@samyx/preview-stacks-ui 0.34.0 → 0.36.0

package/dist/assets/{SsoView-2q_nGP-Q.js → SsoView-B_GrAR_X.js}

@@ -1,2 +1,2 @@
-import{d as ce,p as E,c as d,a as s,f as a,e as h,w as R,_ as Q,g as f,z as G,F as b,t as r,i as u,L as me,v as p,r as D,a3 as ve,j as y,k as w,C as M,U as z,o as i,u as he,M as I,D as fe,a6 as ye}from"./index-IvJmpI3b.js";import{_ as X}from"./ActionButton.vue_vue_type_script_setup_true_lang-DBfqkgMV.js";import{_ as Z}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DrinGQ_J.js";import{_ as ge}from"./HelpModal.vue_vue_type_script_setup_true_lang-Cj0ZWsrz.js";import{_ as ke}from"./RelativeTime.vue_vue_type_script_setup_true_lang-surhYF0H.js";import{_ as be}from"./SelectMenu.vue_vue_type_script_setup_true_lang-C7bhFOYU.js";import{_ as we}from"./SkeletonList.vue_vue_type_script_setup_true_lang-CUZB1sxf.js";import{_ as N}from"./SsoMark.vue_vue_type_script_setup_true_lang-EdIcAiak.js";import{_ as Ue}from"./_plugin-vue_export-helper-DlAUqK2U.js";import"./DialogTrigger-K-5IAbpM.js";import"./Teleport-bdITH--T.js";const Ce={class:"page-head"},xe={class:"sub"},_e={class:"panel"},$e={class:"phead"},Re={class:"section"},Ie={class:"mute"},Ae={class:"check"},Se={key:0,class:"banner plain"},Ve=["href"],Le={class:"field"},Oe={class:"row sso-copy"},Ee={class:"sso-url"},De={key:1,class:"field"},ze={class:"field"},Te=["placeholder"],je={class:"hint"},qe=["for"],Ge=["id","onUpdate:modelValue"],Me={class:"field"},Ne=["data-incomplete"],Ke={class:"hint"},He={key:1,class:"field"},Be={class:"field"},Pe={class:"field"},We={class:"hint"},Fe={class:"field"},Ye=["placeholder"],Je=["open"],Qe={class:"field"},Xe={class:"field"},Ze={class:"field"},es={class:"field"},ss={class:"field"},ts={class:"section",style:{"margin-top":"var(--s4)"}},os={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},ls=["for"],ns=["id","onUpdate:modelValue"],as={class:"panel"},is={class:"field"},rs={class:"field"},ds={key:0,class:"field"},us={key:1,class:"hint"},ps={class:"field"},cs={class:"hint"},ms={class:"row",style:{gap:"var(--s3)"}},vs={key:3,class:"panel"},hs={class:"phead"},fs={class:"section"},ys={class:"sso-tiles"},gs=["onClick"],ks={class:"sso-tile-mode"},bs={class:"panel"},ws={class:"sso-cards stagger"},Us={class:"sso-card-main"},Cs={class:"sso-card-head"},xs={class:"mute"},_s={key:0,class:"badge off"},$s={class:"sso-card-sub"},Rs={class:"row-actions"},Is=["onClick"],As={class:"panel"},Ss={class:"row sso-copy"},Vs={class:"sso-url"},K="inherit",Ls=ce({__name:"SsoView",setup(Os){const T={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},H=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",groupsUrl:"",scopes:"",claimMap:{...T},allowedEmailDomains:[],allowedUsernames:[],requiredGroups:[],defaultRole:""}),ee={viewer:"reads everything",developer:"deploys and tears down",maintainer:"host configuration",admin:"accounts and sign-on"},U=y("");E.get("/api/settings").then(t=>{var e;t.ok&&(U.value=String(((e=t.body.settings.find(n=>n.key==="default_role"))==null?void 0:e.value)??""))});const se=w(()=>[{value:K,label:"The host default",hint:U.value?`${I(U.value)} today — follows Settings`:"set in Settings"},...ye.map(t=>({value:t,label:I(t),hint:ee[t]}))]),C=y([]),A=y([]),S=y(""),V=y(!1),g=y(""),o=y(null),B=w({get:()=>{var t;return((t=o.value)==null?void 0:t.form.defaultRole)||K},set:t=>{o.value&&(o.value.form.defaultRole=t===K?"":t)}}),_=y(!1),L=y(!1),x=y("");async function j(){const t=await E.get("/api/sso/config");if(V.value=!0,!t.ok){g.value=M(t,"read the sign-on settings");return}g.value="",C.value=t.body.providers??[],A.value=t.body.presets??[],S.value=t.body.callbackUrl}j();const P=w(()=>!o.value&&(_.value||V.value&&!g.value&&C.value.length===0)),te=w(()=>[...A.value.map(t=>({preset:t,id:t.key,label:t.label,mode:t.mode})),{preset:null,id:"custom-oauth2",label:"Custom OAuth 2.0",mode:"oauth2"},{preset:null,id:"custom-oidc",label:"Custom OpenID Connect",mode:"oidc"}]);function oe(t){const e=new Set(C.value.map(n=>n.key));if(!e.has(t))return t;for(let n=2;;n++)if(!e.has(`${t}-${n}`))return`${t}-${n}`}function le(t){const e=t.preset,n=H();n.mode=t.mode,n.provider=e?e.key:t.mode==="oauth2"?"custom":"",e&&(n.label=e.label,n.scopes=e.scopes,n.claimMap={...T,...e.claimMap},e.mode==="oauth2"?(n.authorizeUrl=e.authorizeUrl,n.tokenUrl=e.tokenUrl,n.userInfoUrl=e.userInfoUrl):e.discoveryUrl.includes("<")||(n.discoveryUrl=e.discoveryUrl)),o.value={originalKey:null,key:oe(e?e.key:t.mode==="oauth2"?"custom":"oidc"),preset:e,form:n,secret:"",secretSet:!1,domains:"",usernames:"",groups:"",placeholders:{}},x.value="",_.value=!1}function ne(t){o.value={originalKey:t.key,key:t.key,preset:A.value.find(e=>e.key===t.config.provider)??null,form:{...H(),...t.config,claimMap:{...T,...t.config.claimMap}},secret:"",secretSet:t.secretSet,domains:(t.config.allowedEmailDomains??[]).join(", "),usernames:(t.config.allowedUsernames??[]).join(", "),groups:(t.config.requiredGroups??[]).join(", "),placeholders:{}},x.value="",_.value=!1}const $=w(()=>{const t=o.value;if(!t||t.originalKey!==null||!t.preset||t.form.mode!=="oidc")return null;const e=t.preset.discoveryUrl;if(!e.includes("<"))return null;const n=[],c=/<([^>]+)>/g;let m=0;for(let v=c.exec(e);v;v=c.exec(e))v.index>m&&n.push(e.slice(m,v.index)),n.push({ph:v[1]??""}),m=v.index+v[0].length;return m<e.length&&n.push(e.slice(m)),n}),W=w(()=>($.value??[]).flatMap(t=>typeof t=="string"?[]:[t.ph])),O=w(()=>{const t=$.value,e=o.value;return!t||!e?"":t.map(n=>{var c;return typeof n=="string"?n:((c=e.placeholders[n.ph])==null?void 0:c.trim())||`<${n.ph}>`}).join("")}),ae=/^[a-z0-9][a-z0-9-]{0,31}$/,F=w(()=>{const t=o.value;if(!t)return"nothing is being edited";const e=t.key.trim();if(!ae.test(e))return"the key must be a lowercase slug of letters, digits and dashes (32 at most)";if(t.originalKey===null&&C.value.some(n=>n.key===e))return`a provider is already stored under "${e}" — edit that one instead, or pick another key`;if(!t.form.clientId.trim())return"the client id is required";if(!t.secretSet&&!t.secret.trim())return"the client secret is required";if(t.form.mode==="oidc"){const n=$.value?O.value:t.form.discoveryUrl.trim();if(!n)return"the issuer is required";if(n.includes("<"))return"fill in the issuer placeholder first"}else if(!t.form.authorizeUrl.trim()||!t.form.tokenUrl.trim())return"the authorize and token URLs are required";return""}),q=t=>t.split(",").map(e=>e.trim()).filter(Boolean);async function ie(){const t=o.value;if(!t)return;L.value=!0;const e={...t.form,key:t.key.trim(),clientSecret:t.secret.trim(),discoveryUrl:$.value?O.value:t.form.discoveryUrl,allowedEmailDomains:q(t.domains),allowedUsernames:q(t.usernames),requiredGroups:t.form.mode==="oidc"?[]:q(t.groups)},n=await E.put("/api/sso/config",e);if(L.value=!1,!n.ok){x.value=M(n,"save the provider");return}x.value="",z("ok",t.form.mode==="oidc"?"Saved — the issuer answered, so the settings are known good.":"Saved."),o.value=null,j()}async function re(t){const e=await E.del(`/api/sso/config/${t.key}`);if(!e.ok){g.value=M(e,"remove the provider");return}z("ok",`Removed ${t.key}. Existing accounts keep working.`),j()}async function Y(){try{await navigator.clipboard.writeText(S.value),z("ok","Copied.")}catch{z("error","Could not reach the clipboard — select the text and copy it.")}}function de(t){if(t.mode==="oidc")try{return`OpenID Connect · ${new URL(t.discoveryUrl).hostname}`}catch{return"OpenID Connect"}const e=A.value.find(n=>n.key===t.provider);return e?`OAuth 2.0 · ${e.label}`:"OAuth 2.0 · custom endpoints"}function ue(t){return t.defaultRole?`new accounts: ${I(t.defaultRole)}`:`new accounts: the host default${U.value?` (${I(U.value)})`:""}`}function pe(t){var n,c,m;const e=[];return(n=t.allowedEmailDomains)!=null&&n.length&&e.push(`domains ${t.allowedEmailDomains.join(", ")}`),(c=t.allowedUsernames)!=null&&c.length&&e.push(`usernames ${t.allowedUsernames.join(", ")}`),(m=t.requiredGroups)!=null&&m.length&&e.push(`groups ${t.requiredGroups.join(", ")}`),e.length?`lets in ${e.join("; ")}`:"lets in anyone the provider allows"}return(t,e)=>{var n,c,m,v;return i(),d("div",null,[s("div",Ce,[s("div",null,[s("h1",null,[e[20]||(e[20]=a(" Single sign-on ",-1)),h(ge,{title:"How single sign-on works here"},{default:R(()=>[...e[19]||(e[19]=[s("p",null,[s("b",null,"This service is the relying party and nothing more."),a(" You register an OAuth or OIDC application in your own organisation and paste its client id and secret here. Your directory stays yours — no accounts are copied, and nothing is synchronised. ")],-1),s("p",null,[s("b",null,"Anyone who authenticates gets an account"),a(", created on their first sign-in. That is deliberate: your provider already decides who may authenticate (Workspace restricts to internal users, a GitHub app can be org-approved), and duplicating that policy here would just be a second list to keep in step. Narrow it with the sign-in rules on each provider if you need to. ")],-1),s("p",null,[s("b",null,"Identity is the provider's subject, not the email."),a(" Someone changing their address keeps their account, their history and their tokens. An address is only used to adopt an account that already exists here, and only when the provider says it is verified. ")],-1),s("p",null,[s("b",null,"Several providers share the accounts."),a(" Each shows up as its own button on the login page, and the same person arriving from the same directory is the same account — nothing about local accounts or personal tokens changes either way. ")],-1)])]),_:1})]),s("div",xe,[e[22]||(e[22]=a(" Let people sign in with the identity providers you already run ",-1)),h(Q,{label:"what is stored"},{default:R(()=>[...e[21]||(e[21]=[a(" One row per provider: the endpoints, the client id, and the client secret. The secret has no read path — this page only learns whether one is stored, and leaving the field empty keeps it. ",-1)])]),_:1})])]),e[23]||(e[23]=s("span",{class:"grow"},null,-1)),V.value&&!g.value&&!o.value&&!P.value?(i(),d("button",{key:0,class:"primary",onClick:e[0]||(e[0]=l=>_.value=!0)},"Add provider")):f("",!0)]),g.value?(i(),G(Z,{key:0,text:g.value,title:"Single sign-on."},null,8,["text"])):f("",!0),V.value?o.value?(i(),d(b,{key:2},[s("section",_e,[s("div",$e,[h(N,{preset:o.value.form.provider,size:20},null,8,["preset"]),s("h2",Re,r(o.value.originalKey?`Edit ${o.value.originalKey}`:`Add ${((n=o.value.preset)==null?void 0:n.label)??(o.value.form.mode==="oidc"?"an OpenID Connect issuer":"a custom OAuth 2.0 provider")}`),1),s("span",Ie,r(o.value.form.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1),e[25]||(e[25]=s("span",{class:"grow"},null,-1)),s("label",Ae,[u(s("input",{"onUpdate:modelValue":e[1]||(e[1]=l=>o.value.form.enabled=l),type:"checkbox"},null,512),[[me,o.value.form.enabled]]),e[24]||(e[24]=a(" Enabled",-1))])]),o.value.preset?(i(),d("div",Se,[s("b",null,"Register the app with "+r(o.value.preset.label),1),s("p",null,r(o.value.preset.setupHint),1),s("p",null,[s("a",{href:o.value.preset.setupUrl,target:"_blank",rel:"noopener"}," Create the app in "+r(o.value.preset.label)+" → ",9,Ve)])])):f("",!0),s("div",Le,[e[26]||(e[26]=s("label",null,"Redirect URI",-1)),s("div",Oe,[s("code",Ee,r(S.value),1),s("button",{type:"button",onClick:Y},"Copy")]),e[27]||(e[27]=s("p",{class:"hint"}," Paste this into the provider's application as the redirect / callback URL. It has to match byte for byte, and it is the same for every provider on this host — a mismatch is the single most common reason the exchange fails, and the provider's error rarely says so. ",-1))]),o.value.originalKey?f("",!0):(i(),d("div",De,[e[28]||(e[28]=s("label",{for:"sso-key"},"Key",-1)),u(s("input",{id:"sso-key","onUpdate:modelValue":e[2]||(e[2]=l=>o.value.key=l),type:"text",spellcheck:"false",class:"sso-key"},null,512),[[p,o.value.key]]),e[29]||(e[29]=s("p",{class:"hint"}," This host's name for the provider — it appears in the sign-in URL and in exports, never to the person signing in. Lowercase letters, digits and dashes. ",-1))])),s("div",ze,[e[30]||(e[30]=s("label",{for:"sso-label"},"Button text",-1)),u(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=l=>o.value.form.label=l),type:"text",placeholder:((c=o.value.preset)==null?void 0:c.label)||"Acme SSO"},null,8,Te),[[p,o.value.form.label]]),s("p",je,"The login page draws it as “Continue with "+r(o.value.form.label||((m=o.value.preset)==null?void 0:m.label)||"…")+"”.",1)]),o.value.form.mode==="oidc"?(i(),d(b,{key:2},[$.value?(i(),d(b,{key:0},[(i(!0),d(b,null,D(W.value,l=>(i(),d("div",{key:l,class:"field"},[s("label",{for:`ph-${l}`},r(he(I)(l)),9,qe),u(s("input",{id:`ph-${l}`,"onUpdate:modelValue":k=>o.value.placeholders[l]=k,type:"text",spellcheck:"false",class:"sso-key"},null,8,Ge),[[p,o.value.placeholders[l]]])]))),128)),s("div",Me,[e[31]||(e[31]=s("label",null,"Issuer",-1)),s("code",{class:"sso-url","data-incomplete":O.value.includes("<")||void 0},r(O.value),9,Ne),s("p",Ke," Assembled from the value"+r(W.value.length>1?"s":"")+" above — "+r((v=o.value.preset)==null?void 0:v.label)+" gives every account its own issuer, so there is no single URL a preset could carry. It is fetched when you save, so a typo is refused here rather than at someone's first login. ",1)])],64)):(i(),d("div",He,[e[32]||(e[32]=s("label",{for:"sso-issuer"},"Issuer",-1)),u(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=l=>o.value.form.discoveryUrl=l),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[p,o.value.form.discoveryUrl]]),e[33]||(e[33]=s("p",{class:"hint"},[a(" Or the full "),s("code",null,"…/.well-known/openid-configuration"),a(" URL. Everything but the client id and secret is discovered from it, and it is fetched when you save — so a typo is refused here rather than at someone's first login. ")],-1))]))],64)):f("",!0),s("div",Be,[e[34]||(e[34]=s("label",{for:"sso-client"},"Client id",-1)),u(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=l=>o.value.form.clientId=l),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[p,o.value.form.clientId]])]),s("div",Pe,[e[35]||(e[35]=s("label",{for:"sso-secret"},"Client secret",-1)),u(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=l=>o.value.secret=l),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[p,o.value.secret]]),s("p",We," Write-only. "+r(o.value.secretSet?"A secret is stored — leave this empty to keep it.":"Stored on save and never returned by any route."),1)]),s("div",Fe,[e[36]||(e[36]=s("label",{for:"sso-scopes"},"Scopes",-1)),u(s("input",{id:"sso-scopes","onUpdate:modelValue":e[7]||(e[7]=l=>o.value.form.scopes=l),type:"text",spellcheck:"false",placeholder:o.value.form.mode==="oidc"?"openid profile email":""},null,8,Ye),[[p,o.value.form.scopes]])]),o.value.form.mode==="oauth2"?