@samyx/preview-stacks-ui 0.31.0 → 0.32.0

package/dist/assets/{SsoView-BUz2EaVq.js.map → SsoView-CltdTdwt.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SsoView-BUz2EaVq.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * THREE THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { ClaimMap, SsoConfig, SsoConfigResponse, SsoPreset, SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  defaultRole: 'admin',\n});\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup walkthrough and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.form.mode === 'oidc' ? 'Saved — the issuer answered, so the settings are known good.' : 'Saved.');\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Existing accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the sign-in rules on each\n              provider if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Several providers share the accounts.</b> Each shows up as its own button on the\n              login page, and the same person arriving from the same directory is the same account —\n              nothing about local accounts or personal tokens changes either way.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity providers you already run\n          <InfoHint label=\"what is stored\">\n            One row per provider: the endpoints, the client id, and the client secret. The secret has\n            no read path — this page only learns whether one is stored, and leaving the field empty\n            keeps it.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- The walkthrough: where to create the app, in the preset's own words. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <b>Register the app with {{ editing.preset.label }}</b>\n          <p>{{ editing.preset.setupHint }}</p>\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">\n            Paste this into the provider's application as the redirect / callback URL. It has to\n            match byte for byte, and it is the same for every provider on this host — a mismatch is\n            the single most common reason the exchange fails, and the provider's error rarely says\n            so.\n          </p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">\n            This host's name for the provider — it appears in the sign-in URL and in exports, never\n            to the person signing in. Lowercase letters, digits and dashes.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">The login page draws it as “Continue with {{ editing.form.label || editing.preset?.label || '…' }}”.</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">\n                Assembled from the value{{ placeholderNames.length > 1 ? 's' : '' }} above —\n                {{ editing.preset?.label }} gives every account its own issuer, so there is no single\n                URL a preset could carry. It is fetched when you save, so a typo is refused here\n                rather than at someone's first login.\n              </p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">\n              Or the full <code>…/.well-known/openid-configuration</code> URL. Everything but the\n              client id and secret is discovered from it, and it is fetched when you save — so a typo\n              is refused here rather than at someone's first login.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'A secret is stored — leave this empty to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Where this host asks which groups someone is in. Only consulted when there is a group\n              rule below. Filled in automatically for a preset — but only while the user info URL is\n              still the preset's, because a self-hosted host's token must not be sent to the public\n              one, so a self-hosted provider needs this typed.\n            </p>\n          </div>\n\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account</h2></div>\n        <p class=\"dim\">\n          By default, anyone this provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane. <b>Any one entry in a list is enough to satisfy that\n          list, and every list you fill in has to be satisfied</b> — fill all three in and a login\n          needs a listed domain, a matching username, and one of the groups. A list left empty is not\n          a rule at all: it lets everyone past that check, it does not lock everyone out.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns, case-insensitive: <code>*</code>, <code>?</code> and\n            <code>[0-9]</code> classes. Empty means no restriction. <b>Non-empty means a login whose\n            provider sends no username is refused too</b> — so this is a rule for a provider that\n            actually has usernames (GitHub's <code>login</code>, GitLab's <code>username</code>). On\n            an OpenID Connect issuer that sends no <code>preferred_username</code> it refuses\n            everyone rather than nobody, so set it only where you know the provider sends one.\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            Comma-separated, and <b>exact names, not patterns</b> — an organisation login, or a group\n            path like <code>acme/backend</code>. Case-insensitive. Empty means no restriction.\n            Non-empty makes every sign-in ask the provider for that person's groups, so it needs the\n            OAuth scope that endpoint requires: <b>add it to Scopes above, or the save is refused</b>\n            — and the refusal names the scope. It also needs a provider whose group list this host\n            knows how to read, which the save checks by name. If that call does not answer, the\n            sign-in is refused rather than allowed.\n          </p>\n        </div>\n        <p v-else class=\"hint\">\n          A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth\n          2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none\n          here.\n        </p>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">\n          Pick where your team already signs in. A preset knows the provider's endpoints and its\n          quirks — the only things it cannot know are the client id and secret you get when you\n          register the app, and the form that opens says exactly where to do that.\n        </p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n        <p class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n          Removing a provider does not delete anyone. Those accounts keep their personal tokens, and\n          pointing the same provider back at this host re-links them by subject.\n        </p>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">\n          The redirect URI to register with every provider — one URL for all of them, built by the\n          server so it cannot drift from the one the sign-in flow actually sends.\n        </p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["OIDC_CLAIMS","blank","providers","ref","presets","callbackUrl","loaded","listError","editing","picking","saving","formError","load","r","api","problem","showPicker","computed","pickerTiles","p","suggestKey","base","taken","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","_a","keyRe","cannotSave","key","url","list","s","v","save","body","toast","remove","copyCallback","whereLine","c","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","SsoMark","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","$event","_openBlock","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","_hoisted_12","_hoisted_13","_vModelText","_hoisted_14","_hoisted_16","_renderList","ph","_unref","sentence","_hoisted_17","_hoisted_19","_hoisted_20","_hoisted_21","_d","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_25","_hoisted_26","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","_hoisted_33","_hoisted_34","_hoisted_35","k","_hoisted_36","_hoisted_38","_hoisted_39","_hoisted_40","_hoisted_41","_hoisted_42","_hoisted_43","ActionButton","_createTextVNode","_hoisted_44","_hoisted_45","_hoisted_46","_hoisted_47","_hoisted_49","_hoisted_50","_hoisted_51","i","_hoisted_52","_hoisted_53","_hoisted_54","_hoisted_55","_hoisted_56","RelativeTime","_hoisted_57","_hoisted_58","_hoisted_59","_hoisted_60","_hoisted_61","SkeletonList"],"mappings":"ssEA2CA,MAAMA,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAChB,YAAa,OAAA,GAGTE,EAAYC,EAAwB,EAAE,EACtCC,EAAUD,EAAiB,EAAE,EAC7BE,EAAcF,EAAI,EAAE,EACpBG,EAASH,EAAI,EAAK,EAClBI,EAAYJ,EAAI,EAAE,EAmBlBK,EAAUL,EAAoB,IAAI,EAClCM,EAAUN,EAAI,EAAK,EACnBO,EAASP,EAAI,EAAK,EAClBQ,EAAYR,EAAI,EAAE,EAExB,eAAeS,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAuB,iBAAiB,EAE5D,GADAR,EAAO,MAAQ,GACX,CAACO,EAAE,GAAI,CACTN,EAAU,MAAQQ,EAAQF,EAAG,2BAA2B,EACxD,MACF,CACAN,EAAU,MAAQ,GAClBL,EAAU,MAAQW,EAAE,KAAK,WAAa,CAAA,EACtCT,EAAQ,MAAQS,EAAE,KAAK,SAAW,CAAA,EAClCR,EAAY,MAAQQ,EAAE,KAAK,WAC7B,CACKD,EAAA,EAGL,MAAMI,EAAaC,EAAS,IAAM,CAACT,EAAQ,QAAUC,EAAQ,OAAUH,EAAO,OAAS,CAACC,EAAU,OAASL,EAAU,MAAM,SAAW,EAAG,EAEnIgB,EAAcD,EAAS,IAAM,CACjC,GAAGb,EAAQ,MAAM,IAAKe,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,EAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIpB,EAAU,MAAM,IAAKiB,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAAS,EAAI,GAAK,IAAK,GAAI,CAACC,EAAM,IAAI,GAAGD,CAAI,IAAI,CAAC,EAAE,QAAU,GAAGA,CAAI,IAAI,CAAC,EAC5E,CAEA,SAASE,EAASC,EAAmE,CACnF,MAAML,EAAIK,EAAK,OACTC,EAAIxB,EAAA,EACVwB,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWN,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,GACzDL,IACFM,EAAE,MAAQN,EAAE,MACZM,EAAE,OAASN,EAAE,OACbM,EAAE,SAAW,CAAE,GAAGzB,EAAa,GAAGmB,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbM,EAAE,aAAeN,EAAE,aACnBM,EAAE,SAAWN,EAAE,SACfM,EAAE,YAAcN,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCM,EAAE,aAAeN,EAAE,eAGvBX,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKY,EAAWD,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQL,EACR,KAAMM,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBd,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASiB,EAAUC,EAA+B,CAChDnB,EAAQ,MAAQ,CACd,YAAamB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQvB,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAG1B,IAAS,GAAG0B,EAAM,OAAQ,SAAU,CAAE,GAAG3B,EAAa,GAAG2B,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBhB,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMoB,EAAgBZ,EAAgD,IAAM,CAC1E,MAAMa,EAAItB,EAAQ,MAClB,GAAI,CAACsB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,EAAmBnB,EAAS,KAC/BY,EAAc,OAAS,CAAA,GAAI,QAASV,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EkB,EAAqBpB,EAAS,IAAM,CACxC,MAAMe,EAAQH,EAAc,MACtB,EAAIrB,EAAQ,MAClB,MAAI,CAACwB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKb,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAImB,EAAA,EAAE,aAAanB,EAAE,EAAE,IAAnB,YAAAmB,EAAsB,SAAU,IAAInB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKoB,GAAQ,4BAGRC,EAAavB,EAAiB,IAAM,CACxC,MAAMa,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,MAAO,0BACf,MAAMW,EAAMX,EAAE,IAAI,KAAA,EAClB,GAAI,CAACS,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIX,EAAE,cAAgB,MAAQ5B,EAAU,MAAM,KAAMiB,GAAMA,EAAE,MAAQsB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACX,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMY,EAAMb,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACY,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACZ,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKa,EAAQC,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKC,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAeC,IAAsB,CACnC,MAAMhB,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,OACRpB,EAAO,MAAQ,GAIf,MAAMqC,EAA0D,CAC9D,GAAGjB,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBa,EAAKb,EAAE,OAAO,EACnC,iBAAkBa,EAAKb,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKa,EAAKb,EAAE,MAAM,CAAA,EAEvDjB,EAAI,MAAMC,EAAI,IAAkC,kBAAmBiC,CAAI,EAE7E,GADArC,EAAO,MAAQ,GACX,CAACG,EAAE,GAAI,CAGTF,EAAU,MAAQI,EAAQF,EAAG,mBAAmB,EAChD,MACF,CACAF,EAAU,MAAQ,GAClBqC,EAAM,KAAMlB,EAAE,KAAK,OAAS,OAAS,+DAAiE,QAAQ,EAC9GtB,EAAQ,MAAQ,KACXI,EAAA,CACP,CAEA,eAAeqC,GAAOtB,EAAwC,CAC5D,MAAMd,EAAI,MAAMC,EAAI,IAAI,mBAAmBa,EAAM,GAAG,EAAE,EACtD,GAAI,CAACd,EAAE,GAAI,CACTN,EAAU,MAAQQ,EAAQF,EAAG,qBAAqB,EAClD,MACF,CACAmC,EAAM,KAAM,WAAWrB,EAAM,GAAG,mCAAmC,EAC9Df,EAAA,CACP,CAEA,eAAesC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAU7C,EAAY,KAAK,EACrD2C,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAMjC,EAAIf,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQwB,EAAE,QAAQ,EACxD,OAAOjC,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAGA,SAASkC,GAAUD,EAAsB,WACvC,MAAMpB,EAAkB,CAAA,EACxB,OAAIM,EAAAc,EAAE,sBAAF,MAAAd,EAAuB,QAAQN,EAAM,KAAK,WAAWoB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFE,EAAAF,EAAE,mBAAF,MAAAE,EAAoB,QAAQtB,EAAM,KAAK,aAAaoB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFG,EAAAH,EAAE,iBAAF,MAAAG,EAAkB,QAAQvB,EAAM,KAAK,UAAUoB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEpB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,sCAIEwB,EAoVM,MAAA,KAAA,CAnVJC,EAyCM,MAzCNC,GAyCM,CAxCJD,EAqCM,MAAA,KAAA,CApCJA,EA2BK,KAAA,KAAA,iBA3BD,mBAEF,EAAA,GAAAE,EAwBYC,GAAA,CAxBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,sUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAII,IAAA,KAAA,CAHFA,EAA4C,SAAzC,uCAAqC,IAAI,qMAG9C,CAAA,kBAGJA,EAOM,MAPNK,GAOM,iBAPW,mEAEf,EAAA,GAAAH,EAIWI,EAAA,CAJD,MAAM,kBAAgB,WAAC,IAIjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJiC,gMAIjC,EAAA,CAAA,6BAGJJ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJnD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDwC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO/C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGF,EAAA,WAAjByD,EAAwEC,EAAA,OAA3C,KAAM1D,EAAA,MAAW,MAAM,iBAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArBgD,EA+NWU,EAAA,CAAA,IAAA,GAAA,CA9NTT,EA6JU,UA7JVU,GA6JU,CA5JRV,EAYM,MAZNW,GAYM,CAXJT,EAAsDU,EAAA,CAA5C,OAAQ7D,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChDiD,EAMK,KANLa,GAMKC,EAJD/D,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4B8B,EAAA9B,EAAA,MAAQ,SAAR,YAAA8B,EAAgB,SAAU9B,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5IiD,EAA6F,OAA7Fe,GAA6FD,EAAvE/D,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvCiD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FgB,GAA6F,GAAxEhB,EAAwD,QAAA,sCAAxCjD,EAAA,MAAQ,KAAK,QAAOkE,GAAE,KAAK,UAAA,iBAA3BlE,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnBmE,IAAAnB,EAQM,MARNoB,GAQM,CAPJnB,EAAuD,SAApD,yBAAsBc,EAAG/D,QAAQ,OAAO,KAAK,EAAA,CAAA,EAChDiD,EAAqC,IAAA,KAAAc,EAA/B/D,EAAA,MAAQ,OAAO,SAAS,EAAA,CAAA,EAC9BiD,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAMjD,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAAqE,EAAA,CAAA,eAKJpB,EAYM,MAZNqB,GAYM,CAXJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNsB,GAGM,CAFJtB,EAA8C,OAA9CuB,GAA8CT,EAArBlE,EAAA,KAAW,EAAA,CAAA,EACpCoD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOP,CAAA,EAAc,MAAI,CAAA,GAElDW,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,4QAKhB,EAAA,EAAA,GAGUjD,EAAA,MAAQ,sBAApBmE,IAAAnB,EAOM,MAPNyB,GAOM,CANJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAAlE,EAAA,MAAQ,IAAGkE,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAQ,EAAA1E,EAAA,MAAQ,GAAG,CAAA,GACxCqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,QAAO,4JAGhB,EAAA,EAAA,IAGFA,EAIM,MAJN0B,GAIM,CAHJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqBjD,EAAA,MAAQ,KAAK,MAAKkE,GAAE,KAAK,OAAQ,cAAapB,EAAA9C,EAAA,MAAQ,SAAR,YAAA8C,EAAgB,QAAK,UAAA,iBAAnE9C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjDiD,EAAwH,IAAxH2B,GAAgB,6CAA0Cb,EAAG/D,QAAQ,KAAK,SAAS+C,EAAA/C,EAAA,MAAQ,SAAR,YAAA+C,EAAgB,aAAe,KAAE,CAAA,CAAA,GAItG/C,EAAA,MAAQ,KAAK,OAAI,YAAjCgD,EA0BWU,EAAA,CAAA,IAAA,CAAA,EAAA,CAzBOrC,EAAA,WAAhB2B,EAeWU,EAAA,CAAA,IAAA,GAAA,QAdTV,EAGMU,EAAA,KAAAmB,EAHYjD,EAAA,MAANkD,QAAZ9B,EAGM,MAAA,CAH+B,IAAK8B,EAAI,MAAM,OAAA,GAClD7B,EAAmD,QAAA,CAA3C,UAAW6B,CAAE,EAAA,EAAOf,EAAAgB,GAAAC,EAAA,EAASF,CAAE,CAAA,EAAA,EAAAG,EAAA,IACvChC,EAA4G,QAAA,CAApG,SAAU6B,CAAE,4BAAa9E,EAAA,MAAQ,aAAa8E,CAAE,EAAAZ,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/DlE,EAAA,MAAQ,aAAa8E,CAAE,CAAA,CAAA,aAE1D7B,EASM,MATNiC,GASM,CARJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBpB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAsD,EAAA,EAC5GlC,EAKI,IALJmC,GAAgB,4BACUrB,EAAGnC,QAAiB,OAAM,EAAA,IAAA,EAAA,EAAkB,eACjEyD,EAAArF,EAAA,MAAQ,SAAR,YAAAqF,EAAgB,KAAK,EAAG,qLAG7B,CAAA,CAAA,UAGJlB,IAAAnB,EAQM,MARNsC,GAQM,CAPJjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,aAAYkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtElE,EAAA,MAAQ,KAAK,YAAY,CAAA,iBACzDiD,EAII,IAAA,CAJD,MAAM,QAAM,GAAC,eACF,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,yKAG7D,CAAA,yBAIJA,EAGM,MAHNsC,GAGM,CAFJlC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,SAAQkE,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnElE,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvDiD,EAOM,MAPNuC,GAOM,CANJnC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAAlE,EAAA,MAAQ,OAAMkE,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAQ,EAAA1E,EAAA,MAAQ,MAAM,CAAA,GAC9CiD,EAGI,IAHJwC,GAAgB,gBAEd1B,EAAG/D,EAAA,MAAQ,UAAS,oDAAA,iDAAA,EAAA,CAAA,CAAA,GAIxBiD,EAGM,MAHNyC,GAGM,CAFJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,OAAMkE,GAAE,KAAK,OAAO,WAAW,QAAS,YAAalE,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhCgD,EAkDU,UAAA,OAlDqC,MAAM,UAAW,KAAI,CAAGhD,EAAA,MAAQ,MAAA,GAC7EqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHN0C,GAGM,CAFJtC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoBjD,EAAA,MAAQ,KAAK,aAAYkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlDlE,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzDiD,EAGM,MAHN2C,GAGM,CAFJvC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqBjD,EAAA,MAAQ,KAAK,SAAQkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9ClE,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtDiD,EAIM,MAJN4C,GAIM,CAHJxC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwBjD,EAAA,MAAQ,KAAK,YAAWkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjDlE,EAAA,MAAQ,KAAK,WAAW,CAAA,GAC1DqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARN6C,GAQM,eAPJ7C,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsBjD,EAAA,MAAQ,KAAK,UAASkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/ClE,EAAA,MAAQ,KAAK,SAAS,CAAA,GACtDqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,GAEFA,EASM,MATN8C,GASM,eARJ9C,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0BjD,EAAA,MAAQ,KAAK,UAASkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/ClE,EAAA,MAAQ,KAAK,SAAS,CAAA,GAC1DqