[13]=[s("p",null,[s("b",null,"This service is the relying party and nothing more."),a(" You register an OAuth or OIDC application in your own organisation and paste its client id and secret here. Your directory stays yours — no accounts are copied, and nothing is synchronised. ")],-1),s("p",null,[s("b",null,"Anyone who authenticates gets an account"),a(", created on their first sign-in. That is deliberate: your provider already decides who may authenticate (Workspace restricts to internal users, a GitHub app can be org-approved), and duplicating that policy here would just be a second list to keep in step. Narrow it with the allowed email domains below if you need to. ")],-1),s("p",null,[s("b",null,"Identity is the provider's subject, not the email."),a(" Someone changing their address keeps their account, their history and their tokens. An address is only used to adopt an account that already exists here, and only when the provider says it is verified. ")],-1),s("p",null,[s("b",null,"Nothing about local accounts changes."),a(" The admin credential, manually created users and personal API tokens all keep working exactly as they do now. ")],-1)])]),_:1})]),s("div",K,[e[16]||(e[16]=a(" Let people sign in with the identity provider you already run ",-1)),f(O,{label:"what is stored"},{default:y(()=>[...e[15]||(e[15]=[a(" One row: the endpoints, the client id, and the client secret. The secret has no read path — this page is shown a mask, and leaving it alone keeps what is stored. ",-1)])]),_:1})])])]),v.value?(n(),C(G,{key:0,text:v.value,title:"Single sign-on."},null,8,["text"])):p("",!0),L.value?(n(),d(V,{key:2},[s("section",q,[e[17]||(e[17]=s("div",{class:"phead"},[s("h2",{class:"section"},"Register this callback URL")],-1)),e[18]||(e[18]=s("p",{class:"dim"}," Paste this into your provider's application as the redirect / callback URL. It has to match exactly, and it is the same for every provider — a mismatch is the single most common reason the exchange fails, and the provider's error rarely says so. ",-1)),s("div",J,[s("code",Q,k(x.value),1),s("button",{onClick:M},"Copy")])]),s("section",X,[s("div",Z,[e[20]||(e[20]=s("h2",{class:"section"},"Provider",-1)),e[21]||(e[21]=s("span",{class:"grow"},null,-1)),s("label",ee,[i(s("input",{"onUpdate:modelValue":e[0]||(e[0]=o=>l.value.enabled=o),type:"checkbox"},null,512),[[N,l.value.enabled]]),e[19]||(e[19]=a(" Enabled",-1))])]),s("div",se,[s("div",le,[e[22]||(e[22]=s("label",{for:"sso-mode"},"Kind",-1)),f(E,{id:"sso-mode","model-value":l.value.mode,label:"Which protocol",options:[{value:"oidc",label:"OpenID Connect"},{value:"oauth2",label:"OAuth 2.0"}],"onUpdate:modelValue":e[1]||(e[1]=o=>l.value.mode=o)},null,8,["model-value"])]),l.value.mode==="oauth2"?(n(),d("div",oe,[e[23]||(e[23]=s("label",{for:"sso-preset"},"Provider",-1)),f(E,{id:"sso-preset","model-value":l.value.provider,label:"Which provider",options:[...b.value.map(o=>({value:o.key,label:o.label})),{value:"custom",label:"Custom"}],"onUpdate:modelValue":e[2]||(e[2]=o=>T(String(o)))},null,8,["model-value","options"])])):p("",!0),s("div",te,[e[24]||(e[24]=s("label",{for:"sso-label"},"Button text",-1)),i(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=o=>l.value.label=o),type:"text",placeholder:"Acme SSO"},null,512),[[r,l.value.label]])])]),l.value.mode==="oidc"?(n(),d("p",ae," Everything but the client id and secret is discovered from the issuer. GitHub is the one exception you may reach for and cannot use here: its OIDC document signs Actions job tokens, not user logins — use OAuth 2.0 for GitHub. ")):p("",!0),l.value.mode==="oidc"?(n(),d("div",ie,[e[25]||(e[25]=s("label",{for:"sso-issuer"},"Issuer",-1)),i(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=o=>l.value.discoveryUrl=o),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[r,l.value.discoveryUrl]]),e[26]||(e[26]=s("p",{class:"hint"},[a("Or the full "),s("code",null,"…/.well-known/openid-configuration"),a(" URL. It is fetched when you save, so a typo is refused here rather than at someone's first login.")],-1))])):p("",!0),s("div",ne,[e[27]||(e[27]=s("label",{for:"sso-client"},"Client id",-1)),i(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=o=>l.value.clientId=o),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[r,l.value.clientId]])]),s("div",re,[e[28]||(e[28]=s("label",{for:"sso-secret"},"Client secret",-1)),i(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=o=>m.value=o),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[r,m.value]]),s("p",de," Write-only. "+k(c.value?"A secret is stored — leave this as it is to keep it.":"Stored on save and never returned by any route."),1)]),l.value.mode==="oauth2"?(n(),d(V,{key:2},[s("div",ue,[e[29]||(e[29]=s("label",{for:"sso-auth"},"Authorize URL",-1)),i(s("input",{id:"sso-auth","onUpdate:modelValue":e[7]||(e[7]=o=>l.value.authorizeUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.authorizeUrl]])]),s("div",pe,[e[30]||(e[30]=s("label",{for:"sso-token"},"Token URL",-1)),i(s("input",{id:"sso-token","onUpdate:modelValue":e[8]||(e[8]=o=>l.value.tokenUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.tokenUrl]])]),s("div",ve,[e[31]||(e[31]=s("label",{for:"sso-userinfo"},"User info URL",-1)),i(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[9]||(e[9]=o=>l.value.userInfoUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.userInfoUrl]]),e[32]||(e[32]=s("p",{class:"hint"},"Leave empty to take the identity from the token response alone — a subject and nothing else.",-1))]),s("div",me,[e[33]||(e[33]=s("label",{for:"sso-emails"},[a("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),i(s("input",{id:"sso-emails","onUpdate:modelValue":e[10]||(e[10]=o=>l.value.emailsUrl=o),type:"text",spellcheck:"false"},null,512),[[r,l.value.emailsUrl]]),e[34]||(e[34]=s("p",{class:"hint"}," Only consulted when the profile carries no address — which is GitHub's default. Filled in automatically for a preset, and needed only if you pointed the user info URL at your own host. ",-1))])],64)):p("",!0),s("div",ce,[e[35]||(e[35]=s("label",{for:"sso-scopes"},"Scopes",-1)),i(s("input",{id:"sso-scopes","onUpdate:modelValue":e[11]||(e[11]=o=>l.value.scopes=o),type:"text",spellcheck:"false",placeholder:l.value.mode==="oidc"?"openid profile email":""},null,8,fe),[[r,l.value.scopes]])]),l.value.mode==="oauth2"?(n(),d("div",he,[s("h3",ye,[e[37]||(e[37]=a(" Claim mapping ",-1)),f(O,{label:"what this is"},{default:y(()=>[...e[36]||(e[36]=[a(" Which key of the provider's user response holds each field. Flat lookups, not expressions. A preset fills these in; you only touch them for a provider nobody has written a preset for. ",-1)])]),_:1})]),s("div",be,[(n(),d(V,null,H(["subject","username","email","name","avatar"],o=>s("div",{key:o,class:"field inline"},[s("label",{for:`cm-${o}`},k(o),9,ge),i(s("input",{id:`cm-${o}`,"onUpdate:modelValue":$=>l.value.claimMap[o]=$,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,ke),[[r,l.value.claimMap[o]]])])),64))])])):p("",!0)]),s("section",we,[e[40]||(e[40]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets an account")],-1)),e[41]||(e[41]=s("p",{class:"dim"}," By default, anyone your provider lets authenticate. It already owns that decision; this is only here for the case where the application you registered is broader than the people who should reach this control plane. ",-1)),s("div",Ue,[e[38]||(e[38]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),i(s("input",{id:"sso-domains","onUpdate:modelValue":e[12]||(e[12]=o=>h.value=o),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[r,h.value]]),e[39]||(e[39]=s("p",{class:"hint"},[a(" Comma-separated; subdomains count. Empty means no restriction. "),s("b",null,"Non-empty means a login with no email address at all is refused too"),a(" — a provider that hides the address (a private GitHub profile with no "),s("code",null,"user:email"),a(" scope) cannot be checked, so it is not waved through. ")],-1))])]),s("div",xe,[f(z,{variant:"primary",pending:g.value,disabled:g.value||!_.value,onClick:j},{default:y(()=>[a(k(c.value?"Save changes":"Enable single sign-on"),1)]),_:1},8,["pending","disabled"]),e[43]||(e[43]=s("span",{class:"grow"},null,-1)),c.value?(n(),C(z,{key:0,variant:"danger",confirm:`Remove ${l.value.label||"the provider"}?`,onRun:D},{default:y(()=>[...e[42]||(e[42]=[a(" Remove provider ",-1)])]),_:1},8,["confirm"])):p("",!0)]),c.value?(n(),d("p",Ie," Removing the provider does not delete anyone. Those accounts keep their personal tokens, and pointing the same provider back at this host re-links them by subject. ")):p("",!0)],64)):(n(),C(F,{key:1,rows:5}))]))}});export{Ee as default};
-//# sourceMappingURL=SsoView-D2yf-noE.js.map