(i(),d("details",{key:3,class:"sso-adv",open:!o.value.preset},[e[47]||(e[47]=s("summary",null,"Endpoints and claim mapping",-1)),s("div",Qe,[e[37]||(e[37]=s("label",{for:"sso-auth"},"Authorize URL",-1)),u(s("input",{id:"sso-auth","onUpdate:modelValue":e[8]||(e[8]=l=>o.value.form.authorizeUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.authorizeUrl]])]),s("div",Xe,[e[38]||(e[38]=s("label",{for:"sso-token"},"Token URL",-1)),u(s("input",{id:"sso-token","onUpdate:modelValue":e[9]||(e[9]=l=>o.value.form.tokenUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.tokenUrl]])]),s("div",Ze,[e[39]||(e[39]=s("label",{for:"sso-userinfo"},"User info URL",-1)),u(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[10]||(e[10]=l=>o.value.form.userInfoUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.userInfoUrl]]),e[40]||(e[40]=s("p",{class:"hint"},"Leave empty to take the identity from the token response alone — a subject and nothing else.",-1))]),s("div",es,[e[41]||(e[41]=s("label",{for:"sso-emails"},[a("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),u(s("input",{id:"sso-emails","onUpdate:modelValue":e[11]||(e[11]=l=>o.value.form.emailsUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.emailsUrl]]),e[42]||(e[42]=s("p",{class:"hint"}," Only consulted when the profile carries no address — which is GitHub's default. Filled in automatically for a preset, and needed only if you pointed the user info URL at your own host. ",-1))]),s("div",ss,[e[43]||(e[43]=s("label",{for:"sso-groups-url"},[a("Groups URL "),s("span",{class:"mute"},"(optional)")],-1)),u(s("input",{id:"sso-groups-url","onUpdate:modelValue":e[12]||(e[12]=l=>o.value.form.groupsUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.groupsUrl]]),e[44]||(e[44]=s("p",{class:"hint"}," Where this host asks which groups someone is in. Only consulted when there is a group rule below. Filled in automatically for a preset — but only while the user info URL is still the preset's, because a self-hosted host's token must not be sent to the public one, so a self-hosted provider needs this typed. ",-1))]),s("h3",ts,[e[46]||(e[46]=a(" Claim mapping ",-1)),h(Q,{label:"what this is"},{default:R(()=>[...e[45]||(e[45]=[a(" Which key of the provider's user response holds each field. Flat lookups, not expressions. A preset fills these in; you only touch them for a provider nobody has written a preset for. ",-1)])]),_:1})]),s("div",os,[(i(),d(b,null,D(["subject","username","email","name","avatar"],l=>s("div",{key:l,class:"field inline"},[s("label",{for:`cm-${l}`},r(l),9,ls),u(s("input",{id:`cm-${l}`,"onUpdate:modelValue":k=>o.value.form.claimMap[l]=k,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,ns),[[p,o.value.form.claimMap[l]]])])),64))])],8,Je)):f("",!0)]),s("section",as,[e[57]||(e[57]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets an account, and as what")],-1)),e[58]||(e[58]=s("p",{class:"dim"},[a(" By default, anyone this provider lets authenticate. It already owns that decision; this is only here for the case where the application you registered is broader than the people who should reach this control plane. "),s("b",null,"Any one entry in a list is enough to satisfy that list, and every list you fill in has to be satisfied"),a(" — fill all three in and a login needs a listed domain, a matching username, and one of the groups. A list left empty is not a rule at all: it lets everyone past that check, it does not lock everyone out. ")],-1)),s("div",is,[e[48]||(e[48]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),u(s("input",{id:"sso-domains","onUpdate:modelValue":e[13]||(e[13]=l=>o.value.domains=l),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[p,o.value.domains]]),e[49]||(e[49]=s("p",{class:"hint"},[a(" Comma-separated; subdomains count. Empty means no restriction. "),s("b",null,"Non-empty means a login with no email address at all is refused too"),a(" — a provider that hides the address (a private GitHub profile with no "),s("code",null,"user:email"),a(" scope) cannot be checked, so it is not waved through. ")],-1))]),s("div",rs,[e[50]||(e[50]=s("label",{for:"sso-usernames"},"Allowed usernames",-1)),u(s("input",{id:"sso-usernames","onUpdate:modelValue":e[14]||(e[14]=l=>o.value.usernames=l),type:"text",spellcheck:"false",placeholder:"octocat, qa-[0-9]*"},null,512),[[p,o.value.usernames]]),e[51]||(e[51]=ve('<p class="hint" data-v-afee1731> Comma-separated patterns, case-insensitive: <code data-v-afee1731>*</code>, <code data-v-afee1731>?</code> and <code data-v-afee1731>[0-9]</code> classes. Empty means no restriction. <b data-v-afee1731>Non-empty means a login whose provider sends no username is refused too</b> — so this is a rule for a provider that actually has usernames (GitHub&#39;s <code data-v-afee1731>login</code>, GitLab&#39;s <code data-v-afee1731>username</code>). On an OpenID Connect issuer that sends no <code data-v-afee1731>preferred_username</code> it refuses everyone rather than nobody, so set it only where you know the provider sends one. </p>',1))]),o.value.form.mode==="oauth2"?(i(),d("div",ds,[e[52]||(e[52]=s("label",{for:"sso-groups"},"Required groups",-1)),u(s("input",{id:"sso-groups","onUpdate:modelValue":e[15]||(e[15]=l=>o.value.groups=l),type:"text",spellcheck:"false",placeholder:"acme, acme/backend"},null,512),[[p,o.value.groups]]),e[53]||(e[53]=s("p",{class:"hint"},[a(" Comma-separated, and "),s("b",null,"exact names, not patterns"),a(" — an organisation login, or a group path like "),s("code",null,"acme/backend"),a(". Case-insensitive. Empty means no restriction. Non-empty makes every sign-in ask the provider for that person's groups, so it needs the OAuth scope that endpoint requires: "),s("b",null,"add it to Scopes above, or the save is refused"),a(" — and the refusal names the scope. It also needs a provider whose group list this host knows how to read, which the save checks by name. If that call does not answer, the sign-in is refused rather than allowed. ")],-1))])):(i(),d("p",us," A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth 2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none here. ")),s("div",ps,[e[56]||(e[56]=s("label",{for:"sso-role"},"Role for the accounts it creates",-1)),h(be,{id:"sso-role",modelValue:B.value,"onUpdate:modelValue":e[16]||(e[16]=l=>B.value=l),label:"Role for the accounts this provider creates",options:se.value},null,8,["modelValue","options"]),s("p",cs,[e[54]||(e[54]=a(" Applied when an account is created here — on someone's first sign-in — and never after: promoting or demoting a person later is done in Accounts, and this does not reach back and change them. ",-1)),e[55]||(e[55]=s("b",null,"The host default follows Settings",-1)),a(" rather than being copied in now, so raising or lowering it there moves this provider with it. "+r(U.value?`It is ${U.value} today.`:"")+" Picking a role here pins this provider to it instead. ",1)])])]),x.value?(i(),G(Z,{key:0,text:x.value,title:"Not saved."},null,8,["text"])):f("",!0),s("div",ms,[h(X,{variant:"primary",pending:L.value,disabled:L.value||!!F.value,title:F.value||void 0,onClick:ie},{default:R(()=>[a(r(o.value.originalKey?"Save changes":"Add provider"),1)]),_:1},8,["pending","disabled","title"]),s("button",{class:"ghost",onClick:e[17]||(e[17]=l=>o.value=null)},"Cancel")])],64)):P.value?(i(),d("section",vs,[s("div",hs,[s("h2",fs,r(C.value.length?"Add a provider":"Pick a provider"),1),e[59]||(e[59]=s("span",{class:"grow"},null,-1)),C.value.length?(i(),d("button",{key:0,class:"ghost",onClick:e[18]||(e[18]=l=>_.value=!1)},"Cancel")):f("",!0)]),e[60]||(e[60]=s("p",{class:"dim"}," Pick where your team already signs in. A preset knows the provider's endpoints and its quirks — the only things it cannot know are the client id and secret you get when you register the app, and the form that opens says exactly where to do that. ",-1)),s("div",ys,[(i(!0),d(b,null,D(te.value,l=>{var k;return i(),d("button",{key:l.id,class:"sso-tile",onClick:J=>le(l)},[h(N,{preset:((k=l.preset)==null?void 0:k.key)??"custom",size:22},null,8,["preset"]),s("span",null,r(l.label),1),s("span",ks,r(l.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1)],8,gs)}),128))])])):g.value?f("",!0):(i(),d(b,{key:4},[s("section",bs,[e[62]||(e[62]=s("div",{class:"phead"},[s("h2",{class:"section"},"Providers")],-1)),s("div",ws,[(i(!0),d(b,null,D(C.value,(l,k)=>(i(),d("div",{key:l.key,class:"sso-card",style:fe({"--i":k})},[h(N,{preset:l.config.provider,size:22},null,8,["preset"]),s("div",Us,[s("div",Cs,[s("b",null,r(l.config.label),1),s("code",xs,r(l.key),1),l.config.enabled?f("",!0):(i(),d("span",_s,"disabled"))]),s("div",$s,[a(r(de(l.config))+" · "+r(pe(l.config))+" · "+r(ue(l.config))+" · updated ",1),h(ke,{at:l.updatedAt},null,8,["at"])])]),s("div",Rs,[s("button",{class:"ghost sm",onClick:J=>ne(l)},"Edit",8,Is),h(X,{variant:"ghost",class:"sm sso-remove",confirm:`Remove ${l.key}?`,onRun:J=>re(l)},{default:R(()=>[...e[61]||(e[61]=[a(" Remove ",-1)])]),_:1},8,["confirm","onRun"])])],4))),128))]),e[63]||(e[63]=s("p",{class:"mute",style:{"font-size":"var(--t-sm)","margin-top":"var(--s3)"}}," Removing a provider does not delete anyone. Those accounts keep their personal tokens, and pointing the same provider back at this host re-links them by subject. ",-1))]),s("section",As,[e[64]||(e[64]=s("div",{class:"phead"},[s("h2",{class:"section"},"Callback URL")],-1)),e[65]||(e[65]=s("p",{class:"dim"}," The redirect URI to register with every provider — one URL for all of them, built by the server so it cannot drift from the one the sign-in flow actually sends. ",-1)),s("div",Ss,[s("code",Vs,r(S.value),1),s("button",{type:"button",onClick:Y},"Copy")])])],64)):(i(),G(we,{key:1,rows:4}))])}}}),Bs=Ue(Ls,[["__scopeId","data-v-afee1731"]]);export{Bs as default};
-//# sourceMappingURL=SsoView-2q_nGP-Q.js.map
+import{d as ce,p as E,c as d,a as s,f as a,e as h,w as R,_ as Q,g as f,z as G,F as b,t as r,i as u,L as me,v as p,r as D,a5 as ve,j as y,k as w,C as M,U as z,o as i,u as he,M as I,D as fe,a8 as ye}from"./index-BzdU0RNE.js";import{_ as X}from"./ActionButton.vue_vue_type_script_setup_true_lang-CB94t3xm.js";import{_ as Z}from"./ErrorNote.vue_vue_type_script_setup_true_lang-Imao12aK.js";import{_ as ge}from"./HelpModal.vue_vue_type_script_setup_true_lang-CjoiZrMf.js";import{_ as ke}from"./RelativeTime.vue_vue_type_script_setup_true_lang-ze6IGxQV.js";import{_ as be}from"./SelectMenu.vue_vue_type_script_setup_true_lang-JY8m6tfk.js";import{_ as we}from"./SkeletonList.vue_vue_type_script_setup_true_lang-DMvuIcZF.js";import{_ as N}from"./SsoMark.vue_vue_type_script_setup_true_lang-BXhQGdjJ.js";import{_ as Ue}from"./_plugin-vue_export-helper-DlAUqK2U.js";import"./DialogTrigger-BlkbgxBa.js";import"./Teleport-DwPgOPS3.js";const Ce={class:"page-head"},xe={class:"sub"},_e={class:"panel"},$e={class:"phead"},Re={class:"section"},Ie={class:"mute"},Ae={class:"check"},Se={key:0,class:"banner plain"},Ve=["href"],Le={class:"field"},Oe={class:"row sso-copy"},Ee={class:"sso-url"},De={key:1,class:"field"},ze={class:"field"},Te=["placeholder"],je={class:"hint"},qe=["for"],Ge=["id","onUpdate:modelValue"],Me={class:"field"},Ne=["data-incomplete"],Ke={class:"hint"},He={key:1,class:"field"},Be={class:"field"},Pe={class:"field"},We={class:"hint"},Fe={class:"field"},Ye=["placeholder"],Je=["open"],Qe={class:"field"},Xe={class:"field"},Ze={class:"field"},es={class:"field"},ss={class:"field"},ts={class:"section",style:{"margin-top":"var(--s4)"}},os={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},ls=["for"],ns=["id","onUpdate:modelValue"],as={class:"panel"},is={class:"field"},rs={class:"field"},ds={key:0,class:"field"},us={key:1,class:"hint"},ps={class:"field"},cs={class:"hint"},ms={class:"row",style:{gap:"var(--s3)"}},vs={key:3,class:"panel"},hs={class:"phead"},fs={class:"section"},ys={class:"sso-tiles"},gs=["onClick"],ks={class:"sso-tile-mode"},bs={class:"panel"},ws={class:"sso-cards stagger"},Us={class:"sso-card-main"},Cs={class:"sso-card-head"},xs={class:"mute"},_s={key:0,class:"badge off"},$s={class:"sso-card-sub"},Rs={class:"row-actions"},Is=["onClick"],As={class:"panel"},Ss={class:"row sso-copy"},Vs={class:"sso-url"},K="inherit",Ls=ce({__name:"SsoView",setup(Os){const T={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},H=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",groupsUrl:"",scopes:"",claimMap:{...T},allowedEmailDomains:[],allowedUsernames:[],requiredGroups:[],defaultRole:""}),ee={viewer:"reads everything",developer:"deploys and tears down",maintainer:"host configuration",admin:"accounts and sign-on"},U=y("");E.get("/api/settings").then(t=>{var e;t.ok&&(U.value=String(((e=t.body.settings.find(n=>n.key==="default_role"))==null?void 0:e.value)??""))});const se=w(()=>[{value:K,label:"The host default",hint:U.value?`${I(U.value)} today — follows Settings`:"set in Settings"},...ye.map(t=>({value:t,label:I(t),hint:ee[t]}))]),C=y([]),A=y([]),S=y(""),V=y(!1),g=y(""),o=y(null),B=w({get:()=>{var t;return((t=o.value)==null?void 0:t.form.defaultRole)||K},set:t=>{o.value&&(o.value.form.defaultRole=t===K?"":t)}}),_=y(!1),L=y(!1),x=y("");async function j(){const t=await E.get("/api/sso/config");if(V.value=!0,!t.ok){g.value=M(t,"read the sign-on settings");return}g.value="",C.value=t.body.providers??[],A.value=t.body.presets??[],S.value=t.body.callbackUrl}j();const P=w(()=>!o.value&&(_.value||V.value&&!g.value&&C.value.length===0)),te=w(()=>[...A.value.map(t=>({preset:t,id:t.key,label:t.label,mode:t.mode})),{preset:null,id:"custom-oauth2",label:"Custom OAuth 2.0",mode:"oauth2"},{preset:null,id:"custom-oidc",label:"Custom OpenID Connect",mode:"oidc"}]);function oe(t){const e=new Set(C.value.map(n=>n.key));if(!e.has(t))return t;for(let n=2;;n++)if(!e.has(`${t}-${n}`))return`${t}-${n}`}function le(t){const e=t.preset,n=H();n.mode=t.mode,n.provider=e?e.key:t.mode==="oauth2"?"custom":"",e&&(n.label=e.label,n.scopes=e.scopes,n.claimMap={...T,...e.claimMap},e.mode==="oauth2"?(n.authorizeUrl=e.authorizeUrl,n.tokenUrl=e.tokenUrl,n.userInfoUrl=e.userInfoUrl):e.discoveryUrl.includes("<")||(n.discoveryUrl=e.discoveryUrl)),o.value={originalKey:null,key:oe(e?e.key:t.mode==="oauth2"?"custom":"oidc"),preset:e,form:n,secret:"",secretSet:!1,domains:"",usernames:"",groups:"",placeholders:{}},x.value="",_.value=!1}function ne(t){o.value={originalKey:t.key,key:t.key,preset:A.value.find(e=>e.key===t.config.provider)??null,form:{...H(),...t.config,claimMap:{...T,...t.config.claimMap}},secret:"",secretSet:t.secretSet,domains:(t.config.allowedEmailDomains??[]).join(", "),usernames:(t.config.allowedUsernames??[]).join(", "),groups:(t.config.requiredGroups??[]).join(", "),placeholders:{}},x.value="",_.value=!1}const $=w(()=>{const t=o.value;if(!t||t.originalKey!==null||!t.preset||t.form.mode!=="oidc")return null;const e=t.preset.discoveryUrl;if(!e.includes("<"))return null;const n=[],c=/<([^>]+)>/g;let m=0;for(let v=c.exec(e);v;v=c.exec(e))v.index>m&&n.push(e.slice(m,v.index)),n.push({ph:v[1]??""}),m=v.index+v[0].length;return m<e.length&&n.push(e.slice(m)),n}),W=w(()=>($.value??[]).flatMap(t=>typeof t=="string"?