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,wTAKhB,EAAA,EAAA,GAGFA,EAOK,KAPL+C,GAOK,iBAP6C,kBAEhD,EAAA,GAAA7C,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALNgD,GAKM,MAJJjD,EAGMU,EAAA,KAAAmB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALqB,GAAZjD,EAGM,MAAA,CAH2E,IAAKiD,EAAG,MAAM,cAAA,GAC7FjD,EAAuC,QAAA,CAA/B,UAAWiD,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5BlD,EAAgH,QAAA,CAAxG,SAAUiD,CAAC,GAAa,sBAAAhC,GAAAlE,EAAA,MAAQ,KAAK,SAASkG,CAAC,EAAAhC,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAQ,EAAA1E,EAAA,MAAQ,KAAK,SAASkG,CAAC,CAAA,CAAA,gCAO/DjD,EAoDU,UApDVmD,GAoDU,eAnDRnD,EAAqE,MAAA,CAAhE,MAAM,SAAO,CAACA,EAA4C,KAAA,CAAxC,MAAM,SAAA,EAAU,qBAAmB,CAAA,qBAC1DA,EAOI,IAAA,CAPD,MAAM,OAAK,GAAC,0NAGoB,EAAAA,EACuB,SADpB,wGACgB,IAAI,+MAG1D,CAAA,OACAA,EASM,MATNoD,GASM,CARJhD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,QAAOkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAQ,EAAA1E,EAAA,MAAQ,OAAO,CAAA,iBAChDiD,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,SAGFA,EAWM,MAXNqD,GAWM,CAVJjD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,UAASkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAQ,EAAA1E,EAAA,MAAQ,SAAS,CAAA,srBAW3CA,EAAA,MAAQ,KAAK,OAAI,UAA5BmE,IAAAnB,EAYM,MAZNuD,GAYM,CAXJlD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,OAAMkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAQ,EAAA1E,EAAA,MAAQ,MAAM,CAAA,iBAC9CiD,EAQI,IAAA,CARD,MAAM,QAAM,GAAC,wBACO,EAAAA,EAAgC,SAA7B,2BAAyB,IAAI,iDAC3C,EAAAA,EAAyB,YAAnB,cAAY,IAAO,+KAEC,EAAAA,EAAqD,SAAlD,gDAA8C,IAAI,sNAI3F,CAAA,eAEFD,EAII,IAJJwD,GAAuB,2LAIvB,EAAA,GAGerG,EAAA,WAAjBqD,EAAmEC,EAAA,OAAtC,KAAMtD,EAAA,MAAW,MAAM,YAAA,6BAEpD8C,EAKM,MALNwD,GAKM,CAJJtD,EAEeuD,EAAA,CAFD,QAAQ,UAAW,QAASxG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM8B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOM,EAAA,aAC5H,IAA2D,CAAxDqE,EAAA5C,EAAA/D,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExBiD,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAOjD,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnB2D,EAAA,EAAAnB,EAkBU,UAlBV4D,GAkBU,CAjBR3D,EAIM,MAJN4D,GAIM,CAHJ5D,EAAsF,KAAtF6D,GAAsF/C,EAA/DrE,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCuD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJvD,EAAA,MAAU,YAAxBsD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO/C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/EoD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAMM,MANN8D,GAMM,QALJ/D,EAISU,EAAA,KAAAmB,EAJWnE,EAAA,MAALa,GAAC,kBAAhByB,EAIS,SAAA,CAJyB,IAAKzB,EAAE,GAAI,MAAM,WAAY,QAAK2C,GAAEnD,EAASQ,CAAC,CAAA,GAC9E4B,EAA0DU,EAAA,CAAhD,SAAQ/B,EAAAP,EAAE,SAAF,YAAAO,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpDmB,EAA0B,OAAA,KAAAc,EAAjBxC,EAAE,KAAK,EAAA,CAAA,EAChB0B,EAA2F,OAA3F+D,GAA2FjD,EAA5DxC,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvBxB,EAAA,oBAAtBiD,EA0CWU,EAAA,CAAA,IAAA,GAAA,CAzCTT,EA4BU,UA5BVgE,GA4BU,eA3BRhE,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBNiE,GAqBM,EApBJ/C,EAAA,EAAA,EAAAnB,EAmBMU,EAAA,KAAAmB,EAnBgBnF,EAAA,MAAS,CAAlBiB,EAAGwG,SAAhBnE,EAmBM,MAAA,CAnB4B,IAAKrC,EAAE,IAAK,MAAM,WAAY,gBAAgBwG,EAAC,CAAA,GAC/EhE,EAAkDU,EAAA,CAAxC,OAAQlD,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CsC,EAUM,MAVNmE,GAUM,CATJnE,EAIM,MAJNoE,GAIM,CAHJpE,EAA2B,IAAA,KAAAc,EAArBpD,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBsC,EAAqC,OAArCqE,GAAqCvD,EAAfpD,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBqC,EAAgE,OAAhEuE,GAAiD,UAAQ,KAE3DtE,EAGM,MAHNuE,GAGM,CAFDb,EAAA5C,EAAApB,GAAUhC,EAAE,MAAM,CAAA,EAAI,MAAGoD,EAAGlB,GAAUlC,EAAE,MAAM,GAAI,cAC7C,CAAA,EAAAwC,EAAkCsE,GAAA,CAAnB,GAAI9G,EAAE,SAAA,qBAGjCsC,EAKM,MALNyE,GAKM,CAJJzE,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKiB,GAAEhD,EAAUP,CAAC,CAAA,EAAG,OAAI,EAAAgH,EAAA,EACnDxE,EAEeuD,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAY/F,EAAE,GAAG,IAAM,MAAGuD,GAAEzB,GAAO9B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAA0C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,+DAINJ,EAGI,IAAA,CAHD,MAAM,OAAO,MAAA,CAAA,YAAA,cAAA,aAAA,WAAA,CAAA,EAAsD,sKAGtE,EAAA,EAAA,GAGFA,EAUU,UAVV2E,GAUU,eATR3E,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,KAAA,EAAM,qKAGf,EAAA,GACAA,EAGM,MAHN4E,GAGM,CAFJ5E,EAA8C,OAA9C6E,GAA8C/D,EAArBlE,EAAA,KAAW,EAAA,CAAA,EACpCoD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOP,CAAA,EAAc,MAAI,CAAA,gBAnStDc,EAAyCuE,GAAA,OAAX,KAAM,CAAA"}
+{"version":3,"file":"SsoView-CltdTdwt.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * THREE THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport type { ClaimMap, SsoConfig, SsoConfigResponse, SsoPreset, SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  defaultRole: 'admin',\n});\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup walkthrough and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.form.mode === 'oidc' ? 'Saved — the issuer answered, so the settings are known good.' : 'Saved.');\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Existing accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the sign-in rules on each\n              provider if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Several providers share the accounts.</b> Each shows up as its own button on the\n              login page, and the same person arriving from the same directory is the same account —\n              nothing about local accounts or personal tokens changes either way.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity providers you already run\n          <InfoHint label=\"what is stored\">\n            One row per provider: the endpoints, the client id, and the client secret. The secret has\n            no read path — this page only learns whether one is stored, and leaving the field empty\n            keeps it.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- The walkthrough: where to create the app, in the preset's own words. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <b>Register the app with {{ editing.preset.label }}</b>\n          <p>{{ editing.preset.setupHint }}</p>\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">\n            Paste this into the provider's application as the redirect / callback URL. It has to\n            match byte for byte, and it is the same for every provider on this host — a mismatch is\n            the single most common reason the exchange fails, and the provider's error rarely says\n            so.\n          </p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">\n            This host's name for the provider — it appears in the sign-in URL and in exports, never\n            to the person signing in. Lowercase letters, digits and dashes.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">The login page draws it as “Continue with {{ editing.form.label || editing.preset?.label || '…' }}”.</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">\n                Assembled from the value{{ placeholderNames.length > 1 ? 's' : '' }} above —\n                {{ editing.preset?.label }} gives every account its own issuer, so there is no single\n                URL a preset could carry. It is fetched when you save, so a typo is refused here\n                rather than at someone's first login.\n              </p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">\n              Or the full <code>…/.well-known/openid-configuration</code> URL. Everything but the\n              client id and secret is discovered from it, and it is fetched when you save — so a typo\n              is refused here rather than at someone's first login.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'A secret is stored — leave this empty to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Where this host asks which groups someone is in. Only consulted when there is a group\n              rule below. Filled in automatically for a preset — but only while the user info URL is\n              still the preset's, because a self-hosted host's token must not be sent to the public\n              one, so a self-hosted provider needs this typed.\n            </p>\n          </div>\n\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account</h2></div>\n        <p class=\"dim\">\n          By default, anyone this provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane. <b>Any one entry in a list is enough to satisfy that\n          list, and every list you fill in has to be satisfied</b> — fill all three in and a login\n          needs a listed domain, a matching username, and one of the groups. A list left empty is not\n          a rule at all: it lets everyone past that check, it does not lock everyone out.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns, case-insensitive: <code>*</code>, <code>?</code> and\n            <code>[0-9]</code> classes. Empty means no restriction. <b>Non-empty means a login whose\n            provider sends no username is refused too</b> — so this is a rule for a provider that\n            actually has usernames (GitHub's <code>login</code>, GitLab's <code>username</code>). On\n            an OpenID Connect issuer that sends no <code>preferred_username</code> it refuses\n            everyone rather than nobody, so set it only where you know the provider sends one.\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            Comma-separated, and <b>exact names, not patterns</b> — an organisation login, or a group\n            path like <code>acme/backend</code>. Case-insensitive. Empty means no restriction.\n            Non-empty makes every sign-in ask the provider for that person's groups, so it needs the\n            OAuth scope that endpoint requires: <b>add it to Scopes above, or the save is refused</b>\n            — and the refusal names the scope. It also needs a provider whose group list this host\n            knows how to read, which the save checks by name. If that call does not answer, the\n            sign-in is refused rather than allowed.\n          </p>\n        </div>\n        <p v-else class=\"hint\">\n          A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth\n          2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none\n          here.\n        </p>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">\n          Pick where your team already signs in. A preset knows the provider's endpoints and its\n          quirks — the only things it cannot know are the client id and secret you get when you\n          register the app, and the form that opens says exactly where to do that.\n        </p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n        <p class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n          Removing a provider does not delete anyone. Those accounts keep their personal tokens, and\n          pointing the same provider back at this host re-links them by subject.\n        </p>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">\n          The redirect URI to register with every provider — one URL for all of them, built by the\n          server so it cannot drift from the one the sign-in flow actually sends.\n        </p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["OIDC_CLAIMS","blank","providers","ref","presets","callbackUrl","loaded","listError","editing","picking","saving","formError","load","r","api","problem","showPicker","computed","pickerTiles","p","suggestKey","base","taken","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","_a","keyRe","cannotSave","key","url","list","s","v","save","body","toast","remove","copyCallback","whereLine","c","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","SsoMark","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","$event","_openBlock","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","_hoisted_12","_hoisted_13","_vModelText","_hoisted_14","_hoisted_16","_renderList","ph","_unref","sentence","_hoisted_17","_hoisted_19","_hoisted_20","_hoisted_21","_d","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_25","_hoisted_26","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","_hoisted_33","_hoisted_34","_hoisted_35","k","_hoisted_36","_hoisted_38","_hoisted_39","_hoisted_40","_hoisted_41","_hoisted_42","_hoisted_43","ActionButton","_createTextVNode","_hoisted_44","_hoisted_45","_hoisted_46","_hoisted_47","_hoisted_49","_hoisted_50","_hoisted_51","i","_hoisted_52","_hoisted_53","_hoisted_54","_hoisted_55","_hoisted_56","RelativeTime","_hoisted_57","_hoisted_58","_hoisted_59","_hoisted_60","_hoisted_61","SkeletonList"],"mappings":"ssEA2CA,MAAMA,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAChB,YAAa,OAAA,GAGTE,EAAYC,EAAwB,EAAE,EACtCC,EAAUD,EAAiB,EAAE,EAC7BE,EAAcF,EAAI,EAAE,EACpBG,EAASH,EAAI,EAAK,EAClBI,EAAYJ,EAAI,EAAE,EAmBlBK,EAAUL,EAAoB,IAAI,EAClCM,EAAUN,EAAI,EAAK,EACnBO,EAASP,EAAI,EAAK,EAClBQ,EAAYR,EAAI,EAAE,EAExB,eAAeS,GAAsB,CACnC,MAAMC,EAAI,MAAMC,EAAI,IAAuB,iBAAiB,EAE5D,GADAR,EAAO,MAAQ,GACX,CAACO,EAAE,GAAI,CACTN,EAAU,MAAQQ,EAAQF,EAAG,2BAA2B,EACxD,MACF,CACAN,EAAU,MAAQ,GAClBL,EAAU,MAAQW,EAAE,KAAK,WAAa,CAAA,EACtCT,EAAQ,MAAQS,EAAE,KAAK,SAAW,CAAA,EAClCR,EAAY,MAAQQ,EAAE,KAAK,WAC7B,CACKD,EAAA,EAGL,MAAMI,EAAaC,EAAS,IAAM,CAACT,EAAQ,QAAUC,EAAQ,OAAUH,EAAO,OAAS,CAACC,EAAU,OAASL,EAAU,MAAM,SAAW,EAAG,EAEnIgB,EAAcD,EAAS,IAAM,CACjC,GAAGb,EAAQ,MAAM,IAAKe,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,EAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIpB,EAAU,MAAM,IAAKiB,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAAS,EAAI,GAAK,IAAK,GAAI,CAACC,EAAM,IAAI,GAAGD,CAAI,IAAI,CAAC,EAAE,QAAU,GAAGA,CAAI,IAAI,CAAC,EAC5E,CAEA,SAASE,EAASC,EAAmE,CACnF,MAAML,EAAIK,EAAK,OACTC,EAAIxB,EAAA,EACVwB,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWN,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,GACzDL,IACFM,EAAE,MAAQN,EAAE,MACZM,EAAE,OAASN,EAAE,OACbM,EAAE,SAAW,CAAE,GAAGzB,EAAa,GAAGmB,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbM,EAAE,aAAeN,EAAE,aACnBM,EAAE,SAAWN,EAAE,SACfM,EAAE,YAAcN,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCM,EAAE,aAAeN,EAAE,eAGvBX,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKY,EAAWD,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQL,EACR,KAAMM,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBd,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASiB,EAAUC,EAA+B,CAChDnB,EAAQ,MAAQ,CACd,YAAamB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQvB,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAG1B,IAAS,GAAG0B,EAAM,OAAQ,SAAU,CAAE,GAAG3B,EAAa,GAAG2B,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBhB,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMoB,EAAgBZ,EAAgD,IAAM,CAC1E,MAAMa,EAAItB,EAAQ,MAClB,GAAI,CAACsB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,EAAmBnB,EAAS,KAC/BY,EAAc,OAAS,CAAA,GAAI,QAASV,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EkB,EAAqBpB,EAAS,IAAM,CACxC,MAAMe,EAAQH,EAAc,MACtB,EAAIrB,EAAQ,MAClB,MAAI,CAACwB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKb,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAImB,EAAA,EAAE,aAAanB,EAAE,EAAE,IAAnB,YAAAmB,EAAsB,SAAU,IAAInB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKoB,GAAQ,4BAGRC,EAAavB,EAAiB,IAAM,CACxC,MAAMa,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,MAAO,0BACf,MAAMW,EAAMX,EAAE,IAAI,KAAA,EAClB,GAAI,CAACS,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIX,EAAE,cAAgB,MAAQ5B,EAAU,MAAM,KAAMiB,GAAMA,EAAE,MAAQsB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACX,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMY,EAAMb,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACY,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACZ,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKa,EAAQC,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKC,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAeC,IAAsB,CACnC,MAAMhB,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,OACRpB,EAAO,MAAQ,GAIf,MAAMqC,EAA0D,CAC9D,GAAGjB,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBa,EAAKb,EAAE,OAAO,EACnC,iBAAkBa,EAAKb,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKa,EAAKb,EAAE,MAAM,CAAA,EAEvDjB,EAAI,MAAMC,EAAI,IAAkC,kBAAmBiC,CAAI,EAE7E,GADArC,EAAO,MAAQ,GACX,CAACG,EAAE,GAAI,CAGTF,EAAU,MAAQI,EAAQF,EAAG,mBAAmB,EAChD,MACF,CACAF,EAAU,MAAQ,GAClBqC,EAAM,KAAMlB,EAAE,KAAK,OAAS,OAAS,+DAAiE,QAAQ,EAC9GtB,EAAQ,MAAQ,KACXI,EAAA,CACP,CAEA,eAAeqC,GAAOtB,EAAwC,CAC5D,MAAMd,EAAI,MAAMC,EAAI,IAAI,mBAAmBa,EAAM,GAAG,EAAE,EACtD,GAAI,CAACd,EAAE,GAAI,CACTN,EAAU,MAAQQ,EAAQF,EAAG,qBAAqB,EAClD,MACF,CACAmC,EAAM,KAAM,WAAWrB,EAAM,GAAG,mCAAmC,EAC9Df,EAAA,CACP,CAEA,eAAesC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAU7C,EAAY,KAAK,EACrD2C,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAMjC,EAAIf,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQwB,EAAE,QAAQ,EACxD,OAAOjC,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAGA,SAASkC,GAAUD,EAAsB,WACvC,MAAMpB,EAAkB,CAAA,EACxB,OAAIM,EAAAc,EAAE,sBAAF,MAAAd,EAAuB,QAAQN,EAAM,KAAK,WAAWoB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFE,EAAAF,EAAE,mBAAF,MAAAE,EAAoB,QAAQtB,EAAM,KAAK,aAAaoB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFG,EAAAH,EAAE,iBAAF,MAAAG,EAAkB,QAAQvB,EAAM,KAAK,UAAUoB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEpB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,sCAIEwB,EAoVM,MAAA,KAAA,CAnVJC,EAyCM,MAzCNC,GAyCM,CAxCJD,EAqCM,MAAA,KAAA,CApCJA,EA2BK,KAAA,KAAA,iBA3BD,mBAEF,EAAA,GAAAE,EAwBYC,GAAA,CAxBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,sUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAII,IAAA,KAAA,CAHFA,EAA4C,SAAzC,uCAAqC,IAAI,qMAG9C,CAAA,kBAGJA,EAOM,MAPNK,GAOM,iBAPW,mEAEf,EAAA,GAAAH,EAIWI,EAAA,CAJD,MAAM,kBAAgB,WAAC,IAIjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJiC,gMAIjC,EAAA,CAAA,6BAGJJ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJnD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDwC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO/C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGF,EAAA,WAAjByD,EAAwEC,EAAA,OAA3C,KAAM1D,EAAA,MAAW,MAAM,iBAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArBgD,EA+NWU,EAAA,CAAA,IAAA,GAAA,CA9NTT,EA6JU,UA7JVU,GA6JU,CA5JRV,EAYM,MAZNW,GAYM,CAXJT,EAAsDU,EAAA,CAA5C,OAAQ7D,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChDiD,EAMK,KANLa,GAMKC,EAJD/D,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4B8B,EAAA9B,EAAA,MAAQ,SAAR,YAAA8B,EAAgB,SAAU9B,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5IiD,EAA6F,OAA7Fe,GAA6FD,EAAvE/D,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvCiD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FgB,GAA6F,GAAxEhB,EAAwD,QAAA,sCAAxCjD,EAAA,MAAQ,KAAK,QAAOkE,