package/dist/assets/SsoView-D2yf-noE.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SsoView-D2yf-noE.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: point this control plane at the identity provider the operator already runs.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * TWO THINGS THIS FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname.\n *   2. The client secret is write-only. The server answers with a mask; submitting the mask back\n *      unchanged keeps the stored secret, so an operator editing the label cannot silently wipe it.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { ClaimMap, SsoConfig, SsoConfigResponse, SsoPreset } from '../api/types';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: 'github',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  defaultRole: 'admin',\n});\n\nconst form = ref<SsoConfig>(blank());\nconst secret = ref('');\nconst domains = ref('');\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst configured = ref(false);\nconst loaded = ref(false);\nconst error = ref('');\nconst saving = ref(false);\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    error.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  error.value = '';\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n  configured.value = r.body.configured;\n  if (r.body.config) {\n    form.value = { ...blank(), ...r.body.config };\n    domains.value = (r.body.config.allowedEmailDomains ?? []).join(', ');\n  }\n  // The mask, so leaving the field alone re-submits it and the server keeps what it has.\n  secret.value = r.body.clientSecret;\n}\nvoid load();\n\n/** Picking a preset fills the endpoints in. Everything stays editable — a self-hosted GitLab is\n *  this preset with three URLs replaced, not a `custom` provider with five fields typed by hand. */\nfunction applyPreset(key: string): void {\n  form.value.provider = key;\n  const p = presets.value.find((x) => x.key === key);\n  if (!p) {\n    form.value.authorizeUrl = '';\n    form.value.tokenUrl = '';\n    form.value.userInfoUrl = '';\n    form.value.emailsUrl = '';\n    form.value.claimMap = { ...OIDC_CLAIMS };\n    return;\n  }\n  form.value.authorizeUrl = p.authorizeUrl;\n  form.value.tokenUrl = p.tokenUrl;\n  form.value.userInfoUrl = p.userInfoUrl ?? '';\n  // Left blank on purpose: the server fills the preset's own emails endpoint back in, and only\n  // while userInfoUrl is still the preset's.\n  form.value.emailsUrl = '';\n  form.value.scopes = p.scopes;\n  form.value.claimMap = { ...p.claimMap };\n  if (!form.value.label || presets.value.some((x) => x.label === form.value.label)) form.value.label = p.label;\n}\n\nasync function save(): Promise<void> {\n  saving.value = true;\n  const r = await api.put<{ ok: boolean; callbackUrl: string }>('/api/sso/config', {\n    ...form.value,\n    clientSecret: secret.value,\n    allowedEmailDomains: domains.value.split(',').map((d) => d.trim()).filter(Boolean),\n  });\n  saving.value = false;\n  if (!r.ok) {\n    error.value = problem(r, 'save the provider');\n    return;\n  }\n  error.value = '';\n  toast('ok', 'Saved. The provider answered, so the settings are known good.');\n  void load();\n}\n\nasync function remove(): Promise<void> {\n  const r = await api.del('/api/sso/config');\n  if (!r.ok) {\n    error.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', 'Removed. Existing accounts keep working.');\n  form.value = blank();\n  secret.value = '';\n  domains.value = '';\n  configured.value = false;\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\nconst canSave = computed(() => {\n  if (!form.value.clientId.trim() || !secret.value) return false;\n  if (form.value.mode === 'oidc') return !!form.value.discoveryUrl.trim();\n  return !!form.value.authorizeUrl.trim() && !!form.value.tokenUrl.trim();\n});\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the allowed email domains\n              below if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Nothing about local accounts changes.</b> The admin credential, manually created\n              users and personal API tokens all keep working exactly as they do now.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity provider you already run\n          <InfoHint label=\"what is stored\">\n            One row: the endpoints, the client id, and the client secret. The secret has no read\n            path — this page is shown a mask, and leaving it alone keeps what is stored.\n          </InfoHint>\n        </div>\n      </div>\n    </div>\n\n    <ErrorNote v-if=\"error\" :text=\"error\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"5\" />\n\n    <template v-else>\n      <!-- ============================ the callback URL ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Register this callback URL</h2></div>\n        <p class=\"dim\">\n          Paste this into your provider's application as the redirect / callback URL. It has to match\n          exactly, and it is the same for every provider — a mismatch is the single most common\n          reason the exchange fails, and the provider's error rarely says so.\n        </p>\n        <div class=\"row\" style=\"gap: var(--s3); align-items: center\">\n          <code class=\"code\" style=\"flex: 1; overflow-x: auto; white-space: nowrap\">{{ callbackUrl }}</code>\n          <button @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n\n      <!-- ============================ the provider ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">Provider</h2>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <div class=\"row\" style=\"gap: var(--s4); flex-wrap: wrap\">\n          <div class=\"field inline\">\n            <label for=\"sso-mode\">Kind</label>\n            <SelectMenu\n              id=\"sso-mode\"\n              :model-value=\"form.mode\"\n              label=\"Which protocol\"\n              :options=\"[\n                { value: 'oidc', label: 'OpenID Connect' },\n                { value: 'oauth2', label: 'OAuth 2.0' },\n              ]\"\n              @update:model-value=\"(v) => (form.mode = v as 'oidc' | 'oauth2')\"\n            />\n          </div>\n          <div v-if=\"form.mode === 'oauth2'\" class=\"field inline\">\n            <label for=\"sso-preset\">Provider</label>\n            <SelectMenu\n              id=\"sso-preset\"\n              :model-value=\"form.provider\"\n              label=\"Which provider\"\n              :options=\"[...presets.map((p) => ({ value: p.key, label: p.label })), { value: 'custom', label: 'Custom' }]\"\n              @update:model-value=\"(v) => applyPreset(String(v))\"\n            />\n          </div>\n          <div class=\"field inline\">\n            <label for=\"sso-label\">Button text</label>\n            <input id=\"sso-label\" v-model=\"form.label\" type=\"text\" placeholder=\"Acme SSO\" />\n          </div>\n        </div>\n\n        <p v-if=\"form.mode === 'oidc'\" class=\"hint\">\n          Everything but the client id and secret is discovered from the issuer. GitHub is the one\n          exception you may reach for and cannot use here: its OIDC document signs Actions job\n          tokens, not user logins — use OAuth 2.0 for GitHub.\n        </p>\n\n        <div v-if=\"form.mode === 'oidc'\" class=\"field\">\n          <label for=\"sso-issuer\">Issuer</label>\n          <input id=\"sso-issuer\" v-model=\"form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n          <p class=\"hint\">Or the full <code>…/.well-known/openid-configuration</code> URL. It is fetched when you save, so a typo is refused here rather than at someone's first login.</p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only. {{ configured ? 'A secret is stored — leave this as it is to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <template v-if=\"form.mode === 'oauth2'\">\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <div v-if=\"form.mode === 'oauth2'\">\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </div>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account</h2></div>\n        <p class=\"dim\">\n          By default, anyone your provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n      </section>\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !canSave\" @click=\"save\">\n          {{ configured ? 'Save changes' : 'Enable single sign-on' }}\n        </ActionButton>\n        <span class=\"grow\" />\n        <ActionButton v-if=\"configured\" variant=\"danger\" :confirm=\"`Remove ${form.label || 'the provider'}?`\" @run=\"remove\">\n          Remove provider\n        </ActionButton>\n      </div>\n      <p v-if=\"configured\" class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n        Removing the provider does not delete anyone. Those accounts keep their personal tokens, and\n        pointing the same provider back at this host re-links them by subject.\n      </p>\n    </template>\n  </div>\n</template>\n"],"names":["OIDC_CLAIMS","blank","form","ref","secret","domains","presets","callbackUrl","configured","loaded","error","saving","load","r","api","problem","applyPreset","key","p","x","save","d","toast","remove","copyCallback","canSave","computed","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","_hoisted_8","$event","_vModelCheckbox","_hoisted_9","_hoisted_10","SelectMenu","v","_openBlock","_hoisted_11","_hoisted_12","_vModelText","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_24","_hoisted_25","_hoisted_26","_renderList","k","_hoisted_27","_hoisted_29","_hoisted_30","_hoisted_31","ActionButton","_hoisted_32","SkeletonList"],"mappings":"4jDA6BA,MAAMA,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,SACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,YAAa,OAAA,GAGTE,EAAOC,EAAeF,GAAO,EAC7BG,EAASD,EAAI,EAAE,EACfE,EAAUF,EAAI,EAAE,EAChBG,EAAUH,EAAiB,EAAE,EAC7BI,EAAcJ,EAAI,EAAE,EACpBK,EAAaL,EAAI,EAAK,EACtBM,EAASN,EAAI,EAAK,EAClBO,EAAQP,EAAI,EAAE,EACdQ,EAASR,EAAI,EAAK,EAExB,eAAeS,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAuB,iBAAiB,EAE5D,GADAL,EAAO,MAAQ,GACX,CAACI,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,2BAA2B,EACpD,MACF,CACAH,EAAM,MAAQ,GACdJ,EAAQ,MAAQO,EAAE,KAAK,SAAW,CAAA,EAClCN,EAAY,MAAQM,EAAE,KAAK,YAC3BL,EAAW,MAAQK,EAAE,KAAK,WACtBA,EAAE,KAAK,SACTX,EAAK,MAAQ,CAAE,GAAGD,EAAA,EAAS,GAAGY,EAAE,KAAK,MAAA,EACrCR,EAAQ,OAASQ,EAAE,KAAK,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