[]:[t.ph])),O=w(()=>{const t=$.value,e=o.value;return!t||!e?"":t.map(n=>{var c;return typeof n=="string"?n:((c=e.placeholders[n.ph])==null?void 0:c.trim())||`<${n.ph}>`}).join("")}),ae=/^[a-z0-9][a-z0-9-]{0,31}$/,F=w(()=>{const t=o.value;if(!t)return"nothing is being edited";const e=t.key.trim();if(!ae.test(e))return"the key must be a lowercase slug of letters, digits and dashes (32 at most)";if(t.originalKey===null&&C.value.some(n=>n.key===e))return`a provider is already stored under "${e}" — edit that one instead, or pick another key`;if(!t.form.clientId.trim())return"the client id is required";if(!t.secretSet&&!t.secret.trim())return"the client secret is required";if(t.form.mode==="oidc"){const n=$.value?O.value:t.form.discoveryUrl.trim();if(!n)return"the issuer is required";if(n.includes("<"))return"fill in the issuer placeholder first"}else if(!t.form.authorizeUrl.trim()||!t.form.tokenUrl.trim())return"the authorize and token URLs are required";return""}),q=t=>t.split(",").map(e=>e.trim()).filter(Boolean);async function ie(){const t=o.value;if(!t)return;L.value=!0;const e={...t.form,key:t.key.trim(),clientSecret:t.secret.trim(),discoveryUrl:$.value?O.value:t.form.discoveryUrl,allowedEmailDomains:q(t.domains),allowedUsernames:q(t.usernames),requiredGroups:t.form.mode==="oidc"?[]:q(t.groups)},n=await E.put("/api/sso/config",e);if(L.value=!1,!n.ok){x.value=M(n,"save the provider");return}x.value="",z("ok",t.form.mode==="oidc"?"Saved — the issuer answered, so the settings are known good.":"Saved."),o.value=null,j()}async function re(t){const e=await E.del(`/api/sso/config/${t.key}`);if(!e.ok){g.value=M(e,"remove the provider");return}z("ok",`Removed ${t.key}. Existing accounts keep working.`),j()}async function Y(){try{await navigator.clipboard.writeText(S.value),z("ok","Copied.")}catch{z("error","Could not reach the clipboard — select the text and copy it.")}}function de(t){if(t.mode==="oidc")try{return`OpenID Connect · ${new URL(t.discoveryUrl).hostname}`}catch{return"OpenID Connect"}const e=A.value.find(n=>n.key===t.provider);return e?`OAuth 2.0 · ${e.label}`:"OAuth 2.0 · custom endpoints"}function ue(t){return t.defaultRole?`new accounts: ${I(t.defaultRole)}`:`new accounts: the host default${U.value?` (${I(U.value)})`:""}`}function pe(t){var n,c,m;const e=[];return(n=t.allowedEmailDomains)!=null&&n.length&&e.push(`domains ${t.allowedEmailDomains.join(", ")}`),(c=t.allowedUsernames)!=null&&c.length&&e.push(`usernames ${t.allowedUsernames.join(", ")}`),(m=t.requiredGroups)!=null&&m.length&&e.push(`groups ${t.requiredGroups.join(", ")}`),e.length?`lets in ${e.join("; ")}`:"lets in anyone the provider allows"}return(t,e)=>{var n,c,m,v;return i(),d("div",null,[s("div",Ce,[s("div",null,[s("h1",null,[e[20]||(e[20]=a(" Single sign-on ",-1)),h(ge,{title:"How single sign-on works here"},{default:R(()=>[...e[19]||(e[19]=[s("p",null,[s("b",null,"This service is the relying party and nothing more."),a(" You register an OAuth or OIDC application in your own organisation and paste its client id and secret here. Your directory stays yours — no accounts are copied, and nothing is synchronised. ")],-1),s("p",null,[s("b",null,"Anyone who authenticates gets an account"),a(", created on their first sign-in. That is deliberate: your provider already decides who may authenticate (Workspace restricts to internal users, a GitHub app can be org-approved), and duplicating that policy here would just be a second list to keep in step. Narrow it with the sign-in rules on each provider if you need to. ")],-1),s("p",null,[s("b",null,"Identity is the provider's subject, not the email."),a(" Someone changing their address keeps their account, their history and their tokens. An address is only used to adopt an account that already exists here, and only when the provider says it is verified. ")],-1),s("p",null,[s("b",null,"Several providers share the accounts."),a(" Each shows up as its own button on the login page, and the same person arriving from the same directory is the same account — nothing about local accounts or personal tokens changes either way. ")],-1)])]),_:1})]),s("div",xe,[e[22]||(e[22]=a(" Let people sign in with the identity providers you already run ",-1)),h(Q,{label:"what is stored"},{default:R(()=>[...e[21]||(e[21]=[a(" One row per provider: the endpoints, the client id, and the client secret. The secret has no read path — this page only learns whether one is stored, and leaving the field empty keeps it. ",-1)])]),_:1})])]),e[23]||(e[23]=s("span",{class:"grow"},null,-1)),V.value&&!g.value&&!o.value&&!P.value?(i(),d("button",{key:0,class:"primary",onClick:e[0]||(e[0]=l=>_.value=!0)},"Add provider")):f("",!0)]),g.value?(i(),G(Z,{key:0,text:g.value,title:"Single sign-on."},null,8,["text"])):f("",!0),V.value?o.value?(i(),d(b,{key:2},[s("section",_e,[s("div",$e,[h(N,{preset:o.value.form.provider,size:20},null,8,["preset"]),s("h2",Re,r(o.value.originalKey?`Edit ${o.value.originalKey}`:`Add ${((n=o.value.preset)==null?void 0:n.label)??(o.value.form.mode==="oidc"?"an OpenID Connect issuer":"a custom OAuth 2.0 provider")}`),1),s("span",Ie,r(o.value.form.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1),e[25]||(e[25]=s("span",{class:"grow"},null,-1)),s("label",Ae,[u(s("input",{"onUpdate:modelValue":e[1]||(e[1]=l=>o.value.form.enabled=l),type:"checkbox"},null,512),[[me,o.value.form.enabled]]),e[24]||(e[24]=a(" Enabled",-1))])]),o.value.preset?(i(),d("div",Se,[s("b",null,"Register the app with "+r(o.value.preset.label),1),s("p",null,r(o.value.preset.setupHint),1),s("p",null,[s("a",{href:o.value.preset.setupUrl,target:"_blank",rel:"noopener"}," Create the app in "+r(o.value.preset.label)+" → ",9,Ve)])])):f("",!0),s("div",Le,[e[26]||(e[26]=s("label",null,"Redirect URI",-1)),s("div",Oe,[s("code",Ee,r(S.value),1),s("button",{type:"button",onClick:Y},"Copy")]),e[27]||(e[27]=s("p",{class:"hint"}," Paste this into the provider's application as the redirect / callback URL. It has to match byte for byte, and it is the same for every provider on this host — a mismatch is the single most common reason the exchange fails, and the provider's error rarely says so. ",-1))]),o.value.originalKey?f("",!0):(i(),d("div",De,[e[28]||(e[28]=s("label",{for:"sso-key"},"Key",-1)),u(s("input",{id:"sso-key","onUpdate:modelValue":e[2]||(e[2]=l=>o.value.key=l),type:"text",spellcheck:"false",class:"sso-key"},null,512),[[p,o.value.key]]),e[29]||(e[29]=s("p",{class:"hint"}," This host's name for the provider — it appears in the sign-in URL and in exports, never to the person signing in. Lowercase letters, digits and dashes. ",-1))])),s("div",ze,[e[30]||(e[30]=s("label",{for:"sso-label"},"Button text",-1)),u(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=l=>o.value.form.label=l),type:"text",placeholder:((c=o.value.preset)==null?void 0:c.label)||"Acme SSO"},null,8,Te),[[p,o.value.form.label]]),s("p",je,"The login page draws it as “Continue with "+r(o.value.form.label||((m=o.value.preset)==null?void 0:m.label)||"…")+"”.",1)]),o.value.form.mode==="oidc"?(i(),d(b,{key:2},[$.value?(i(),d(b,{key:0},[(i(!0),d(b,null,D(W.value,l=>(i(),d("div",{key:l,class:"field"},[s("label",{for:`ph-${l}`},r(he(I)(l)),9,qe),u(s("input",{id:`ph-${l}`,"onUpdate:modelValue":k=>o.value.placeholders[l]=k,type:"text",spellcheck:"false",class:"sso-key"},null,8,Ge),[[p,o.value.placeholders[l]]])]))),128)),s("div",Me,[e[31]||(e[31]=s("label",null,"Issuer",-1)),s("code",{class:"sso-url","data-incomplete":O.value.includes("<")||void 0},r(O.value),9,Ne),s("p",Ke," Assembled from the value"+r(W.value.length>1?"s":"")+" above — "+r((v=o.value.preset)==null?void 0:v.label)+" gives every account its own issuer, so there is no single URL a preset could carry. It is fetched when you save, so a typo is refused here rather than at someone's first login. ",1)])],64)):(i(),d("div",He,[e[32]||(e[32]=s("label",{for:"sso-issuer"},"Issuer",-1)),u(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=l=>o.value.form.discoveryUrl=l),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[p,o.value.form.discoveryUrl]]),e[33]||(e[33]=s("p",{class:"hint"},[a(" Or the full "),s("code",null,"…/.well-known/openid-configuration"),a(" URL. Everything but the client id and secret is discovered from it, and it is fetched when you save — so a typo is refused here rather than at someone's first login. ")],-1))]))],64)):f("",!0),s("div",Be,[e[34]||(e[34]=s("label",{for:"sso-client"},"Client id",-1)),u(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=l=>o.value.form.clientId=l),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[p,o.value.form.clientId]])]),s("div",Pe,[e[35]||(e[35]=s("label",{for:"sso-secret"},"Client secret",-1)),u(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=l=>o.value.secret=l),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[p,o.value.secret]]),s("p",We," Write-only. "+r(o.value.secretSet?"A secret is stored — leave this empty to keep it.":"Stored on save and never returned by any route."),1)]),s("div",Fe,[e[36]||(e[36]=s("label",{for:"sso-scopes"},"Scopes",-1)),u(s("input",{id:"sso-scopes","onUpdate:modelValue":e[7]||(e[7]=l=>o.value.form.scopes=l),type:"text",spellcheck:"false",placeholder:o.value.form.mode==="oidc"?"openid profile email":""},null,8,Ye),[[p,o.value.form.scopes]])]),o.value.form.mode==="oauth2"?(i(),d("details",{key:3,class:"sso-adv",open:!o.value.preset},[e[47]||(e[47]=s("summary",null,"Endpoints and claim mapping",-1)),s("div",Qe,[e[37]||(e[37]=s("label",{for:"sso-auth"},"Authorize URL",-1)),u(s("input",{id:"sso-auth","onUpdate:modelValue":e[8]||(e[8]=l=>o.value.form.authorizeUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.authorizeUrl]])]),s("div",Xe,[e[38]||(e[38]=s("label",{for:"sso-token"},"Token URL",-1)),u(s("input",{id:"sso-token","onUpdate:modelValue":e[9]||(e[9]=l=>o.value.form.tokenUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.tokenUrl]])]),s("div",Ze,[e[39]||(e[39]=s("label",{for:"sso-userinfo"},"User info URL",-1)),u(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[10]||(e[10]=l=>o.value.form.userInfoUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.userInfoUrl]]),e[40]||(e[40]=s("p",{class:"hint"},"Leave empty to take the identity from the token response alone — a subject and nothing else.",-1))]),s("div",es,[e[41]||(e[41]=s("label",{for:"sso-emails"},[a("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),u(s("input",{id:"sso-emails","onUpdate:modelValue":e[11]||(e[11]=l=>o.value.form.emailsUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.emailsUrl]]),e[42]||(e[42]=s("p",{class:"hint"}," Only consulted when the profile carries no address — which is GitHub's default. Filled in automatically for a preset, and needed only if you pointed the user info URL at your own host. ",-1))]),s("div",ss,[e[43]||(e[43]=s("label",{for:"sso-groups-url"},[a("Groups URL "),s("span",{class:"mute"},"(optional)")],-1)),u(s("input",{id:"sso-groups-url","onUpdate:modelValue":e[12]||(e[12]=l=>o.value.form.groupsUrl=l),type:"text",spellcheck:"false"},null,512),[[p,o.value.form.groupsUrl]]),e[44]||(e[44]=s("p",{class:"hint"}," Where this host asks which groups someone is in. Only consulted when there is a group rule below. Filled in automatically for a preset — but only while the user info URL is still the preset's, because a self-hosted host's token must not be sent to the public one, so a self-hosted provider needs this typed. ",-1))]),s("h3",ts,[e[46]||(e[46]=a(" Claim mapping ",-1)),h(Q,{label:"what this is"},{default:R(()=>[...e[45]||(e[45]=[a(" Which key of the provider's user response holds each field. Flat lookups, not expressions. A preset fills these in; you only touch them for a provider nobody has written a preset for. ",-1)])]),_:1})]),s("div",os,[(i(),d(b,null,D(["subject","username","email","name","avatar"],l=>s("div",{key:l,class:"field inline"},[s("label",{for:`cm-${l}`},r(l),9,ls),u(s("input",{id:`cm-${l}`,"onUpdate:modelValue":k=>o.value.form.claimMap[l]=k,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,ns),[[p,o.value.form.claimMap[l]]])])),64))])],8,Je)):f("",!0)]),s("section",as,[e[57]||(e[57]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets an account, and as what")],-1)),e[58]||(e[58]=s("p",{class:"dim"},[a(" By default, anyone this provider lets authenticate. It already owns that decision; this is only here for the case where the application you registered is broader than the people who should reach this control plane. "),s("b",null,"Any one entry in a list is enough to satisfy that list, and every list you fill in has to be satisfied"),a(" — fill all three in and a login needs a listed domain, a matching username, and one of the groups. A list left empty is not a rule at all: it lets everyone past that check, it does not lock everyone out. ")],-1)),s("div",is,[e[48]||(e[48]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),u(s("input",{id:"sso-domains","onUpdate:modelValue":e[13]||(e[13]=l=>o.value.domains=l),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[p,o.value.domains]]),e[49]||(e[49]=s("p",{class:"hint"},[a(" Comma-separated; subdomains count. Empty means no restriction. "),s("b",null,"Non-empty means a login with no email address at all is refused too"),a(" — a provider that hides the address (a private GitHub profile with no "),s("code",null,"user:email"),a(" scope) cannot be checked, so it is not waved through. ")],-1))]),s("div",rs,[e[50]||(e[50]=s("label",{for:"sso-usernames"},"Allowed usernames",-1)),u(s("input",{id:"sso-usernames","onUpdate:modelValue":e[14]||(e[14]=l=>o.value.usernames=l),type:"text",spellcheck:"false",placeholder:"octocat, qa-[0-9]*"},null,512),[[p,o.value.usernames]]),e[51]||(e[51]=ve('<p class="hint" data-v-afee1731> Comma-separated patterns, case-insensitive: <code data-v-afee1731>*</code>, <code data-v-afee1731>?</code> and <code data-v-afee1731>[0-9]</code> classes. Empty means no restriction. <b data-v-afee1731>Non-empty means a login whose provider sends no username is refused too</b> — so this is a rule for a provider that actually has usernames (GitHub&#39;s <code data-v-afee1731>login</code>, GitLab&#39;s <code data-v-afee1731>username</code>). On an OpenID Connect issuer that sends no <code data-v-afee1731>preferred_username</code> it refuses everyone rather than nobody, so set it only where you know the provider sends one. </p>',1))]),o.value.form.mode==="oauth2"?