GAAE,KAAK,UAAA,iBAA3BlE,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnBmE,IAAAnB,EAQM,MARNoB,GAQM,CAPJnB,EAAuD,SAApD,yBAAsBc,EAAG/D,QAAQ,OAAO,KAAK,EAAA,CAAA,EAChDiD,EAAqC,IAAA,KAAAc,EAA/B/D,EAAA,MAAQ,OAAO,SAAS,EAAA,CAAA,EAC9BiD,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAMjD,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAAqE,EAAA,CAAA,eAKJpB,EAYM,MAZNqB,GAYM,CAXJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNsB,GAGM,CAFJtB,EAA8C,OAA9CuB,GAA8CT,EAArBlE,EAAA,KAAW,EAAA,CAAA,EACpCoD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOP,CAAA,EAAc,MAAI,CAAA,GAElDW,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,4QAKhB,EAAA,EAAA,GAGUjD,EAAA,MAAQ,sBAApBmE,IAAAnB,EAOM,MAPNyB,GAOM,CANJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAAlE,EAAA,MAAQ,IAAGkE,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAQ,EAAA1E,EAAA,MAAQ,GAAG,CAAA,GACxCqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,QAAO,4JAGhB,EAAA,EAAA,IAGFA,EAIM,MAJN0B,GAIM,CAHJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqBjD,EAAA,MAAQ,KAAK,MAAKkE,GAAE,KAAK,OAAQ,cAAapB,EAAA9C,EAAA,MAAQ,SAAR,YAAA8C,EAAgB,QAAK,UAAA,iBAAnE9C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjDiD,EAAwH,IAAxH2B,GAAgB,6CAA0Cb,EAAG/D,QAAQ,KAAK,SAAS+C,EAAA/C,EAAA,MAAQ,SAAR,YAAA+C,EAAgB,aAAe,KAAE,CAAA,CAAA,GAItG/C,EAAA,MAAQ,KAAK,OAAI,YAAjCgD,EA0BWU,EAAA,CAAA,IAAA,CAAA,EAAA,CAzBOrC,EAAA,WAAhB2B,EAeWU,EAAA,CAAA,IAAA,GAAA,QAdTV,EAGMU,EAAA,KAAAmB,EAHYjD,EAAA,MAANkD,QAAZ9B,EAGM,MAAA,CAH+B,IAAK8B,EAAI,MAAM,OAAA,GAClD7B,EAAmD,QAAA,CAA3C,UAAW6B,CAAE,EAAA,EAAOf,EAAAgB,GAAAC,EAAA,EAASF,CAAE,CAAA,EAAA,EAAAG,EAAA,IACvChC,EAA4G,QAAA,CAApG,SAAU6B,CAAE,4BAAa9E,EAAA,MAAQ,aAAa8E,CAAE,EAAAZ,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/DlE,EAAA,MAAQ,aAAa8E,CAAE,CAAA,CAAA,aAE1D7B,EASM,MATNiC,GASM,CARJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBpB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAsD,EAAA,EAC5GlC,EAKI,IALJmC,GAAgB,4BACUrB,EAAGnC,QAAiB,OAAM,EAAA,IAAA,EAAA,EAAkB,eACjEyD,EAAArF,EAAA,MAAQ,SAAR,YAAAqF,EAAgB,KAAK,EAAG,qLAG7B,CAAA,CAAA,UAGJlB,IAAAnB,EAQM,MARNsC,GAQM,CAPJjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,aAAYkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtElE,EAAA,MAAQ,KAAK,YAAY,CAAA,iBACzDiD,EAII,IAAA,CAJD,MAAM,QAAM,GAAC,eACF,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,yKAG7D,CAAA,yBAIJA,EAGM,MAHNsC,GAGM,CAFJlC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,SAAQkE,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnElE,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvDiD,EAOM,MAPNuC,GAOM,CANJnC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAAlE,EAAA,MAAQ,OAAMkE,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAQ,EAAA1E,EAAA,MAAQ,MAAM,CAAA,GAC9CiD,EAGI,IAHJwC,GAAgB,gBAEd1B,EAAG/D,EAAA,MAAQ,UAAS,oDAAA,iDAAA,EAAA,CAAA,CAAA,GAIxBiD,EAGM,MAHNyC,GAGM,CAFJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsBjD,EAAA,MAAQ,KAAK,OAAMkE,GAAE,KAAK,OAAO,WAAW,QAAS,YAAalE,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhCgD,EAkDU,UAAA,OAlDqC,MAAM,UAAW,KAAI,CAAGhD,EAAA,MAAQ,MAAA,GAC7EqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHN0C,GAGM,CAFJtC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoBjD,EAAA,MAAQ,KAAK,aAAYkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlDlE,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzDiD,EAGM,MAHN2C,GAGM,CAFJvC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqBjD,EAAA,MAAQ,KAAK,SAAQkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9ClE,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtDiD,EAIM,MAJN4C,GAIM,CAHJxC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwBjD,EAAA,MAAQ,KAAK,YAAWkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjDlE,EAAA,MAAQ,KAAK,WAAW,CAAA,GAC1DqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARN6C,GAQM,eAPJ7C,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsBjD,EAAA,MAAQ,KAAK,UAASkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/ClE,EAAA,MAAQ,KAAK,SAAS,CAAA,GACtDqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,GAEFA,EASM,MATN8C,GASM,eARJ9C,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0BjD,EAAA,MAAQ,KAAK,UAASkE,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/ClE,EAAA,MAAQ,KAAK,SAAS,CAAA,GAC1DqD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,wTAKhB,EAAA,EAAA,GAGFA,EAOK,KAPL+C,GAOK,iBAP6C,kBAEhD,EAAA,GAAA7C,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALNgD,GAKM,MAJJjD,EAGMU,EAAA,KAAAmB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALqB,GAAZjD,EAGM,MAAA,CAH2E,IAAKiD,EAAG,MAAM,cAAA,GAC7FjD,EAAuC,QAAA,CAA/B,UAAWiD,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5BlD,EAAgH,QAAA,CAAxG,SAAUiD,CAAC,GAAa,sBAAAhC,GAAAlE,EAAA,MAAQ,KAAK,SAASkG,CAAC,EAAAhC,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAQ,EAAA1E,EAAA,MAAQ,KAAK,SAASkG,CAAC,CAAA,CAAA,gCAO/DjD,EAoDU,UApDVmD,GAoDU,eAnDRnD,EAAqE,MAAA,CAAhE,MAAM,SAAO,CAACA,EAA4C,KAAA,CAAxC,MAAM,SAAA,EAAU,qBAAmB,CAAA,qBAC1DA,EAOI,IAAA,CAPD,MAAM,OAAK,GAAC,0NAGoB,EAAAA,EACuB,SADpB,wGACgB,IAAI,+MAG1D,CAAA,OACAA,EASM,MATNoD,GASM,CARJhD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,QAAOkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAQ,EAAA1E,EAAA,MAAQ,OAAO,CAAA,iBAChDiD,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,SAGFA,EAWM,MAXNqD,GAWM,CAVJjD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,UAASkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAQ,EAAA1E,EAAA,MAAQ,SAAS,CAAA,srBAW3CA,EAAA,MAAQ,KAAK,OAAI,UAA5BmE,IAAAnB,EAYM,MAZNuD,GAYM,CAXJlD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAAlE,EAAA,MAAQ,OAAMkE,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAQ,EAAA1E,EAAA,MAAQ,MAAM,CAAA,iBAC9CiD,EAQI,IAAA,CARD,MAAM,QAAM,GAAC,wBACO,EAAAA,EAAgC,SAA7B,2BAAyB,IAAI,iDAC3C,EAAAA,EAAyB,YAAnB,cAAY,IAAO,+KAEC,EAAAA,EAAqD,SAAlD,gDAA8C,IAAI,sNAI3F,CAAA,eAEFD,EAII,IAJJwD,GAAuB,2LAIvB,EAAA,GAGerG,EAAA,WAAjBqD,EAAmEC,EAAA,OAAtC,KAAMtD,EAAA,MAAW,MAAM,YAAA,6BAEpD8C,EAKM,MALNwD,GAKM,CAJJtD,EAEeuD,EAAA,CAFD,QAAQ,UAAW,QAASxG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM8B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOM,EAAA,aAC5H,IAA2D,CAAxDqE,EAAA5C,EAAA/D,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExBiD,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAOjD,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnB2D,EAAA,EAAAnB,EAkBU,UAlBV4D,GAkBU,CAjBR3D,EAIM,MAJN4D,GAIM,CAHJ5D,EAAsF,KAAtF6D,GAAsF/C,EAA/DrE,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCuD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJvD,EAAA,MAAU,YAAxBsD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO/C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/EoD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAMM,MANN8D,GAMM,QALJ/D,EAISU,EAAA,KAAAmB,EAJWnE,EAAA,MAALa,GAAC,kBAAhByB,EAIS,SAAA,CAJyB,IAAKzB,EAAE,GAAI,MAAM,WAAY,QAAK2C,GAAEnD,EAASQ,CAAC,CAAA,GAC9E4B,EAA0DU,EAAA,CAAhD,SAAQ/B,EAAAP,EAAE,SAAF,YAAAO,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpDmB,EAA0B,OAAA,KAAAc,EAAjBxC,EAAE,KAAK,EAAA,CAAA,EAChB0B,EAA2F,OAA3F+D,GAA2FjD,EAA5DxC,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvBxB,EAAA,oBAAtBiD,EA0CWU,EAAA,CAAA,IAAA,GAAA,CAzCTT,EA4BU,UA5BVgE,GA4BU,eA3BRhE,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBNiE,GAqBM,EApBJ/C,EAAA,EAAA,EAAAnB,EAmBMU,EAAA,KAAAmB,EAnBgBnF,EAAA,MAAS,CAAlBiB,EAAGwG,SAAhBnE,EAmBM,MAAA,CAnB4B,IAAKrC,EAAE,IAAK,MAAM,WAAY,gBAAgBwG,EAAC,CAAA,GAC/EhE,EAAkDU,EAAA,CAAxC,OAAQlD,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CsC,EAUM,MAVNmE,GAUM,CATJnE,EAIM,MAJNoE,GAIM,CAHJpE,EAA2B,IAAA,KAAAc,EAArBpD,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBsC,EAAqC,OAArCqE,GAAqCvD,EAAfpD,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBqC,EAAgE,OAAhEuE,GAAiD,UAAQ,KAE3DtE,EAGM,MAHNuE,GAGM,CAFDb,EAAA5C,EAAApB,GAAUhC,EAAE,MAAM,CAAA,EAAI,MAAGoD,EAAGlB,GAAUlC,EAAE,MAAM,GAAI,cAC7C,CAAA,EAAAwC,EAAkCsE,GAAA,CAAnB,GAAI9G,EAAE,SAAA,qBAGjCsC,EAKM,MALNyE,GAKM,CAJJzE,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKiB,GAAEhD,EAAUP,CAAC,CAAA,EAAG,OAAI,EAAAgH,EAAA,EACnDxE,EAEeuD,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAY/F,EAAE,GAAG,IAAM,MAAGuD,GAAEzB,GAAO9B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAA0C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,+DAINJ,EAGI,IAAA,CAHD,MAAM,OAAO,MAAA,CAAA,YAAA,cAAA,aAAA,WAAA,CAAA,EAAsD,sKAGtE,EAAA,EAAA,GAGFA,EAUU,UAVV2E,GAUU,eATR3E,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,KAAA,EAAM,qKAGf,EAAA,GACAA,EAGM,MAHN4E,GAGM,CAFJ5E,EAA8C,OAA9C6E,GAA8C/D,EAArBlE,EAAA,KAAW,EAAA,CAAA,EACpCoD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOP,CAAA,EAAc,MAAI,CAAA,gBAnStDc,EAAyCuE,GAAA,OAAX,KAAM,CAAA"}

package/dist/assets/StateBadge.vue_vue_type_script_setup_true_lang-nD6Zdx0q.js

@@ -0,0 +1,2 @@
+import{d as s,c as t,E as n,a as o,f as r,t as c,u as l,M as p,o as d}from"./index-Cqe_7QZw.js";const u=s({__name:"StateBadge",props:{state:{}},setup(e){return(m,a)=>(d(),t("span",{class:n(["badge",e.state])},[a[0]||(a[0]=o("span",{class:"dot"},null,-1)),r(" "+c(l(p)(e.state)),1)],2))}});export{u as _};
+//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-nD6Zdx0q.js.map

package/dist/assets/StateBadge.vue_vue_type_script_setup_true_lang-nD6Zdx0q.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-nD6Zdx0q.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing\n *   queued  grey · cancelled  grey · superseded  grey\n *\n * THE THREE GREYS ARE DELIBERATE, and they are grey because none of them is an alarm:\n *\n *   `cancelled` — someone meant to stop it. Not `ok` either: whatever the job had already done was\n *   left exactly as it was, which is why the job page puts a banner under this badge.\n *   `queued`    — it has not started. Waiting is the system working as designed (one job per stack,\n *   and a host-wide cap), so it must not borrow `running`'s blue, and it must not PULSE — the pulse\n *   is what says \"something is happening right now\", and nothing is.\n *   `superseded` — a newer job for the same stack replaced it while it waited. It never ran, so\n *   there is nothing out there from it; routine, and quieter than cancelled if anything.\n *\n * Only `running` pulses (`.badge.running .dot` in app.css). The three greys fall through to the\n * base `.badge` rule with no colour of their own — which is the correct severity, not an oversight,\n * so do not \"finish\" them with a hue.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2KAiCEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}

package/dist/assets/{SubmitView-s5haxS9q.js → SubmitView-D-jg5Wxy.js}

@@ -1,4 +1,4 @@
-import{d as Z,j as h,p as E,J as D,c as n,a as t,t as m,f as o,F as w,e as p,w as y,g as v,E as _,i as V,v as I,_ as R,Y as F,r as q,z as ee,k as N,l as te,o as a,n as se,G as oe,O as le,C as ae,X as M}from"./index-T3JGe9ku.js";import{a as ne,w as ie,p as z,r as re}from"./useVars-VN9gYdR6.js";import{_ as de}from"./ActionButton.vue_vue_type_script_setup_true_lang-C6PZurL0.js";import{_ as ue}from"./ErrorNote.vue_vue_type_script_setup_true_lang-CUZs06O0.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-JwR7DqO1.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-DKYlHroe.js";import"./Teleport-CKfsIrp8.js";const me={class:"page-head"},ye={class:"sub"},ce={class:"panel"},he={key:0,class:"banner warn"},fe={key:0},ke={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},xe={class:"field",style:{"max-width":"280px"}},$e={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},Ce={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Te={class:"check"},Ve={class:"check"},Re={class:"field",style:{"max-width":"340px"}},Ne={key:0,class:"hint"},Ae={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"hint"},We={class:"hint"},je={class:"row",style:{"margin-top":"var(--s5)"}},Oe={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},De={key:1,class:"s-ok"},Fe={key:6,class:"banner warn"},qe={key:0},Me={key:7,class:"banner warn"},ze=`services:
+import{d as Z,j as h,p as E,N as O,c as n,a as t,t as m,f as o,F as w,e as p,w as y,g as v,E as _,i as V,v as I,_ as R,a2 as F,r as q,z as ee,k as N,l as te,o as a,n as se,J as oe,U as le,C as ae,a1 as M}from"./index-Cqe_7QZw.js";import{a as ne,w as ie,p as z,r as re}from"./useVars-VN9gYdR6.js";import{_ as de}from"./ActionButton.vue_vue_type_script_setup_true_lang-D8Xlp6c9.js";import{_ as ue}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DVbGiVTB.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-uPHU_Ugp.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-BtHqT6G1.js";import"./VarIO-BldCQ6Xx.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";import"./Teleport-I0XiM19H.js";const me={class:"page-head"},ye={class:"sub"},ce={class:"panel"},he={key:0,class:"banner warn"},fe={key:0},ke={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},xe={class:"field",style:{"max-width":"280px"}},$e={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},Ce={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Te={class:"check"},Ve={class:"check"},Re={class:"field",style:{"max-width":"340px"}},Ne={key:0,class:"hint"},Ae={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"hint"},We={class:"hint"},je={class:"row",style:{"margin-top":"var(--s5)"}},De={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},Oe={key:1,class:"s-ok"},Fe={key:6,class:"banner warn"},qe={key:0},Me={key:7,class:"banner warn"},ze=`services:
   app:
     image: nginx:alpine
     profiles: [app]
@@ -7,7 +7,7 @@ import{d as Z,j as h,p as E,J as D,c as n,a as t,t as m,f as o,F as w,e as p,w a
       # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the
       # service entirely alone, so only do that when you need something the shorthand cannot say.
       - pstack.routing.port=80
-`,Qe=Z({__name:"SubmitView",props:{id:{}},setup(P){const A=P,l=h({id:A.id??"",spec:"",compose:""}),f=h([{k:"",v:""}]),k=h("inline"),S=h(""),x=h(!1),g=h(""),r=h(null),$=h([]),K=N(()=>[{value:"",label:"— choose —"},...$.value.map(s=>({value:s.name,label:s.name,hint:s.kind}))]);E.get("/api/specs").then(s=>{s.ok&&Array.isArray(s.body.specs)&&($.value=s.body.specs)});const C=N(()=>$.value.find(s=>s.name===S.value)),L=N(()=>!!A.id),B=se(),T=N(()=>{const s=B.query.from;return typeof s=="string"&&s?s:null}),c=h("idle"),b=h(null);async function W(s){c.value="loading",b.value=null;const e=await E.getAuthed(`/api/deployments/${encodeURIComponent(s)}/source`);if(e.status===404||!e.ok){c.value="failed";return}if(e.body.sourceWithheld){c.value="withheld",e.body.specName&&(b.value=e.body.specName);return}l.value.spec||(l.value.spec=e.body.spec??""),l.value.compose||(l.value.compose=e.body.compose??""),e.body.specName&&(b.value=e.body.specName),c.value="loaded"}D(T,async s=>{var d;if(!s||A.id)return;g.value="",r.value=null,l.value.spec="",l.value.compose="";const e=(d=M(s))==null?void 0:d.vars;e&&(f.value=z(e)),await W(s),l.value.id=""},{immediate:!0}),D(()=>A.id,s=>{var u;if(g.value="",r.value=null,c.value="idle",b.value=null,!s)return;s!==l.value.id&&(l.value.spec="",l.value.compose=""),l.value.id=s;const e=(u=M(s))==null?void 0:u.vars,d=e?z(e):re(s);d.some(U=>U.k)&&(f.value=d),W(s)},{immediate:!0});const H=N(()=>!!l.value.id&&(k.value==="stored"?!!S.value:!!l.value.spec.trim())&&!x.value);async function X(){x.value=!0,g.value="",r.value=null;const s=l.value.id,e=ne(f.value),d={vars:e,env:e};k.value==="stored"?d.specName=S.value:(d.spec=l.value.spec,l.value.compose.trim()&&(d.compose=l.value.compose));const u=await E.put(`/api/deployments/${encodeURIComponent(s)}`,d);if(x.value=!1,u.status===200||u.status===201){r.value={id:u.body.id??s,stack:u.body.stack??"?",created:u.status===201,stackSharedWith:u.body.stackSharedWith,swarmNotes:u.body.swarmNotes},ie(s,f.value),oe(),le("ok",`${u.status===201?"Created":"Replaced"} ${s} → ${r.value.stack}`,{to:`/deployments/${encodeURIComponent(s)}`,toLabel:"Open"});return}g.value=ae(u,"save this deployment")}function G(){const s=location.hostname;if(s==="localhost"||s.endsWith(".localhost")||/^[\d.]+$/.test(s)||s.includes(":"))return"preview.example.com";const e=s.split(".");return e.length>=3?e.slice(1).join("."):s}const J=s=>`version: 1
+`,_e=Z({__name:"SubmitView",props:{id:{}},setup(P){const A=P,l=h({id:A.id??"",spec:"",compose:""}),f=h([{k:"",v:""}]),k=h("inline"),S=h(""),x=h(!1),g=h(""),r=h(null),$=h([]),K=N(()=>[{value:"",label:"— choose —"},...$.value.map(s=>({value:s.name,label:s.name,hint:s.kind}))]);E.get("/api/specs").then(s=>{s.ok&&Array.isArray(s.body.specs)&&($.value=s.body.specs)});const C=N(()=>$.value.find(s=>s.name===S.value)),L=N(()=>!!A.id),B=se(),T=N(()=>{const s=B.query.from;return typeof s=="string"&&s?s:null}),c=h("idle"),b=h(null);async function W(s){c.value="loading",b.value=null;const e=await E.getAuthed(`/api/deployments/${encodeURIComponent(s)}/source`);if(e.status===404||!e.ok){c.value="failed";return}if(e.body.sourceWithheld){c.value="withheld",e.body.specName&&(b.value=e.body.specName);return}l.value.spec||(l.value.spec=e.body.spec??""),l.value.compose||(l.value.compose=e.body.compose??""),e.body.specName&&(b.value=e.body.specName),c.value="loaded"}O(T,async s=>{var d;if(!s||A.id)return;g.value="",r.value=null,l.value.spec="",l.value.compose="";const e=(d=M(s))==null?void 0:d.vars;e&&(f.value=z(e)),await W(s),l.value.id=""},{immediate:!0}),O(()=>A.id,s=>{var u;if(g.value="",r.value=null,c.value="idle",b.value=null,!s)return;s!==l.value.id&&(l.value.spec="",l.value.compose=""),l.value.id=s;const e=(u=M(s))==null?void 0:u.vars,d=e?z(e):re(s);d.some(U=>U.k)&&(f.value=d),W(s)},{immediate:!0});const H=N(()=>!!l.value.id&&(k.value==="stored"?!!S.value:!!l.value.spec.trim())&&!x.value);async function J(){x.value=!0,g.value="",r.value=null;const s=l.value.id,e=ne(f.value),d={vars:e,env:e};k.value==="stored"?d.specName=S.value:(d.spec=l.value.spec,l.value.compose.trim()&&(d.compose=l.value.compose));const u=await E.put(`/api/deployments/${encodeURIComponent(s)}`,d);if(x.value=!1,u.status===200||u.status===201){r.value={id:u.body.id??s,stack:u.body.stack??"?",created:u.status===201,stackSharedWith:u.body.stackSharedWith,swarmNotes:u.body.swarmNotes},ie(s,f.value),oe(),le("ok",`${u.status===201?"Created":"Replaced"} ${s} → ${r.value.stack}`,{to:`/deployments/${encodeURIComponent(s)}`,toLabel:"Open"});return}g.value=ae(u,"save this deployment")}function X(){const s=location.hostname;if(s==="localhost"||s.endsWith(".localhost")||/^[\d.]+$/.test(s)||s.includes(":"))return"preview.example.com";const e=s.split(".");return e.length>=3?e.slice(1).join("."):s}const G=s=>`version: 1
 kind: isolated
 