,GAGrET,EAAO,MAAQS,EAAE,KAAK,YACxB,CACKD,EAAA,EAIL,SAASI,EAAYC,EAAmB,CACtCf,EAAK,MAAM,SAAWe,EACtB,MAAMC,EAAIZ,EAAQ,MAAM,KAAMa,GAAMA,EAAE,MAAQF,CAAG,EACjD,GAAI,CAACC,EAAG,CACNhB,EAAK,MAAM,aAAe,GAC1BA,EAAK,MAAM,SAAW,GACtBA,EAAK,MAAM,YAAc,GACzBA,EAAK,MAAM,UAAY,GACvBA,EAAK,MAAM,SAAW,CAAE,GAAGF,CAAA,EAC3B,MACF,CACAE,EAAK,MAAM,aAAegB,EAAE,aAC5BhB,EAAK,MAAM,SAAWgB,EAAE,SACxBhB,EAAK,MAAM,YAAcgB,EAAE,aAAe,GAG1ChB,EAAK,MAAM,UAAY,GACvBA,EAAK,MAAM,OAASgB,EAAE,OACtBhB,EAAK,MAAM,SAAW,CAAE,GAAGgB,EAAE,QAAA,GACzB,CAAChB,EAAK,MAAM,OAASI,EAAQ,MAAM,KAAMa,GAAMA,EAAE,QAAUjB,EAAK,MAAM,KAAK,KAAGA,EAAK,MAAM,MAAQgB,EAAE,MACzG,CAEA,eAAeE,GAAsB,CACnCT,EAAO,MAAQ,GACf,MAAME,EAAI,MAAMC,EAAI,IAA0C,kBAAmB,CAC/E,GAAGZ,EAAK,MACR,aAAcE,EAAO,MACrB,oBAAqBC,EAAQ,MAAM,MAAM,GAAG,EAAE,IAAKgB,GAAMA,EAAE,MAAM,EAAE,OAAO,OAAO,CAAA,CAClF,EAED,GADAV,EAAO,MAAQ,GACX,CAACE,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,mBAAmB,EAC5C,MACF,CACAH,EAAM,MAAQ,GACdY,EAAM,KAAM,+DAA+D,EACtEV,EAAA,CACP,CAEA,eAAeW,GAAwB,CACrC,MAAMV,EAAI,MAAMC,EAAI,IAAI,iBAAiB,EACzC,GAAI,CAACD,EAAE,GAAI,CACTH,EAAM,MAAQK,EAAQF,EAAG,qBAAqB,EAC9C,MACF,CACAS,EAAM,KAAM,0CAA0C,EACtDpB,EAAK,MAAQD,EAAA,EACbG,EAAO,MAAQ,GACfC,EAAQ,MAAQ,GAChBG,EAAW,MAAQ,GACdI,EAAA,CACP,CAEA,eAAeY,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAUjB,EAAY,KAAK,EACrDe,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAEA,MAAMG,EAAUC,EAAS,IACnB,CAACxB,EAAK,MAAM,SAAS,QAAU,CAACE,EAAO,MAAc,GACrDF,EAAK,MAAM,OAAS,OAAe,CAAC,CAACA,EAAK,MAAM,aAAa,KAAA,EAC1D,CAAC,CAACA,EAAK,MAAM,aAAa,QAAU,CAAC,CAACA,EAAK,MAAM,SAAS,KAAA,CAClE,oBAICyB,EA0MM,MAAA,KAAA,CAzMJC,EAqCM,MArCNC,EAqCM,CApCJD,EAmCM,MAAA,KAAA,CAlCJA,EA0BK,KAAA,KAAA,iBA1BD,mBAEF,EAAA,GAAAE,EAuBYC,EAAA,CAvBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,mUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAGI,IAAA,KAAA,CAFFA,EAA4C,SAAzC,uCAAqC,IAAI,iHAE9C,CAAA,kBAGJA,EAMM,MANNK,EAMM,iBANW,kEAEf,EAAA,GAAAH,EAGWI,EAAA,CAHD,MAAM,kBAAgB,WAAC,IAGjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAHiC,sKAGjC,EAAA,CAAA,iBAKWtB,EAAA,WAAjByB,EAAgEC,EAAA,OAAvC,KAAM1B,EAAA,MAAO,MAAM,iBAAA,6BACvBD,EAAA,WAErBkB,EA8JWU,EAAA,CAAA,IAAA,GAAA,CA5JTT,EAWU,UAXVU,EAWU,eAVRV,EAA4E,MAAA,CAAvE,MAAM,SAAO,CAACA,EAAmD,KAAA,CAA/C,MAAM,SAAA,EAAU,4BAA0B,CAAA,OACjEI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAGM,MAHNW,EAGM,CAFJX,EAAkG,OAAlGY,EAAkGC,EAArBlC,EAAA,KAAW,EAAA,CAAA,EACxFqB,EAA2C,SAAA,CAAlC,QAAOJ,CAAA,EAAc,MAAI,CAAA,KAKtCI,EA2GU,UA3GVc,EA2GU,CA1GRd,EAIM,MAJNe,EAIM,CAHJX,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAiC,KAAA,CAA7B,MAAM,SAAA,EAAU,WAAQ,EAAA,iBAC5BA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAAqF,QAArFgB,GAAqF,GAAhEhB,EAAgD,QAAA,CAAhC,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,QAAO2C,GAAE,KAAK,UAAA,aAAnB,CAAAC,EAAA5C,EAAA,MAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAG/E0B,EA4BM,MA5BNmB,GA4BM,CA3BJnB,EAYM,MAZNoB,GAYM,CAXJhB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAkC,QAAA,CAA3B,IAAI,UAAA,EAAW,OAAI,EAAA,GAC1BE,EASEmB,EAAA,CARA,GAAG,WACF,cAAa/C,EAAA,MAAK,KACnB,MAAM,iBACL,QAAS,2EAIT,kCAAqBgD,GAAOhD,QAAK,KAAOgD,EAAA,4BAGlChD,EAAA,MAAK,OAAI,UAApBiD,IAAAxB,EASM,MATNyB,GASM,CARJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,YAAA,EAAa,WAAQ,EAAA,GAChCE,EAMEmB,EAAA,CALA,GAAG,aACF,cAAa/C,EAAA,MAAK,SACnB,MAAM,iBACL,QAAO,CAAA,GAAMI,EAAA,MAAQ,IAAKY,IAAC,CAAA,MAAeA,EAAE,IAAG,MAASA,EAAE,OAAK,EAAA,CAAA,MAAA,SAAA,MAAA,SAAA,EAC/D,kCAAqBgC,GAAMlC,EAAY,OAAOkC,CAAC,CAAA,EAAA,gDAGpDtB,EAGM,MAHNyB,GAGM,CAFJrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAgF,QAAA,CAAzE,GAAG,YAAqB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,MAAK2C,GAAE,KAAK,OAAO,YAAY,UAAA,aAApC,CAAAS,EAAApD,EAAA,MAAK,KAAK,CAAA,OAIpCA,EAAA,MAAK,OAAI,YAAlByB,EAII,IAJJ4B,GAA4C,qOAI5C,YAEWrD,EAAA,MAAK,OAAI,QAApBiD,IAAAxB,EAIM,MAJN6B,GAIM,CAHJxB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAA8H,QAAA,CAAvH,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,aAAY2C,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,aAA9D,CAAAS,EAAApD,EAAA,MAAK,YAAY,CAAA,iBACjD0B,EAAiL,IAAA,CAA9K,MAAM,QAAM,GAAC,cAAY,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,oGAAkG,CAAA,mBAG/KA,EAGM,MAHN6B,GAGM,CAFJzB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAAmG,QAAA,CAA5F,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,SAAQ2C,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,aAA3D,CAAAS,EAAApD,EAAA,MAAK,QAAQ,CAAA,KAE/C0B,EAMM,MANN8B,GAMM,CALJ1B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAyG,QAAA,CAAlG,GAAG,kDAAsBxB,EAAM,MAAAyC,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,gBAAxDzC,EAAA,KAAM,CAAA,GACtCwB,EAEI,IAFJ+B,GAAgB,kBACCnD,EAAA,MAAU,uDAAA,iDAAA,EAAA,CAAA,CAAA,GAIbN,EAAA,MAAK,OAAI,cAAzByB,EAuBWU,EAAA,CAAA,IAAA,GAAA,CAtBTT,EAGM,MAHNgC,GAGM,CAFJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAAkF,QAAA,CAA3E,GAAG,WAAoB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,aAAY2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAA1C,CAAAS,EAAApD,EAAA,MAAK,YAAY,CAAA,KAEjD0B,EAGM,MAHNiC,GAGM,CAFJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAA+E,QAAA,CAAxE,GAAG,YAAqB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,SAAQ2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAtC,CAAAS,EAAApD,EAAA,MAAK,QAAQ,CAAA,KAE9C0B,EAIM,MAJNkC,GAIM,CAHJ9B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAAqF,QAAA,CAA9E,GAAG,eAAwB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA3C,EAAA,MAAK,YAAW2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAzC,CAAAS,EAAApD,EAAA,MAAK,WAAW,CAAA,GAClD8B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARNmC,GAQM,eAPJnC,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAiF,QAAA,CAA1E,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA3C,EAAA,MAAK,UAAS2C,GAAE,KAAK,OAAO,WAAW,OAAA,aAAvC,CAAAS,EAAApD,EAAA,MAAK,SAAS,CAAA,GAC9C8B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,kBAIJA,EAGM,MAHNoC,GAGM,CAFJhC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgJ,QAAA,CAAzI,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA3C,EAAA,MAAK,OAAM2C,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa3C,EAAA,MAAK,OAAI,OAAA,uBAAA,EAAA,cAAnE,CAAAoD,EAAApD,EAAA,MAAK,MAAM,CAAA,KAGlCA,EAAA,MAAK,OAAI,cAApByB,EAeM,MAAAsC,GAAA,CAdJrC,EAOK,KAPLsC,GAOK,iBAP6C,kBAEhD,EAAA,GAAApC,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALNuC,GAKM,MAJJxC,EAGMU,EAAA,KAAA+B,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALC,GAAZzC,EAGM,MAAA,CAH2E,IAAKyC,EAAG,MAAM,cAAA,GAC7FzC,EAAuC,QAAA,CAA/B,UAAWyC,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5B1C,EAAwG,QAAA,CAAhG,SAAUyC,CAAC,4BAAanE,EAAA,MAAK,SAASmE,CAAC,EAAAxB,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,iBAAjD3C,EAAA,MAAK,SAASmE,CAAC,CAAA,CAAA,2BAOvDzC,EAiBU,UAjBV2C,GAiBU,eAhBR3C,EAAqE,MAAA,CAAhE,MAAM,SAAO,CAACA,EAA4C,KAAA,CAAxC,MAAM,SAAA,EAAU,qBAAmB,CAAA,OAC1DI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,2NAIf,EAAA,GACAA,EASM,MATN4C,GASM,CARJxC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAAmH,QAAA,CAA5G,GAAG,qDAAuBvB,EAAO,MAAAwC,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,gBAApDxC,EAAA,KAAO,CAAA,iBACxCuB,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,WAIJA,EAQM,MARN6C,GAQM,CAPJ3C,EAEe4C,EAAA,CAFD,QAAQ,UAAW,QAAS/D,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAKc,EAAA,MAAU,QAAOL,CAAA,aACvF,IAA2D,KAAxDZ,EAAA,MAAU,eAAA,uBAAA,EAAA,CAAA,CAAA,gDAEfoB,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACEpB,EAAA,WAApB2B,EAEeuC,EAAA,OAFiB,QAAQ,SAAU,QAAO,UAAYxE,EAAA,MAAK,OAAK,cAAA,IAAwB,MAAKqB,CAAA,aAAQ,IAEpH,CAAA,GAAAS,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFoH,oBAEpH,EAAA,CAAA,qCAEOxB,EAAA,WAATmB,EAGI,IAHJgD,GAAwF,uKAGxF,uBA/JFxC,EAAyCyC,EAAA,OAAX,KAAM,CAAA"}

package/dist/assets/SubmitView-Cdxo6Chq.js

@@ -1,50 +0,0 @@
-import{d as J,r as h,n as N,J as j,c as n,a as t,t as m,f as o,F as T,e as p,w as y,g as v,E as Y,i as V,v as E,_ as R,Y as O,y as Q,z as Z,j as A,k as _,o as a,m as ee,G as te,O as se,C as oe,X as D}from"./index-9Ra4jfL4.js";import{a as le,w as ae,p as F,r as ne}from"./useVars-VN9gYdR6.js";import{_ as ie}from"./ActionButton.vue_vue_type_script_setup_true_lang-B0qf7_XI.js";import{_ as re}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DNaY6OBe.js";import{_ as de}from"./VarEditor.vue_vue_type_script_setup_true_lang-CyOlKVt5.js";import{_ as ue}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BLfPhhAj.js";import"./Teleport-BUn4ayOo.js";const pe={class:"page-head"},ve={class:"sub"},me={class:"panel"},ye={key:0,class:"banner warn"},ce={key:0},he={key:1},fe={key:2},ke={key:3},be={key:2,class:"banner warn"},ge={class:"row",style:{"margin-bottom":"var(--s4)"}},we={class:"field",style:{"max-width":"280px"}},Se={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},xe={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},$e={class:"check"},Ce={class:"check"},Te={class:"field",style:{"max-width":"340px"}},Ve={key:0,class:"hint"},Re={key:0},Ae={key:1},Le={key:2},Ue={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Ne={class:"hint"},Ee={class:"hint"},Pe={class:"row",style:{"margin-top":"var(--s5)"}},We={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},je={key:1,class:"s-ok"},Oe={key:6,class:"banner warn"},De={key:0},Fe=`services:
-  app:
-    image: nginx:alpine
-    profiles: [app]
-    labels:
-      # The ONE label routing needs: pstack generates the Traefik router, TLS and network wiring
-      # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the
-      # service entirely alone, so only do that when you need something the shorthand cannot say.