(i(),d("div",ds,[e[52]||(e[52]=s("label",{for:"sso-groups"},"Required groups",-1)),u(s("input",{id:"sso-groups","onUpdate:modelValue":e[15]||(e[15]=l=>o.value.groups=l),type:"text",spellcheck:"false",placeholder:"acme, acme/backend"},null,512),[[p,o.value.groups]]),e[53]||(e[53]=s("p",{class:"hint"},[a(" Comma-separated, and "),s("b",null,"exact names, not patterns"),a(" — an organisation login, or a group path like "),s("code",null,"acme/backend"),a(". Case-insensitive. Empty means no restriction. Non-empty makes every sign-in ask the provider for that person's groups, so it needs the OAuth scope that endpoint requires: "),s("b",null,"add it to Scopes above, or the save is refused"),a(" — and the refusal names the scope. It also needs a provider whose group list this host knows how to read, which the save checks by name. If that call does not answer, the sign-in is refused rather than allowed. ")],-1))])):(i(),d("p",us," A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth 2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none here. ")),s("div",ps,[e[56]||(e[56]=s("label",{for:"sso-role"},"Role for the accounts it creates",-1)),h(be,{id:"sso-role",modelValue:B.value,"onUpdate:modelValue":e[16]||(e[16]=l=>B.value=l),label:"Role for the accounts this provider creates",options:se.value},null,8,["modelValue","options"]),s("p",cs,[e[54]||(e[54]=a(" Applied when an account is created here — on someone's first sign-in — and never after: promoting or demoting a person later is done in Accounts, and this does not reach back and change them. ",-1)),e[55]||(e[55]=s("b",null,"The host default follows Settings",-1)),a(" rather than being copied in now, so raising or lowering it there moves this provider with it. "+r(U.value?`It is ${U.value} today.`:"")+" Picking a role here pins this provider to it instead. ",1)])])]),x.value?(i(),G(Z,{key:0,text:x.value,title:"Not saved."},null,8,["text"])):f("",!0),s("div",ms,[h(X,{variant:"primary",pending:L.value,disabled:L.value||!!F.value,title:F.value||void 0,onClick:ie},{default:R(()=>[a(r(o.value.originalKey?"Save changes":"Add provider"),1)]),_:1},8,["pending","disabled","title"]),s("button",{class:"ghost",onClick:e[17]||(e[17]=l=>o.value=null)},"Cancel")])],64)):P.value?(i(),d("section",vs,[s("div",hs,[s("h2",fs,r(C.value.length?"Add a provider":"Pick a provider"),1),e[59]||(e[59]=s("span",{class:"grow"},null,-1)),C.value.length?(i(),d("button",{key:0,class:"ghost",onClick:e[18]||(e[18]=l=>_.value=!1)},"Cancel")):f("",!0)]),e[60]||(e[60]=s("p",{class:"dim"}," Pick where your team already signs in. A preset knows the provider's endpoints and its quirks — the only things it cannot know are the client id and secret you get when you register the app, and the form that opens says exactly where to do that. ",-1)),s("div",ys,[(i(!0),d(b,null,D(te.value,l=>{var k;return i(),d("button",{key:l.id,class:"sso-tile",onClick:J=>le(l)},[h(N,{preset:((k=l.preset)==null?void 0:k.key)??"custom",size:22},null,8,["preset"]),s("span",null,r(l.label),1),s("span",ks,r(l.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1)],8,gs)}),128))])])):g.value?f("",!0):(i(),d(b,{key:4},[s("section",bs,[e[62]||(e[62]=s("div",{class:"phead"},[s("h2",{class:"section"},"Providers")],-1)),s("div",ws,[(i(!0),d(b,null,D(C.value,(l,k)=>(i(),d("div",{key:l.key,class:"sso-card",style:fe({"--i":k})},[h(N,{preset:l.config.provider,size:22},null,8,["preset"]),s("div",Us,[s("div",Cs,[s("b",null,r(l.config.label),1),s("code",xs,r(l.key),1),l.config.enabled?f("",!0):(i(),d("span",_s,"disabled"))]),s("div",$s,[a(r(de(l.config))+" · "+r(pe(l.config))+" · "+r(ue(l.config))+" · updated ",1),h(ke,{at:l.updatedAt},null,8,["at"])])]),s("div",Rs,[s("button",{class:"ghost sm",onClick:J=>ne(l)},"Edit",8,Is),h(X,{variant:"ghost",class:"sm sso-remove",confirm:`Remove ${l.key}?`,onRun:J=>re(l)},{default:R(()=>[...e[61]||(e[61]=[a(" Remove ",-1)])]),_:1},8,["confirm","onRun"])])],4))),128))]),e[63]||(e[63]=s("p",{class:"mute",style:{"font-size":"var(--t-sm)","margin-top":"var(--s3)"}}," Removing a provider does not delete anyone. Those accounts keep their personal tokens, and pointing the same provider back at this host re-links them by subject. ",-1))]),s("section",As,[e[64]||(e[64]=s("div",{class:"phead"},[s("h2",{class:"section"},"Callback URL")],-1)),e[65]||(e[65]=s("p",{class:"dim"}," The redirect URI to register with every provider — one URL for all of them, built by the server so it cannot drift from the one the sign-in flow actually sends. ",-1)),s("div",Ss,[s("code",Vs,r(S.value),1),s("button",{type:"button",onClick:Y},"Copy")])])],64)):(i(),G(we,{key:1,rows:4}))])}}}),Bs=Ue(Ls,[["__scopeId","data-v-afee1731"]]);export{Bs as default};
+//# sourceMappingURL=SsoView-B_GrAR_X.js.map

package/dist/assets/{SsoView-2q_nGP-Q.js.map → SsoView-B_GrAR_X.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SsoView-2q_nGP-Q.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * FOUR THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n *   4. The role its accounts are created at is ON SCREEN, and its resting state is INHERIT. This\n *      field existed on the wire from the start and was never drawn, so the form sent whatever\n *      `blank()` happened to hold — which was `admin`, explicitly, for every provider anyone added\n *      here. Inherit is the empty string, resolved against the host's `default_role` when an\n *      account is provisioned rather than frozen at save time; it can only ever resolve to viewer\n *      on a host that set nothing, never to admin by omission.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport { ROLES, type ClaimMap, type HostSettings, type Role, type SsoConfig, type SsoConfigResponse, type SsoPreset, type SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  // EMPTY = INHERIT the host's default role, resolved when the account is provisioned rather than\n  // frozen into the provider now — so raising or lowering the host default moves every inheriting\n  // provider with it. It resolves to viewer on a host where nobody set one, and never to admin.\n  //\n  // THE HISTORY, because losing it is how this comes back: this line said 'admin', and since the\n  // form never rendered the field, every provider added here sent `defaultRole: \"admin\"`\n  // EXPLICITLY — which the server honours. Anyone who completed the OAuth flow against such a\n  // provider became a full administrator, and the viewer default the server grew in 0.32.0 was\n  // defeated through the most common path there is. It then said 'viewer', which was safe but still\n  // a value chosen by a form nobody could see.\n  //\n  // Now the field is on screen with this as its resting state, so granting the most privilege this\n  // product has is something a person picked, in words.\n  defaultRole: '',\n});\n\n/**\n * The select's stand-in for \"inherit\". It cannot be `''`: reka's `SelectItem` throws on an\n * empty-string value (that is how it clears a selection and shows the placeholder), so the empty\n * string the API wants is mapped at the binding rather than stored in the form.\n */\nconst INHERIT = 'inherit';\n\n/** One line each, in the picker itself — a role name alone does not say what it costs to grant. */\nconst ROLE_WHAT: Record<Role, string> = {\n  viewer: 'reads everything',\n  developer: 'deploys and tears down',\n  maintainer: 'host configuration',\n  admin: 'accounts and sign-on',\n};\n\n/**\n * The host's own default, read only so \"inherit\" can say what it currently resolves to. Best\n * effort: an older server has no such route, and the option still reads correctly without it.\n */\nconst hostDefaultRole = ref('');\nvoid api.get<HostSettings>('/api/settings').then((r) => {\n  if (r.ok) hostDefaultRole.value = String(r.body.settings.find((s) => s.key === 'default_role')?.value ?? '');\n});\n\nconst roleOptions = computed(() => [\n  {\n    value: INHERIT,\n    label: 'The host default',\n    hint: hostDefaultRole.value ? `${sentence(hostDefaultRole.value)} today — follows Settings` : 'set in Settings',\n  },\n  ...ROLES.map((r) => ({ value: r, label: sentence(r), hint: ROLE_WHAT[r] })),\n]);\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup walkthrough and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\n\n/** `''` on the wire, the sentinel in the control. Nothing else in the form needs translating. */\nconst roleChoice = computed<string>({\n  get: () => editing.value?.form.defaultRole || INHERIT,\n  set: (v) => {\n    if (editing.value) editing.value.form.defaultRole = v === INHERIT ? '' : v;\n  },\n});\n\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.form.mode === 'oidc' ? 'Saved — the issuer answered, so the settings are known good.' : 'Saved.');\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Existing accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/**\n * The card's third fact: what an account this provider mints is created as — visible in the list\n * because a provider that hands out admin should not need opening to find that out.\n */\nfunction roleLine(c: SsoConfig): string {\n  if (c.defaultRole) return `new accounts: ${sentence(c.defaultRole)}`;\n  return `new accounts: the host default${hostDefaultRole.value ? ` (${sentence(hostDefaultRole.value)})` : ''}`;\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the sign-in rules on each\n              provider if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Several providers share the accounts.</b> Each shows up as its own button on the\n              login page, and the same person arriving from the same directory is the same account —\n              nothing about local accounts or personal tokens changes either way.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity providers you already run\n          <InfoHint label=\"what is stored\">\n            One row per provider: the endpoints, the client id, and the client secret. The secret has\n            no read path — this page only learns whether one is stored, and leaving the field empty\n            keeps it.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- The walkthrough: where to create the app, in the preset's own words. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <b>Register the app with {{ editing.preset.label }}</b>\n          <p>{{ editing.preset.setupHint }}</p>\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">\n            Paste this into the provider's application as the redirect / callback URL. It has to\n            match byte for byte, and it is the same for every provider on this host — a mismatch is\n            the single most common reason the exchange fails, and the provider's error rarely says\n            so.\n          </p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">\n            This host's name for the provider — it appears in the sign-in URL and in exports, never\n            to the person signing in. Lowercase letters, digits and dashes.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">The login page draws it as “Continue with {{ editing.form.label || editing.preset?.label || '…' }}”.</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">\n                Assembled from the value{{ placeholderNames.length > 1 ? 's' : '' }} above —\n                {{ editing.preset?.label }} gives every account its own issuer, so there is no single\n                URL a preset could carry. It is fetched when you save, so a typo is refused here\n                rather than at someone's first login.\n              </p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">\n              Or the full <code>…/.well-known/openid-configuration</code> URL. Everything but the\n              client id and secret is discovered from it, and it is fetched when you save — so a typo\n              is refused here rather than at someone's first login.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'A secret is stored — leave this empty to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Where this host asks which groups someone is in. Only consulted when there is a group\n              rule below. Filled in automatically for a preset — but only while the user info URL is\n              still the preset's, because a self-hosted host's token must not be sent to the public\n              one, so a self-hosted provider needs this typed.\n            </p>\n          </div>\n\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account, and as what</h2></div>\n        <p class=\"dim\">\n          By default, anyone this provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane. <b>Any one entry in a list is enough to satisfy that\n          list, and every list you fill in has to be satisfied</b> — fill all three in and a login\n          needs a listed domain, a matching username, and one of the groups. A list left empty is not\n          a rule at all: it lets everyone past that check, it does not lock everyone out.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns, case-insensitive: <code>*</code>, <code>?</code> and\n            <code>[0-9]</code> classes. Empty means no restriction. <b>Non-empty means a login whose\n            provider sends no username is refused too</b> — so this is a rule for a provider that\n            actually has usernames (GitHub's <code>login</code>, GitLab's <code>username</code>). On\n            an OpenID Connect issuer that sends no <code>preferred_username</code> it refuses\n            everyone rather than nobody, so set it only where you know the provider sends one.\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            Comma-separated, and <b>exact names, not patterns</b> — an organisation login, or a group\n            path like <code>acme/backend</code>. Case-insensitive. Empty means no restriction.\n            Non-empty makes every sign-in ask the provider for that person's groups, so it needs the\n            OAuth scope that endpoint requires: <b>add it to Scopes above, or the save is refused</b>\n            — and the refusal names the scope. It also needs a provider whose group list this host\n            knows how to read, which the save checks by name. If that call does not answer, the\n            sign-in is refused rather than allowed.\n          </p>\n        </div>\n        <p v-else class=\"hint\">\n          A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth\n          2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none\n          here.\n        </p>\n\n        <!-- Never rendered before today, while the form quietly sent `admin`. Every account this\n             provider mints is created at this role, so it is the one field on the page that decides\n             what a stranger who completes the OAuth flow can do. -->\n        <div class=\"field\">\n          <label for=\"sso-role\">Role for the accounts it creates</label>\n          <SelectMenu\n            id=\"sso-role\"\n            v-model=\"roleChoice\"\n            label=\"Role for the accounts this provider creates\"\n            :options=\"roleOptions\"\n          />\n          <p class=\"hint\">\n            Applied when an account is created here — on someone's first sign-in — and never after:\n            promoting or demoting a person later is done in Accounts, and this does not reach back\n            and change them.\n            <b>The host default follows Settings</b> rather than being copied in now, so raising or\n            lowering it there moves this provider with it.\n            {{ hostDefaultRole ? `It is ${hostDefaultRole} today.` : '' }}\n            Picking a role here pins this provider to it instead.\n          </p>\n        </div>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">\n          Pick where your team already signs in. A preset knows the provider's endpoints and its\n          quirks — the only things it cannot know are the client id and secret you get when you\n          register the app, and the form that opens says exactly where to do that.