 # The stack identity: the compose project name, and $STACK inside every hook.
@@ -43,8 +43,8 @@ axes:
     assert_gone: |
       test -d /tmp || exit 1
       ! test -d /tmp/$STACK
-`;function Y(){k.value="inline",l.value.spec=J(G()),l.value.compose.trim()||(l.value.compose=ze),l.value.id||(l.value.id="pr-123"),f.value.some(s=>s.k)||(f.value=[{k:"PR",v:"123"}])}return(s,e)=>{var u,U,j,O;const d=te("RouterLink");return a(),n("div",null,[t("div",me,[t("div",null,[t("h1",null,m(L.value?"Edit a deployment":T.value?"Duplicate a deployment":"Submit a deployment"),1),t("div",ye,m(L.value?"Loaded from what is stored; saving replaces the record":T.value?`Copied from ${T.value} — give it a new id, then edit`:"Stores a spec so it can be deployed"),1)]),e[7]||(e[7]=t("span",{class:"grow"},null,-1)),t("button",{class:"ghost",onClick:Y},"Load example spec")]),t("section",ce,[T.value&&!L.value?(a(),n("div",he,[e[20]||(e[20]=t("b",null,"Change the stack, not just the id.",-1)),t("p",null,[e[11]||(e[11]=o(" Two deployments that resolve to the same ",-1)),e[12]||(e[12]=t("code",null,"stack",-1)),e[13]||(e[13]=o(" drive the same compose project — ",-1)),e[14]||(e[14]=t("code",null,"down",-1)),e[15]||(e[15]=o(" on either stops the other's containers. If the stack interpolates a variable (",-1)),e[16]||(e[16]=t("code",null,"pr-${PR}",-1)),e[17]||(e[17]=o(") give it a different value below; if it is a literal, edit the ",-1)),e[18]||(e[18]=t("code",null,"stack:",-1)),e[19]||(e[19]=o(" line. ",-1)),c.value==="withheld"?(a(),n(w,{key:0},[e[9]||(e[9]=o(" The spec could not be copied without an access token — ",-1)),p(d,{to:"/settings"},{default:y(()=>[...e[8]||(e[8]=[o("add yours",-1)])]),_:1}),e[10]||(e[10]=o(". ",-1))],64)):v("",!0)])])):v("",!0),L.value?(a(),n("div",{key:1,class:_(["banner",c.value==="loaded"?"info":"warn"])},[t("b",null,"Replacing "+m(P.id)+".",1),c.value==="loading"?(a(),n("p",fe,"Loading what is stored…")):c.value==="loaded"?(a(),n("p",ke," Loaded from the stored record — edit it and save. Saving replaces the record outright, so anything you delete here stops being tracked while whatever it created keeps running. ")):c.value==="withheld"?(a(),n("p",be,[e[22]||(e[22]=o(" The stored spec was not loaded: reading it needs an access token, because hooks routinely carry a credential inline. ",-1)),p(d,{to:"/settings"},{default:y(()=>[...e[21]||(e[21]=[o("Add your token",-1)])]),_:1}),e[23]||(e[23]=o(" to edit in place — otherwise paste the ",-1)),e[24]||(e[24]=t("b",null,"complete",-1)),e[25]||(e[25]=o(" spec, since anything you leave out stops being tracked. ",-1))])):(a(),n("p",ge,[...e[26]||(e[26]=[o(" The stored spec could not be loaded, so this form is empty. Paste the ",-1),t("b",null,"complete",-1),o(" spec you want stored — anything you leave out stops being tracked while whatever it created keeps running. ",-1)])]))],2)):v("",!0),b.value?(a(),n("div",we,[t("b",null,"This deployment tracks the stored spec “"+m(b.value)+"”.",1),t("p",null,[e[28]||(e[28]=o(" Saving here writes a private copy and stops it following that spec. To change every deployment using it, edit ",-1)),p(d,{to:`/specs/${encodeURIComponent(b.value)}`},{default:y(()=>[...e[27]||(e[27]=[o("the spec",-1)])]),_:1},8,["to"]),e[29]||(e[29]=o(" instead. ",-1))])])):v("",!0),t("div",Se,[t("div",xe,[e[30]||(e[30]=t("label",{for:"did"},"Deployment id",-1)),V(t("input",{id:"did","onUpdate:modelValue":e[0]||(e[0]=i=>l.value.id=i),type:"text",placeholder:"pr-123",spellcheck:"false",autocomplete:"off"},null,512),[[I,l.value.id,void 0,{trim:!0}]])]),t("span",$e,[e[32]||(e[32]=o(" Lower case ",-1)),p(R,{label:"allowed characters in a deployment id"},{default:y(()=>[...e[31]||(e[31]=[o(" Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64 characters — ",-1),t("code",null,"[a-z0-9][a-z0-9._-]{0,63}",-1),o(". ",-1)])]),_:1})])]),$.value.length?(a(),n("div",Ce,[t("label",Te,[V(t("input",{"onUpdate:modelValue":e[1]||(e[1]=i=>k.value=i),type:"radio",value:"inline"},null,512),[[F,k.value]]),e[33]||(e[33]=o(" inline spec ",-1))]),t("label",Ve,[V(t("input",{"onUpdate:modelValue":e[2]||(e[2]=i=>k.value=i),type:"radio",value:"stored"},null,512),[[F,k.value]]),e[34]||(e[34]=o(" reference a stored spec ",-1))])])):v("",!0),k.value==="stored"&&$.value.length?(a(),n(w,{key:4},[t("div",Re,[e[35]||(e[35]=t("label",{for:"sn"},"Stored spec",-1)),p(ve,{modelValue:S.value,"onUpdate:modelValue":e[3]||(e[3]=i=>S.value=i),id:"sn",label:"Stored spec",options:K.value},null,8,["modelValue","options"])]),C.value?(a(),n("p",Ne,[C.value.description?(a(),n("span",Ae,m(C.value.description)+" — ",1)):v("",!0),e[37]||(e[37]=o(" needs ",-1)),C.value.requiredVars.length?(a(),n("b",Le,m(C.value.requiredVars.join(", ")),1)):(a(),n("span",Ue,"no variables")),e[38]||(e[38]=o(". ",-1)),p(R,{label:"why variables are required"},{default:y(()=>[...e[36]||(e[36]=[o(" A missing variable is refused by name. It is never filled in with a blank, which would silently give every deployment the same stack name. ",-1)])]),_:1})])):v("",!0)],64)):(a(),n(w,{key:5},[t("div",Ee,[e[39]||(e[39]=t("label",{for:"spec"},"Spec.yml",-1)),V(t("textarea",{id:"spec","onUpdate:modelValue":e[4]||(e[4]=i=>l.value.spec=i),rows:"12",spellcheck:"false",placeholder:`version: 1
+`;function Q(){k.value="inline",l.value.spec=G(X()),l.value.compose.trim()||(l.value.compose=ze),l.value.id||(l.value.id="pr-123"),f.value.some(s=>s.k)||(f.value=[{k:"PR",v:"123"}])}return(s,e)=>{var u,U,j,D;const d=te("RouterLink");return a(),n("div",null,[t("div",me,[t("div",null,[t("h1",null,m(L.value?"Edit a deployment":T.value?"Duplicate a deployment":"Submit a deployment"),1),t("div",ye,m(L.value?"Loaded from what is stored; saving replaces the record":T.value?`Copied from ${T.value} — give it a new id, then edit`:"Stores a spec so it can be deployed"),1)]),e[7]||(e[7]=t("span",{class:"grow"},null,-1)),t("button",{class:"ghost",onClick:Q},"Load example spec")]),t("section",ce,[T.value&&!L.value?(a(),n("div",he,[e[20]||(e[20]=t("b",null,"Change the stack, not just the id.",-1)),t("p",null,[e[11]||(e[11]=o(" Two deployments that resolve to the same ",-1)),e[12]||(e[12]=t("code",null,"stack",-1)),e[13]||(e[13]=o(" drive the same compose project — ",-1)),e[14]||(e[14]=t("code",null,"down",-1)),e[15]||(e[15]=o(" on either stops the other's containers. If the stack interpolates a variable (",-1)),e[16]||(e[16]=t("code",null,"pr-${PR}",-1)),e[17]||(e[17]=o(") give it a different value below; if it is a literal, edit the ",-1)),e[18]||(e[18]=t("code",null,"stack:",-1)),e[19]||(e[19]=o(" line. ",-1)),c.value==="withheld"?(a(),n(w,{key:0},[e[9]||(e[9]=o(" The spec could not be copied without an access token — ",-1)),p(d,{to:"/settings"},{default:y(()=>[...e[8]||(e[8]=[o("add yours",-1)])]),_:1}),e[10]||(e[10]=o(". ",-1))],64)):v("",!0)])])):v("",!0),L.value?(a(),n("div",{key:1,class:_(["banner",c.value==="loaded"?"info":"warn"])},[t("b",null,"Replacing "+m(P.id)+".",1),c.value==="loading"?(a(),n("p",fe,"Loading what is stored…")):c.value==="loaded"?(a(),n("p",ke," Loaded from the stored record — edit it and save. Saving replaces the record outright, so anything you delete here stops being tracked while whatever it created keeps running. ")):c.value==="withheld"?(a(),n("p",be,[e[22]||(e[22]=o(" The stored spec was not loaded: reading it needs an access token, because hooks routinely carry a credential inline. ",-1)),p(d,{to:"/settings"},{default:y(()=>[...e[21]||(e[21]=[o("Add your token",-1)])]),_:1}),e[23]||(e[23]=o(" to edit in place — otherwise paste the ",-1)),e[24]||(e[24]=t("b",null,"complete",-1)),e[25]||(e[25]=o(" spec, since anything you leave out stops being tracked. ",-1))])):(a(),n("p",ge,[...e[26]||(e[26]=[o(" The stored spec could not be loaded, so this form is empty. Paste the ",-1),t("b",null,"complete",-1),o(" spec you want stored — anything you leave out stops being tracked while whatever it created keeps running. ",-1)])]))],2)):v("",!0),b.value?(a(),n("div",we,[t("b",null,"This deployment tracks the stored spec “"+m(b.value)+"”.",1),t("p",null,[e[28]||(e[28]=o(" Saving here writes a private copy and stops it following that spec. To change every deployment using it, edit ",-1)),p(d,{to:`/specs/${encodeURIComponent(b.value)}`},{default:y(()=>[...e[27]||(e[27]=[o("the spec",-1)])]),_:1},8,["to"]),e[29]||(e[29]=o(" instead. ",-1))])])):v("",!0),t("div",Se,[t("div",xe,[e[30]||(e[30]=t("label",{for:"did"},"Deployment id",-1)),V(t("input",{id:"did","onUpdate:modelValue":e[0]||(e[0]=i=>l.value.id=i),type:"text",placeholder:"pr-123",spellcheck:"false",autocomplete:"off"},null,512),[[I,l.value.id,void 0,{trim:!0}]])]),t("span",$e,[e[32]||(e[32]=o(" Lower case ",-1)),p(R,{label:"allowed characters in a deployment id"},{default:y(()=>[...e[31]||(e[31]=[o(" Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64 characters — ",-1),t("code",null,"[a-z0-9][a-z0-9._-]{0,63}",-1),o(". ",-1)])]),_:1})])]),$.value.length?(a(),n("div",Ce,[t("label",Te,[V(t("input",{"onUpdate:modelValue":e[1]||(e[1]=i=>k.value=i),type:"radio",value:"inline"},null,512),[[F,k.value]]),e[33]||(e[33]=o(" inline spec ",-1))]),t("label",Ve,[V(t("input",{"onUpdate:modelValue":e[2]||(e[2]=i=>k.value=i),type:"radio",value:"stored"},null,512),[[F,k.value]]),e[34]||(e[34]=o(" reference a stored spec ",-1))])])):v("",!0),k.value==="stored"&&$.value.length?(a(),n(w,{key:4},[t("div",Re,[e[35]||(e[35]=t("label",{for:"sn"},"Stored spec",-1)),p(ve,{modelValue:S.value,"onUpdate:modelValue":e[3]||(e[3]=i=>S.value=i),id:"sn",label:"Stored spec",options:K.value},null,8,["modelValue","options"])]),C.value?(a(),n("p",Ne,[C.value.description?(a(),n("span",Ae,m(C.value.description)+" — ",1)):v("",!0),e[37]||(e[37]=o(" needs ",-1)),C.value.requiredVars.length?(a(),n("b",Le,m(C.value.requiredVars.join(", ")),1)):(a(),n("span",Ue,"no variables")),e[38]||(e[38]=o(". ",-1)),p(R,{label:"why variables are required"},{default:y(()=>[...e[36]||(e[36]=[o(" A missing variable is refused by name. It is never filled in with a blank, which would silently give every deployment the same stack name. ",-1)])]),_:1})])):v("",!0)],64)):(a(),n(w,{key:5},[t("div",Ee,[e[39]||(e[39]=t("label",{for:"spec"},"Spec.yml",-1)),V(t("textarea",{id:"spec","onUpdate:modelValue":e[4]||(e[4]=i=>l.value.spec=i),rows:"12",spellcheck:"false",placeholder:`version: 1
 kind: isolated
 stack: pr-\${PR}
-axes: []`},null,512),[[I,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),V(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[I,l.value.compose]])]),t("p",Pe,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[57]||(e[57]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(pe,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",We,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",je,[p(de,{variant:"primary",pending:x.value,disabled:!H.value,onClick:X},{default:y(()=>[o(m(x.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),r.value?v("",!0):(a(),n("span",Oe,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),r.value?(a(),n("span",De,[o(m(r.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(r.value.stack),1),p(d,{to:`/deployments/${encodeURIComponent(r.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(U=(u=r.value)==null?void 0:u.stackSharedWith)!=null&&U.length?(a(),n("div",Fe,[t("b",null,"Another deployment already resolves to stack “"+m(r.value.stack)+"”.",1),t("p",null,[(a(!0),n(w,null,q(r.value.stackSharedWith,(i,Q)=>(a(),n(w,{key:i},[p(d,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),Q<r.value.stackSharedWith.length-1?(a(),n("span",qe,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),(O=(j=r.value)==null?void 0:j.swarmNotes)!=null&&O.length?(a(),n("div",Me,[e[55]||(e[55]=t("b",null,"Swarm will not run this compose file as written.",-1)),e[56]||(e[56]=t("p",null,[o(" Some keys are dropped and others are rewritten — "),t("code",null,"docker stack deploy"),o(" reports that once, to a terminal nobody is watching. Every change it makes to what you submitted: ")],-1)),t("ul",null,[(a(!0),n(w,null,q(r.value.swarmNotes,i=>(a(),n("li",{key:i},m(i),1))),128))])])):v("",!0),g.value?(a(),ee(ue,{key:8,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{Qe as default};
-//# sourceMappingURL=SubmitView-s5haxS9q.js.map
+axes: []`},null,512),[[I,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),V(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[I,l.value.compose]])]),t("p",Pe,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[57]||(e[57]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(pe,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",We,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",je,[p(de,{variant:"primary",pending:x.value,disabled:!H.value,onClick:J},{default:y(()=>[o(m(x.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),r.value?v("",!0):(a(),n("span",De,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),r.value?(a(),n("span",Oe,[o(m(r.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(r.value.stack),1),p(d,{to:`/deployments/${encodeURIComponent(r.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(U=(u=r.value)==null?void 0:u.stackSharedWith)!=null&&U.length?(a(),n("div",Fe,[t("b",null,"Another deployment already resolves to stack “"+m(r.value.stack)+"”.",1),t("p",null,[(a(!0),n(w,null,q(r.value.stackSharedWith,(i,Y)=>(a(),n(w,{key:i},[p(d,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),Y<r.value.stackSharedWith.length-1?(a(),n("span",qe,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),(D=(j=r.value)==null?void 0:j.swarmNotes)!=null&&D.length?(a(),n("div",Me,[e[55]||(e[55]=t("b",null,"Swarm will not run this compose file as written.",-1)),e[56]||(e[56]=t("p",null,[o(" Some keys are dropped and others are rewritten — "),t("code",null,"docker stack deploy"),o(" reports that once, to a terminal nobody is watching. Every change it makes to what you submitted: ")],-1)),t("ul",null,[(a(!0),n(w,null,q(r.value.swarmNotes,i=>(a(),n("li",{key:i},m(i),1))),128))])])):v("",!0),g.value?(a(),ee(ue,{key:8,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{_e as default};
+//# sourceMappingURL=SubmitView-D-jg5Wxy.js.map

package/dist/assets/{SubmitView-s5haxS9q.js.map → SubmitView-D-jg5Wxy.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SubmitView-s5haxS9q.js","sources":["../../src/views/SubmitView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Submit or replace a deployment.\n *\n * The server's 400 is the whole point of this screen. It carries the SpecError verbatim — the key\n * or variable that is wrong, often the corrected form, and the assert-lint warnings about an\n * `assert_gone` that fails open. That text is the tool's main teaching surface, so it is rendered\n * whole, with newlines intact, and never summarised.\n *\n * The spec is parsed BEFORE anything touches disk, so a rejected submission leaves nothing behind\n * and, on a replace, a good record is never destroyed over a typo.\n */\nimport { computed, ref, watch } from 'vue';\nimport { useRoute } from 'vue-router';\nimport { api, problem } from '../api/client';\nimport InfoHint from '../components/InfoHint.vue';\nimport type {\n  DeploymentSourceResponse,\n  SpecMeta,\n  SpecsResponse,\n  SubmitResponse,\n  VarPair,\n} from '../api/types';\nimport { loadDeployments, rowFor } from '../composables/useControlPlane';\nimport { pairsFromRecord, readVars, recordFromPairs, writeVars } from '../composables/useVars';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport VarEditor from '../components/VarEditor.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\n\nconst props = defineProps<{ id?: string }>();\n\nconst form = ref({ id: props.id ?? '', spec: '', compose: '' });\nconst vars = ref<VarPair[]>([{ k: '', v: '' }]);\nconst source = ref<'inline' | 'stored'>('inline');\nconst specName = ref('');\n\nconst submitting = ref(false);\nconst error = ref('');\nconst result = ref<{\n  id: string;\n  stack: string;\n  created: boolean;\n  /** Other deployments resolving to the same stack — reported by the server on a new deployment. */\n  stackSharedWith?: string[];\n  /** Compose keys swarm will ignore — reported by the server at submit time. */\n  swarmNotes?: string[];\n} | null>(null);\n\n/**\n * Stored specs, when this server has them. A build without `/api/specs` answers 404, which is not\n * an error here — the picker simply is not offered and inline stays the only shape.\n */\nconst specs = ref<SpecMeta[]>([]);\n\n/** `— choose —` stays first: an empty value is a real state here, not a placeholder. */\nconst specOptions = computed(() => [\n  { value: '', label: '— choose —' },\n  ...specs.value.map((s) => ({ value: s.name, label: s.name, hint: s.kind })),\n]);\nvoid api.get<SpecsResponse>('/api/specs').then((r) => {\n  if (r.ok && Array.isArray(r.body.specs)) specs.value = r.body.specs;\n});\n\nconst chosenSpec = computed(() => specs.value.find((s) => s.name === specName.value));\n\nconst replacing = computed(() => !!props.id);\n\n/**\n * Duplicate mode: `/submit?from=<id>` copies an existing deployment's spec, compose and variables into\n * a NEW submission. Distinct from replacing — the id starts empty so you name the new one, and nothing\n * is written over.