-      - pstack.routing.port=80
-`,Ge=J({__name:"SubmitView",props:{id:{}},setup(P){const L=P,l=h({id:L.id??"",spec:"",compose:""}),f=h([{k:"",v:""}]),k=h("inline"),w=h(""),S=h(!1),g=h(""),d=h(null),x=h([]),q=A(()=>[{value:"",label:"— choose —"},...x.value.map(s=>({value:s.name,label:s.name,hint:s.kind}))]);N.get("/api/specs").then(s=>{s.ok&&Array.isArray(s.body.specs)&&(x.value=s.body.specs)});const $=A(()=>x.value.find(s=>s.name===w.value)),U=A(()=>!!L.id),M=ee(),C=A(()=>{const s=M.query.from;return typeof s=="string"&&s?s:null}),c=h("idle"),b=h(null);async function W(s){c.value="loading",b.value=null;const e=await N.getAuthed(`/api/deployments/${encodeURIComponent(s)}/source`);if(e.status===404||!e.ok){c.value="failed";return}if(e.body.sourceWithheld){c.value="withheld",e.body.specName&&(b.value=e.body.specName);return}l.value.spec||(l.value.spec=e.body.spec??""),l.value.compose||(l.value.compose=e.body.compose??""),e.body.specName&&(b.value=e.body.specName),c.value="loaded"}j(C,async s=>{var r;if(!s||L.id)return;g.value="",d.value=null,l.value.spec="",l.value.compose="";const e=(r=D(s))==null?void 0:r.vars;e&&(f.value=F(e)),await W(s),l.value.id=""},{immediate:!0}),j(()=>L.id,s=>{var u;if(g.value="",d.value=null,c.value="idle",b.value=null,!s)return;s!==l.value.id&&(l.value.spec="",l.value.compose=""),l.value.id=s;const e=(u=D(s))==null?void 0:u.vars,r=e?F(e):ne(s);r.some(I=>I.k)&&(f.value=r),W(s)},{immediate:!0});const z=A(()=>!!l.value.id&&(k.value==="stored"?!!w.value:!!l.value.spec.trim())&&!S.value);async function K(){S.value=!0,g.value="",d.value=null;const s=l.value.id,e=le(f.value),r={vars:e,env:e};k.value==="stored"?r.specName=w.value:(r.spec=l.value.spec,l.value.compose.trim()&&(r.compose=l.value.compose));const u=await N.put(`/api/deployments/${encodeURIComponent(s)}`,r);if(S.value=!1,u.status===200||u.status===201){d.value={id:u.body.id??s,stack:u.body.stack??"?",created:u.status===201,stackSharedWith:u.body.stackSharedWith},ae(s,f.value),te(),se("ok",`${u.status===201?"Created":"Replaced"} ${s} → ${d.value.stack}`,{to:`/deployments/${encodeURIComponent(s)}`,toLabel:"Open"});return}g.value=oe(u,"save this deployment")}function B(){const s=location.hostname;if(s==="localhost"||s.endsWith(".localhost")||/^[\d.]+$/.test(s)||s.includes(":"))return"preview.example.com";const e=s.split(".");return e.length>=3?e.slice(1).join("."):s}const H=s=>`version: 1
-kind: isolated
-
-# The stack identity: the compose project name, and $STACK inside every hook.
-# \${PR} is interpolated ONCE, at resolve time, from the variables sent with the request.
-stack: pr-\${PR}
-
-env:
-  # The base every generated hostname hangs off: the app below is served at
-  # app-pr-\${PR}.${s}
-  PREVIEW_DOMAIN: ${s}
-
-compose:
-  file: compose.yml
-  # Every service sits behind a profile so a bare \`up\` starts nothing.
-  # \`down\` always enables ALL of them — otherwise the unselected profiles' network leaks.
-  profiles: [app]
-
-requires:
-  - name: traefik-network
-    assert: docker network inspect traefik >/dev/null 2>&1
-    hint: run \`pstack init\` on the host first
-
-axes:
-  # Hooks run from the deployment directory, which holds only spec.yml and compose.yml —
-  # so use inline shell or absolute paths, never ./hooks/foo.sh.
-  - name: scratch
-    up: mkdir -p /tmp/$STACK
-    assert_live: test -d /tmp/$STACK
-    down: rm -rf /tmp/$STACK
-    # assert_gone MUST FAIL CLOSED. A bare \`! <probe>\` reports "gone" whenever the probe fails
-    # for any reason — a missing CLI, an expired token — turning "I could not tell" into
-    # "it is gone", a false negative on the one thing this tool exists to catch.
-    assert_gone: |
-      test -d /tmp || exit 1
-      ! test -d /tmp/$STACK
-`;function X(){k.value="inline",l.value.spec=H(B()),l.value.compose.trim()||(l.value.compose=Fe),l.value.id||(l.value.id="pr-123"),f.value.some(s=>s.k)||(f.value=[{k:"PR",v:"123"}])}return(s,e)=>{var u,I;const r=_("RouterLink");return a(),n("div",null,[t("div",pe,[t("div",null,[t("h1",null,m(U.value?"Edit a deployment":C.value?"Duplicate a deployment":"Submit a deployment"),1),t("div",ve,m(U.value?"Loaded from what is stored; saving replaces the record":C.value?`Copied from ${C.value} — give it a new id, then edit`:"Stores a spec so it can be deployed"),1)]),e[7]||(e[7]=t("span",{class:"grow"},null,-1)),t("button",{class:"ghost",onClick:X},"Load example spec")]),t("section",me,[C.value&&!U.value?(a(),n("div",ye,[e[20]||(e[20]=t("b",null,"Change the stack, not just the id.",-1)),t("p",null,[e[11]||(e[11]=o(" Two deployments that resolve to the same ",-1)),e[12]||(e[12]=t("code",null,"stack",-1)),e[13]||(e[13]=o(" drive the same compose project — ",-1)),e[14]||(e[14]=t("code",null,"down",-1)),e[15]||(e[15]=o(" on either stops the other's containers. If the stack interpolates a variable (",-1)),e[16]||(e[16]=t("code",null,"pr-${PR}",-1)),e[17]||(e[17]=o(") give it a different value below; if it is a literal, edit the ",-1)),e[18]||(e[18]=t("code",null,"stack:",-1)),e[19]||(e[19]=o(" line. ",-1)),c.value==="withheld"?(a(),n(T,{key:0},[e[9]||(e[9]=o(" The spec could not be copied without an access token — ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[8]||(e[8]=[o("add yours",-1)])]),_:1}),e[10]||(e[10]=o(". ",-1))],64)):v("",!0)])])):v("",!0),U.value?(a(),n("div",{key:1,class:Y(["banner",c.value==="loaded"?"info":"warn"])},[t("b",null,"Replacing "+m(P.id)+".",1),c.value==="loading"?(a(),n("p",ce,"Loading what is stored…")):c.value==="loaded"?(a(),n("p",he," Loaded from the stored record — edit it and save. Saving replaces the record outright, so anything you delete here stops being tracked while whatever it created keeps running. ")):c.value==="withheld"?(a(),n("p",fe,[e[22]||(e[22]=o(" The stored spec was not loaded: reading it needs an access token, because hooks routinely carry a credential inline. ",-1)),p(r,{to:"/settings"},{default:y(()=>[...e[21]||(e[21]=[o("Add your token",-1)])]),_:1}),e[23]||(e[23]=o(" to edit in place — otherwise paste the ",-1)),e[24]||(e[24]=t("b",null,"complete",-1)),e[25]||(e[25]=o(" spec, since anything you leave out stops being tracked. ",-1))])):(a(),n("p",ke,[...e[26]||(e[26]=[o(" The stored spec could not be loaded, so this form is empty. Paste the ",-1),t("b",null,"complete",-1),o(" spec you want stored — anything you leave out stops being tracked while whatever it created keeps running. ",-1)])]))],2)):v("",!0),b.value?(a(),n("div",be,[t("b",null,"This deployment tracks the stored spec “"+m(b.value)+"”.",1),t("p",null,[e[28]||(e[28]=o(" Saving here writes a private copy and stops it following that spec. To change every deployment using it, edit ",-1)),p(r,{to:`/specs/${encodeURIComponent(b.value)}`},{default:y(()=>[...e[27]||(e[27]=[o("the spec",-1)])]),_:1},8,["to"]),e[29]||(e[29]=o(" instead. ",-1))])])):v("",!0),t("div",ge,[t("div",we,[e[30]||(e[30]=t("label",{for:"did"},"Deployment id",-1)),V(t("input",{id:"did","onUpdate:modelValue":e[0]||(e[0]=i=>l.value.id=i),type:"text",placeholder:"pr-123",spellcheck:"false",autocomplete:"off"},null,512),[[E,l.value.id,void 0,{trim:!0}]])]),t("span",Se,[e[32]||(e[32]=o(" Lower case ",-1)),p(R,{label:"allowed characters in a deployment id"},{default:y(()=>[...e[31]||(e[31]=[o(" Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64 characters — ",-1),t("code",null,"[a-z0-9][a-z0-9._-]{0,63}",-1),o(". ",-1)])]),_:1})])]),x.value.length?(a(),n("div",xe,[t("label",$e,[V(t("input",{"onUpdate:modelValue":e[1]||(e[1]=i=>k.value=i),type:"radio",value:"inline"},null,512),[[O,k.value]]),e[33]||(e[33]=o(" inline spec ",-1))]),t("label",Ce,[V(t("input",{"onUpdate:modelValue":e[2]||(e[2]=i=>k.value=i),type:"radio",value:"stored"},null,512),[[O,k.value]]),e[34]||(e[34]=o(" reference a stored spec ",-1))])])):v("",!0),k.value==="stored"&&x.value.length?(a(),n(T,{key:4},[t("div",Te,[e[35]||(e[35]=t("label",{for:"sn"},"Stored spec",-1)),p(ue,{modelValue:w.value,"onUpdate:modelValue":e[3]||(e[3]=i=>w.value=i),id:"sn",label:"Stored spec",options:q.value},null,8,["modelValue","options"])]),$.value?(a(),n("p",Ve,[$.value.description?(a(),n("span",Re,m($.value.description)+" — ",1)):v("",!0),e[37]||(e[37]=o(" needs ",-1)),$.value.requiredVars.length?(a(),n("b",Ae,m($.value.requiredVars.join(", ")),1)):(a(),n("span",Le,"no variables")),e[38]||(e[38]=o(". ",-1)),p(R,{label:"why variables are required"},{default:y(()=>[...e[36]||(e[36]=[o(" A missing variable is refused by name. It is never filled in with a blank, which would silently give every deployment the same stack name. ",-1)])]),_:1})])):v("",!0)],64)):(a(),n(T,{key:5},[t("div",Ue,[e[39]||(e[39]=t("label",{for:"spec"},"Spec.yml",-1)),V(t("textarea",{id:"spec","onUpdate:modelValue":e[4]||(e[4]=i=>l.value.spec=i),rows:"12",spellcheck:"false",placeholder:`version: 1