\n        </p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} · {{ roleLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n        <p class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n          Removing a provider does not delete anyone. Those accounts keep their personal tokens, and\n          pointing the same provider back at this host re-links them by subject.\n        </p>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">\n          The redirect URI to register with every provider — one URL for all of them, built by the\n          server so it cannot drift from the one the sign-in flow actually sends.\n        </p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["INHERIT","OIDC_CLAIMS","blank","ROLE_WHAT","hostDefaultRole","ref","api","r","_a","s","roleOptions","computed","sentence","ROLES","providers","presets","callbackUrl","loaded","listError","editing","roleChoice","v","picking","saving","formError","load","problem","showPicker","pickerTiles","p","suggestKey","base","taken","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","keyRe","cannotSave","key","url","list","save","body","toast","remove","copyCallback","whereLine","c","roleLine","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","SsoMark","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","$event","_openBlock","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","_hoisted_12","_hoisted_13","_vModelText","_hoisted_14","_hoisted_16","_renderList","ph","_unref","_hoisted_17","_hoisted_19","_hoisted_20","_hoisted_21","_d","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_25","_hoisted_26","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","_hoisted_33","_hoisted_34","_hoisted_35","k","_hoisted_36","_hoisted_38","_hoisted_39","_hoisted_40","_hoisted_41","_hoisted_42","_hoisted_43","SelectMenu","_hoisted_44","_createTextVNode","_hoisted_45","ActionButton","_hoisted_46","_hoisted_47","_hoisted_48","_hoisted_49","_hoisted_51","_hoisted_52","_hoisted_53","i","_hoisted_54","_hoisted_55","_hoisted_56","_hoisted_57","_hoisted_58","RelativeTime","_hoisted_59","_hoisted_60","_hoisted_61","_hoisted_62","_hoisted_63","SkeletonList"],"mappings":"myEA0FMA,EAAU,4CAxChB,MAAMC,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAchB,YAAa,EAAA,GAWTE,GAAkC,CACtC,OAAQ,mBACR,UAAW,yBACX,WAAY,qBACZ,MAAO,sBAAA,EAOHC,EAAkBC,EAAI,EAAE,EACzBC,EAAI,IAAkB,eAAe,EAAE,KAAMC,GAAM,OAClDA,EAAE,KAAIH,EAAgB,MAAQ,SAAOI,EAAAD,EAAE,KAAK,SAAS,KAAME,GAAMA,EAAE,MAAQ,cAAc,IAApD,YAAAD,EAAuD,QAAS,EAAE,EAC7G,CAAC,EAED,MAAME,GAAcC,EAAS,IAAM,CACjC,CACE,MAAOX,EACP,MAAO,mBACP,KAAMI,EAAgB,MAAQ,GAAGQ,EAASR,EAAgB,KAAK,CAAC,4BAA8B,iBAAA,EAEhG,GAAGS,GAAM,IAAKN,IAAO,CAAE,MAAOA,EAAG,MAAOK,EAASL,CAAC,EAAG,KAAMJ,GAAUI,CAAC,GAAI,CAAA,CAC3E,EAEKO,EAAYT,EAAwB,EAAE,EACtCU,EAAUV,EAAiB,EAAE,EAC7BW,EAAcX,EAAI,EAAE,EACpBY,EAASZ,EAAI,EAAK,EAClBa,EAAYb,EAAI,EAAE,EAmBlBc,EAAUd,EAAoB,IAAI,EAGlCe,EAAaT,EAAiB,CAClC,IAAK,IAAA,OAAM,QAAAH,EAAAW,EAAQ,QAAR,YAAAX,EAAe,KAAK,cAAeR,GAC9C,IAAMqB,GAAM,CACNF,EAAQ,QAAOA,EAAQ,MAAM,KAAK,YAAcE,IAAMrB,EAAU,GAAKqB,EAC3E,CAAA,CACD,EAEKC,EAAUjB,EAAI,EAAK,EACnBkB,EAASlB,EAAI,EAAK,EAClBmB,EAAYnB,EAAI,EAAE,EAExB,eAAeoB,GAAsB,CACnC,MAAMlB,EAAI,MAAMD,EAAI,IAAuB,iBAAiB,EAE5D,GADAW,EAAO,MAAQ,GACX,CAACV,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,2BAA2B,EACxD,MACF,CACAW,EAAU,MAAQ,GAClBJ,EAAU,MAAQP,EAAE,KAAK,WAAa,CAAA,EACtCQ,EAAQ,MAAQR,EAAE,KAAK,SAAW,CAAA,EAClCS,EAAY,MAAQT,EAAE,KAAK,WAC7B,CACKkB,EAAA,EAGL,MAAME,EAAahB,EAAS,IAAM,CAACQ,EAAQ,QAAUG,EAAQ,OAAUL,EAAO,OAAS,CAACC,EAAU,OAASJ,EAAU,MAAM,SAAW,EAAG,EAEnIc,GAAcjB,EAAS,IAAM,CACjC,GAAGI,EAAQ,MAAM,IAAKc,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,GAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIlB,EAAU,MAAM,IAAKe,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAAS,EAAI,GAAK,IAAK,GAAI,CAACC,EAAM,IAAI,GAAGD,CAAI,IAAI,CAAC,EAAE,QAAU,GAAGA,CAAI,IAAI,CAAC,EAC5E,CAEA,SAASE,GAASC,EAAmE,CACnF,MAAML,EAAIK,EAAK,OACTC,EAAIjC,EAAA,EACViC,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWN,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,GACzDL,IACFM,EAAE,MAAQN,EAAE,MACZM,EAAE,OAASN,EAAE,OACbM,EAAE,SAAW,CAAE,GAAGlC,EAAa,GAAG4B,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbM,EAAE,aAAeN,EAAE,aACnBM,EAAE,SAAWN,EAAE,SACfM,EAAE,YAAcN,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCM,EAAE,aAAeN,EAAE,eAGvBV,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKW,GAAWD,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQL,EACR,KAAMM,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBX,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASc,GAAUC,EAA+B,CAChDlB,EAAQ,MAAQ,CACd,YAAakB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQtB,EAAQ,MAAM,KAAMuB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAGnC,IAAS,GAAGmC,EAAM,OAAQ,SAAU,CAAE,GAAGpC,EAAa,GAAGoC,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBb,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMiB,EAAgB5B,EAAgD,IAAM,CAC1E,MAAM6B,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,EAAmBnC,EAAS,KAC/B4B,EAAc,OAAS,CAAA,GAAI,QAASV,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EkB,EAAqBpC,EAAS,IAAM,CACxC,MAAM+B,EAAQH,EAAc,MACtB,EAAIpB,EAAQ,MAClB,MAAI,CAACuB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKb,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAIrB,EAAA,EAAE,aAAaqB,EAAE,EAAE,IAAnB,YAAArB,EAAsB,SAAU,IAAIqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKmB,GAAQ,4BAGRC,EAAatC,EAAiB,IAAM,CACxC,MAAM6B,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,EAAG,MAAO,0BACf,MAAMU,EAAMV,EAAE,IAAI,KAAA,EAClB,GAAI,CAACQ,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIV,EAAE,cAAgB,MAAQ1B,EAAU,MAAM,KAAMe,GAAMA,EAAE,MAAQqB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACV,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMW,EAAMZ,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACW,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACX,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKY,EAAQ3C,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKY,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAegC,IAAsB,CACnC,MAAMb,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,EAAG,OACRjB,EAAO,MAAQ,GAIf,MAAM+B,EAA0D,CAC9D,GAAGd,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBY,EAAKZ,EAAE,OAAO,EACnC,iBAAkBY,EAAKZ,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKY,EAAKZ,EAAE,MAAM,CAAA,EAEvDjC,EAAI,MAAMD,EAAI,IAAkC,kBAAmBgD,CAAI,EAE7E,GADA/B,EAAO,MAAQ,GACX,CAAChB,EAAE,GAAI,CAGTiB,EAAU,MAAQE,EAAQnB,EAAG,mBAAmB,EAChD,MACF,CACAiB,EAAU,MAAQ,GAClB+B,EAAM,KAAMf,EAAE,KAAK,OAAS,OAAS,+DAAiE,QAAQ,EAC9GrB,EAAQ,MAAQ,KACXM,EAAA,CACP,CAEA,eAAe+B,GAAOnB,EAAwC,CAC5D,MAAM9B,EAAI,MAAMD,EAAI,IAAI,mBAAmB+B,EAAM,GAAG,EAAE,EACtD,GAAI,CAAC9B,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,qBAAqB,EAClD,MACF,CACAgD,EAAM,KAAM,WAAWlB,EAAM,GAAG,mCAAmC,EAC9DZ,EAAA,CACP,CAEA,eAAegC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAUzC,EAAY,KAAK,EACrDuC,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAM9B,EAAId,EAAQ,MAAM,KAAMuB,GAAMA,EAAE,MAAQqB,EAAE,QAAQ,EACxD,OAAO9B,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAMA,SAAS+B,GAASD,EAAsB,CACtC,OAAIA,EAAE,YAAoB,iBAAiB/C,EAAS+C,EAAE,WAAW,CAAC,GAC3D,iCAAiCvD,EAAgB,MAAQ,KAAKQ,EAASR,EAAgB,KAAK,CAAC,IAAM,EAAE,EAC9G,CAGA,SAASyD,GAAUF,EAAsB,WACvC,MAAMjB,EAAkB,CAAA,EACxB,OAAIlC,EAAAmD,EAAE,sBAAF,MAAAnD,EAAuB,QAAQkC,EAAM,KAAK,WAAWiB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFG,EAAAH,EAAE,mBAAF,MAAAG,EAAoB,QAAQpB,EAAM,KAAK,aAAaiB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFI,EAAAJ,EAAE,iBAAF,MAAAI,EAAkB,QAAQrB,EAAM,KAAK,UAAUiB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEjB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,sCAIEsB,EA0WM,MAAA,KAAA,CAzWJC,EAyCM,MAzCNC,GAyCM,CAxCJD,EAqCM,MAAA,KAAA,CApCJA,EA2BK,KAAA,KAAA,iBA3BD,mBAEF,EAAA,GAAAE,EAwBYC,GAAA,CAxBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,sUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAII,IAAA,KAAA,CAHFA,EAA4C,SAAzC,uCAAqC,IAAI,qMAG9C,CAAA,kBAGJA,EAOM,MAPNK,GAOM,iBAPW,mEAEf,EAAA,GAAAH,EAIWI,EAAA,CAJD,MAAM,kBAAgB,WAAC,IAIjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJiC,gMAIjC,EAAA,CAAA,6BAGJJ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJhD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDqC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO1C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGJ,EAAA,WAAjBsD,EAAwEC,EAAA,OAA3C,KAAMvD,EAAA,MAAW,MAAM,iBAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArB6C,EAqPWU,EAAA,CAAA,IAAA,GAAA,CApPTT,EA6JU,UA7JVU,GA6JU,CA5JRV,EAYM,MAZNW,GAYM,CAXJT,EAAsDU,EAAA,CAA5C,OAAQ1D,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChD8C,EAMK,KANLa,GAMKC,EAJD5D,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4BX,EAAAW,EAAA,MAAQ,SAAR,YAAAX,EAAgB,SAAUW,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5I8C,EAA6F,OAA7Fe,GAA6FD,EAAvE5D,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvC8C,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FgB,GAA6F,GAAxEhB,EAAwD,QAAA,sCAAxC9C,EAAA,MAAQ,KAAK,QAAO+D,GAAE,KAAK,UAAA,iBAA3B/D,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnBgE,IAAAnB,EAQM,MARNoB,GAQM,CAPJnB,EAAuD,SAApD,yBAAsBc,EAAG5D,QAAQ,OAAO,KAAK,EAAA,CAAA,EAChD8C,EAAqC,IAAA,KAAAc,EAA/B5D,EAAA,MAAQ,OAAO,SAAS,EAAA,CAAA,EAC9B8C,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAM9C,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAAkE,EAAA,CAAA,eAKJpB,EAYM,MAZNqB,GAYM,CAXJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNsB,GAGM,CAFJtB,EAA8C,OAA9CuB,GAA8CT,EAArB/D,EAAA,KAAW,EAAA,CAAA,EACpCiD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,GAElDY,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,4QAKhB,EAAA,EAAA,GAGU9C,EAAA,MAAQ,sBAApBgE,IAAAnB,EAOM,MAPNyB,GAOM,CANJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA/D,EAAA,MAAQ,IAAG+D,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAQ,EAAAvE,EAAA,MAAQ,GAAG,CAAA,GACxCkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,QAAO,4JAGhB,EAAA,EAAA,IAGFA,EAIM,MAJN0B,GAIM,CAHJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqB9C,EAAA,MAAQ,KAAK,MAAK+D,GAAE,KAAK,OAAQ,cAAapB,EAAA3C,EAAA,MAAQ,SAAR,YAAA2C,EAAgB,QAAK,UAAA,iBAAnE3C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjD8C,EAAwH,IAAxH2B,GAAgB,6CAA0Cb,EAAG5D,QAAQ,KAAK,SAAS4C,EAAA5C,EAAA,MAAQ,SAAR,YAAA4C,EAAgB,aAAe,KAAE,CAAA,CAAA,GAItG5C,EAAA,MAAQ,KAAK,OAAI,YAAjC6C,EA0BWU,EAAA,CAAA,IAAA,CAAA,EAAA,CAzBOnC,EAAA,WAAhByB,EAeWU,EAAA,CAAA,IAAA,GAAA,QAdTV,EAGMU,EAAA,KAAAmB,EAHY/C,EAAA,MAANgD,QAAZ9B,EAGM,MAAA,CAH+B,IAAK8B,EAAI,MAAM,OAAA,GAClD7B,EAAmD,QAAA,CAA3C,UAAW6B,CAAE,EAAA,EAAOf,EAAAgB,GAAAnF,CAAA,EAASkF,CAAE,CAAA,EAAA,EAAAE,EAAA,IACvC/B,EAA4G,QAAA,CAApG,SAAU6B,CAAE,4BAAa3E,EAAA,MAAQ,aAAa2E,CAAE,EAAAZ,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/D/D,EAAA,MAAQ,aAAa2E,CAAE,CAAA,CAAA,aAE1D7B,EASM,MATNgC,GASM,CARJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBlB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAmD,EAAA,EAC5GjC,EAKI,IALJkC,GAAgB,4BACUpB,EAAGjC,QAAiB,OAAM,EAAA,IAAA,EAAA,EAAkB,eACjEsD,EAAAjF,EAAA,MAAQ,SAAR,YAAAiF,EAAgB,KAAK,EAAG,qLAG7B,CAAA,CAAA,UAGJjB,IAAAnB,EAQM,MARNqC,GAQM,CAPJhC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,aAAY+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtE/D,EAAA,MAAQ,KAAK,YAAY,CAAA,iBACzD8C,EAII,IAAA,CAJD,MAAM,QAAM,GAAC,eACF,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,yKAG7D,CAAA,yBAIJA,EAGM,MAHNqC,GAGM,CAFJjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,SAAQ+D,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnE/D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvD8C,EAOM,MAPNsC,GAOM,CANJlC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA/D,EAAA,MAAQ,OAAM+D,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAQ,EAAAvE,EAAA,MAAQ,MAAM,CAAA,GAC9C8C,EAGI,IAHJuC,GAAgB,gBAEdzB,EAAG5D,EAAA,MAAQ,UAAS,oDAAA,iDAAA,EAAA,CAAA,CAAA,GAIxB8C,EAGM,MAHNwC,GAGM,CAFJpC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,OAAM+D,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa/D,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhC6C,EAkDU,UAAA,OAlDqC,MAAM,UAAW,KAAI,CAAG7C,EAAA,MAAQ,MAAA,GAC7EkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHNyC,GAGM,CAFJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoB9C,EAAA,MAAQ,KAAK,aAAY+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlD/D,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzD8C,EAGM,MAHN0C,GAGM,CAFJtC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqB9C,EAAA,MAAQ,KAAK,SAAQ+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9C/D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtD8C,EAIM,MAJN2C,GAIM,CAHJvC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwB9C,EAAA,MAAQ,KAAK,YAAW+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjD/D,EAAA,MAAQ,KAAK,WAAW,CAAA,GAC1DkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARN4C,GAQM,eAPJ5C,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsB9C,EAAA,MAAQ,KAAK,UAAS+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C/D,EAAA,MAAQ,KAAK,SAAS,CAAA,GACtDkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,GAEFA,EASM,MATN6C,GASM,eARJ7C,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0B9C,EAAA,MAAQ,KAAK,UAAS+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C/D,EAAA,MAAQ,KAAK,SAAS,CAAA,GAC1DkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,wTAKhB,EAAA,EAAA,GAGFA,EAOK,KAPL8C,GAOK,iBAP6C,kBAEhD,EAAA,GAAA5C,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALN+C,GAKM,MAJJhD,EAGMU,EAAA,KAAAmB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALoB,GAAZhD,EAGM,MAAA,CAH2E,IAAKgD,EAAG,MAAM,cAAA,GAC7FhD,EAAuC,QAAA,CAA/B,UAAWgD,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5BjD,EAAgH,QAAA,CAAxG,SAAUgD,CAAC,GAAa,sBAAA/B,GAAA/D,EAAA,MAAQ,KAAK,SAAS8F,CAAC,EAAA/B,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAQ,EAAAvE,EAAA,MAAQ,KAAK,SAAS8F,CAAC,CAAA,CAAA,gCAO/DhD,EA0EU,UA1EVkD,GA0EU,eAzERlD,EAAkF,MAAA,CAA7E,MAAM,SAAO,CAACA,EAAyD,KAAA,CAArD,MAAM,SAAA,EAAU,kCAAgC,CAAA,qBACvEA,EAOI,IAAA,CAPD,MAAM,OAAK,GAAC,0NAGoB,EAAAA,EACuB,SADpB,wGACgB,IAAI,+MAG1D,CAAA,OACAA,EASM,MATNmD,GASM,CARJ/C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,QAAO+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAQ,EAAAvE,EAAA,MAAQ,OAAO,CAAA,iBAChD8C,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,SAGFA,EAWM,MAXNoD,GAWM,CAVJhD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,UAAS+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAQ,EAAAvE,EAAA,MAAQ,SAAS,CAAA,srBAW3CA,EAAA,MAAQ,KAAK,OAAI,UAA5BgE,IAAAnB,EAYM,MAZNsD,GAYM,CAXJjD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,OAAM+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAQ,EAAAvE,EAAA,MAAQ,MAAM,CAAA,iBAC9C8C,EAQI,IAAA,CARD,MAAM,QAAM,GAAC,wBACO,EAAAA,EAAgC,SAA7B,2BAAyB,IAAI,iDAC3C,EAAAA,EAAyB,YAAnB,cAAY,IAAO,+KAEC,EAAAA,EAAqD,SAAlD,gDAA8C,IAAI,sNAI3F,CAAA,eAEFD,EAII,IAJJuD,GAAuB,2LAIvB,GAKAtD,EAiBM,MAjBNuD,GAiBM,CAhBJnD