\n *\n * The `stack:` line is the thing to watch, which is why the banner says so: copy a spec whose stack is a\n * literal and both deployments drive the same compose project, so `down` on either stops the other's\n * containers. A spec whose stack interpolates a variable (`pr-${PR}`) just needs a different value. The\n * server independently reports a collision at submit time — see `stackSharedWith`.\n */\nconst route = useRoute();\nconst copyFrom = computed(() => {\n  const v = route.query.from;\n  return typeof v === 'string' && v ? v : null;\n});\n\n/**\n * Replacing now PRE-FILLS from what is stored.\n *\n * It used to start empty, because nothing could hand the source back. Replacing is whole-record, so\n * an operator retyping a spec from memory silently dropped whatever they forgot — and a dropped axis\n * stops being tracked while the resources it created keep running. Being unable to read your own\n * submission is what made that a likely mistake rather than a careless one.\n *\n * The body is still cleared FIRST, on every id change. A leftover body from another deployment is the\n * dangerous case: it is perfectly valid YAML, so the PUT would succeed and overwrite the wrong\n * deployment with nothing able to catch it. Clearing first means a failed or withheld fetch leaves the\n * form empty rather than holding someone else's spec.\n */\nconst sourceState = ref<'idle' | 'loading' | 'loaded' | 'withheld' | 'failed'>('idle');\n/** Set when this deployment tracks a stored spec — editing this copy forks it from the original. */\nconst forkWarning = ref<string | null>(null);\n\nasync function loadSource(id: string): Promise<void> {\n  sourceState.value = 'loading';\n  forkWarning.value = null;\n  const r = await api.getAuthed<DeploymentSourceResponse>(\n    `/api/deployments/${encodeURIComponent(id)}/source`,\n  );\n  // A build of the API without the route answers 404; that is a capability difference, not an error,\n  // and it must land on the old empty-form behaviour rather than an alarming banner.\n  if (r.status === 404 || !r.ok) {\n    sourceState.value = 'failed';\n    return;\n  }\n  if (r.body.sourceWithheld) {\n    sourceState.value = 'withheld';\n    if (r.body.specName) forkWarning.value = r.body.specName;\n    return;\n  }\n  // Only fill if the user has not started typing — a slow fetch must never overwrite their edit.\n  if (!form.value.spec) form.value.spec = r.body.spec ?? '';\n  if (!form.value.compose) form.value.compose = r.body.compose ?? '';\n  if (r.body.specName) forkWarning.value = r.body.specName;\n  sourceState.value = 'loaded';\n}\n\n// Duplicate: same fetch, but the id stays empty and the variables come across too, since a copied\n// spec interpolates the same names.\nwatch(\n  copyFrom,\n  async (from) => {\n    if (!from || props.id) return;\n    error.value = '';\n    result.value = null;\n    form.value.spec = '';\n    form.value.compose = '';\n    const saved = rowFor(from)?.vars;\n    if (saved) vars.value = pairsFromRecord(saved);\n    await loadSource(from);\n    // A copied record's own id is not a name for the new one; the operator picks that.\n    form.value.id = '';\n  },\n  { immediate: true },\n);\n\nwatch(\n  () => props.id,\n  (id) => {\n    error.value = '';\n    result.value = null;\n    sourceState.value = 'idle';\n    forkWarning.value = null;\n    if (!id) return;\n    if (id !== form.value.id) {\n      form.value.spec = '';\n      form.value.compose = '';\n    }\n    form.value.id = id;\n    // Seed the variables from what this deployment already uses: replacing a spec usually needs\n    // the same ones that resolved it.\n    const stored = rowFor(id)?.vars;\n    const saved = stored ? pairsFromRecord(stored) : readVars(id);\n    if (saved.some((e) => e.k)) vars.value = saved;\n    void loadSource(id);\n  },\n  { immediate: true },\n);\n\nconst canSubmit = computed(\n  () =>\n    !!form.value.id &&\n    (source.value === 'stored' ? !!specName.value : !!form.value.spec.trim()) &&\n    !submitting.value,\n);\n\nasync function submit(): Promise<void> {\n  submitting.value = true;\n  error.value = '';\n  result.value = null;\n\n  const id = form.value.id;\n  const record = recordFromPairs(vars.value);\n  /**\n   * `vars` are STORED with the deployment on servers that support it, which makes a later `down`\n   * resolve the same stack `up` created with no query parameters at all. `env` validates this\n   * submission on every server, new or old. Sending both is what keeps this form working against\n   * either build — an older server ignores the key it does not know.\n   */\n  const body: Record<string, unknown> = { vars: record, env: record };\n  if (source.value === 'stored') body.specName = specName.value;\n  else {\n    body.spec = form.value.spec;\n    if (form.value.compose.trim()) body.compose = form.value.compose;\n  }\n\n  const r = await api.put<SubmitResponse>(`/api/deployments/${encodeURIComponent(id)}`, body);\n  submitting.value = false;\n\n  if (r.status === 200 || r.status === 201) {\n    result.value = {\n      id: r.body.id ?? id,\n      stack: r.body.stack ?? '?',\n      created: r.status === 201,\n      stackSharedWith: r.body.stackSharedWith,\n      swarmNotes: r.body.swarmNotes,\n    };\n    // Persist the variables that just validated this spec. On an older server this is the single\n    // thing keeping a later `down` pointed at the stack the `up` created.\n    writeVars(id, vars.value);\n    void loadDeployments();\n    toast('ok', `${r.status === 201 ? 'Created' : 'Replaced'} ${id} → ${result.value.stack}`, {\n      to: `/deployments/${encodeURIComponent(id)}`,\n      toLabel: 'Open',\n    });\n    return;\n  }\n  // 400 (SpecError), 409 (a job in flight over this stack), 401, 404 — all rendered verbatim.\n  error.value = problem(r, 'save this deployment');\n}\n\n/**\n * The preview domain, guessed from where this page is served.\n *\n * The UI lives on a host UNDER the preview domain (ui.preview.example.com, pstack.preview…), so\n * previews live beside it: drop this page's own first label and that is the base every generated\n * hostname hangs off. localhost and bare IPs have no domain to offer — those keep an honest\n * placeholder rather than generating `pr-123.192.168.1.5`.\n */\nfunction detectPreviewDomain(): string {\n  const h = location.hostname;\n  if (h === 'localhost' || h.endsWith('.localhost') || /^[\\d.]+$/.test(h) || h.includes(':')) {\n    return 'preview.example.com';\n  }\n  const labels = h.split('.');\n  return labels.length >= 3 ? labels.slice(1).join('.') : h;\n}\n\n/**\n * Kept as a function of the domain so the example is true on the host it is loaded on — a spec\n * copied from here should deploy without edits, not after find-and-replacing example.com.\n *\n * The compose half uses `pstack.routing.port`, NOT hand-written traefik labels: pstack generates\n * the router, TLS and network wiring from that one label. A bare `traefik.enable=true` is the\n * OPT-OUT signal (any traefik.* label means \"leave my service alone\") — which is what an older\n * version of this example taught, producing a service that was never reachable.\n */\nconst exampleSpec = (domain: string): string => `version: 1\nkind: isolated\n\n# The stack identity: the compose project name, and $STACK inside every hook.\n# \\${PR} is interpolated ONCE, at resolve time, from the variables sent with the request.\nstack: pr-\\${PR}\n\nenv:\n  # The base every generated hostname hangs off: the app below is served at\n  # app-pr-\\${PR}.${domain}\n  PREVIEW_DOMAIN: ${domain}\n\ncompose:\n  file: compose.yml\n  # Every service sits behind a profile so a bare \\`up\\` starts nothing.\n  # \\`down\\` always enables ALL of them — otherwise the unselected profiles' network leaks.\n  profiles: [app]\n\nrequires:\n  - name: traefik-network\n    assert: docker network inspect traefik >/dev/null 2>&1\n    hint: run \\`pstack init\\` on the host first\n\naxes:\n  # Hooks run from the deployment directory, which holds only spec.yml and compose.yml —\n  # so use inline shell or absolute paths, never ./hooks/foo.sh.\n  - name: scratch\n    up: mkdir -p /tmp/$STACK\n    assert_live: test -d /tmp/$STACK\n    down: rm -rf /tmp/$STACK\n    # assert_gone MUST FAIL CLOSED. A bare \\`! <probe>\\` reports \"gone\" whenever the probe fails\n    # for any reason — a missing CLI, an expired token — turning \"I could not tell\" into\n    # \"it is gone\", a false negative on the one thing this tool exists to catch.\n    assert_gone: |\n      test -d /tmp || exit 1\n      ! test -d /tmp/$STACK\n`;\n\nconst EXAMPLE_COMPOSE = `services:\n  app:\n    image: nginx:alpine\n    profiles: [app]\n    labels:\n      # The ONE label routing needs: pstack generates the Traefik router, TLS and network wiring\n      # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the\n      # service entirely alone, so only do that when you need something the shorthand cannot say.\n      - pstack.routing.port=80\n`;\n\nfunction loadExample(): void {\n  source.value = 'inline';\n  form.value.spec = exampleSpec(detectPreviewDomain());\n  if (!form.value.compose.trim()) form.value.compose = EXAMPLE_COMPOSE;\n  if (!form.value.id) form.value.id = 'pr-123';\n  if (!vars.value.some((e) => e.k)) vars.value = [{ k: 'PR', v: '123' }];\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          {{ replacing ? 'Edit a deployment' : copyFrom ? 'Duplicate a deployment' : 'Submit a deployment' }}\n        </h1>\n        <div class=\"sub\">\n          {{\n            replacing\n              ? 'Loaded from what is stored; saving replaces the record'\n              : copyFrom\n                ? `Copied from ${copyFrom} — give it a new id, then edit`\n                : 'Stores a spec so it can be deployed'\n          }}\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button class=\"ghost\" @click=\"loadExample\">Load example spec</button>\n    </div>\n\n    <section class=\"panel\">\n      <!-- The \"nothing saved until valid\" reassurance lives beside the Submit button below — the\n           moment of commitment is where a guarantee about committing belongs, not floating above\n           an unrelated id field. -->\n\n      <!--\n        A `PUT` REPLACES the whole record, and this form cannot pre-fill it: the API has no route\n        that returns a stored spec. Say that out loud, because a half-remembered spec pasted here\n        is still valid YAML — the server will accept it, and the axes the original declared simply\n        stop existing as far as the control plane knows, while whatever they created keeps running.\n      -->\n      <!--\n        The one thing that makes duplicating dangerous, said before the form rather than after the\n        submission: two records resolving to one stack drive the same compose project.\n      -->\n      <div v-if=\"copyFrom && !replacing\" class=\"banner warn\">\n        <b>Change the stack, not just the id.</b>\n        <p>\n          Two deployments that resolve to the same <code>stack</code> drive the same compose project —\n          <code>down</code> on either stops the other's containers. If the stack interpolates a variable\n          (<code>pr-${PR}</code>) give it a different value below; if it is a literal, edit the\n          <code>stack:</code> line.\n          <template v-if=\"sourceState === 'withheld'\">\n            The spec could not be copied without an access token —\n            <RouterLink to=\"/settings\">add yours</RouterLink>.\n          </template>\n        </p>\n      </div>\n\n      <div v-if=\"replacing\" class=\"banner\" :class=\"sourceState === 'loaded' ? 'info' : 'warn'\">\n        <b>Replacing {{ id }}.</b>\n        <p v-if=\"sourceState === 'loading'\">Loading what is stored…</p>\n        <p v-else-if=\"sourceState === 'loaded'\">\n          Loaded from the stored record — edit it and save. Saving replaces the record outright, so\n          anything you delete here stops being tracked while whatever it created keeps running.\n        </p>\n        <p v-else-if=\"sourceState === 'withheld'\">\n          The stored spec was not loaded: reading it needs an access token, because hooks routinely\n          carry a credential inline. <RouterLink to=\"/settings\">Add your token</RouterLink> to edit\n          in place — otherwise paste the <b>complete</b> spec, since anything you leave out stops\n          being tracked.\n        </p>\n        <p v-else>\n          The stored spec could not be loaded, so this form is empty. Paste the <b>complete</b> spec\n          you want stored — anything you leave out stops being tracked while whatever it created keeps\n          running.\n        </p>\n      </div>\n\n      <!--\n        A deployment that references a stored spec keeps its own copy of the source. Editing that copy\n        forks it: the stored spec every other deployment shares is untouched, and this one stops\n        following it. Silent forks are the kind of thing discovered months later.\n      -->\n      <div v-if=\"forkWarning\" class=\"banner warn\">\n        <b>This deployment tracks the stored spec “{{ forkWarning }}”.</b>\n        <p>\n          Saving here writes a private copy and stops it following that spec. To change every\n          deployment using it, edit\n          <RouterLink :to=\"`/specs/${encodeURIComponent(forkWarning)}`\">the spec</RouterLink> instead.\n        </p>\n      </div>\n\n      <div class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <div class=\"field\" style=\"max-width: 280px\">\n          <label for=\"did\">Deployment id</label>\n          <input\n            id=\"did\"\n            v-model.trim=\"form.id\"\n            type=\"text\"\n            placeholder=\"pr-123\"\n            spellcheck=\"false\"\n            autocomplete=\"off\"\n          />\n        </div>\n        <span class=\"mute\" style=\"align-self: end; padding-bottom: 10px\">\n          Lower case\n          <InfoHint label=\"allowed characters in a deployment id\">\n            Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64\n            characters — <code>[a-z0-9][a-z0-9._-]{0,63}</code>.\n          </InfoHint>\n        </span>\n      </div>\n\n      <!-- Offered only when this server actually has stored specs. -->\n      <div v-if=\"specs.length\" class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"inline\" /> inline spec\n        </label>\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"stored\" /> reference a stored spec\n        </label>\n      </div>\n\n      <template v-if=\"source === 'stored' && specs.length\">\n        <div class=\"field\" style=\"max-width: 340px\">\n          <label for=\"sn\">Stored spec</label>\n          <SelectMenu v-model=\"specName\" id=\"sn\" label=\"Stored spec\" :options=\"specOptions\" />\n        </div>\n        <p v-if=\"chosenSpec\" class=\"hint\">\n          <span v-if=\"chosenSpec.description\">{{ chosenSpec.description }} — </span>\n          needs\n          <b v-if=\"chosenSpec.requiredVars.length\">{{ chosenSpec.requiredVars.join(', ') }}</b>\n          <span v-else>no variables</span>.\n          <InfoHint label=\"why variables are required\">\n            A missing variable is refused by name. It is never filled in with a blank, which would\n            silently give every deployment the same stack name.\n          </InfoHint>\n        </p>\n      </template>\n\n      <template v-else>\n        <div class=\"field\">\n          <label for=\"spec\">Spec.yml</label>\n          <textarea\n            id=\"spec\"\n            v-model=\"form.spec\"\n            rows=\"12\"\n            spellcheck=\"false\"\n            placeholder=\"version: 1&#10;kind: isolated&#10;stack: pr-${PR}&#10;axes: []\"\n          />\n        </div>\n\n        <div class=\"field\" style=\"margin-top: var(--s3)\">\n          <label for=\"compose\">compose.yml <span class=\"mute\">(optional)</span></label>\n          <textarea\n            id=\"compose\"\n            v-model=\"form.compose\"\n            rows=\"6\"\n            spellcheck=\"false\"\n            placeholder=\"Written next to spec.yml, so a compose file named compose.yml resolves\"\n          />\n        </div>\n        <p class=\"hint\">\n          Hooks must be inline shell or an absolute path.\n          <InfoHint label=\"why a relative script path does not work\">\n            A deployment directory only ever holds <code>spec.yml</code> and\n            <code>compose.yml</code>, and hooks run from there — so\n            <code>up: ./hooks/db.sh</code> has nothing to find.