-kind: isolated
-stack: pr-\${PR}
-axes: []`},null,512),[[E,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),V(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[E,l.value.compose]])]),t("p",Ne,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[55]||(e[55]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(de,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",Ee,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",Pe,[p(ie,{variant:"primary",pending:S.value,disabled:!z.value,onClick:K},{default:y(()=>[o(m(S.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),d.value?v("",!0):(a(),n("span",We,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),d.value?(a(),n("span",je,[o(m(d.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(d.value.stack),1),p(r,{to:`/deployments/${encodeURIComponent(d.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(I=(u=d.value)==null?void 0:u.stackSharedWith)!=null&&I.length?(a(),n("div",Oe,[t("b",null,"Another deployment already resolves to stack “"+m(d.value.stack)+"”.",1),t("p",null,[(a(!0),n(T,null,Q(d.value.stackSharedWith,(i,G)=>(a(),n(T,{key:i},[p(r,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),G<d.value.stackSharedWith.length-1?(a(),n("span",De,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),g.value?(a(),Z(re,{key:7,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{Ge as default};
-//# sourceMappingURL=SubmitView-Cdxo6Chq.js.map

package/dist/assets/SubmitView-Cdxo6Chq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SubmitView-Cdxo6Chq.js","sources":["../../src/views/SubmitView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Submit or replace a deployment.\n *\n * The server's 400 is the whole point of this screen. It carries the SpecError verbatim — the key\n * or variable that is wrong, often the corrected form, and the assert-lint warnings about an\n * `assert_gone` that fails open. That text is the tool's main teaching surface, so it is rendered\n * whole, with newlines intact, and never summarised.\n *\n * The spec is parsed BEFORE anything touches disk, so a rejected submission leaves nothing behind\n * and, on a replace, a good record is never destroyed over a typo.\n */\nimport { computed, ref, watch } from 'vue';\nimport { useRoute } from 'vue-router';\nimport { api, problem } from '../api/client';\nimport InfoHint from '../components/InfoHint.vue';\nimport type {\n  DeploymentSourceResponse,\n  SpecMeta,\n  SpecsResponse,\n  SubmitResponse,\n  VarPair,\n} from '../api/types';\nimport { loadDeployments, rowFor } from '../composables/useControlPlane';\nimport { pairsFromRecord, readVars, recordFromPairs, writeVars } from '../composables/useVars';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport VarEditor from '../components/VarEditor.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\n\nconst props = defineProps<{ id?: string }>();\n\nconst form = ref({ id: props.id ?? '', spec: '', compose: '' });\nconst vars = ref<VarPair[]>([{ k: '', v: '' }]);\nconst source = ref<'inline' | 'stored'>('inline');\nconst specName = ref('');\n\nconst submitting = ref(false);\nconst error = ref('');\nconst result = ref<{\n  id: string;\n  stack: string;\n  created: boolean;\n  /** Other deployments resolving to the same stack — reported by the server on a new deployment. */\n  stackSharedWith?: string[];\n} | null>(null);\n\n/**\n * Stored specs, when this server has them. A build without `/api/specs` answers 404, which is not\n * an error here — the picker simply is not offered and inline stays the only shape.\n */\nconst specs = ref<SpecMeta[]>([]);\n\n/** `— choose —` stays first: an empty value is a real state here, not a placeholder. */\nconst specOptions = computed(() => [\n  { value: '', label: '— choose —' },\n  ...specs.value.map((s) => ({ value: s.name, label: s.name, hint: s.kind })),\n]);\nvoid api.get<SpecsResponse>('/api/specs').then((r) => {\n  if (r.ok && Array.isArray(r.body.specs)) specs.value = r.body.specs;\n});\n\nconst chosenSpec = computed(() => specs.value.find((s) => s.name === specName.value));\n\nconst replacing = computed(() => !!props.id);\n\n/**\n * Duplicate mode: `/submit?from=<id>` copies an existing deployment's spec, compose and variables into\n * a NEW submission. Distinct from replacing — the id starts empty so you name the new one, and nothing\n * is written over.\n *\n * The `stack:` line is the thing to watch, which is why the banner says so: copy a spec whose stack is a\n * literal and both deployments drive the same compose project, so `down` on either stops the other's\n * containers. A spec whose stack interpolates a variable (`pr-${PR}`) just needs a different value. The\n * server independently reports a collision at submit time — see `stackSharedWith`.\n */\nconst route = useRoute();\nconst copyFrom = computed(() => {\n  const v = route.query.from;\n  return typeof v === 'string' && v ? v : null;\n});\n\n/**\n * Replacing now PRE-FILLS from what is stored.\n *\n * It used to start empty, because nothing could hand the source back. Replacing is whole-record, so\n * an operator retyping a spec from memory silently dropped whatever they forgot — and a dropped axis\n * stops being tracked while the resources it created keep running. Being unable to read your own\n * submission is what made that a likely mistake rather than a careless one.\n *\n * The body is still cleared FIRST, on every id change. A leftover body from another deployment is the\n * dangerous case: it is perfectly valid YAML, so the PUT would succeed and overwrite the wrong\n * deployment with nothing able to catch it. Clearing first means a failed or withheld fetch leaves the\n * form empty rather than holding someone else's spec.\n */\nconst sourceState = ref<'idle' | 'loading' | 'loaded' | 'withheld' | 'failed'>('idle');\n/** Set when this deployment tracks a stored spec — editing this copy forks it from the original. */\nconst forkWarning = ref<string | null>(null);\n\nasync function loadSource(id: string): Promise<void> {\n  sourceState.value = 'loading';\n  forkWarning.value = null;\n  const r = await api.getAuthed<DeploymentSourceResponse>(\n    `/api/deployments/${encodeURIComponent(id)}/source`,\n  );\n  // A build of the API without the route answers 404; that is a capability difference, not an error,\n  // and it must land on the old empty-form behaviour rather than an alarming banner.\n  if (r.status === 404 || !r.ok) {\n    sourceState.value = 'failed';\n    return;\n  }\n  if (r.body.sourceWithheld) {\n    sourceState.value = 'withheld';\n    if (r.body.specName) forkWarning.value = r.body.specName;\n    return;\n  }\n  // Only fill if the user has not started typing — a slow fetch must never overwrite their edit.\n  if (!form.value.spec) form.value.spec = r.body.spec ?? '';\n  if (!form.value.compose) form.value.compose = r.body.compose ?? '';\n  if (r.body.specName) forkWarning.value = r.body.specName;\n  sourceState.value = 'loaded';\n}\n\n// Duplicate: same fetch, but the id stays empty and the variables come across too, since a copied\n// spec interpolates the same names.\nwatch(\n  copyFrom,\n  async (from) => {\n    if (!from || props.id) return;\n    error.value = '';\n    result.value = null;\n    form.value.spec = '';\n    form.value.compose = '';\n    const saved = rowFor(from)?.vars;\n    if (saved) vars.value = pairsFromRecord(saved);\n    await loadSource(from);\n    // A copied record's own id is not a name for the new one; the operator picks that.\n    form.value.id = '';\n  },\n  { immediate: true },\n);\n\nwatch(\n  () => props.id,\n  (id) => {\n    error.value = '';\n    result.value = null;\n    sourceState.value = 'idle';\n    forkWarning.value = null;\n    if (!id) return;\n    if (id !== form.value.id) {\n      form.value.spec = '';\n      form.value.compose = '';\n    }\n    form.value.id = id;\n    // Seed the variables from what this deployment already uses: replacing a spec usually needs\n    // the same ones that resolved it.\n    const stored = rowFor(id)?.vars;\n    const saved = stored ? pairsFromRecord(stored) : readVars(id);\n    if (saved.some((e) => e.k)) vars.value = saved;\n    void loadSource(id);\n  },\n  { immediate: true },\n);\n\nconst canSubmit = computed(\n  () =>\n    !!form.value.id &&\n    (source.value === 'stored' ? !!specName.value : !!form.value.spec.trim()) &&\n    !submitting.value,\n);\n\nasync function submit(): Promise<void> {\n  submitting.value = true;\n  error.value = '';\n  result.value = null;\n\n  const id = form.value.id;\n  const record = recordFromPairs(vars.value);\n  /**\n   * `vars` are STORED with the deployment on servers that support it, which makes a later `down`\n   * resolve the same stack `up` created with no query parameters at all. `env` validates this\n   * submission on every server, new or old. Sending both is what keeps this form working against\n   * either build — an older server ignores the key it does not know.