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8D,QAAA,CAAvD,IAAI,UAAA,EAAW,mCAAgC,EAAA,GACtDE,EAKEsD,GAAA,CAJA,GAAG,sBACMrG,EAAA,6CAAAA,EAAU,MAAA8D,GACnB,MAAM,8CACL,QAASxE,GAAA,KAAA,mCAEZuD,EAQI,IARJyD,GAQI,iBARY,oMAId,EAAA,GAAArD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,SAArC,oCAAiC,EAAA,GAAI0D,EAAA,kGAExC5C,EAAG3E,EAAA,MAAe,SAAYA,EAAA,KAAe,cAAiB,0DAEhE,CAAA,CAAA,OAIaoB,EAAA,WAAjBgD,EAAmEC,EAAA,OAAtC,KAAMjD,EAAA,MAAW,MAAM,YAAA,6BAEpDyC,EAKM,MALN2D,GAKM,CAJJzD,EAEe0D,EAAA,CAFD,QAAQ,UAAW,QAAStG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM0B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOI,EAAA,aAC5H,IAA2D,CAAxDsE,EAAA5C,EAAA5D,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExB8C,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAO9C,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnBwD,EAAA,EAAAnB,EAkBU,UAlBV8D,GAkBU,CAjBR7D,EAIM,MAJN8D,GAIM,CAHJ9D,EAAsF,KAAtF+D,GAAsFjD,EAA/DjE,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCmD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJnD,EAAA,MAAU,YAAxBkD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO1C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/E+C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAMM,MANNgE,GAMM,QALJjE,EAISU,EAAA,KAAAmB,EAJWjE,GAAA,MAALa,GAAC,kBAAhBuB,EAIS,SAAA,CAJyB,IAAKvB,EAAE,GAAI,MAAM,WAAY,QAAKyC,GAAEjD,GAASQ,CAAC,CAAA,GAC9E0B,EAA0DU,EAAA,CAAhD,SAAQrE,EAAAiC,EAAE,SAAF,YAAAjC,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpDyD,EAA0B,OAAA,KAAAc,EAAjBtC,EAAE,KAAK,EAAA,CAAA,EAChBwB,EAA2F,OAA3FiE,GAA2FnD,EAA5DtC,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvBvB,EAAA,oBAAtB8C,EA0CWU,EAAA,CAAA,IAAA,GAAA,CAzCTT,EA4BU,UA5BVkE,GA4BU,eA3BRlE,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBNmE,GAqBM,EApBJjD,EAAA,EAAA,EAAAnB,EAmBMU,EAAA,KAAAmB,EAnBgB/E,EAAA,MAAS,CAAlBe,EAAGwG,SAAhBrE,EAmBM,MAAA,CAnB4B,IAAKnC,EAAE,IAAK,MAAM,WAAY,gBAAgBwG,EAAC,CAAA,GAC/ElE,EAAkDU,EAAA,CAAxC,OAAQhD,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CoC,EAUM,MAVNqE,GAUM,CATJrE,EAIM,MAJNsE,GAIM,CAHJtE,EAA2B,IAAA,KAAAc,EAArBlD,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBoC,EAAqC,OAArCuE,GAAqCzD,EAAflD,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBmC,EAAgE,OAAhEyE,GAAiD,UAAQ,KAE3DxE,EAGM,MAHNyE,GAGM,KAFDhF,GAAU7B,EAAE,MAAM,GAAI,MAAGkD,EAAGlB,GAAUhC,EAAE,MAAM,CAAA,EAAI,MAAGkD,EAAGnB,GAAS/B,EAAE,MAAM,CAAA,EAAI,cACxE,CAAA,EAAAsC,EAAkCwE,GAAA,CAAnB,GAAI9G,EAAE,SAAA,qBAGjCoC,EAKM,MALN2E,GAKM,CAJJ3E,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKiB,GAAE9C,GAAUP,CAAC,CAAA,EAAG,OAAI,EAAAgH,EAAA,EACnD1E,EAEe0D,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAYhG,EAAE,GAAG,IAAM,MAAGqD,GAAE1B,GAAO3B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAAwC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,+DAINJ,EAGI,IAAA,CAHD,MAAM,OAAO,MAAA,CAAA,YAAA,cAAA,aAAA,WAAA,CAAA,EAAsD,sKAGtE,EAAA,EAAA,GAGFA,EAUU,UAVV6E,GAUU,eATR7E,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,KAAA,EAAM,qKAGf,EAAA,GACAA,EAGM,MAHN8E,GAGM,CAFJ9E,EAA8C,OAA9C+E,GAA8CjE,EAArB/D,EAAA,KAAW,EAAA,CAAA,EACpCiD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,gBAzTtDe,EAAyCyE,GAAA,OAAX,KAAM,CAAA"}
+{"version":3,"file":"SsoView-B_GrAR_X.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * FOUR THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n *   4. The role its accounts are created at is ON SCREEN, and its resting state is INHERIT. This\n *      field existed on the wire from the start and was never drawn, so the form sent whatever\n *      `blank()` happened to hold — which was `admin`, explicitly, for every provider anyone added\n *      here. Inherit is the empty string, resolved against the host's `default_role` when an\n *      account is provisioned rather than frozen at save time; it can only ever resolve to viewer\n *      on a host that set nothing, never to admin by omission.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport { ROLES, type ClaimMap, type HostSettings, type Role, type SsoConfig, type SsoConfigResponse, type SsoPreset, type SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport HelpModal from '../components/HelpModal.vue';\nimport InfoHint from '../components/InfoHint.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  // EMPTY = INHERIT the host's default role, resolved when the account is provisioned rather than\n  // frozen into the provider now — so raising or lowering the host default moves every inheriting\n  // provider with it. It resolves to viewer on a host where nobody set one, and never to admin.\n  //\n  // THE HISTORY, because losing it is how this comes back: this line said 'admin', and since the\n  // form never rendered the field, every provider added here sent `defaultRole: \"admin\"`\n  // EXPLICITLY — which the server honours. Anyone who completed the OAuth flow against such a\n  // provider became a full administrator, and the viewer default the server grew in 0.32.0 was\n  // defeated through the most common path there is. It then said 'viewer', which was safe but still\n  // a value chosen by a form nobody could see.\n  //\n  // Now the field is on screen with this as its resting state, so granting the most privilege this\n  // product has is something a person picked, in words.\n  defaultRole: '',\n});\n\n/**\n * The select's stand-in for \"inherit\". It cannot be `''`: reka's `SelectItem` throws on an\n * empty-string value (that is how it clears a selection and shows the placeholder), so the empty\n * string the API wants is mapped at the binding rather than stored in the form.\n */\nconst INHERIT = 'inherit';\n\n/** One line each, in the picker itself — a role name alone does not say what it costs to grant. */\nconst ROLE_WHAT: Record<Role, string> = {\n  viewer: 'reads everything',\n  developer: 'deploys and tears down',\n  maintainer: 'host configuration',\n  admin: 'accounts and sign-on',\n};\n\n/**\n * The host's own default, read only so \"inherit\" can say what it currently resolves to. Best\n * effort: an older server has no such route, and the option still reads correctly without it.\n */\nconst hostDefaultRole = ref('');\nvoid api.get<HostSettings>('/api/settings').then((r) => {\n  if (r.ok) hostDefaultRole.value = String(r.body.settings.find((s) => s.key === 'default_role')?.value ?? '');\n});\n\nconst roleOptions = computed(() => [\n  {\n    value: INHERIT,\n    label: 'The host default',\n    hint: hostDefaultRole.value ? `${sentence(hostDefaultRole.value)} today — follows Settings` : 'set in Settings',\n  },\n  ...ROLES.map((r) => ({ value: r, label: sentence(r), hint: ROLE_WHAT[r] })),\n]);\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup walkthrough and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\n\n/** `''` on the wire, the sentinel in the control. Nothing else in the form needs translating. */\nconst roleChoice = computed<string>({\n  get: () => editing.value?.form.defaultRole || INHERIT,\n  set: (v) => {\n    if (editing.value) editing.value.form.defaultRole = v === INHERIT ? '' : v;\n  },\n});\n\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.form.mode === 'oidc' ? 'Saved — the issuer answered, so the settings are known good.' : 'Saved.');\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Existing accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Could not reach the clipboard — select the text and copy it.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/**\n * The card's third fact: what an account this provider mints is created as — visible in the list\n * because a provider that hands out admin should not need opening to find that out.\n */\nfunction roleLine(c: SsoConfig): string {\n  if (c.defaultRole) return `new accounts: ${sentence(c.defaultRole)}`;\n  return `new accounts: the host default${hostDefaultRole.value ? ` (${sentence(hostDefaultRole.value)})` : ''}`;\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>\n          Single sign-on\n          <HelpModal title=\"How single sign-on works here\">\n            <p>\n              <b>This service is the relying party and nothing more.</b> You register an OAuth or\n              OIDC application in your own organisation and paste its client id and secret here. Your\n              directory stays yours — no accounts are copied, and nothing is synchronised.\n            </p>\n            <p>\n              <b>Anyone who authenticates gets an account</b>, created on their first sign-in. That is\n              deliberate: your provider already decides who may authenticate (Workspace restricts to\n              internal users, a GitHub app can be org-approved), and duplicating that policy here\n              would just be a second list to keep in step. Narrow it with the sign-in rules on each\n              provider if you need to.\n            </p>\n            <p>\n              <b>Identity is the provider's subject, not the email.</b> Someone changing their\n              address keeps their account, their history and their tokens. An address is only used to\n              adopt an account that already exists here, and only when the provider says it is\n              verified.\n            </p>\n            <p>\n              <b>Several providers share the accounts.</b> Each shows up as its own button on the\n              login page, and the same person arriving from the same directory is the same account —\n              nothing about local accounts or personal tokens changes either way.\n            </p>\n          </HelpModal>\n        </h1>\n        <div class=\"sub\">\n          Let people sign in with the identity providers you already run\n          <InfoHint label=\"what is stored\">\n            One row per provider: the endpoints, the client id, and the client secret. The secret has\n            no read path — this page only learns whether one is stored, and leaving the field empty\n            keeps it.\n          </InfoHint>\n        </div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Single sign-on.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- The walkthrough: where to create the app, in the preset's own words. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <b>Register the app with {{ editing.preset.label }}</b>\n          <p>{{ editing.preset.setupHint }}</p>\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">\n            Paste this into the provider's application as the redirect / callback URL. It has to\n            match byte for byte, and it is the same for every provider on this host — a mismatch is\n            the single most common reason the exchange fails, and the provider's error rarely says\n            so.\n          </p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">\n            This host's name for the provider — it appears in the sign-in URL and in exports, never\n            to the person signing in. Lowercase letters, digits and dashes.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">The login page draws it as “Continue with {{ editing.form.label || editing.preset?.label || '…' }}”.</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">\n                Assembled from the value{{ placeholderNames.length > 1 ? 's' : '' }} above —\n                {{ editing.preset?.label }} gives every account its own issuer, so there is no single\n                URL a preset could carry. It is fetched when you save, so a typo is refused here\n                rather than at someone's first login.\n              </p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">\n              Or the full <code>…/.well-known/openid-configuration</code> URL. Everything but the\n              client id and secret is discovered from it, and it is fetched when you save — so a typo\n              is refused here rather than at someone's first login.\n            </p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'A secret is stored — leave this empty to keep it.' : 'Stored on save and never returned by any route.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">Leave empty to take the identity from the token response alone — a subject and nothing else.</p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Only consulted when the profile carries no address — which is GitHub's default. Filled\n              in automatically for a preset, and needed only if you pointed the user info URL at your\n              own host.\n            </p>\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n            <p class=\"hint\">\n              Where this host asks which groups someone is in. Only consulted when there is a group\n              rule below. Filled in automatically for a preset — but only while the user info URL is\n              still the preset's, because a self-hosted host's token must not be sent to the public\n              one, so a self-hosted provider needs this typed.\n            </p>\n          </div>\n\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">\n            Claim mapping\n            <InfoHint label=\"what this is\">\n              Which key of the provider's user response holds each field. Flat lookups, not\n              expressions. A preset fills these in; you only touch them for a provider nobody has\n              written a preset for.\n            </InfoHint>\n          </h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets an account, and as what</h2></div>\n        <p class=\"dim\">\n          By default, anyone this provider lets authenticate. It already owns that decision; this is\n          only here for the case where the application you registered is broader than the people who\n          should reach this control plane. <b>Any one entry in a list is enough to satisfy that\n          list, and every list you fill in has to be satisfied</b> — fill all three in and a login\n          needs a listed domain, a matching username, and one of the groups. A list left empty is not\n          a rule at all: it lets everyone past that check, it does not lock everyone out.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. Empty means no restriction. <b>Non-empty means a login\n            with no email address at all is refused too</b> — a provider that hides the address (a\n            private GitHub profile with no <code>user:email</code> scope) cannot be checked, so it is\n            not waved through.\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns, case-insensitive: <code>*</code>, <code>?</code> and\n            <code>[0-9]</code> classes. Empty means no restriction. <b>Non-empty means a login whose\n            provider sends no username is refused too</b> — so this is a rule for a provider that\n            actually has usernames (GitHub's <code>login</code>, GitLab's <code>username</code>). On\n            an OpenID Connect issuer that sends no <code>preferred_username</code> it refuses\n            everyone rather than nobody, so set it only where you know the provider sends one.