\n          </InfoHint>\n        </p>\n      </template>\n\n      <h2 class=\"section\" style=\"margin: var(--s5) 0 var(--s3)\">Variables</h2>\n      <VarEditor v-model=\"vars\" />\n      <p class=\"hint\">\n        Saved with the deployment, so tearing it down later targets the same stack.\n        <InfoHint label=\"how variables are remembered\">\n          They are stored on the server where it supports that, and in this browser either way — so\n          the actions on the deployment page send exactly these values.\n        </InfoHint>\n      </p>\n\n      <div class=\"row\" style=\"margin-top: var(--s5)\">\n        <ActionButton variant=\"primary\" :pending=\"submitting\" :disabled=\"!canSubmit\" @click=\"submit\">\n          {{ submitting ? 'Submitting…' : 'Submit' }}\n        </ActionButton>\n        <span v-if=\"!result\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n          Nothing is saved until the spec is valid\n          <InfoHint label=\"what happens on a rejected submission\">\n            The spec is checked before anything is written, so a rejected submission leaves nothing\n            behind — and a replace never destroys a good record over a typo. Whether the deployment\n            is shared or isolated comes from the spec, not from this form.\n          </InfoHint>\n        </span>\n        <span v-if=\"result\" class=\"s-ok\">\n          {{ result.created ? 'Created' : 'Replaced' }} — stack\n          <b>{{ result.stack }}</b>\n          <RouterLink :to=\"`/deployments/${encodeURIComponent(result.id)}`\" style=\"margin-left: 8px\">\n            open →\n          </RouterLink>\n        </span>\n      </div>\n\n      <!--\n        The server's rejection text IS the documentation: it names the key, the variable or the\n        assert that is wrong, and often prints the corrected form. Rendered whole, newlines and\n        indentation intact. Never truncate it, never collapse it, never say \"invalid spec\".\n      -->\n      <!--\n        Reported by the server, which resolved every other deployment to check. Shown after the fact\n        because it can only be known once the spec has resolved — and it is a warning, not a rejection:\n        it can be deliberate, and refusing over a guess would be worse than saying so.\n      -->\n      <div v-if=\"result?.stackSharedWith?.length\" class=\"banner warn\">\n        <b>Another deployment already resolves to stack “{{ result.stack }}”.</b>\n        <p>\n          <template v-for=\"(o, i) in result.stackSharedWith\" :key=\"o\">\n            <RouterLink :to=\"`/deployments/${encodeURIComponent(o)}`\">{{ o }}</RouterLink\n            ><span v-if=\"i < result.stackSharedWith.length - 1\">, </span> </template\n          >— both records now drive the same compose project, so <code>down</code> on either stops the\n          other's containers and <code>verify</code> on either reports the other's leaks. If that was not\n          intended, change this one's <code>stack</code> and save again.\n        </p>\n      </div>\n\n      <!--\n        The keys swarm drops. Same reasoning as the banner above: advisory, and only knowable once\n        the spec resolved. It is shown here rather than left to the deploy log because the whole\n        point is to reach the author while they are still looking at the file they just wrote.\n      -->\n      <div v-if=\"result?.swarmNotes?.length\" class=\"banner warn\">\n        <b>Swarm will not run this compose file as written.</b>\n        <p>\n          Some keys are dropped and others are rewritten — <code>docker stack deploy</code> reports\n          that once, to a terminal nobody is watching. Every change it makes to what you submitted:\n        </p>\n        <ul>\n          <li v-for=\"n in result.swarmNotes\" :key=\"n\">{{ n }}</li>\n        </ul>\n      </div>\n\n      <ErrorNote v-if=\"error\" :text=\"error\" title=\"The server rejected this submission.\" />\n    </section>\n  </div>\n</template>\n"],"names":["EXAMPLE_COMPOSE","props","__props","form","ref","vars","source","specName","submitting","error","result","specs","specOptions","computed","api","r","chosenSpec","replacing","route","useRoute","copyFrom","v","sourceState","forkWarning","loadSource","id","watch","from","saved","_a","rowFor","pairsFromRecord","stored","readVars","e","canSubmit","submit","record","recordFromPairs","body","writeVars","loadDeployments","toast","problem","detectPreviewDomain","h","labels","exampleSpec","domain","loadExample","_createElementBlock","_createElementVNode","_hoisted_1","_toDisplayString","_hoisted_2","_hoisted_3","_openBlock","_hoisted_4","_cache","_Fragment","_createVNode","_component_RouterLink","_normalizeClass","_hoisted_7","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","$event","_hoisted_12","InfoHint","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","SelectMenu","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_21","_vModelText","_hoisted_22","_hoisted_23","VarEditor","_hoisted_24","_hoisted_25","ActionButton","_hoisted_26","_hoisted_27","_b","_hoisted_28","o","i","_d","_c","_hoisted_30","_renderList","n","_createBlock","ErrorNote"],"mappings":"k+CA4RMA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mDA7PxB,MAAMC,EAAQC,EAERC,EAAOC,EAAI,CAAE,GAAIH,EAAM,IAAM,GAAI,KAAM,GAAI,QAAS,EAAA,CAAI,EACxDI,EAAOD,EAAe,CAAC,CAAE,EAAG,GAAI,EAAG,EAAA,CAAI,CAAC,EACxCE,EAASF,EAAyB,QAAQ,EAC1CG,EAAWH,EAAI,EAAE,EAEjBI,EAAaJ,EAAI,EAAK,EACtBK,EAAQL,EAAI,EAAE,EACdM,EAASN,EAQL,IAAI,EAMRO,EAAQP,EAAgB,EAAE,EAG1BQ,EAAcC,EAAS,IAAM,CACjC,CAAE,MAAO,GAAI,MAAO,YAAA,EACpB,GAAGF,EAAM,MAAM,IAAK,IAAO,CAAE,MAAO,EAAE,KAAM,MAAO,EAAE,KAAM,KAAM,EAAE,MAAO,CAAA,CAC3E,EACIG,EAAI,IAAmB,YAAY,EAAE,KAAMC,GAAM,CAChDA,EAAE,IAAM,MAAM,QAAQA,EAAE,KAAK,KAAK,IAAGJ,EAAM,MAAQI,EAAE,KAAK,MAChE,CAAC,EAED,MAAMC,EAAaH,EAAS,IAAMF,EAAM,MAAM,KAAM,GAAM,EAAE,OAASJ,EAAS,KAAK,CAAC,EAE9EU,EAAYJ,EAAS,IAAM,CAAC,CAACZ,EAAM,EAAE,EAYrCiB,EAAQC,GAAA,EACRC,EAAWP,EAAS,IAAM,CAC9B,MAAMQ,EAAIH,EAAM,MAAM,KACtB,OAAO,OAAOG,GAAM,UAAYA,EAAIA,EAAI,IAC1C,CAAC,EAeKC,EAAclB,EAA2D,MAAM,EAE/EmB,EAAcnB,EAAmB,IAAI,EAE3C,eAAeoB,EAAWC,EAA2B,CACnDH,EAAY,MAAQ,UACpBC,EAAY,MAAQ,KACpB,MAAMR,EAAI,MAAMD,EAAI,UAClB,oBAAoB,mBAAmBW,CAAE,CAAC,SAAA,EAI5C,GAAIV,EAAE,SAAW,KAAO,CAACA,EAAE,GAAI,CAC7BO,EAAY,MAAQ,SACpB,MACF,CACA,GAAIP,EAAE,KAAK,eAAgB,CACzBO,EAAY,MAAQ,WAChBP,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChD,MACF,CAEKZ,EAAK,MAAM,SAAW,MAAM,KAAOY,EAAE,KAAK,MAAQ,IAClDZ,EAAK,MAAM,YAAc,MAAM,QAAUY,EAAE,KAAK,SAAW,IAC5DA,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChDO,EAAY,MAAQ,QACtB,CAIAI,EACEN,EACA,MAAOO,GAAS,OACd,GAAI,CAACA,GAAQ1B,EAAM,GAAI,OACvBQ,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfP,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,GACrB,MAAMyB,GAAQC,EAAAC,EAAOH,CAAI,IAAX,YAAAE,EAAc,KACxBD,IAAOvB,EAAK,MAAQ0B,EAAgBH,CAAK,GAC7C,MAAMJ,EAAWG,CAAI,EAErBxB,EAAK,MAAM,GAAK,EAClB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpBuB,EACE,IAAMzB,EAAM,GACXwB,GAAO,OAKN,GAJAhB,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfY,EAAY,MAAQ,OACpBC,EAAY,MAAQ,KAChB,CAACE,EAAI,OACLA,IAAOtB,EAAK,MAAM,KACpBA,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,IAEvBA,EAAK,MAAM,GAAKsB,EAGhB,MAAMO,GAASH,EAAAC,EAAOL,CAAE,IAAT,YAAAI,EAAY,KACrBD,EAAQI,EAASD,EAAgBC,CAAM,EAAIC,GAASR,CAAE,EACxDG,EAAM,KAAMM,GAAMA,EAAE,CAAC,MAAQ,MAAQN,GACpCJ,EAAWC,CAAE,CACpB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpB,MAAMU,EAAYtB,EAChB,IACE,CAAC,CAACV,EAAK,MAAM,KACZG,EAAO,QAAU,SAAW,CAAC,CAACC,EAAS,MAAQ,CAAC,CAACJ,EAAK,MAAM,KAAK,KAAA,IAClE,CAACK,EAAW,KAAA,EAGhB,eAAe4B,GAAwB,CACrC5B,EAAW,MAAQ,GACnBC,EAAM,MAAQ,GACdC,EAAO,MAAQ,KAEf,MAAMe,EAAKtB,EAAK,MAAM,GAChBkC,EAASC,GAAgBjC,EAAK,KAAK,EAOnCkC,EAAgC,CAAE,KAAMF,EAAQ,IAAKA,CAAA,EACvD/B,EAAO,QAAU,SAAUiC,EAAK,SAAWhC,EAAS,OAEtDgC,EAAK,KAAOpC,EAAK,MAAM,KACnBA,EAAK,MAAM,QAAQ,KAAA,IAAQoC,EAAK,QAAUpC,EAAK,MAAM,UAG3D,MAAMY,EAAI,MAAMD,EAAI,IAAoB,oBAAoB,mBAAmBW,CAAE,CAAC,GAAIc,CAAI,EAG1F,GAFA/B,EAAW,MAAQ,GAEfO,EAAE,SAAW,KAAOA,EAAE,SAAW,IAAK,CACxCL,EAAO,MAAQ,CACb,GAAIK,EAAE,KAAK,IAAMU,EACjB,MAAOV,EAAE,KAAK,OAAS,IACvB,QAASA,EAAE,SAAW,IACtB,gBAAiBA,EAAE,KAAK,gBACxB,WAAYA,EAAE,KAAK,UAAA,EAIrByB,GAAUf,EAAIpB,EAAK,KAAK,EACnBoC,GAAA,EACLC,GAAM,KAAM,GAAG3B,EAAE,SAAW,IAAM,UAAY,UAAU,IAAIU,CAAE,MAAMf,EAAO,MAAM,KAAK,GAAI,CACxF,GAAI,gBAAgB,mBAAmBe,CAAE,CAAC,GAC1C,QAAS,MAAA,CACV,EACD,MACF,CAEAhB,EAAM,MAAQkC,GAAQ5B,EAAG,sBAAsB,CACjD,CAUA,SAAS6B,GAA8B,CACrC,MAAMC,EAAI,SAAS,SACnB,GAAIA,IAAM,aAAeA,EAAE,SAAS,YAAY,GAAK,WAAW,KAAKA,CAAC,GAAKA,EAAE,SAAS,GAAG,EACvF,MAAO,sBAET,MAAMC,EAASD,EAAE,MAAM,GAAG,EAC1B,OAAOC,EAAO,QAAU,EAAIA,EAAO,MAAM,CAAC,EAAE,KAAK,GAAG,EAAID,CAC1D,CAWA,MAAME,EAAeC,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAS5BA,CAAM;AAAA,oBACNA,CAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuC1B,SAASC,GAAoB,CAC3B3C,EAAO,MAAQ,SACfH,EAAK,MAAM,KAAO4C,EAAYH,EAAA,CAAqB,EAC9CzC,EAAK,MAAM,QAAQ,SAAQA,EAAK,MAAM,QAAUH,IAChDG,EAAK,MAAM,KAAIA,EAAK,MAAM,GAAK,UAC/BE,EAAK,MAAM,KAAM6B,GAAMA,EAAE,CAAC,IAAG7B,EAAK,MAAQ,CAAC,CAAE,EAAG,KAAM,EAAG,MAAO,EACvE,+DAIE6C,EA0OM,MAAA,KAAA,CAzOJC,EAiBM,MAjBNC,GAiBM,CAhBJD,EAaM,MAAA,KAAA,CAZJA,EAEK,KAAA,KAAAE,EADApC,EAAA,MAAS,oBAAyBG,EAAA,MAAQ,yBAAA,qBAAA,EAAA,CAAA,EAE/C+B,EAQM,MARNG,GAQMD,EANFpC,EAAA,+DAAmGG,EAAA,qBAA0CA,EAAA,KAAQ,yFAQ3J+B,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAAqE,SAAA,CAA7D,MAAM,QAAS,QAAOF,CAAA,EAAa,mBAAiB,CAAA,GAG9DE,EAqNU,UArNVI,GAqNU,CAtMGnC,EAAA,QAAaH,EAAA,OAAxBuC,IAAAN,EAYM,MAZNO,GAYM,CAXJC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAyC,SAAtC,qCAAkC,EAAA,GACrCA,EASI,IAAA,KAAA,iBATD,6CACwC,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,qCAC3D,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,kFAChB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,mBAAO,mEACtB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,UACnB,EAAA,GAAgB7B,EAAA,QAAW,gBAA3B4B,EAGWS,EAAA,CAAA,IAAA,GAAA,eAHiC,2DAE1C,EAAA,GAAAC,EAAiDC,EAAA,CAArC,GAAG,aAAW,WAAC,IAAS,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAT,YAAS,EAAA,CAAA,2BAAa,KACnD,EAAA,EAAA,8BAIOzC,EAAA,WAAXiC,EAkBM,MAAA,OAlBgB,MAAKY,EAAA,CAAC,SAAiBxC,EAAA,QAAW,SAAA,OAAA,MAAA,CAAA,CAAA,GACtD6B,EAA0B,IAAA,KAAvB,aAAUE,EAAGnD,EAAA,EAAE,EAAG,IAAC,CAAA,EACboB,EAAA,QAAW,WAApBkC,EAAA,EAAAN,EAA+D,OAA3B,yBAAuB,GAC7C5B,EAAA,QAAW,UAAzBkC,IAAAN,EAGI,OAHoC,mLAGxC,GACc5B,EAAA,QAAW,gBAAzB4B,EAKI,IAAAa,GAAA,iBALsC,yHAEb,EAAA,GAAAH,EAAsDC,EAAA,CAA1C,GAAG,aAAW,WAAC,IAAc,CAAA,GAAAH,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAd,iBAAc,EAAA,CAAA,2BAAa,2CAClD,EAAA,GAAAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,mBAAI,4DAEhD,EAAA,EAAA,SACAD,EAII,IAAAc,GAAA,CAAA,GAAAN,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJM,0EAC8D,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,IAAI,+GAGvF,EAAA,CAAA,oBAQS5B,EAAA,OAAXiC,EAAA,EAAAN,EAOM,MAPNe,GAOM,CANJd,EAAkE,IAAA,KAA/D,2CAAwCE,EAAG9B,EAAA,KAAW,EAAG,KAAE,CAAA,EAC9D4B,EAII,IAAA,KAAA,iBAJD,kHAGD,EAAA,GAAAS,EAAmFC,EAAA,CAAtE,GAAE,UAAY,mBAAmBtC,EAAA,KAAW,CAAA,EAAA,aAAK,IAAQ,CAAA,GAAAmC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAR,WAAQ,EAAA,CAAA,oCAAa,aACrF,EAAA,EAAA,eAGFP,EAmBM,MAnBNe,GAmBM,CAlBJf,EAUM,MAVNgB,GAUM,CATJT,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAsC,QAAA,CAA/B,IAAI,KAAA,EAAM,gBAAa,EAAA,KAC9BA,EAOE,QAAA,CANA,GAAG,MACW,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,GAAEiE,GACrB,KAAK,OACL,YAAY,SACZ,WAAW,QACX,aAAa,KAAA,gBAJCjE,EAAA,MAAK,UAAX,CAAA,KAAR,EAAA,CAAsB,MAO1BgD,EAMO,OANPkB,GAMO,iBAN0D,eAE/D,EAAA,GAAAT,EAGWU,EAAA,CAHD,MAAM,yCAAuC,WAAC,IAEzC,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFyC,wGAEzC,EAAA,EAAAP,EAAsC,YAAhC,4BAAyB,EAAA,IAAO,KACrD,EAAA,CAAA,eAKOxC,EAAA,MAAM,QAAjB6C,IAAAN,EAOM,MAPNqB,GAOM,CANJpB,EAEQ,QAFRqB,GAEQ,GADNrB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,gBACxD,EAAA,EAAA,GACA6C,EAEQ,QAFRsB,GAEQ,GADNtB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,4BACxD,EAAA,EAAA,eAGcA,EAAA,QAAM,UAAiBK,EAAA,MAAM,YAA7CuC,EAeWS,EAAA,CAAA,IAAA,GAAA,CAdTR,EAGM,MAHNuB,GAGM,CAFJhB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmC,QAAA,CAA5B,IAAI,IAAA,EAAK,cAAW,EAAA,GAC3BS,EAAoFe,GAAA,YAA/DpE,EAAA,2CAAAA,EAAQ,MAAA6D,GAAE,GAAG,KAAK,MAAM,cAAe,QAASxD,EAAA,KAAA,qCAE9DI,EAAA,OAATwC,EAAA,EAAAN,EASI,IATJ0B,GASI,CARU5D,EAAA,MAAW,aAAvBwC,IAAAN,EAA0E,OAAA2B,GAAAxB,EAAnCrC,EAAA,MAAW,WAAW,EAAG,MAAG,CAAA,4BAAO,UAE1E,EAAA,GAASA,EAAA,MAAW,aAAa,QAAjCwC,EAAA,EAAAN,EAAqF,IAAA4B,GAAAzB,EAAzCrC,EAAA,MAAW,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,IACxEwC,IAAAN,EAAgC,UAAnB,cAAY,mBAAO,KAChC,EAAA,GAAAU,EAGWU,EAAA,CAHD,MAAM,8BAA4B,WAAC,IAG7C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH6C,+IAG7C,EAAA,CAAA,kCAIJR,EA8BWS,EAAA,CAAA,IAAA,GAAA,CA7BTR,EASM,MATN4B,GASM,CARJrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkC,QAAA,CAA3B,IAAI,MAAA,EAAO,WAAQ,EAAA,KAC1BA,EAME,WAAA,CALA,GAAG,OACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,KAAIiE,GAClB,KAAK,KACL,WAAW,QACX,YAAY;AAAA;AAAA;AAAA,SAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,IAAI,CAAA,KAOtBgD,EASM,MATN8B,GASM,eARJ9B,EAA6E,QAAA,CAAtE,IAAI,WAAS,GAAC,cAAY,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAC9DA,EAME,WAAA,CALA,GAAG,UACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,QAAOiE,GACrB,KAAK,IACL,WAAW,QACX,YAAY,wEAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,OAAO,CAAA,KAMzBgD,EAOI,IAPJ+B,GAOI,iBAPY,oDAEd,EAAA,GAAAtB,EAIWU,EAAA,CAJD,MAAM,4CAA0C,WAAC,IAClB,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GADkB,2CAClB,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,IAAO,QAC5D,EAAA,EAAAA,EAAwB,YAAlB,cAAW,EAAA,IAAO,mCACxB,EAAA,EAAAA,EAA8B,YAAxB,oBAAiB,EAAA,IAAO,yBAChC,EAAA,CAAA,iCAIJA,EAAwE,KAAA,CAApE,MAAM,UAAU,MAAA,CAAA,OAAA,uBAAA,CAAA,EAAsC,YAAS,EAAA,GACnES,EAA4BuB,GAAA,YAAR9E,EAAA,2CAAAA,EAAI,MAAA+D,EAAA,yBACxBjB,EAMI,IANJiC,GAMI,iBANY,gFAEd,EAAA,GAAAxB,EAGWU,EAAA,CAHD,MAAM,gCAA8B,WAAC,IAG/C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH+C,4JAG/C,EAAA,CAAA,aAGFP,EAmBM,MAnBNkC,GAmBM,CAlBJzB,EAEe0B,GAAA,CAFD,QAAQ,UAAW,QAAS9E,EAAA,MAAa,UAAW2B,EAAA,MAAY,QAAOC,CAAA,aACnF,IAA2C,KAAxC5B,EAAA,MAAU,cAAA,QAAA,EAAA,CAAA,CAAA,kCAEFE,EAAA,gBAAb8C,IAAAN,EAOO,OAPPqC,GAOO,iBAP0D,6CAE/D,EAAA,GAAA3B,EAIWU,EAAA,CAJD,MAAM,yCAAuC,WAAC,IAIxD,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJwD,mPAIxD,EAAA,CAAA,cAEUhD,EAAA,OAAZ8C,EAAA,EAAAN,EAMO,OANPsC,GAMO,KALF9E,EAAA,MAAO,QAAO,UAAA,UAAA,EAA4B,YAC7C,CAAA,EAAAyC,EAAyB,IAAA,KAAAE,EAAnB3C,EAAA,MAAO,KAAK,EAAA,CAAA,EAClBkD,EAEaC,EAAA,CAFA,GAAE,gBAAkB,mBAAmBnD,EAAA,MAAO,EAAE,CAAA,GAAK,MAAA,CAAA,cAAA,KAAA,CAAA,aAAyB,IAE3F,CAAA,GAAAgD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAF2F,WAE3F,EAAA,CAAA,mCAcO+B,GAAA5D,EAAAnB,EAAA,QAAA,YAAAmB,EAAQ,kBAAR,MAAA4D,EAAyB,QAApCjC,IAAAN,EAUM,MAVNwC,GAUM,CATJvC,EAAyE,SAAtE,iDAA8CE,EAAG3C,QAAO,KAAK,EAAG,KAAE,CAAA,EACrEyC,EAOI,IAAA,KAAA,EANFK,EAAA,EAAA,EAAAN,EAGCS,SAH0BjD,EAAA,MAAO,gBAAe,CAA/BiF,EAAGC,kBAAoCD,GAAC,CACxD/B,EACCC,EAAA,CADY,GAAE,gBAAkB,mBAAmB8B,CAAC,CAAA,EAAA,aAAK,IAAO,KAAJA,CAAC,EAAA,CAAA,CAAA,qBACjDC,EAAIlF,EAAA,MAAO,gBAAgB,OAAM,GAA7C8C,EAAA,EAAAN,EAA4D,UAAT,IAAE,yCACvD,yDAAsD,EAAA,GAAAQ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,+CACjD,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,qFACd,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,oBAChD,EAAA,EAAA,gBAQS0C,GAAAC,EAAApF,EAAA,QAAA,YAAAoF,EAAQ,aAAR,MAAAD,EAAoB,QAA/BrC,IAAAN,EASM,MATN6C,GASM,CARJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAuD,SAApD,mDAAgD,EAAA,iBACnDA,EAGI,IAAA,KAAA,GAHD,oDACgD,EAAAA,EAAgC,YAA1B,qBAAmB,IAAO,qGAEnF,CAAA,OACAA,EAEK,KAAA,KAAA,EADHK,EAAA,EAAA,EAAAN,EAAwDS,EAAA,KAAAqC,EAAxCtF,EAAA,MAAO,WAAZuF,IAAXzC,EAAA,EAAAN,EAAwD,KAAA,CAApB,IAAK+C,CAAA,IAAMA,CAAC,EAAA,CAAA,wBAInCxF,EAAA,WAAjByF,GAAqFC,GAAA,OAA5D,KAAM1F,EAAA,MAAO,MAAM,sCAAA"}