\n   */\n  const body: Record<string, unknown> = { vars: record, env: record };\n  if (source.value === 'stored') body.specName = specName.value;\n  else {\n    body.spec = form.value.spec;\n    if (form.value.compose.trim()) body.compose = form.value.compose;\n  }\n\n  const r = await api.put<SubmitResponse>(`/api/deployments/${encodeURIComponent(id)}`, body);\n  submitting.value = false;\n\n  if (r.status === 200 || r.status === 201) {\n    result.value = {\n      id: r.body.id ?? id,\n      stack: r.body.stack ?? '?',\n      created: r.status === 201,\n      stackSharedWith: r.body.stackSharedWith,\n    };\n    // Persist the variables that just validated this spec. On an older server this is the single\n    // thing keeping a later `down` pointed at the stack the `up` created.\n    writeVars(id, vars.value);\n    void loadDeployments();\n    toast('ok', `${r.status === 201 ? 'Created' : 'Replaced'} ${id} → ${result.value.stack}`, {\n      to: `/deployments/${encodeURIComponent(id)}`,\n      toLabel: 'Open',\n    });\n    return;\n  }\n  // 400 (SpecError), 409 (a job in flight over this stack), 401, 404 — all rendered verbatim.\n  error.value = problem(r, 'save this deployment');\n}\n\n/**\n * The preview domain, guessed from where this page is served.\n *\n * The UI lives on a host UNDER the preview domain (ui.preview.example.com, pstack.preview…), so\n * previews live beside it: drop this page's own first label and that is the base every generated\n * hostname hangs off. localhost and bare IPs have no domain to offer — those keep an honest\n * placeholder rather than generating `pr-123.192.168.1.5`.\n */\nfunction detectPreviewDomain(): string {\n  const h = location.hostname;\n  if (h === 'localhost' || h.endsWith('.localhost') || /^[\\d.]+$/.test(h) || h.includes(':')) {\n    return 'preview.example.com';\n  }\n  const labels = h.split('.');\n  return labels.length >= 3 ? labels.slice(1).join('.') : h;\n}\n\n/**\n * Kept as a function of the domain so the example is true on the host it is loaded on — a spec\n * copied from here should deploy without edits, not after find-and-replacing example.com.\n *\n * The compose half uses `pstack.routing.port`, NOT hand-written traefik labels: pstack generates\n * the router, TLS and network wiring from that one label. A bare `traefik.enable=true` is the\n * OPT-OUT signal (any traefik.* label means \"leave my service alone\") — which is what an older\n * version of this example taught, producing a service that was never reachable.\n */\nconst exampleSpec = (domain: string): string => `version: 1\nkind: isolated\n\n# The stack identity: the compose project name, and $STACK inside every hook.\n# \\${PR} is interpolated ONCE, at resolve time, from the variables sent with the request.\nstack: pr-\\${PR}\n\nenv:\n  # The base every generated hostname hangs off: the app below is served at\n  # app-pr-\\${PR}.${domain}\n  PREVIEW_DOMAIN: ${domain}\n\ncompose:\n  file: compose.yml\n  # Every service sits behind a profile so a bare \\`up\\` starts nothing.\n  # \\`down\\` always enables ALL of them — otherwise the unselected profiles' network leaks.\n  profiles: [app]\n\nrequires:\n  - name: traefik-network\n    assert: docker network inspect traefik >/dev/null 2>&1\n    hint: run \\`pstack init\\` on the host first\n\naxes:\n  # Hooks run from the deployment directory, which holds only spec.yml and compose.yml —\n  # so use inline shell or absolute paths, never ./hooks/foo.sh.\n  - name: scratch\n    up: mkdir -p /tmp/$STACK\n    assert_live: test -d /tmp/$STACK\n    down: rm -rf /tmp/$STACK\n    # assert_gone MUST FAIL CLOSED. A bare \\`! <probe>\\` reports \"gone\" whenever the probe fails\n    # for any reason — a missing CLI, an expired token — turning \"I could not tell\" into\n    # \"it is gone\", a false negative on the one thing this tool exists to catch.\n    assert_gone: |\n      test -d /tmp || exit 1\n      ! test -d /tmp/$STACK\n`;\n\nconst EXAMPLE_COMPOSE = `services:\n  app:\n    image: nginx:alpine\n    profiles: [app]\n    labels:\n      # The ONE label routing needs: pstack generates the Traefik router, TLS and network wiring\n      # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the\n      # service entirely alone, so only do that when you need something the shorthand cannot say.\n      - pstack.routing.port=80\n`;\n\nfunction loadExample(): void {\n  source.value = 'inline';\n  form.value.spec = exampleSpec(detectPreviewDomain());\n  if (!form.value.compose.trim()) form.value.compose = EXAMPLE_COMPOSE;\n  if (!form.value.id) form.value.id = 'pr-123';\n  if (!vars.value.some((e) => e.k)) vars.value = [{ k: 'PR', v: '123' }];\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          {{ replacing ? 'Edit a deployment' : copyFrom ? 'Duplicate a deployment' : 'Submit a deployment' }}\n        </h1>\n        <div class=\"sub\">\n          {{\n            replacing\n              ? 'Loaded from what is stored; saving replaces the record'\n              : copyFrom\n                ? `Copied from ${copyFrom} — give it a new id, then edit`\n                : 'Stores a spec so it can be deployed'\n          }}\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button class=\"ghost\" @click=\"loadExample\">Load example spec</button>\n    </div>\n\n    <section class=\"panel\">\n      <!-- The \"nothing saved until valid\" reassurance lives beside the Submit button below — the\n           moment of commitment is where a guarantee about committing belongs, not floating above\n           an unrelated id field. -->\n\n      <!--\n        A `PUT` REPLACES the whole record, and this form cannot pre-fill it: the API has no route\n        that returns a stored spec. Say that out loud, because a half-remembered spec pasted here\n        is still valid YAML — the server will accept it, and the axes the original declared simply\n        stop existing as far as the control plane knows, while whatever they created keeps running.\n      -->\n      <!--\n        The one thing that makes duplicating dangerous, said before the form rather than after the\n        submission: two records resolving to one stack drive the same compose project.\n      -->\n      <div v-if=\"copyFrom && !replacing\" class=\"banner warn\">\n        <b>Change the stack, not just the id.</b>\n        <p>\n          Two deployments that resolve to the same <code>stack</code> drive the same compose project —\n          <code>down</code> on either stops the other's containers. If the stack interpolates a variable\n          (<code>pr-${PR}</code>) give it a different value below; if it is a literal, edit the\n          <code>stack:</code> line.\n          <template v-if=\"sourceState === 'withheld'\">\n            The spec could not be copied without an access token —\n            <RouterLink to=\"/settings\">add yours</RouterLink>.\n          </template>\n        </p>\n      </div>\n\n      <div v-if=\"replacing\" class=\"banner\" :class=\"sourceState === 'loaded' ? 'info' : 'warn'\">\n        <b>Replacing {{ id }}.</b>\n        <p v-if=\"sourceState === 'loading'\">Loading what is stored…</p>\n        <p v-else-if=\"sourceState === 'loaded'\">\n          Loaded from the stored record — edit it and save. Saving replaces the record outright, so\n          anything you delete here stops being tracked while whatever it created keeps running.\n        </p>\n        <p v-else-if=\"sourceState === 'withheld'\">\n          The stored spec was not loaded: reading it needs an access token, because hooks routinely\n          carry a credential inline. <RouterLink to=\"/settings\">Add your token</RouterLink> to edit\n          in place — otherwise paste the <b>complete</b> spec, since anything you leave out stops\n          being tracked.\n        </p>\n        <p v-else>\n          The stored spec could not be loaded, so this form is empty. Paste the <b>complete</b> spec\n          you want stored — anything you leave out stops being tracked while whatever it created keeps\n          running.\n        </p>\n      </div>\n\n      <!--\n        A deployment that references a stored spec keeps its own copy of the source. Editing that copy\n        forks it: the stored spec every other deployment shares is untouched, and this one stops\n        following it. Silent forks are the kind of thing discovered months later.\n      -->\n      <div v-if=\"forkWarning\" class=\"banner warn\">\n        <b>This deployment tracks the stored spec “{{ forkWarning }}”.</b>\n        <p>\n          Saving here writes a private copy and stops it following that spec. To change every\n          deployment using it, edit\n          <RouterLink :to=\"`/specs/${encodeURIComponent(forkWarning)}`\">the spec</RouterLink> instead.