+{"version":3,"file":"SubmitView-D-jg5Wxy.js","sources":["../../src/views/SubmitView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Submit or replace a deployment.\n *\n * The server's 400 is the whole point of this screen. It carries the SpecError verbatim — the key\n * or variable that is wrong, often the corrected form, and the assert-lint warnings about an\n * `assert_gone` that fails open. That text is the tool's main teaching surface, so it is rendered\n * whole, with newlines intact, and never summarised.\n *\n * The spec is parsed BEFORE anything touches disk, so a rejected submission leaves nothing behind\n * and, on a replace, a good record is never destroyed over a typo.\n */\nimport { computed, ref, watch } from 'vue';\nimport { useRoute } from 'vue-router';\nimport { api, problem } from '../api/client';\nimport InfoHint from '../components/InfoHint.vue';\nimport type {\n  DeploymentSourceResponse,\n  SpecMeta,\n  SpecsResponse,\n  SubmitResponse,\n  VarPair,\n} from '../api/types';\nimport { loadDeployments, rowFor } from '../composables/useControlPlane';\nimport { pairsFromRecord, readVars, recordFromPairs, writeVars } from '../composables/useVars';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport VarEditor from '../components/VarEditor.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\n\nconst props = defineProps<{ id?: string }>();\n\nconst form = ref({ id: props.id ?? '', spec: '', compose: '' });\nconst vars = ref<VarPair[]>([{ k: '', v: '' }]);\nconst source = ref<'inline' | 'stored'>('inline');\nconst specName = ref('');\n\nconst submitting = ref(false);\nconst error = ref('');\nconst result = ref<{\n  id: string;\n  stack: string;\n  created: boolean;\n  /** Other deployments resolving to the same stack — reported by the server on a new deployment. */\n  stackSharedWith?: string[];\n  /** Compose keys swarm will ignore — reported by the server at submit time. */\n  swarmNotes?: string[];\n} | null>(null);\n\n/**\n * Stored specs, when this server has them. A build without `/api/specs` answers 404, which is not\n * an error here — the picker simply is not offered and inline stays the only shape.\n */\nconst specs = ref<SpecMeta[]>([]);\n\n/** `— choose —` stays first: an empty value is a real state here, not a placeholder. */\nconst specOptions = computed(() => [\n  { value: '', label: '— choose —' },\n  ...specs.value.map((s) => ({ value: s.name, label: s.name, hint: s.kind })),\n]);\nvoid api.get<SpecsResponse>('/api/specs').then((r) => {\n  if (r.ok && Array.isArray(r.body.specs)) specs.value = r.body.specs;\n});\n\nconst chosenSpec = computed(() => specs.value.find((s) => s.name === specName.value));\n\nconst replacing = computed(() => !!props.id);\n\n/**\n * Duplicate mode: `/submit?from=<id>` copies an existing deployment's spec, compose and variables into\n * a NEW submission. Distinct from replacing — the id starts empty so you name the new one, and nothing\n * is written over.\n *\n * The `stack:` line is the thing to watch, which is why the banner says so: copy a spec whose stack is a\n * literal and both deployments drive the same compose project, so `down` on either stops the other's\n * containers. A spec whose stack interpolates a variable (`pr-${PR}`) just needs a different value. The\n * server independently reports a collision at submit time — see `stackSharedWith`.\n */\nconst route = useRoute();\nconst copyFrom = computed(() => {\n  const v = route.query.from;\n  return typeof v === 'string' && v ? v : null;\n});\n\n/**\n * Replacing now PRE-FILLS from what is stored.\n *\n * It used to start empty, because nothing could hand the source back. Replacing is whole-record, so\n * an operator retyping a spec from memory silently dropped whatever they forgot — and a dropped axis\n * stops being tracked while the resources it created keep running. Being unable to read your own\n * submission is what made that a likely mistake rather than a careless one.\n *\n * The body is still cleared FIRST, on every id change. A leftover body from another deployment is the\n * dangerous case: it is perfectly valid YAML, so the PUT would succeed and overwrite the wrong\n * deployment with nothing able to catch it. Clearing first means a failed or withheld fetch leaves the\n * form empty rather than holding someone else's spec.\n */\nconst sourceState = ref<'idle' | 'loading' | 'loaded' | 'withheld' | 'failed'>('idle');\n/** Set when this deployment tracks a stored spec — editing this copy forks it from the original. */\nconst forkWarning = ref<string | null>(null);\n\nasync function loadSource(id: string): Promise<void> {\n  sourceState.value = 'loading';\n  forkWarning.value = null;\n  const r = await api.getAuthed<DeploymentSourceResponse>(\n    `/api/deployments/${encodeURIComponent(id)}/source`,\n  );\n  // A build of the API without the route answers 404; that is a capability difference, not an error,\n  // and it must land on the old empty-form behaviour rather than an alarming banner.\n  if (r.status === 404 || !r.ok) {\n    sourceState.value = 'failed';\n    return;\n  }\n  if (r.body.sourceWithheld) {\n    sourceState.value = 'withheld';\n    if (r.body.specName) forkWarning.value = r.body.specName;\n    return;\n  }\n  // Only fill if the user has not started typing — a slow fetch must never overwrite their edit.\n  if (!form.value.spec) form.value.spec = r.body.spec ?? '';\n  if (!form.value.compose) form.value.compose = r.body.compose ?? '';\n  if (r.body.specName) forkWarning.value = r.body.specName;\n  sourceState.value = 'loaded';\n}\n\n// Duplicate: same fetch, but the id stays empty and the variables come across too, since a copied\n// spec interpolates the same names.\nwatch(\n  copyFrom,\n  async (from) => {\n    if (!from || props.id) return;\n    error.value = '';\n    result.value = null;\n    form.value.spec = '';\n    form.value.compose = '';\n    const saved = rowFor(from)?.vars;\n    if (saved) vars.value = pairsFromRecord(saved);\n    await loadSource(from);\n    // A copied record's own id is not a name for the new one; the operator picks that.\n    form.value.id = '';\n  },\n  { immediate: true },\n);\n\nwatch(\n  () => props.id,\n  (id) => {\n    error.value = '';\n    result.value = null;\n    sourceState.value = 'idle';\n    forkWarning.value = null;\n    if (!id) return;\n    if (id !== form.value.id) {\n      form.value.spec = '';\n      form.value.compose = '';\n    }\n    form.value.id = id;\n    // Seed the variables from what this deployment already uses: replacing a spec usually needs\n    // the same ones that resolved it.\n    const stored = rowFor(id)?.vars;\n    const saved = stored ? pairsFromRecord(stored) : readVars(id);\n    if (saved.some((e) => e.k)) vars.value = saved;\n    void loadSource(id);\n  },\n  { immediate: true },\n);\n\nconst canSubmit = computed(\n  () =>\n    !!form.value.id &&\n    (source.value === 'stored' ? !!specName.value : !!form.value.spec.trim()) &&\n    !submitting.value,\n);\n\nasync function submit(): Promise<void> {\n  submitting.value = true;\n  error.value = '';\n  result.value = null;\n\n  const id = form.value.id;\n  const record = recordFromPairs(vars.value);\n  /**\n   * `vars` are STORED with the deployment on servers that support it, which makes a later `down`\n   * resolve the same stack `up` created with no query parameters at all. `env` validates this\n   * submission on every server, new or old. Sending both is what keeps this form working against\n   * either build — an older server ignores the key it does not know.\n   */\n  const body: Record<string, unknown> = { vars: record, env: record };\n  if (source.value === 'stored') body.specName = specName.value;\n  else {\n    body.spec = form.value.spec;\n    if (form.value.compose.trim()) body.compose = form.value.compose;\n  }\n\n  const r = await api.put<SubmitResponse>(`/api/deployments/${encodeURIComponent(id)}`, body);\n  submitting.value = false;\n\n  if (r.status === 200 || r.status === 201) {\n    result.value = {\n      id: r.body.id ?? id,\n      stack: r.body.stack ?? '?',\n      created: r.status === 201,\n      stackSharedWith: r.body.stackSharedWith,\n      swarmNotes: r.body.swarmNotes,\n    };\n    // Persist the variables that just validated this spec. On an older server this is the single\n    // thing keeping a later `down` pointed at the stack the `up` created.\n    writeVars(id, vars.value);\n    void loadDeployments();\n    toast('ok', `${r.status === 201 ? 'Created' : 'Replaced'} ${id} → ${result.value.stack}`, {\n      to: `/deployments/${encodeURIComponent(id)}`,\n      toLabel: 'Open',\n    });\n    return;\n  }\n  // 400 (SpecError), 409 (a job in flight over this stack), 401, 404 — all rendered verbatim.\n  error.value = problem(r, 'save this deployment');\n}\n\n/**\n * The preview domain, guessed from where this page is served.\n *\n * The UI lives on a host UNDER the preview domain (ui.preview.example.com, pstack.preview…), so\n * previews live beside it: drop this page's own first label and that is the base every generated\n * hostname hangs off. localhost and bare IPs have no domain to offer — those keep an honest\n * placeholder rather than generating `pr-123.192.168.1.5`.\n */\nfunction detectPreviewDomain(): string {\n  const h = location.hostname;\n  if (h === 'localhost' || h.endsWith('.localhost') || /^[\\d.]+$/.test(h) || h.includes(':')) {\n    return 'preview.example.com';\n  }\n  const labels = h.split('.');\n  return labels.length >= 3 ? labels.slice(1).join('.') : h;\n}\n\n/**\n * Kept as a function of the domain so the example is true on the host it is loaded on — a spec\n * copied from here should deploy without edits, not after find-and-replacing example.com.\n *\n * The compose half uses `pstack.routing.port`, NOT hand-written traefik labels: pstack generates\n * the router, TLS and network wiring from that one label. A bare `traefik.enable=true` is the\n * OPT-OUT signal (any traefik.* label means \"leave my service alone\") — which is what an older\n * version of this example taught, producing a service that was never reachable.\n */\nconst exampleSpec = (domain: string): string => `version: 1\nkind: isolated\n\n# The stack identity: the compose project name, and $STACK inside every hook.\n# \\${PR} is interpolated ONCE, at resolve time, from the variables sent with the request.\nstack: pr-\\${PR}\n\nenv:\n  # The base every generated hostname hangs off: the app below is served at\n  # app-pr-\\${PR}.${domain}\n  PREVIEW_DOMAIN: ${domain}\n\ncompose:\n  file: compose.yml\n  # Every service sits behind a profile so a bare \\`up\\` starts nothing.\n  # \\`down\\` always enables ALL of them — otherwise the unselected profiles' network leaks.\n  profiles: [app]\n\nrequires:\n  - name: traefik-network\n    assert: docker network inspect traefik >/dev/null 2>&1\n    hint: run \\`pstack init\\` on the host first\n\naxes:\n  # Hooks run from the deployment directory, which holds only spec.yml and compose.yml —\n  # so use inline shell or absolute paths, never ./hooks/foo.sh.\n  - name: scratch\n    up: mkdir -p /tmp/$STACK\n    assert_live: test -d /tmp/$STACK\n    down: rm -rf /tmp/$STACK\n    # assert_gone MUST FAIL CLOSED. A bare \\`! <probe>\\` reports \"gone\" whenever the probe fails\n    # for any reason — a missing CLI, an expired token — turning \"I could not tell\" into\n    # \"it is gone\", a false negative on the one thing this tool exists to catch.\n    assert_gone: |\n      test -d /tmp || exit 1\n      ! test -d /tmp/$STACK\n`;\n\nconst EXAMPLE_COMPOSE = `services:\n  app:\n    image: nginx:alpine\n    profiles: [app]\n    labels:\n      # The ONE label routing needs: pstack generates the Traefik router, TLS and network wiring\n      # from it. Writing any traefik.* label yourself is the opt-out — pstack then leaves the\n      # service entirely alone, so only do that when you need something the shorthand cannot say.\n      - pstack.routing.port=80\n`;\n\nfunction loadExample(): void {\n  source.value = 'inline';\n  form.value.spec = exampleSpec(detectPreviewDomain());\n  if (!form.value.compose.trim()) form.value.compose = EXAMPLE_COMPOSE;\n  if (!form.value.id) form.value.id = 'pr-123';\n  if (!vars.value.some((e) => e.k)) vars.value = [{ k: 'PR', v: '123' }];\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          {{ replacing ? 'Edit a deployment' : copyFrom ? 'Duplicate a deployment' : 'Submit a deployment' }}\n        </h1>\n        <div class=\"sub\">\n          {{\n            replacing\n              ? 'Loaded from what is stored; saving replaces the record'\n              : copyFrom\n                ? `Copied from ${copyFrom} — give it a new id, then edit`\n                : 'Stores a spec so it can be deployed'\n          }}\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button class=\"ghost\" @click=\"loadExample\">Load example spec</button>\n    </div>\n\n    <section class=\"panel\">\n      <!-- The \"nothing saved until valid\" reassurance lives beside the Submit button below — the\n           moment of commitment is where a guarantee about committing belongs, not floating above\n           an unrelated id field. -->\n\n      <!--\n        A `PUT` REPLACES the whole record, and this form cannot pre-fill it: the API has no route\n        that returns a stored spec. Say that out loud, because a half-remembered spec pasted here\n        is still valid YAML — the server will accept it, and the axes the original declared simply\n        stop existing as far as the control plane knows, while whatever they created keeps running.\n      -->\n      <!--\n        The one thing that makes duplicating dangerous, said before the form rather than after the\n        submission: two records resolving to one stack drive the same compose project.\n      -->\n      <div v-if=\"copyFrom && !replacing\" class=\"banner warn\">\n        <b>Change the stack, not just the id.</b>\n        <p>\n          Two deployments that resolve to the same <code>stack</code> drive the same compose project —\n          <code>down</code> on either stops the other's containers. If the stack interpolates a variable\n          (<code>pr-${PR}</code>) give it a different value below; if it is a literal, edit the\n          <code>stack:</code> line.\n          <template v-if=\"sourceState === 'withheld'\">\n            The spec could not be copied without an access token —\n            <RouterLink to=\"/settings\">add yours</RouterLink>.\n          </template>\n        </p>\n      </div>\n\n      <div v-if=\"replacing\" class=\"banner\" :class=\"sourceState === 'loaded' ? 'info' : 'warn'\">\n        <b>Replacing {{ id }}.</b>\n        <p v-if=\"sourceState === 'loading'\">Loading what is stored…</p>\n        <p v-else-if=\"sourceState === 'loaded'\">\n          Loaded from the stored record — edit it and save. Saving replaces the record outright, so\n          anything you delete here stops being tracked while whatever it created keeps running.\n        </p>\n        <p v-else-if=\"sourceState === 'withheld'\">\n          The stored spec was not loaded: reading it needs an access token, because hooks routinely\n          carry a credential inline. <RouterLink to=\"/settings\">Add your token</RouterLink> to edit\n          in place — otherwise paste the <b>complete</b> spec, since anything you leave out stops\n          being tracked.\n        </p>\n        <p v-else>\n          The stored spec could not be loaded, so this form is empty. Paste the <b>complete</b> spec\n          you want stored — anything you leave out stops being tracked while whatever it created keeps\n          running.\n        </p>\n      </div>\n\n      <!--\n        A deployment that references a stored spec keeps its own copy of the source. Editing that copy\n        forks it: the stored spec every other deployment shares is untouched, and this one stops\n        following it. Silent forks are the kind of thing discovered months later.\n      -->\n      <div v-if=\"forkWarning\" class=\"banner warn\">\n        <b>This deployment tracks the stored spec “{{ forkWarning }}”.</b>\n        <p>\n          Saving here writes a private copy and stops it following that spec. To change every\n          deployment using it, edit\n          <RouterLink :to=\"`/specs/${encodeURIComponent(forkWarning)}`\">the spec</RouterLink> instead.\n        </p>\n      </div>\n\n      <div class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <div class=\"field\" style=\"max-width: 280px\">\n          <label for=\"did\">Deployment id</label>\n          <input\n            id=\"did\"\n            v-model.trim=\"form.id\"\n            type=\"text\"\n            placeholder=\"pr-123\"\n            spellcheck=\"false\"\n            autocomplete=\"off\"\n          />\n        </div>\n        <span class=\"mute\" style=\"align-self: end; padding-bottom: 10px\">\n          Lower case\n          <InfoHint label=\"allowed characters in a deployment id\">\n            Starts with a letter or digit, then letters, digits, dot, dash or underscore. Up to 64\n            characters — <code>[a-z0-9][a-z0-9._-]{0,63}</code>.\n          </InfoHint>\n        </span>\n      </div>\n\n      <!-- Offered only when this server actually has stored specs. -->\n      <div v-if=\"specs.length\" class=\"row\" style=\"margin-bottom: var(--s4)\">\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"inline\" /> inline spec\n        </label>\n        <label class=\"check\">\n          <input v-model=\"source\" type=\"radio\" value=\"stored\" /> reference a stored spec\n        </label>\n      </div>\n\n      <template v-if=\"source === 'stored' && specs.length\">\n        <div class=\"field\" style=\"max-width: 340px\">\n          <label for=\"sn\">Stored spec</label>\n          <SelectMenu v-model=\"specName\" id=\"sn\" label=\"Stored spec\" :options=\"specOptions\" />\n        </div>\n        <p v-if=\"chosenSpec\" class=\"hint\">\n          <span v-if=\"chosenSpec.description\">{{ chosenSpec.description }} — </span>\n          needs\n          <b v-if=\"chosenSpec.requiredVars.length\">{{ chosenSpec.requiredVars.join(', ') }}</b>\n          <span v-else>no variables</span>.\n          <InfoHint label=\"why variables are required\">\n            A missing variable is refused by name. It is never filled in with a blank, which would\n            silently give every deployment the same stack name.