\n        </p>\n      </div>\n\n      <div class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <div class=\"field\" style=\"max-width: 280px\">\n          <label for=\"did\">Deployment id</label>\n          <input\n            id=\"did\"\n            v-model.trim=\"form.id\"\n            type=\"text\"\n            placeholder=\"pr-123\"\n            spellcheck=\"false\"\n            autocomplete=\"off\"\n          />\n        </div>\n        <span class=\"mute\" style=\"align-self: end; padding-bottom: 10px\">\n          Lower case\n          <InfoHint label=\"allowed characters in a deployment id\">\n            Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64\n            characters — <code>[a-z0-9][a-z0-9._-]{0,63}</code>.\n          </InfoHint>\n        </span>\n      </div>\n\n      <!-- Offered only when this server actually has stored specs. -->\n      <div v-if=\"specs.length\" class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"inline\" /> inline spec\n        </label>\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"stored\" /> reference a stored spec\n        </label>\n      </div>\n\n      <template v-if=\"source === 'stored' && specs.length\">\n        <div class=\"field\" style=\"max-width: 340px\">\n          <label for=\"sn\">Stored spec</label>\n          <SelectMenu v-model=\"specName\" id=\"sn\" label=\"Stored spec\" :options=\"specOptions\" />\n        </div>\n        <p v-if=\"chosenSpec\" class=\"hint\">\n          <span v-if=\"chosenSpec.description\">{{ chosenSpec.description }} — </span>\n          needs\n          <b v-if=\"chosenSpec.requiredVars.length\">{{ chosenSpec.requiredVars.join(', ') }}</b>\n          <span v-else>no variables</span>.\n          <InfoHint label=\"why variables are required\">\n            A missing variable is refused by name. It is never filled in with a blank, which would\n            silently give every deployment the same stack name.\n          </InfoHint>\n        </p>\n      </template>\n\n      <template v-else>\n        <div class=\"field\">\n          <label for=\"spec\">Spec.yml</label>\n          <textarea\n            id=\"spec\"\n            v-model=\"form.spec\"\n            rows=\"12\"\n            spellcheck=\"false\"\n            placeholder=\"version: 1&#10;kind: isolated&#10;stack: pr-${PR}&#10;axes: []\"\n          />\n        </div>\n\n        <div class=\"field\" style=\"margin-top: var(--s3)\">\n          <label for=\"compose\">compose.yml <span class=\"mute\">(optional)</span></label>\n          <textarea\n            id=\"compose\"\n            v-model=\"form.compose\"\n            rows=\"6\"\n            spellcheck=\"false\"\n            placeholder=\"Written next to spec.yml, so a compose file named compose.yml resolves\"\n          />\n        </div>\n        <p class=\"hint\">\n          Hooks must be inline shell or an absolute path.\n          <InfoHint label=\"why a relative script path does not work\">\n            A deployment directory only ever holds <code>spec.yml</code> and\n            <code>compose.yml</code>, and hooks run from there — so\n            <code>up: ./hooks/db.sh</code> has nothing to find.\n          </InfoHint>\n        </p>\n      </template>\n\n      <h2 class=\"section\" style=\"margin: var(--s5) 0 var(--s3)\">Variables</h2>\n      <VarEditor v-model=\"vars\" />\n      <p class=\"hint\">\n        Saved with the deployment, so tearing it down later targets the same stack.\n        <InfoHint label=\"how variables are remembered\">\n          They are stored on the server where it supports that, and in this browser either way — so\n          the actions on the deployment page send exactly these values.\n        </InfoHint>\n      </p>\n\n      <div class=\"row\" style=\"margin-top: var(--s5)\">\n        <ActionButton variant=\"primary\" :pending=\"submitting\" :disabled=\"!canSubmit\" @click=\"submit\">\n          {{ submitting ? 'Submitting…' : 'Submit' }}\n        </ActionButton>\n        <span v-if=\"!result\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n          Nothing is saved until the spec is valid\n          <InfoHint label=\"what happens on a rejected submission\">\n            The spec is checked before anything is written, so a rejected submission leaves nothing\n            behind — and a replace never destroys a good record over a typo. Whether the deployment\n            is shared or isolated comes from the spec, not from this form.\n          </InfoHint>\n        </span>\n        <span v-if=\"result\" class=\"s-ok\">\n          {{ result.created ? 'Created' : 'Replaced' }} — stack\n          <b>{{ result.stack }}</b>\n          <RouterLink :to=\"`/deployments/${encodeURIComponent(result.id)}`\" style=\"margin-left: 8px\">\n            open →\n          </RouterLink>\n        </span>\n      </div>\n\n      <!--\n        The server's rejection text IS the documentation: it names the key, the variable or the\n        assert that is wrong, and often prints the corrected form. Rendered whole, newlines and\n        indentation intact. Never truncate it, never collapse it, never say \"invalid spec\".\n      -->\n      <!--\n        Reported by the server, which resolved every other deployment to check. Shown after the fact\n        because it can only be known once the spec has resolved — and it is a warning, not a rejection:\n        it can be deliberate, and refusing over a guess would be worse than saying so.\n      -->\n      <div v-if=\"result?.stackSharedWith?.length\" class=\"banner warn\">\n        <b>Another deployment already resolves to stack “{{ result.stack }}”.</b>\n        <p>\n          <template v-for=\"(o, i) in result.stackSharedWith\" :key=\"o\">\n            <RouterLink :to=\"`/deployments/${encodeURIComponent(o)}`\">{{ o }}</RouterLink\n            ><span v-if=\"i < result.stackSharedWith.length - 1\">, </span> </template\n          >— both records now drive the same compose project, so <code>down</code> on either stops the\n          other's containers and <code>verify</code> on either reports the other's leaks. If that was not\n          intended, change this one's <code>stack</code> and save again.\n        </p>\n      </div>\n\n      <ErrorNote v-if=\"error\" :text=\"error\" title=\"The server rejected this submission.\" />\n    </section>\n  </div>\n</template>\n"],"names":["EXAMPLE_COMPOSE","props","__props","form","ref","vars","source","specName","submitting","error","result","specs","specOptions","computed","api","r","chosenSpec","replacing","route","useRoute","copyFrom","v","sourceState","forkWarning","loadSource","id","watch","from","saved","_a","rowFor","pairsFromRecord","stored","readVars","e","canSubmit","submit","record","recordFromPairs","body","writeVars","loadDeployments","toast","problem","detectPreviewDomain","h","labels","exampleSpec","domain","loadExample","_createElementBlock","_createElementVNode","_hoisted_1","_toDisplayString","_hoisted_2","_hoisted_3","_openBlock","_hoisted_4","_cache","_Fragment","_createVNode","_component_RouterLink","_normalizeClass","_hoisted_7","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","$event","_hoisted_12","InfoHint","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","SelectMenu","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_21","_vModelText","_hoisted_22","_hoisted_23","VarEditor","_hoisted_24","_hoisted_25","ActionButton","_hoisted_26","_hoisted_27","_b","_hoisted_28","o","i","_createBlock","ErrorNote"],"mappings":"i8CAyRMA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mDA1PxB,MAAMC,EAAQC,EAERC,EAAOC,EAAI,CAAE,GAAIH,EAAM,IAAM,GAAI,KAAM,GAAI,QAAS,EAAA,CAAI,EACxDI,EAAOD,EAAe,CAAC,CAAE,EAAG,GAAI,EAAG,EAAA,CAAI,CAAC,EACxCE,EAASF,EAAyB,QAAQ,EAC1CG,EAAWH,EAAI,EAAE,EAEjBI,EAAaJ,EAAI,EAAK,EACtBK,EAAQL,EAAI,EAAE,EACdM,EAASN,EAML,IAAI,EAMRO,EAAQP,EAAgB,EAAE,EAG1BQ,EAAcC,EAAS,IAAM,CACjC,CAAE,MAAO,GAAI,MAAO,YAAA,EACpB,GAAGF,EAAM,MAAM,IAAK,IAAO,CAAE,MAAO,EAAE,KAAM,MAAO,EAAE,KAAM,KAAM,EAAE,MAAO,CAAA,CAC3E,EACIG,EAAI,IAAmB,YAAY,EAAE,KAAMC,GAAM,CAChDA,EAAE,IAAM,MAAM,QAAQA,EAAE,KAAK,KAAK,IAAGJ,EAAM,MAAQI,EAAE,KAAK,MAChE,CAAC,EAED,MAAMC,EAAaH,EAAS,IAAMF,EAAM,MAAM,KAAM,GAAM,EAAE,OAASJ,EAAS,KAAK,CAAC,EAE9EU,EAAYJ,EAAS,IAAM,CAAC,CAACZ,EAAM,EAAE,EAYrCiB,EAAQC,GAAA,EACRC,EAAWP,EAAS,IAAM,CAC9B,MAAMQ,EAAIH,EAAM,MAAM,KACtB,OAAO,OAAOG,GAAM,UAAYA,EAAIA,EAAI,IAC1C,CAAC,EAeKC,EAAclB,EAA2D,MAAM,EAE/EmB,EAAcnB,EAAmB,IAAI,EAE3C,eAAeoB,EAAWC,EAA2B,CACnDH,EAAY,MAAQ,UACpBC,EAAY,MAAQ,KACpB,MAAMR,EAAI,MAAMD,EAAI,UAClB,oBAAoB,mBAAmBW,CAAE,CAAC,SAAA,EAI5C,GAAIV,EAAE,SAAW,KAAO,CAACA,EAAE,GAAI,CAC7BO,EAAY,MAAQ,SACpB,MACF,CACA,GAAIP,EAAE,KAAK,eAAgB,CACzBO,EAAY,MAAQ,WAChBP,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChD,MACF,CAEKZ,EAAK,MAAM,SAAW,MAAM,KAAOY,EAAE,KAAK,MAAQ,IAClDZ,EAAK,MAAM,YAAc,MAAM,QAAUY,EAAE,KAAK,SAAW,IAC5DA,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChDO,EAAY,MAAQ,QACtB,CAIAI,EACEN,EACA,MAAOO,GAAS,OACd,GAAI,CAACA,GAAQ1B,EAAM,GAAI,OACvBQ,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfP,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,GACrB,MAAMyB,GAAQC,EAAAC,EAAOH,CAAI,IAAX,YAAAE,EAAc,KACxBD,IAAOvB,EAAK,MAAQ0B,EAAgBH,CAAK,GAC7C,MAAMJ,EAAWG,CAAI,EAErBxB,EAAK,MAAM,GAAK,EAClB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpBuB,EACE,IAAMzB,EAAM,GACXwB,GAAO,OAKN,GAJAhB,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfY,EAAY,MAAQ,OACpBC,EAAY,MAAQ,KAChB,CAACE,EAAI,OACLA,IAAOtB,EAAK,MAAM,KACpBA,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,IAEvBA,EAAK,MAAM,GAAKsB,EAGhB,MAAMO,GAASH,EAAAC,EAAOL,CAAE,IAAT,YAAAI,EAAY,KACrBD,EAAQI,EAASD,EAAgBC,CAAM,EAAIC,GAASR,CAAE,EACxDG,EAAM,KAAMM,GAAMA,EAAE,CAAC,MAAQ,MAAQN,GACpCJ,EAAWC,CAAE,CACpB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpB,MAAMU,EAAYtB,EAChB,IACE,CAAC,CAACV,EAAK,MAAM,KACZG,EAAO,QAAU,SAAW,CAAC,CAACC,EAAS,MAAQ,CAAC,CAACJ,EAAK,MAAM,KAAK,KAAA,IAClE,CAACK,EAAW,KAAA,EAGhB,eAAe4B,GAAwB,CACrC5B,EAAW,MAAQ,GACnBC,EAAM,MAAQ,GACdC,EAAO,MAAQ,KAEf,MAAMe,EAAKtB,EAAK,MAAM,GAChBkC,EAASC,GAAgBjC,EAAK,KAAK,EAOnCkC,EAAgC,CAAE,KAAMF,EAAQ,IAAKA,CAAA,EACvD/B,EAAO,QAAU,SAAUiC,EAAK,SAAWhC,EAAS,OAEtDgC,EAAK,KAAOpC,EAAK,MAAM,KACnBA,EAAK,MAAM,QAAQ,KAAA,IAAQoC,EAAK,QAAUpC,EAAK,MAAM,UAG3D,MAAMY,EAAI,MAAMD,EAAI,IAAoB,oBAAoB,mBAAmBW,CAAE,CAAC,GAAIc,CAAI,EAG1F,GAFA/B,EAAW,MAAQ,GAEfO,EAAE,SAAW,KAAOA,EAAE,SAAW,IAAK,CACxCL,EAAO,MAAQ,CACb,GAAIK,EAAE,KAAK,IAAMU,EACjB,MAAOV,EAAE,KAAK,OAAS,IACvB,QAASA,EAAE,SAAW,IACtB,gBAAiBA,EAAE,KAAK,eAAA,EAI1ByB,GAAUf,EAAIpB,EAAK,KAAK,EACnBoC,GAAA,EACLC,GAAM,KAAM,GAAG3B,EAAE,SAAW,IAAM,UAAY,UAAU,IAAIU,CAAE,MAAMf,EAAO,MAAM,KAAK,GAAI,CACxF,GAAI,gBAAgB,mBAAmBe,CAAE,CAAC,GAC1C,QAAS,MAAA,CACV,EACD,MACF,CAEAhB,EAAM,MAAQkC,GAAQ5B,EAAG,sBAAsB,CACjD,CAUA,SAAS6B,GAA8B,CACrC,MAAMC,EAAI,SAAS,SACnB,GAAIA,IAAM,aAAeA,EAAE,SAAS,YAAY,GAAK,WAAW,KAAKA,CAAC,GAAKA,EAAE,SAAS,GAAG,EACvF,MAAO,sBAET,MAAMC,EAASD,EAAE,MAAM,GAAG,EAC1B,OAAOC,EAAO,QAAU,EAAIA,EAAO,MAAM,CAAC,EAAE,KAAK,GAAG,EAAID,CAC1D,CAWA,MAAME,EAAeC,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAS5BA,CAAM;AAAA,oBACNA,CAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuC1B,SAASC,GAAoB,CAC3B3C,EAAO,MAAQ,SACfH,EAAK,MAAM,KAAO4C,EAAYH,EAAA,CAAqB,EAC9CzC,EAAK,MAAM,QAAQ,SAAQA,EAAK,MAAM,QAAUH,IAChDG,EAAK,MAAM,KAAIA,EAAK,MAAM,GAAK,UAC/BE,EAAK,MAAM,KAAM6B,GAAMA,EAAE,CAAC,IAAG7B,EAAK,MAAQ,CAAC,CAAE,EAAG,KAAM,EAAG,MAAO,EACvE,0DAIE6C,EA0NM,MAAA,KAAA,CAzNJC,EAiBM,MAjBNC,GAiBM,CAhBJD,EAaM,MAAA,KAAA,CAZJA,EAEK,KAAA,KAAAE,EADApC,EAAA,MAAS,oBAAyBG,EAAA,MAAQ,yBAAA,qBAAA,EAAA,CAAA,EAE/C+B,EAQM,MARNG,GAQMD,EANFpC,EAAA,+DAAmGG,EAAA,qBAA0CA,EAAA,KAAQ,yFAQ3J+B,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAAqE,SAAA,CAA7D,MAAM,QAAS,QAAOF,CAAA,EAAa,mBAAiB,CAAA,GAG9DE,EAqMU,UArMVI,GAqMU,CAtLGnC,EAAA,QAAaH,EAAA,OAAxBuC,IAAAN,EAYM,MAZNO,GAYM,CAXJC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAyC,SAAtC,qCAAkC,EAAA,GACrCA,EASI,IAAA,KAAA,iBATD,6CACwC,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,qCAC3D,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,kFAChB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,mBAAO,mEACtB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,UACnB,EAAA,GAAgB7B,EAAA,QAAW,gBAA3B4B,EAGWS,EAAA,CAAA,IAAA,GAAA,eAHiC,2DAE1C,EAAA,GAAAC,EAAiDC,EAAA,CAArC,GAAG,aAAW,WAAC,IAAS,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAT,YAAS,EAAA,CAAA,2BAAa,KACnD,EAAA,EAAA,8BAIOzC,EAAA,WAAXiC,EAkBM,MAAA,OAlBgB,MAAKY,EAAA,CAAC,SAAiBxC,EAAA,QAAW,SAAA,OAAA,MAAA,CAAA,CAAA,GACtD6B,EAA0B,IAAA,KAAvB,aAAUE,EAAGnD,EAAA,EAAE,EAAG,IAAC,CAAA,EACboB,EAAA,QAAW,WAApBkC,EAAA,EAAAN,EAA+D,OAA3B,yBAAuB,GAC7C5B,EAAA,QAAW,UAAzBkC,IAAAN,EAGI,OAHoC,mLAGxC,GACc5B,EAAA,QAAW,gBAAzB4B,EAKI,IAAAa,GAAA,iBALsC,yHAEb,EAAA,GAAAH,EAAsDC,EAAA,CAA1C,GAAG,aAAW,WAAC,IAAc,CAAA,GAAAH,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAd,iBAAc,EAAA,CAAA,2BAAa,2CAClD,EAAA,GAAAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,mBAAI,4DAEhD,EAAA,EAAA,SACAD,EAII,IAAAc,GAAA,CAAA,GAAAN,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJM,0EAC8D,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,IAAI,+GAGvF,EAAA,CAAA,oBAQS5B,EAAA,OAAXiC,EAAA,EAAAN,EAOM,MAPNe,GAOM,CANJd,EAAkE,IAAA,KAA/D,2CAAwCE,EAAG9B,EAAA,KAAW,EAAG,KAAE,CAAA,EAC9D4B,EAII,IAAA,KAAA,iBAJD,kHAGD,EAAA,GAAAS,EAAmFC,EAAA,CAAtE,GAAE,UAAY,mBAAmBtC,EAAA,KAAW,CAAA,EAAA,aAAK,IAAQ,CAAA,GAAAmC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAR,WAAQ,EAAA,CAAA,oCAAa,aACrF,EAAA,EAAA,eAGFP,EAmBM,MAnBNe,GAmBM,CAlBJf,EAUM,MAVNgB,GAUM,CATJT,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAsC,QAAA,CAA/B,IAAI,KAAA,EAAM,gBAAa,EAAA,KAC9BA,EAOE,QAAA,CANA,GAAG,MACW,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,GAAEiE,GACrB,KAAK,OACL,YAAY,SACZ,WAAW,QACX,aAAa,KAAA,gBAJCjE,EAAA,MAAK,UAAX,CAAA,KAAR,EAAA,CAAsB,MAO1BgD,EAMO,OANPkB,GAMO,iBAN0D,eAE/D,EAAA,GAAAT,EAGWU,EAAA,CAHD,MAAM,yCAAuC,WAAC,IAEzC,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFyC,wGAEzC,EAAA,EAAAP,EAAsC,YAAhC,4BAAyB,EAAA,IAAO,KACrD,EAAA,CAAA,eAKOxC,EAAA,MAAM,QAAjB6C,IAAAN,EAOM,MAPNqB,GAOM,CANJpB,EAEQ,QAFRqB,GAEQ,GADNrB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,gBACxD,EAAA,EAAA,GACA6C,EAEQ,QAFRsB,GAEQ,GADNtB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,4BACxD,EAAA,EAAA,eAGcA,EAAA,QAAM,UAAiBK,EAAA,MAAM,YAA7CuC,EAeWS,EAAA,CAAA,IAAA,GAAA,CAdTR,EAGM,MAHNuB,GAGM,CAFJhB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmC,QAAA,CAA5B,IAAI,IAAA,EAAK,cAAW,EAAA,GAC3BS,EAAoFe,GAAA,YAA/DpE,EAAA,2CAAAA,EAAQ,MAAA6D,GAAE,GAAG,KAAK,MAAM,cAAe,QAASxD,EAAA,KAAA,qCAE9DI,EAAA,OAATwC,EAAA,EAAAN,EASI,IATJ0B,GASI,CARU5D,EAAA,MAAW,aAAvBwC,IAAAN,EAA0E,OAAA2B,GAAAxB,EAAnCrC,EAAA,MAAW,WAAW,EAAG,MAAG,CAAA,4BAAO,UAE1E,EAAA,GAASA,EAAA,MAAW,aAAa,QAAjCwC,EAAA,EAAAN,EAAqF,IAAA4B,GAAAzB,EAAzCrC,EAAA,MAAW,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,IACxEwC,IAAAN,EAAgC,UAAnB,cAAY,mBAAO,KAChC,EAAA,GAAAU,EAGWU,EAAA,CAHD,MAAM,8BAA4B,WAAC,IAG7C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH6C,+IAG7C,EAAA,CAAA,kCAIJR,EA8BWS,EAAA,CAAA,IAAA,GAAA,CA7BTR,EASM,MATN4B,GASM,CARJrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkC,QAAA,CAA3B,IAAI,MAAA,EAAO,WAAQ,EAAA,KAC1BA,EAME,WAAA,CALA,GAAG,OACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,KAAIiE,GAClB,KAAK,KACL,WAAW,QACX,YAAY;AAAA;AAAA;AAAA,SAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,IAAI,CAAA,KAOtBgD,EASM,MATN8B,GASM,eARJ9B,EAA6E,QAAA,CAAtE,IAAI,WAAS,GAAC,cAAY,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAC9DA,EAME,WAAA,CALA,GAAG,UACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,QAAOiE,GACrB,KAAK,IACL,WAAW,QACX,YAAY,wEAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,OAAO,CAAA,KAMzBgD,EAOI,IAPJ+B,GAOI,iBAPY,oDAEd,EAAA,GAAAtB,EAIWU,EAAA,CAJD,MAAM,4CAA0C,WAAC,IAClB,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GADkB,2CAClB,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,IAAO,QAC5D,EAAA,EAAAA,EAAwB,YAAlB,cAAW,EAAA,IAAO,mCACxB,EAAA,EAAAA,EAA8B,YAAxB,oBAAiB,EAAA,IAAO,yBAChC,EAAA,CAAA,iCAIJA,EAAwE,KAAA,CAApE,MAAM,UAAU,MAAA,CAAA,OAAA,uBAAA,CAAA,EAAsC,YAAS,EAAA,GACnES,EAA4BuB,GAAA,YAAR9E,EAAA,2CAAAA,EAAI,MAAA+D,EAAA,yBACxBjB,EAMI,IANJiC,GAMI,iBANY,gFAEd,EAAA,GAAAxB,EAGWU,EAAA,CAHD,MAAM,gCAA8B,WAAC,IAG/C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH+C,4JAG/C,EAAA,CAAA,aAGFP,EAmBM,MAnBNkC,GAmBM,CAlBJzB,EAEe0B,GAAA,CAFD,QAAQ,UAAW,QAAS9E,EAAA,MAAa,UAAW2B,EAAA,MAAY,QAAOC,CAAA,aACnF,IAA2C,KAAxC5B,EAAA,MAAU,cAAA,QAAA,EAAA,CAAA,CAAA,kCAEFE,EAAA,gBAAb8C,IAAAN,EAOO,OAPPqC,GAOO,iBAP0D,6CAE/D,EAAA,GAAA3B,EAIWU,EAAA,CAJD,MAAM,yCAAuC,WAAC,IAIxD,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJwD,mPAIxD,EAAA,CAAA,cAEUhD,EAAA,OAAZ8C,EAAA,EAAAN,EAMO,OANPsC,GAMO,KALF9E,EAAA,MAAO,QAAO,UAAA,UAAA,EAA4B,YAC7C,CAAA,EAAAyC,EAAyB,IAAA,KAAAE,EAAnB3C,EAAA,MAAO,KAAK,EAAA,CAAA,EAClBkD,EAEaC,EAAA,CAFA,GAAE,gBAAkB,mBAAmBnD,EAAA,MAAO,EAAE,CAAA,GAAK,MAAA,CAAA,cAAA,KAAA,CAAA,aAAyB,IAE3F,CAAA,GAAAgD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAF2F,WAE3F,EAAA,CAAA,mCAcO+B,GAAA5D,EAAAnB,EAAA,QAAA,YAAAmB,EAAQ,kBAAR,MAAA4D,EAAyB,QAApCjC,IAAAN,EAUM,MAVNwC,GAUM,CATJvC,EAAyE,SAAtE,iDAA8CE,EAAG3C,QAAO,KAAK,EAAG,KAAE,CAAA,EACrEyC,EAOI,IAAA,KAAA,EANFK,EAAA,EAAA,EAAAN,EAGCS,SAH0BjD,EAAA,MAAO,gBAAe,CAA/BiF,EAAGC,kBAAoCD,GAAC,CACxD/B,EACCC,EAAA,CADY,GAAE,gBAAkB,mBAAmB8B,CAAC,CAAA,EAAA,aAAK,IAAO,KAAJA,CAAC,EAAA,CAAA,CAAA,qBACjDC,EAAIlF,EAAA,MAAO,gBAAgB,OAAM,GAA7C8C,EAAA,EAAAN,EAA4D,UAAT,IAAE,yCACvD,yDAAsD,EAAA,GAAAQ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,+CACjD,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,qFACd,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,oBAChD,EAAA,EAAA,eAGe1C,EAAA,WAAjBoF,EAAqFC,GAAA,OAA5D,KAAMrF,EAAA,MAAO,MAAM,sCAAA"}