\n          </InfoHint>\n        </p>\n      </template>\n\n      <template v-else>\n        <div class=\"field\">\n          <label for=\"spec\">Spec.yml</label>\n          <textarea\n            id=\"spec\"\n            v-model=\"form.spec\"\n            rows=\"12\"\n            spellcheck=\"false\"\n            placeholder=\"version: 1&#10;kind: isolated&#10;stack: pr-${PR}&#10;axes: []\"\n          />\n        </div>\n\n        <div class=\"field\" style=\"margin-top: var(--s3)\">\n          <label for=\"compose\">compose.yml <span class=\"mute\">(optional)</span></label>\n          <textarea\n            id=\"compose\"\n            v-model=\"form.compose\"\n            rows=\"6\"\n            spellcheck=\"false\"\n            placeholder=\"Written next to spec.yml, so a compose file named compose.yml resolves\"\n          />\n        </div>\n        <p class=\"hint\">\n          Hooks must be inline shell or an absolute path.\n          <InfoHint label=\"why a relative script path does not work\">\n            A deployment directory only ever holds <code>spec.yml</code> and\n            <code>compose.yml</code>, and hooks run from there — so\n            <code>up: ./hooks/db.sh</code> has nothing to find.\n          </InfoHint>\n        </p>\n      </template>\n\n      <h2 class=\"section\" style=\"margin: var(--s5) 0 var(--s3)\">Variables</h2>\n      <VarEditor v-model=\"vars\" />\n      <p class=\"hint\">\n        Saved with the deployment, so tearing it down later targets the same stack.\n        <InfoHint label=\"how variables are remembered\">\n          They are stored on the server where it supports that, and in this browser either way — so\n          the actions on the deployment page send exactly these values.\n        </InfoHint>\n      </p>\n\n      <div class=\"row\" style=\"margin-top: var(--s5)\">\n        <ActionButton variant=\"primary\" :pending=\"submitting\" :disabled=\"!canSubmit\" @click=\"submit\">\n          {{ submitting ? 'Submitting…' : 'Submit' }}\n        </ActionButton>\n        <span v-if=\"!result\" class=\"mute\" style=\"font-size: var(--t-sm)\">\n          Nothing is saved until the spec is valid\n          <InfoHint label=\"what happens on a rejected submission\">\n            The spec is checked before anything is written, so a rejected submission leaves nothing\n            behind — and a replace never destroys a good record over a typo. Whether the deployment\n            is shared or isolated comes from the spec, not from this form.\n          </InfoHint>\n        </span>\n        <span v-if=\"result\" class=\"s-ok\">\n          {{ result.created ? 'Created' : 'Replaced' }} — stack\n          <b>{{ result.stack }}</b>\n          <RouterLink :to=\"`/deployments/${encodeURIComponent(result.id)}`\" style=\"margin-left: 8px\">\n            open →\n          </RouterLink>\n        </span>\n      </div>\n\n      <!--\n        The server's rejection text IS the documentation: it names the key, the variable or the\n        assert that is wrong, and often prints the corrected form. Rendered whole, newlines and\n        indentation intact. Never truncate it, never collapse it, never say \"invalid spec\".\n      -->\n      <!--\n        Reported by the server, which resolved every other deployment to check. Shown after the fact\n        because it can only be known once the spec has resolved — and it is a warning, not a rejection:\n        it can be deliberate, and refusing over a guess would be worse than saying so.\n      -->\n      <div v-if=\"result?.stackSharedWith?.length\" class=\"banner warn\">\n        <b>Another deployment already resolves to stack “{{ result.stack }}”.</b>\n        <p>\n          <template v-for=\"(o, i) in result.stackSharedWith\" :key=\"o\">\n            <RouterLink :to=\"`/deployments/${encodeURIComponent(o)}`\">{{ o }}</RouterLink\n            ><span v-if=\"i < result.stackSharedWith.length - 1\">, </span> </template\n          >— both records now drive the same compose project, so <code>down</code> on either stops the\n          other's containers and <code>verify</code> on either reports the other's leaks. If that was not\n          intended, change this one's <code>stack</code> and save again.\n        </p>\n      </div>\n\n      <!--\n        The keys swarm drops. Same reasoning as the banner above: advisory, and only knowable once\n        the spec resolved. It is shown here rather than left to the deploy log because the whole\n        point is to reach the author while they are still looking at the file they just wrote.\n      -->\n      <div v-if=\"result?.swarmNotes?.length\" class=\"banner warn\">\n        <b>Swarm will not run this compose file as written.</b>\n        <p>\n          Some keys are dropped and others are rewritten — <code>docker stack deploy</code> reports\n          that once, to a terminal nobody is watching. Every change it makes to what you submitted:\n        </p>\n        <ul>\n          <li v-for=\"n in result.swarmNotes\" :key=\"n\">{{ n }}</li>\n        </ul>\n      </div>\n\n      <ErrorNote v-if=\"error\" :text=\"error\" title=\"The server rejected this submission.\" />\n    </section>\n  </div>\n</template>\n"],"names":["EXAMPLE_COMPOSE","props","__props","form","ref","vars","source","specName","submitting","error","result","specs","specOptions","computed","api","r","chosenSpec","replacing","route","useRoute","copyFrom","v","sourceState","forkWarning","loadSource","id","watch","from","saved","_a","rowFor","pairsFromRecord","stored","readVars","e","canSubmit","submit","record","recordFromPairs","body","writeVars","loadDeployments","toast","problem","detectPreviewDomain","h","labels","exampleSpec","domain","loadExample","_createElementBlock","_createElementVNode","_hoisted_1","_toDisplayString","_hoisted_2","_hoisted_3","_openBlock","_hoisted_4","_cache","_Fragment","_createVNode","_component_RouterLink","_normalizeClass","_hoisted_7","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","$event","_hoisted_12","InfoHint","_hoisted_13","_hoisted_14","_hoisted_15","_hoisted_16","SelectMenu","_hoisted_17","_hoisted_18","_hoisted_19","_hoisted_21","_vModelText","_hoisted_22","_hoisted_23","VarEditor","_hoisted_24","_hoisted_25","ActionButton","_hoisted_26","_hoisted_27","_b","_hoisted_28","o","i","_d","_c","_hoisted_30","_renderList","n","_createBlock","ErrorNote"],"mappings":"gjDA4RMA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mDA7PxB,MAAMC,EAAQC,EAERC,EAAOC,EAAI,CAAE,GAAIH,EAAM,IAAM,GAAI,KAAM,GAAI,QAAS,EAAA,CAAI,EACxDI,EAAOD,EAAe,CAAC,CAAE,EAAG,GAAI,EAAG,EAAA,CAAI,CAAC,EACxCE,EAASF,EAAyB,QAAQ,EAC1CG,EAAWH,EAAI,EAAE,EAEjBI,EAAaJ,EAAI,EAAK,EACtBK,EAAQL,EAAI,EAAE,EACdM,EAASN,EAQL,IAAI,EAMRO,EAAQP,EAAgB,EAAE,EAG1BQ,EAAcC,EAAS,IAAM,CACjC,CAAE,MAAO,GAAI,MAAO,YAAA,EACpB,GAAGF,EAAM,MAAM,IAAK,IAAO,CAAE,MAAO,EAAE,KAAM,MAAO,EAAE,KAAM,KAAM,EAAE,MAAO,CAAA,CAC3E,EACIG,EAAI,IAAmB,YAAY,EAAE,KAAMC,GAAM,CAChDA,EAAE,IAAM,MAAM,QAAQA,EAAE,KAAK,KAAK,IAAGJ,EAAM,MAAQI,EAAE,KAAK,MAChE,CAAC,EAED,MAAMC,EAAaH,EAAS,IAAMF,EAAM,MAAM,KAAM,GAAM,EAAE,OAASJ,EAAS,KAAK,CAAC,EAE9EU,EAAYJ,EAAS,IAAM,CAAC,CAACZ,EAAM,EAAE,EAYrCiB,EAAQC,GAAA,EACRC,EAAWP,EAAS,IAAM,CAC9B,MAAMQ,EAAIH,EAAM,MAAM,KACtB,OAAO,OAAOG,GAAM,UAAYA,EAAIA,EAAI,IAC1C,CAAC,EAeKC,EAAclB,EAA2D,MAAM,EAE/EmB,EAAcnB,EAAmB,IAAI,EAE3C,eAAeoB,EAAWC,EAA2B,CACnDH,EAAY,MAAQ,UACpBC,EAAY,MAAQ,KACpB,MAAMR,EAAI,MAAMD,EAAI,UAClB,oBAAoB,mBAAmBW,CAAE,CAAC,SAAA,EAI5C,GAAIV,EAAE,SAAW,KAAO,CAACA,EAAE,GAAI,CAC7BO,EAAY,MAAQ,SACpB,MACF,CACA,GAAIP,EAAE,KAAK,eAAgB,CACzBO,EAAY,MAAQ,WAChBP,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChD,MACF,CAEKZ,EAAK,MAAM,SAAW,MAAM,KAAOY,EAAE,KAAK,MAAQ,IAClDZ,EAAK,MAAM,YAAc,MAAM,QAAUY,EAAE,KAAK,SAAW,IAC5DA,EAAE,KAAK,WAAUQ,EAAY,MAAQR,EAAE,KAAK,UAChDO,EAAY,MAAQ,QACtB,CAIAI,EACEN,EACA,MAAOO,GAAS,OACd,GAAI,CAACA,GAAQ1B,EAAM,GAAI,OACvBQ,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfP,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,GACrB,MAAMyB,GAAQC,EAAAC,EAAOH,CAAI,IAAX,YAAAE,EAAc,KACxBD,IAAOvB,EAAK,MAAQ0B,EAAgBH,CAAK,GAC7C,MAAMJ,EAAWG,CAAI,EAErBxB,EAAK,MAAM,GAAK,EAClB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpBuB,EACE,IAAMzB,EAAM,GACXwB,GAAO,OAKN,GAJAhB,EAAM,MAAQ,GACdC,EAAO,MAAQ,KACfY,EAAY,MAAQ,OACpBC,EAAY,MAAQ,KAChB,CAACE,EAAI,OACLA,IAAOtB,EAAK,MAAM,KACpBA,EAAK,MAAM,KAAO,GAClBA,EAAK,MAAM,QAAU,IAEvBA,EAAK,MAAM,GAAKsB,EAGhB,MAAMO,GAASH,EAAAC,EAAOL,CAAE,IAAT,YAAAI,EAAY,KACrBD,EAAQI,EAASD,EAAgBC,CAAM,EAAIC,GAASR,CAAE,EACxDG,EAAM,KAAMM,GAAMA,EAAE,CAAC,MAAQ,MAAQN,GACpCJ,EAAWC,CAAE,CACpB,EACA,CAAE,UAAW,EAAA,CAAK,EAGpB,MAAMU,EAAYtB,EAChB,IACE,CAAC,CAACV,EAAK,MAAM,KACZG,EAAO,QAAU,SAAW,CAAC,CAACC,EAAS,MAAQ,CAAC,CAACJ,EAAK,MAAM,KAAK,KAAA,IAClE,CAACK,EAAW,KAAA,EAGhB,eAAe4B,GAAwB,CACrC5B,EAAW,MAAQ,GACnBC,EAAM,MAAQ,GACdC,EAAO,MAAQ,KAEf,MAAMe,EAAKtB,EAAK,MAAM,GAChBkC,EAASC,GAAgBjC,EAAK,KAAK,EAOnCkC,EAAgC,CAAE,KAAMF,EAAQ,IAAKA,CAAA,EACvD/B,EAAO,QAAU,SAAUiC,EAAK,SAAWhC,EAAS,OAEtDgC,EAAK,KAAOpC,EAAK,MAAM,KACnBA,EAAK,MAAM,QAAQ,KAAA,IAAQoC,EAAK,QAAUpC,EAAK,MAAM,UAG3D,MAAMY,EAAI,MAAMD,EAAI,IAAoB,oBAAoB,mBAAmBW,CAAE,CAAC,GAAIc,CAAI,EAG1F,GAFA/B,EAAW,MAAQ,GAEfO,EAAE,SAAW,KAAOA,EAAE,SAAW,IAAK,CACxCL,EAAO,MAAQ,CACb,GAAIK,EAAE,KAAK,IAAMU,EACjB,MAAOV,EAAE,KAAK,OAAS,IACvB,QAASA,EAAE,SAAW,IACtB,gBAAiBA,EAAE,KAAK,gBACxB,WAAYA,EAAE,KAAK,UAAA,EAIrByB,GAAUf,EAAIpB,EAAK,KAAK,EACnBoC,GAAA,EACLC,GAAM,KAAM,GAAG3B,EAAE,SAAW,IAAM,UAAY,UAAU,IAAIU,CAAE,MAAMf,EAAO,MAAM,KAAK,GAAI,CACxF,GAAI,gBAAgB,mBAAmBe,CAAE,CAAC,GAC1C,QAAS,MAAA,CACV,EACD,MACF,CAEAhB,EAAM,MAAQkC,GAAQ5B,EAAG,sBAAsB,CACjD,CAUA,SAAS6B,GAA8B,CACrC,MAAMC,EAAI,SAAS,SACnB,GAAIA,IAAM,aAAeA,EAAE,SAAS,YAAY,GAAK,WAAW,KAAKA,CAAC,GAAKA,EAAE,SAAS,GAAG,EACvF,MAAO,sBAET,MAAMC,EAASD,EAAE,MAAM,GAAG,EAC1B,OAAOC,EAAO,QAAU,EAAIA,EAAO,MAAM,CAAC,EAAE,KAAK,GAAG,EAAID,CAC1D,CAWA,MAAME,EAAeC,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAS5BA,CAAM;AAAA,oBACNA,CAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuC1B,SAASC,GAAoB,CAC3B3C,EAAO,MAAQ,SACfH,EAAK,MAAM,KAAO4C,EAAYH,EAAA,CAAqB,EAC9CzC,EAAK,MAAM,QAAQ,SAAQA,EAAK,MAAM,QAAUH,IAChDG,EAAK,MAAM,KAAIA,EAAK,MAAM,GAAK,UAC/BE,EAAK,MAAM,KAAM6B,GAAMA,EAAE,CAAC,IAAG7B,EAAK,MAAQ,CAAC,CAAE,EAAG,KAAM,EAAG,MAAO,EACvE,+DAIE6C,EA0OM,MAAA,KAAA,CAzOJC,EAiBM,MAjBNC,GAiBM,CAhBJD,EAaM,MAAA,KAAA,CAZJA,EAEK,KAAA,KAAAE,EADApC,EAAA,MAAS,oBAAyBG,EAAA,MAAQ,yBAAA,qBAAA,EAAA,CAAA,EAE/C+B,EAQM,MARNG,GAQMD,EANFpC,EAAA,+DAAmGG,EAAA,qBAA0CA,EAAA,KAAQ,yFAQ3J+B,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAAqE,SAAA,CAA7D,MAAM,QAAS,QAAOF,CAAA,EAAa,mBAAiB,CAAA,GAG9DE,EAqNU,UArNVI,GAqNU,CAtMGnC,EAAA,QAAaH,EAAA,OAAxBuC,IAAAN,EAYM,MAZNO,GAYM,CAXJC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAyC,SAAtC,qCAAkC,EAAA,GACrCA,EASI,IAAA,KAAA,iBATD,6CACwC,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,qCAC3D,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,kFAChB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,mBAAO,mEACtB,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,UACnB,EAAA,GAAgB7B,EAAA,QAAW,gBAA3B4B,EAGWS,EAAA,CAAA,IAAA,GAAA,eAHiC,2DAE1C,EAAA,GAAAC,EAAiDC,EAAA,CAArC,GAAG,aAAW,WAAC,IAAS,CAAA,GAAAH,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAA,GAAT,YAAS,EAAA,CAAA,2BAAa,KACnD,EAAA,EAAA,8BAIOzC,EAAA,WAAXiC,EAkBM,MAAA,OAlBgB,MAAKY,EAAA,CAAC,SAAiBxC,EAAA,QAAW,SAAA,OAAA,MAAA,CAAA,CAAA,GACtD6B,EAA0B,IAAA,KAAvB,aAAUE,EAAGnD,EAAA,EAAE,EAAG,IAAC,CAAA,EACboB,EAAA,QAAW,WAApBkC,EAAA,EAAAN,EAA+D,OAA3B,yBAAuB,GAC7C5B,EAAA,QAAW,UAAzBkC,IAAAN,EAGI,OAHoC,mLAGxC,GACc5B,EAAA,QAAW,gBAAzB4B,EAKI,IAAAa,GAAA,iBALsC,yHAEb,EAAA,GAAAH,EAAsDC,EAAA,CAA1C,GAAG,aAAW,WAAC,IAAc,CAAA,GAAAH,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAd,iBAAc,EAAA,CAAA,2BAAa,2CAClD,EAAA,GAAAA,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,mBAAI,4DAEhD,EAAA,EAAA,SACAD,EAII,IAAAc,GAAA,CAAA,GAAAN,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJM,0EAC8D,EAAA,EAAAP,EAAe,SAAZ,WAAQ,EAAA,IAAI,+GAGvF,EAAA,CAAA,oBAQS5B,EAAA,OAAXiC,EAAA,EAAAN,EAOM,MAPNe,GAOM,CANJd,EAAkE,IAAA,KAA/D,2CAAwCE,EAAG9B,EAAA,KAAW,EAAG,KAAE,CAAA,EAC9D4B,EAII,IAAA,KAAA,iBAJD,kHAGD,EAAA,GAAAS,EAAmFC,EAAA,CAAtE,GAAE,UAAY,mBAAmBtC,EAAA,KAAW,CAAA,EAAA,aAAK,IAAQ,CAAA,GAAAmC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAR,WAAQ,EAAA,CAAA,oCAAa,aACrF,EAAA,EAAA,eAGFP,EAmBM,MAnBNe,GAmBM,CAlBJf,EAUM,MAVNgB,GAUM,CATJT,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAsC,QAAA,CAA/B,IAAI,KAAA,EAAM,gBAAa,EAAA,KAC9BA,EAOE,QAAA,CANA,GAAG,MACW,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,GAAEiE,GACrB,KAAK,OACL,YAAY,SACZ,WAAW,QACX,aAAa,KAAA,gBAJCjE,EAAA,MAAK,UAAX,CAAA,KAAR,EAAA,CAAsB,MAO1BgD,EAMO,OANPkB,GAMO,iBAN0D,eAE/D,EAAA,GAAAT,EAGWU,EAAA,CAHD,MAAM,yCAAuC,WAAC,IAEzC,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFyC,wGAEzC,EAAA,EAAAP,EAAsC,YAAhC,4BAAyB,EAAA,IAAO,KACrD,EAAA,CAAA,eAKOxC,EAAA,MAAM,QAAjB6C,IAAAN,EAOM,MAPNqB,GAOM,CANJpB,EAEQ,QAFRqB,GAEQ,GADNrB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,gBACxD,EAAA,EAAA,GACA6C,EAEQ,QAFRsB,GAEQ,GADNtB,EAAsD,QAAA,sCAAtC7C,EAAM,MAAA8D,GAAE,KAAK,QAAQ,MAAM,QAAA,gBAA3B9D,EAAA,KAAM,CAAA,mBAAgC,4BACxD,EAAA,EAAA,eAGcA,EAAA,QAAM,UAAiBK,EAAA,MAAM,YAA7CuC,EAeWS,EAAA,CAAA,IAAA,GAAA,CAdTR,EAGM,MAHNuB,GAGM,CAFJhB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmC,QAAA,CAA5B,IAAI,IAAA,EAAK,cAAW,EAAA,GAC3BS,EAAoFe,GAAA,YAA/DpE,EAAA,2CAAAA,EAAQ,MAAA6D,GAAE,GAAG,KAAK,MAAM,cAAe,QAASxD,EAAA,KAAA,qCAE9DI,EAAA,OAATwC,EAAA,EAAAN,EASI,IATJ0B,GASI,CARU5D,EAAA,MAAW,aAAvBwC,IAAAN,EAA0E,OAAA2B,GAAAxB,EAAnCrC,EAAA,MAAW,WAAW,EAAG,MAAG,CAAA,4BAAO,UAE1E,EAAA,GAASA,EAAA,MAAW,aAAa,QAAjCwC,EAAA,EAAAN,EAAqF,IAAA4B,GAAAzB,EAAzCrC,EAAA,MAAW,aAAa,KAAI,IAAA,CAAA,EAAA,CAAA,IACxEwC,IAAAN,EAAgC,UAAnB,cAAY,mBAAO,KAChC,EAAA,GAAAU,EAGWU,EAAA,CAHD,MAAM,8BAA4B,WAAC,IAG7C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH6C,+IAG7C,EAAA,CAAA,kCAIJR,EA8BWS,EAAA,CAAA,IAAA,GAAA,CA7BTR,EASM,MATN4B,GASM,CARJrB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkC,QAAA,CAA3B,IAAI,MAAA,EAAO,WAAQ,EAAA,KAC1BA,EAME,WAAA,CALA,GAAG,OACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,KAAIiE,GAClB,KAAK,KACL,WAAW,QACX,YAAY;AAAA;AAAA;AAAA,SAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,IAAI,CAAA,KAOtBgD,EASM,MATN8B,GASM,eARJ9B,EAA6E,QAAA,CAAtE,IAAI,WAAS,GAAC,cAAY,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAC9DA,EAME,WAAA,CALA,GAAG,UACM,sBAAAO,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAU,GAAAjE,EAAA,MAAK,QAAOiE,GACrB,KAAK,IACL,WAAW,QACX,YAAY,wEAAA,aAHH,CAAAY,EAAA7E,EAAA,MAAK,OAAO,CAAA,KAMzBgD,EAOI,IAPJ+B,GAOI,iBAPY,oDAEd,EAAA,GAAAtB,EAIWU,EAAA,CAJD,MAAM,4CAA0C,WAAC,IAClB,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GADkB,2CAClB,EAAA,EAAAP,EAAqB,YAAf,WAAQ,EAAA,IAAO,QAC5D,EAAA,EAAAA,EAAwB,YAAlB,cAAW,EAAA,IAAO,mCACxB,EAAA,EAAAA,EAA8B,YAAxB,oBAAiB,EAAA,IAAO,yBAChC,EAAA,CAAA,iCAIJA,EAAwE,KAAA,CAApE,MAAM,UAAU,MAAA,CAAA,OAAA,uBAAA,CAAA,EAAsC,YAAS,EAAA,GACnES,EAA4BuB,GAAA,YAAR9E,EAAA,2CAAAA,EAAI,MAAA+D,EAAA,yBACxBjB,EAMI,IANJiC,GAMI,iBANY,gFAEd,EAAA,GAAAxB,EAGWU,EAAA,CAHD,MAAM,gCAA8B,WAAC,IAG/C,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAH+C,4JAG/C,EAAA,CAAA,aAGFP,EAmBM,MAnBNkC,GAmBM,CAlBJzB,EAEe0B,GAAA,CAFD,QAAQ,UAAW,QAAS9E,EAAA,MAAa,UAAW2B,EAAA,MAAY,QAAOC,CAAA,aACnF,IAA2C,KAAxC5B,EAAA,MAAU,cAAA,QAAA,EAAA,CAAA,CAAA,kCAEFE,EAAA,gBAAb8C,IAAAN,EAOO,OAPPqC,GAOO,iBAP0D,6CAE/D,EAAA,GAAA3B,EAIWU,EAAA,CAJD,MAAM,yCAAuC,WAAC,IAIxD,CAAA,GAAAZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJwD,mPAIxD,EAAA,CAAA,cAEUhD,EAAA,OAAZ8C,EAAA,EAAAN,EAMO,OANPsC,GAMO,KALF9E,EAAA,MAAO,QAAO,UAAA,UAAA,EAA4B,YAC7C,CAAA,EAAAyC,EAAyB,IAAA,KAAAE,EAAnB3C,EAAA,MAAO,KAAK,EAAA,CAAA,EAClBkD,EAEaC,EAAA,CAFA,GAAE,gBAAkB,mBAAmBnD,EAAA,MAAO,EAAE,CAAA,GAAK,MAAA,CAAA,cAAA,KAAA,CAAA,aAAyB,IAE3F,CAAA,GAAAgD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAF2F,WAE3F,EAAA,CAAA,mCAcO+B,GAAA5D,EAAAnB,EAAA,QAAA,YAAAmB,EAAQ,kBAAR,MAAA4D,EAAyB,QAApCjC,IAAAN,EAUM,MAVNwC,GAUM,CATJvC,EAAyE,SAAtE,iDAA8CE,EAAG3C,QAAO,KAAK,EAAG,KAAE,CAAA,EACrEyC,EAOI,IAAA,KAAA,EANFK,EAAA,EAAA,EAAAN,EAGCS,SAH0BjD,EAAA,MAAO,gBAAe,CAA/BiF,EAAGC,kBAAoCD,GAAC,CACxD/B,EACCC,EAAA,CADY,GAAE,gBAAkB,mBAAmB8B,CAAC,CAAA,EAAA,aAAK,IAAO,KAAJA,CAAC,EAAA,CAAA,CAAA,qBACjDC,EAAIlF,EAAA,MAAO,gBAAgB,OAAM,GAA7C8C,EAAA,EAAAN,EAA4D,UAAT,IAAE,yCACvD,yDAAsD,EAAA,GAAAQ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAiB,YAAX,OAAI,EAAA,mBAAO,+CACjD,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAmB,YAAb,SAAM,EAAA,mBAAO,qFACd,EAAA,GAAAO,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAkB,YAAZ,QAAK,EAAA,mBAAO,oBAChD,EAAA,EAAA,gBAQS0C,GAAAC,EAAApF,EAAA,QAAA,YAAAoF,EAAQ,aAAR,MAAAD,EAAoB,QAA/BrC,IAAAN,EASM,MATN6C,GASM,CARJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAP,EAAuD,SAApD,mDAAgD,EAAA,iBACnDA,EAGI,IAAA,KAAA,GAHD,oDACgD,EAAAA,EAAgC,YAA1B,qBAAmB,IAAO,qGAEnF,CAAA,OACAA,EAEK,KAAA,KAAA,EADHK,EAAA,EAAA,EAAAN,EAAwDS,EAAA,KAAAqC,EAAxCtF,EAAA,MAAO,WAAZuF,IAAXzC,EAAA,EAAAN,EAAwD,KAAA,CAApB,IAAK+C,CAAA,IAAMA,CAAC,EAAA,CAAA,wBAInCxF,EAAA,WAAjByF,GAAqFC,GAAA,OAA5D,KAAM1F,EAAA,MAAO,MAAM,sCAAA"}