\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            Comma-separated, and <b>exact names, not patterns</b> — an organisation login, or a group\n            path like <code>acme/backend</code>. Case-insensitive. Empty means no restriction.\n            Non-empty makes every sign-in ask the provider for that person's groups, so it needs the\n            OAuth scope that endpoint requires: <b>add it to Scopes above, or the save is refused</b>\n            — and the refusal names the scope. It also needs a provider whose group list this host\n            knows how to read, which the save checks by name. If that call does not answer, the\n            sign-in is refused rather than allowed.\n          </p>\n        </div>\n        <p v-else class=\"hint\">\n          A group rule needs a provider whose groups endpoint this host knows how to read — an OAuth\n          2.0 preset (GitHub, GitLab), not a discovered OpenID Connect issuer — so there is none\n          here.\n        </p>\n\n        <!-- Never rendered before today, while the form quietly sent `admin`. Every account this\n             provider mints is created at this role, so it is the one field on the page that decides\n             what a stranger who completes the OAuth flow can do. -->\n        <div class=\"field\">\n          <label for=\"sso-role\">Role for the accounts it creates</label>\n          <SelectMenu\n            id=\"sso-role\"\n            v-model=\"roleChoice\"\n            label=\"Role for the accounts this provider creates\"\n            :options=\"roleOptions\"\n          />\n          <p class=\"hint\">\n            Applied when an account is created here — on someone's first sign-in — and never after:\n            promoting or demoting a person later is done in Accounts, and this does not reach back\n            and change them.\n            <b>The host default follows Settings</b> rather than being copied in now, so raising or\n            lowering it there moves this provider with it.\n            {{ hostDefaultRole ? `It is ${hostDefaultRole} today.` : '' }}\n            Picking a role here pins this provider to it instead.\n          </p>\n        </div>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">\n          Pick where your team already signs in. A preset knows the provider's endpoints and its\n          quirks — the only things it cannot know are the client id and secret you get when you\n          register the app, and the form that opens says exactly where to do that.\n        </p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} · {{ roleLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n        <p class=\"mute\" style=\"font-size: var(--t-sm); margin-top: var(--s3)\">\n          Removing a provider does not delete anyone. Those accounts keep their personal tokens, and\n          pointing the same provider back at this host re-links them by subject.\n        </p>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">\n          The redirect URI to register with every provider — one URL for all of them, built by the\n          server so it cannot drift from the one the sign-in flow actually sends.\n        </p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["INHERIT","OIDC_CLAIMS","blank","ROLE_WHAT","hostDefaultRole","ref","api","r","_a","s","roleOptions","computed","sentence","ROLES","providers","presets","callbackUrl","loaded","listError","editing","roleChoice","v","picking","saving","formError","load","problem","showPicker","pickerTiles","p","suggestKey","base","taken","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","keyRe","cannotSave","key","url","list","save","body","toast","remove","copyCallback","whereLine","c","roleLine","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createVNode","HelpModal","_cache","_hoisted_2","InfoHint","_createBlock","ErrorNote","_Fragment","_hoisted_3","_hoisted_4","SsoMark","_hoisted_5","_toDisplayString","_hoisted_6","_hoisted_7","$event","_openBlock","_hoisted_8","_hoisted_9","_hoisted_10","_hoisted_11","_hoisted_12","_hoisted_13","_vModelText","_hoisted_14","_hoisted_16","_renderList","ph","_unref","_hoisted_17","_hoisted_19","_hoisted_20","_hoisted_21","_d","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_25","_hoisted_26","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","_hoisted_33","_hoisted_34","_hoisted_35","k","_hoisted_36","_hoisted_38","_hoisted_39","_hoisted_40","_hoisted_41","_hoisted_42","_hoisted_43","SelectMenu","_hoisted_44","_createTextVNode","_hoisted_45","ActionButton","_hoisted_46","_hoisted_47","_hoisted_48","_hoisted_49","_hoisted_51","_hoisted_52","_hoisted_53","i","_hoisted_54","_hoisted_55","_hoisted_56","_hoisted_57","_hoisted_58","RelativeTime","_hoisted_59","_hoisted_60","_hoisted_61","_hoisted_62","_hoisted_63","SkeletonList"],"mappings":"myEA0FMA,EAAU,4CAxChB,MAAMC,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAchB,YAAa,EAAA,GAWTE,GAAkC,CACtC,OAAQ,mBACR,UAAW,yBACX,WAAY,qBACZ,MAAO,sBAAA,EAOHC,EAAkBC,EAAI,EAAE,EACzBC,EAAI,IAAkB,eAAe,EAAE,KAAMC,GAAM,OAClDA,EAAE,KAAIH,EAAgB,MAAQ,SAAOI,EAAAD,EAAE,KAAK,SAAS,KAAME,GAAMA,EAAE,MAAQ,cAAc,IAApD,YAAAD,EAAuD,QAAS,EAAE,EAC7G,CAAC,EAED,MAAME,GAAcC,EAAS,IAAM,CACjC,CACE,MAAOX,EACP,MAAO,mBACP,KAAMI,EAAgB,MAAQ,GAAGQ,EAASR,EAAgB,KAAK,CAAC,4BAA8B,iBAAA,EAEhG,GAAGS,GAAM,IAAKN,IAAO,CAAE,MAAOA,EAAG,MAAOK,EAASL,CAAC,EAAG,KAAMJ,GAAUI,CAAC,GAAI,CAAA,CAC3E,EAEKO,EAAYT,EAAwB,EAAE,EACtCU,EAAUV,EAAiB,EAAE,EAC7BW,EAAcX,EAAI,EAAE,EACpBY,EAASZ,EAAI,EAAK,EAClBa,EAAYb,EAAI,EAAE,EAmBlBc,EAAUd,EAAoB,IAAI,EAGlCe,EAAaT,EAAiB,CAClC,IAAK,IAAA,OAAM,QAAAH,EAAAW,EAAQ,QAAR,YAAAX,EAAe,KAAK,cAAeR,GAC9C,IAAMqB,GAAM,CACNF,EAAQ,QAAOA,EAAQ,MAAM,KAAK,YAAcE,IAAMrB,EAAU,GAAKqB,EAC3E,CAAA,CACD,EAEKC,EAAUjB,EAAI,EAAK,EACnBkB,EAASlB,EAAI,EAAK,EAClBmB,EAAYnB,EAAI,EAAE,EAExB,eAAeoB,GAAsB,CACnC,MAAMlB,EAAI,MAAMD,EAAI,IAAuB,iBAAiB,EAE5D,GADAW,EAAO,MAAQ,GACX,CAACV,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,2BAA2B,EACxD,MACF,CACAW,EAAU,MAAQ,GAClBJ,EAAU,MAAQP,EAAE,KAAK,WAAa,CAAA,EACtCQ,EAAQ,MAAQR,EAAE,KAAK,SAAW,CAAA,EAClCS,EAAY,MAAQT,EAAE,KAAK,WAC7B,CACKkB,EAAA,EAGL,MAAME,EAAahB,EAAS,IAAM,CAACQ,EAAQ,QAAUG,EAAQ,OAAUL,EAAO,OAAS,CAACC,EAAU,OAASJ,EAAU,MAAM,SAAW,EAAG,EAEnIc,GAAcjB,EAAS,IAAM,CACjC,GAAGI,EAAQ,MAAM,IAAKc,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,GAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIlB,EAAU,MAAM,IAAKe,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAAS,EAAI,GAAK,IAAK,GAAI,CAACC,EAAM,IAAI,GAAGD,CAAI,IAAI,CAAC,EAAE,QAAU,GAAGA,CAAI,IAAI,CAAC,EAC5E,CAEA,SAASE,GAASC,EAAmE,CACnF,MAAML,EAAIK,EAAK,OACTC,EAAIjC,EAAA,EACViC,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWN,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,GACzDL,IACFM,EAAE,MAAQN,EAAE,MACZM,EAAE,OAASN,EAAE,OACbM,EAAE,SAAW,CAAE,GAAGlC,EAAa,GAAG4B,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbM,EAAE,aAAeN,EAAE,aACnBM,EAAE,SAAWN,EAAE,SACfM,EAAE,YAAcN,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCM,EAAE,aAAeN,EAAE,eAGvBV,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKW,GAAWD,EAAIA,EAAE,IAAMK,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQL,EACR,KAAMM,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBX,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASc,GAAUC,EAA+B,CAChDlB,EAAQ,MAAQ,CACd,YAAakB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQtB,EAAQ,MAAM,KAAMuB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAGnC,IAAS,GAAGmC,EAAM,OAAQ,SAAU,CAAE,GAAGpC,EAAa,GAAGoC,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBb,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMiB,EAAgB5B,EAAgD,IAAM,CAC1E,MAAM6B,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,EAAmBnC,EAAS,KAC/B4B,EAAc,OAAS,CAAA,GAAI,QAASV,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EkB,EAAqBpC,EAAS,IAAM,CACxC,MAAM+B,EAAQH,EAAc,MACtB,EAAIpB,EAAQ,MAClB,MAAI,CAACuB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKb,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAIrB,EAAA,EAAE,aAAaqB,EAAE,EAAE,IAAnB,YAAArB,EAAsB,SAAU,IAAIqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKmB,GAAQ,4BAGRC,EAAatC,EAAiB,IAAM,CACxC,MAAM6B,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,EAAG,MAAO,0BACf,MAAMU,EAAMV,EAAE,IAAI,KAAA,EAClB,GAAI,CAACQ,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIV,EAAE,cAAgB,MAAQ1B,EAAU,MAAM,KAAMe,GAAMA,EAAE,MAAQqB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACV,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMW,EAAMZ,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACW,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACX,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKY,EAAQ3C,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKY,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAegC,IAAsB,CACnC,MAAMb,EAAIrB,EAAQ,MAClB,GAAI,CAACqB,EAAG,OACRjB,EAAO,MAAQ,GAIf,MAAM+B,EAA0D,CAC9D,GAAGd,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBY,EAAKZ,EAAE,OAAO,EACnC,iBAAkBY,EAAKZ,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKY,EAAKZ,EAAE,MAAM,CAAA,EAEvDjC,EAAI,MAAMD,EAAI,IAAkC,kBAAmBgD,CAAI,EAE7E,GADA/B,EAAO,MAAQ,GACX,CAAChB,EAAE,GAAI,CAGTiB,EAAU,MAAQE,EAAQnB,EAAG,mBAAmB,EAChD,MACF,CACAiB,EAAU,MAAQ,GAClB+B,EAAM,KAAMf,EAAE,KAAK,OAAS,OAAS,+DAAiE,QAAQ,EAC9GrB,EAAQ,MAAQ,KACXM,EAAA,CACP,CAEA,eAAe+B,GAAOnB,EAAwC,CAC5D,MAAM9B,EAAI,MAAMD,EAAI,IAAI,mBAAmB+B,EAAM,GAAG,EAAE,EACtD,GAAI,CAAC9B,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,qBAAqB,EAClD,MACF,CACAgD,EAAM,KAAM,WAAWlB,EAAM,GAAG,mCAAmC,EAC9DZ,EAAA,CACP,CAEA,eAAegC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAUzC,EAAY,KAAK,EACrDuC,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,8DAA8D,CAC/E,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAM9B,EAAId,EAAQ,MAAM,KAAMuB,GAAMA,EAAE,MAAQqB,EAAE,QAAQ,EACxD,OAAO9B,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAMA,SAAS+B,GAASD,EAAsB,CACtC,OAAIA,EAAE,YAAoB,iBAAiB/C,EAAS+C,EAAE,WAAW,CAAC,GAC3D,iCAAiCvD,EAAgB,MAAQ,KAAKQ,EAASR,EAAgB,KAAK,CAAC,IAAM,EAAE,EAC9G,CAGA,SAASyD,GAAUF,EAAsB,WACvC,MAAMjB,EAAkB,CAAA,EACxB,OAAIlC,EAAAmD,EAAE,sBAAF,MAAAnD,EAAuB,QAAQkC,EAAM,KAAK,WAAWiB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFG,EAAAH,EAAE,mBAAF,MAAAG,EAAoB,QAAQpB,EAAM,KAAK,aAAaiB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFI,EAAAJ,EAAE,iBAAF,MAAAI,EAAkB,QAAQrB,EAAM,KAAK,UAAUiB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEjB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,sCAIEsB,EA0WM,MAAA,KAAA,CAzWJC,EAyCM,MAzCNC,GAyCM,CAxCJD,EAqCM,MAAA,KAAA,CApCJA,EA2BK,KAAA,KAAA,iBA3BD,mBAEF,EAAA,GAAAE,EAwBYC,GAAA,CAxBD,MAAM,iCAA+B,WAC9C,IAII,CAAA,GAAAC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,CAJJJ,EAII,IAAA,KAAA,CAHFA,EAA0D,SAAvD,qDAAmD,IAAI,iMAG5D,CAAA,MACAA,EAMI,IAAA,KAAA,CALFA,EAA+C,SAA5C,0CAAwC,IAAI,sUAKjD,CAAA,MACAA,EAKI,IAAA,KAAA,CAJFA,EAAyD,SAAtD,oDAAkD,IAAI,6MAI3D,CAAA,MACAA,EAII,IAAA,KAAA,CAHFA,EAA4C,SAAzC,uCAAqC,IAAI,qMAG9C,CAAA,kBAGJA,EAOM,MAPNK,GAOM,iBAPW,mEAEf,EAAA,GAAAH,EAIWI,EAAA,CAJD,MAAM,kBAAgB,WAAC,IAIjC,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJiC,gMAIjC,EAAA,CAAA,6BAGJJ,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJhD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDqC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO1C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGJ,EAAA,WAAjBsD,EAAwEC,EAAA,OAA3C,KAAMvD,EAAA,MAAW,MAAM,iBAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArB6C,EAqPWU,EAAA,CAAA,IAAA,GAAA,CApPTT,EA6JU,UA7JVU,GA6JU,CA5JRV,EAYM,MAZNW,GAYM,CAXJT,EAAsDU,EAAA,CAA5C,OAAQ1D,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChD8C,EAMK,KANLa,GAMKC,EAJD5D,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4BX,EAAAW,EAAA,MAAQ,SAAR,YAAAX,EAAgB,SAAUW,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5I8C,EAA6F,OAA7Fe,GAA6FD,EAAvE5D,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvC8C,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FgB,GAA6F,GAAxEhB,EAAwD,QAAA,sCAAxC9C,EAAA,MAAQ,KAAK,QAAO+D,GAAE,KAAK,UAAA,iBAA3B/D,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnBgE,IAAAnB,EAQM,MARNoB,GAQM,CAPJnB,EAAuD,SAApD,yBAAsBc,EAAG5D,QAAQ,OAAO,KAAK,EAAA,CAAA,EAChD8C,EAAqC,IAAA,KAAAc,EAA/B5D,EAAA,MAAQ,OAAO,SAAS,EAAA,CAAA,EAC9B8C,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAM9C,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAAkE,EAAA,CAAA,eAKJpB,EAYM,MAZNqB,GAYM,CAXJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNsB,GAGM,CAFJtB,EAA8C,OAA9CuB,GAA8CT,EAArB/D,EAAA,KAAW,EAAA,CAAA,EACpCiD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,GAElDY,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,4QAKhB,EAAA,EAAA,GAGU9C,EAAA,MAAQ,sBAApBgE,IAAAnB,EAOM,MAPNyB,GAOM,CANJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA/D,EAAA,MAAQ,IAAG+D,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAQ,EAAAvE,EAAA,MAAQ,GAAG,CAAA,GACxCkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,QAAO,4JAGhB,EAAA,EAAA,IAGFA,EAIM,MAJN0B,GAIM,CAHJtB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqB9C,EAAA,MAAQ,KAAK,MAAK+D,GAAE,KAAK,OAAQ,cAAapB,EAAA3C,EAAA,MAAQ,SAAR,YAAA2C,EAAgB,QAAK,UAAA,iBAAnE3C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjD8C,EAAwH,IAAxH2B,GAAgB,6CAA0Cb,EAAG5D,QAAQ,KAAK,SAAS4C,EAAA5C,EAAA,MAAQ,SAAR,YAAA4C,EAAgB,aAAe,KAAE,CAAA,CAAA,GAItG5C,EAAA,MAAQ,KAAK,OAAI,YAAjC6C,EA0BWU,EAAA,CAAA,IAAA,CAAA,EAAA,CAzBOnC,EAAA,WAAhByB,EAeWU,EAAA,CAAA,IAAA,GAAA,QAdTV,EAGMU,EAAA,KAAAmB,EAHY/C,EAAA,MAANgD,QAAZ9B,EAGM,MAAA,CAH+B,IAAK8B,EAAI,MAAM,OAAA,GAClD7B,EAAmD,QAAA,CAA3C,UAAW6B,CAAE,EAAA,EAAOf,EAAAgB,GAAAnF,CAAA,EAASkF,CAAE,CAAA,EAAA,EAAAE,EAAA,IACvC/B,EAA4G,QAAA,CAApG,SAAU6B,CAAE,4BAAa3E,EAAA,MAAQ,aAAa2E,CAAE,EAAAZ,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/D/D,EAAA,MAAQ,aAAa2E,CAAE,CAAA,CAAA,aAE1D7B,EASM,MATNgC,GASM,CARJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBlB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAmD,EAAA,EAC5GjC,EAKI,IALJkC,GAAgB,4BACUpB,EAAGjC,QAAiB,OAAM,EAAA,IAAA,EAAA,EAAkB,eACjEsD,EAAAjF,EAAA,MAAQ,SAAR,YAAAiF,EAAgB,KAAK,EAAG,qLAG7B,CAAA,CAAA,UAGJjB,IAAAnB,EAQM,MARNqC,GAQM,CAPJhC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,aAAY+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtE/D,EAAA,MAAQ,KAAK,YAAY,CAAA,iBACzD8C,EAII,IAAA,CAJD,MAAM,QAAM,GAAC,eACF,EAAAA,EAA+C,YAAzC,oCAAkC,IAAO,yKAG7D,CAAA,yBAIJA,EAGM,MAHNqC,GAGM,CAFJjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,SAAQ+D,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnE/D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvD8C,EAOM,MAPNsC,GAOM,CANJlC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAI,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAa,GAAA/D,EAAA,MAAQ,OAAM+D,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAQ,EAAAvE,EAAA,MAAQ,MAAM,CAAA,GAC9C8C,EAGI,IAHJuC,GAAgB,gBAEdzB,EAAG5D,EAAA,MAAQ,UAAS,oDAAA,iDAAA,EAAA,CAAA,CAAA,GAIxB8C,EAGM,MAHNwC,GAGM,CAFJpC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsB9C,EAAA,MAAQ,KAAK,OAAM+D,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa/D,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhC6C,EAkDU,UAAA,OAlDqC,MAAM,UAAW,KAAI,CAAG7C,EAAA,MAAQ,MAAA,GAC7EkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHNyC,GAGM,CAFJrC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoB9C,EAAA,MAAQ,KAAK,aAAY+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlD/D,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzD8C,EAGM,MAHN0C,GAGM,CAFJtC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqB9C,EAAA,MAAQ,KAAK,SAAQ+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9C/D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtD8C,EAIM,MAJN2C,GAIM,CAHJvC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwB9C,EAAA,MAAQ,KAAK,YAAW+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjD/D,EAAA,MAAQ,KAAK,WAAW,CAAA,GAC1DkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAgH,IAAA,CAA7G,MAAM,QAAO,+FAA4F,EAAA,EAAA,GAE9GA,EAQM,MARN4C,GAQM,eAPJ5C,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsB9C,EAAA,MAAQ,KAAK,UAAS+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C/D,EAAA,MAAQ,KAAK,SAAS,CAAA,GACtDkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,QAAO,6LAIhB,EAAA,EAAA,GAEFA,EASM,MATN6C,GASM,eARJ7C,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0B9C,EAAA,MAAQ,KAAK,UAAS+D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C/D,EAAA,MAAQ,KAAK,SAAS,CAAA,GAC1DkD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAKI,IAAA,CALD,MAAM,QAAO,wTAKhB,EAAA,EAAA,GAGFA,EAOK,KAPL8C,GAOK,iBAP6C,kBAEhD,EAAA,GAAA5C,EAIWI,EAAA,CAJD,MAAM,gBAAc,WAAC,IAI/B,CAAA,GAAAF,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAJ+B,4LAI/B,EAAA,CAAA,aAEFJ,EAKM,MALN+C,GAKM,MAJJhD,EAGMU,EAAA,KAAAmB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALoB,GAAZhD,EAGM,MAAA,CAH2E,IAAKgD,EAAG,MAAM,cAAA,GAC7FhD,EAAuC,QAAA,CAA/B,UAAWgD,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5BjD,EAAgH,QAAA,CAAxG,SAAUgD,CAAC,GAAa,sBAAA/B,GAAA/D,EAAA,MAAQ,KAAK,SAAS8F,CAAC,EAAA/B,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAQ,EAAAvE,EAAA,MAAQ,KAAK,SAAS8F,CAAC,CAAA,CAAA,gCAO/DhD,EA0EU,UA1EVkD,GA0EU,eAzERlD,EAAkF,MAAA,CAA7E,MAAM,SAAO,CAACA,EAAyD,KAAA,CAArD,MAAM,SAAA,EAAU,kCAAgC,CAAA,qBACvEA,EAOI,IAAA,CAPD,MAAM,OAAK,GAAC,0NAGoB,EAAAA,EACuB,SADpB,wGACgB,IAAI,+MAG1D,CAAA,OACAA,EASM,MATNmD,GASM,CARJ/C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,QAAO+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAQ,EAAAvE,EAAA,MAAQ,OAAO,CAAA,iBAChD8C,EAKI,IAAA,CALD,MAAM,QAAM,GAAC,kEACiD,EAAAA,EAChB,SADmB,qEACvB,IAAI,yEAChB,EAAAA,EAAuB,YAAjB,YAAU,IAAO,yDAExD,CAAA,SAGFA,EAWM,MAXNoD,GAWM,CAVJhD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,UAAS+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAQ,EAAAvE,EAAA,MAAQ,SAAS,CAAA,srBAW3CA,EAAA,MAAQ,KAAK,OAAI,UAA5BgE,IAAAnB,EAYM,MAZNsD,GAYM,CAXJjD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAa,GAAA/D,EAAA,MAAQ,OAAM+D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAQ,EAAAvE,EAAA,MAAQ,MAAM,CAAA,iBAC9C8C,EAQI,IAAA,CARD,MAAM,QAAM,GAAC,wBACO,EAAAA,EAAgC,SAA7B,2BAAyB,IAAI,iDAC3C,EAAAA,EAAyB,YAAnB,cAAY,IAAO,+KAEC,EAAAA,EAAqD,SAAlD,gDAA8C,IAAI,sNAI3F,CAAA,eAEFD,EAII,IAJJuD,GAAuB,2LAIvB,GAKAtD,EAiBM,MAjBNuD,GAiBM,CAhBJnD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAA8D,QAAA,CAAvD,IAAI,UAAA,EAAW,mCAAgC,EAAA,GACtDE,EAKEsD,GAAA,CAJA,GAAG,sBACMrG,EAAA,6CAAAA,EAAU,MAAA8D,GACnB,MAAM,8CACL,QAASxE,GAAA,KAAA,mCAEZuD,EAQI,IARJyD,GAQI,iBARY,oMAId,EAAA,GAAArD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAAwC,SAArC,oCAAiC,EAAA,GAAI0D,EAAA,kGAExC5C,EAAG3E,EAAA,MAAe,SAAYA,EAAA,KAAe,cAAiB,0DAEhE,CAAA,CAAA,OAIaoB,EAAA,WAAjBgD,EAAmEC,EAAA,OAAtC,KAAMjD,EAAA,MAAW,MAAM,YAAA,6BAEpDyC,EAKM,MALN2D,GAKM,CAJJzD,EAEe0D,EAAA,CAFD,QAAQ,UAAW,QAAStG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM0B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOI,EAAA,aAC5H,IAA2D,CAAxDsE,EAAA5C,EAAA5D,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExB8C,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAO9C,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnBwD,EAAA,EAAAnB,EAkBU,UAlBV8D,GAkBU,CAjBR7D,EAIM,MAJN8D,GAIM,CAHJ9D,EAAsF,KAAtF+D,GAAsFjD,EAA/DjE,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCmD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJnD,EAAA,MAAU,YAAxBkD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO1C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/E+C,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAII,IAAA,CAJD,MAAM,KAAA,EAAM,0PAIf,EAAA,GACAA,EAMM,MANNgE,GAMM,QALJjE,EAISU,EAAA,KAAAmB,EAJWjE,GAAA,MAALa,GAAC,kBAAhBuB,EAIS,SAAA,CAJyB,IAAKvB,EAAE,GAAI,MAAM,WAAY,QAAKyC,GAAEjD,GAASQ,CAAC,CAAA,GAC9E0B,EAA0DU,EAAA,CAAhD,SAAQrE,EAAAiC,EAAE,SAAF,YAAAjC,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpDyD,EAA0B,OAAA,KAAAc,EAAjBtC,EAAE,KAAK,EAAA,CAAA,EAChBwB,EAA2F,OAA3FiE,GAA2FnD,EAA5DtC,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvBvB,EAAA,oBAAtB8C,EA0CWU,EAAA,CAAA,IAAA,GAAA,CAzCTT,EA4BU,UA5BVkE,GA4BU,eA3BRlE,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBNmE,GAqBM,EApBJjD,EAAA,EAAA,EAAAnB,EAmBMU,EAAA,KAAAmB,EAnBgB/E,EAAA,MAAS,CAAlBe,EAAGwG,SAAhBrE,EAmBM,MAAA,CAnB4B,IAAKnC,EAAE,IAAK,MAAM,WAAY,gBAAgBwG,EAAC,CAAA,GAC/ElE,EAAkDU,EAAA,CAAxC,OAAQhD,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CoC,EAUM,MAVNqE,GAUM,CATJrE,EAIM,MAJNsE,GAIM,CAHJtE,EAA2B,IAAA,KAAAc,EAArBlD,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBoC,EAAqC,OAArCuE,GAAqCzD,EAAflD,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBmC,EAAgE,OAAhEyE,GAAiD,UAAQ,KAE3DxE,EAGM,MAHNyE,GAGM,KAFDhF,GAAU7B,EAAE,MAAM,GAAI,MAAGkD,EAAGlB,GAAUhC,EAAE,MAAM,CAAA,EAAI,MAAGkD,EAAGnB,GAAS/B,EAAE,MAAM,CAAA,EAAI,cACxE,CAAA,EAAAsC,EAAkCwE,GAAA,CAAnB,GAAI9G,EAAE,SAAA,qBAGjCoC,EAKM,MALN2E,GAKM,CAJJ3E,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKiB,GAAE9C,GAAUP,CAAC,CAAA,EAAG,OAAI,EAAAgH,EAAA,EACnD1E,EAEe0D,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAYhG,EAAE,GAAG,IAAM,MAAGqD,GAAE1B,GAAO3B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAAwC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,+DAINJ,EAGI,IAAA,CAHD,MAAM,OAAO,MAAA,CAAA,YAAA,cAAA,aAAA,WAAA,CAAA,EAAsD,sKAGtE,EAAA,EAAA,GAGFA,EAUU,UAVV6E,GAUU,eATR7E,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDI,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAJ,EAGI,IAAA,CAHD,MAAM,KAAA,EAAM,qKAGf,EAAA,GACAA,EAGM,MAHN8E,GAGM,CAFJ9E,EAA8C,OAA9C+E,GAA8CjE,EAArB/D,EAAA,KAAW,EAAA,CAAA,EACpCiD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,gBAzTtDe,EAAyCyE,GAAA,OAAX,KAAM,CAAA"}

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-CwCTE4yP.js → StateBadge.vue_vue_type_script_setup_true_lang-jkd_ejVw.js}

@@ -1,2 +1,2 @@
-import{d as s,c as t,E as n,a as o,f as r,t as c,u as l,M as p,o as d}from"./index-IvJmpI3b.js";const u=s({__name:"StateBadge",props:{state:{}},setup(e){return(m,a)=>(d(),t("span",{class:n(["badge",e.state])},[a[0]||(a[0]=o("span",{class:"dot"},null,-1)),r(" "+c(l(p)(e.state)),1)],2))}});export{u as _};
-//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-CwCTE4yP.js.map
+import{d as s,c as t,E as n,a as o,f as r,t as c,u as l,M as p,o as d}from"./index-BzdU0RNE.js";const u=s({__name:"StateBadge",props:{state:{}},setup(e){return(m,a)=>(d(),t("span",{class:n(["badge",e.state])},[a[0]||(a[0]=o("span",{class:"dot"},null,-1)),r(" "+c(l(p)(e.state)),1)],2))}});export{u as _};
+//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-jkd_ejVw.js.map

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-CwCTE4yP.js.map → StateBadge.vue_vue_type_script_setup_true_lang-jkd_ejVw.js.map}

@@ -1 +1 @@
-{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-CwCTE4yP.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing\n *   queued  grey · cancelled  grey · superseded  grey\n *\n * THE THREE GREYS ARE DELIBERATE, and they are grey because none of them is an alarm:\n *\n *   `cancelled` — someone meant to stop it. Not `ok` either: whatever the job had already done was\n *   left exactly as it was, which is why the job page puts a banner under this badge.\n *   `queued`    — it has not started. Waiting is the system working as designed (one job per stack,\n *   and a host-wide cap), so it must not borrow `running`'s blue, and it must not PULSE — the pulse\n *   is what says \"something is happening right now\", and nothing is.\n *   `superseded` — a newer job for the same stack replaced it while it waited. It never ran, so\n *   there is nothing out there from it; routine, and quieter than cancelled if anything.\n *\n * Only `running` pulses (`.badge.running .dot` in app.css). The three greys fall through to the\n * base `.badge` rule with no colour of their own — which is the correct severity, not an oversight,\n * so do not \"finish\" them with a hue.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2KAiCEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}
+{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-jkd_ejVw.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing\n *   queued  grey · cancelled  grey · superseded  grey\n *\n * THE THREE GREYS ARE DELIBERATE, and they are grey because none of them is an alarm:\n *\n *   `cancelled` — someone meant to stop it. Not `ok` either: whatever the job had already done was\n *   left exactly as it was, which is why the job page puts a banner under this badge.\n *   `queued`    — it has not started. Waiting is the system working as designed (one job per stack,\n *   and a host-wide cap), so it must not borrow `running`'s blue, and it must not PULSE — the pulse\n *   is what says \"something is happening right now\", and nothing is.\n *   `superseded` — a newer job for the same stack replaced it while it waited. It never ran, so\n *   there is nothing out there from it; routine, and quieter than cancelled if anything.\n *\n * Only `running` pulses (`.badge.running .dot` in app.css). The three greys fall through to the\n * base `.badge` rule with no colour of their own — which is the correct severity, not an oversight,\n * so do not \"finish\" them with a hue.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2KAiCEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}

package/dist/assets/{SubmitView-Dxre5OJU.js → SubmitView-D5UffFTS.js}

@@ -1,4 +1,4 @@
-import{d as Z,j as h,p as E,N as O,c as n,a as t,t as m,f as o,F as w,e as p,w as y,g as v,E as _,i as V,v as I,_ as R,a2 as F,r as q,z as ee,k as N,l as te,o as a,n as se,J as oe,U as le,C as ae,a1 as M}from"./index-IvJmpI3b.js";import{a as ne,w as ie,p as z,r as re}from"./useVars-VN9gYdR6.js";import{_ as de}from"./ActionButton.vue_vue_type_script_setup_true_lang-DBfqkgMV.js";import{_ as ue}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DrinGQ_J.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-Be64GoXx.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-C7bhFOYU.js";import"./VarIO-BcNlaWXO.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";import"./Teleport-bdITH--T.js";const me={class:"page-head"},ye={class:"sub"},ce={class:"panel"},he={key:0,class:"banner warn"},fe={key:0},ke={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},xe={class:"field",style:{"max-width":"280px"}},$e={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},Ce={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Te={class:"check"},Ve={class:"check"},Re={class:"field",style:{"max-width":"340px"}},Ne={key:0,class:"hint"},Ae={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"hint"},We={class:"hint"},je={class:"row",style:{"margin-top":"var(--s5)"}},De={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},Oe={key:1,class:"s-ok"},Fe={key:6,class:"banner warn"},qe={key:0},Me={key:7,class:"banner warn"},ze=`services:
+import{d as Z,j as h,p as E,N as O,c as n,a as t,t as m,f as o,F as w,e as p,w as y,g as v,E as _,i as V,v as I,_ as R,a4 as F,r as q,z as ee,k as N,l as te,o as a,n as se,J as oe,U as le,C as ae,a1 as M}from"./index-BzdU0RNE.js";import{a as ne,w as ie,p as z,r as re}from"./useVars-VN9gYdR6.js";import{_ as de}from"./ActionButton.vue_vue_type_script_setup_true_lang-CB94t3xm.js";import{_ as ue}from"./ErrorNote.vue_vue_type_script_setup_true_lang-Imao12aK.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-uS04X_Kj.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-JY8m6tfk.js";import"./VarIO-DkbGdmrU.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";import"./Teleport-DwPgOPS3.js";const me={class:"page-head"},ye={class:"sub"},ce={class:"panel"},he={key:0,class:"banner warn"},fe={key:0},ke={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},xe={class:"field",style:{"max-width":"280px"}},$e={class:"mute",style:{"align-self":"end","padding-bottom":"10px"}},Ce={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Te={class:"check"},Ve={class:"check"},Re={class:"field",style:{"max-width":"340px"}},Ne={key:0,class:"hint"},Ae={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"hint"},We={class:"hint"},je={class:"row",style:{"margin-top":"var(--s5)"}},De={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},Oe={key:1,class:"s-ok"},Fe={key:6,class:"banner warn"},qe={key:0},Me={key:7,class:"banner warn"},ze=`services:
   app:
     image: nginx:alpine
     profiles: [app]
@@ -47,4 +47,4 @@ axes:
 kind: isolated
 stack: pr-\${PR}
 axes: []`},null,512),[[I,l.value.spec]])]),t("div",Ie,[e[40]||(e[40]=t("label",{for:"compose"},[o("compose.yml "),t("span",{class:"mute"},"(optional)")],-1)),V(t("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>l.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml, so a compose file named compose.yml resolves"},null,512),[[I,l.value.compose]])]),t("p",Pe,[e[42]||(e[42]=o(" Hooks must be inline shell or an absolute path. ",-1)),p(R,{label:"why a relative script path does not work"},{default:y(()=>[...e[41]||(e[41]=[o(" A deployment directory only ever holds ",-1),t("code",null,"spec.yml",-1),o(" and ",-1),t("code",null,"compose.yml",-1),o(", and hooks run from there — so ",-1),t("code",null,"up: ./hooks/db.sh",-1),o(" has nothing to find. ",-1)])]),_:1})])],64)),e[57]||(e[57]=t("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),p(pe,{modelValue:f.value,"onUpdate:modelValue":e[6]||(e[6]=i=>f.value=i)},null,8,["modelValue"]),t("p",We,[e[44]||(e[44]=o(" Saved with the deployment, so tearing it down later targets the same stack. ",-1)),p(R,{label:"how variables are remembered"},{default:y(()=>[...e[43]||(e[43]=[o(" They are stored on the server where it supports that, and in this browser either way — so the actions on the deployment page send exactly these values. ",-1)])]),_:1})]),t("div",je,[p(de,{variant:"primary",pending:x.value,disabled:!H.value,onClick:J},{default:y(()=>[o(m(x.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),r.value?v("",!0):(a(),n("span",De,[e[46]||(e[46]=o(" Nothing is saved until the spec is valid ",-1)),p(R,{label:"what happens on a rejected submission"},{default:y(()=>[...e[45]||(e[45]=[o(" The spec is checked before anything is written, so a rejected submission leaves nothing behind — and a replace never destroys a good record over a typo. Whether the deployment is shared or isolated comes from the spec, not from this form. ",-1)])]),_:1})])),r.value?(a(),n("span",Oe,[o(m(r.value.created?"Created":"Replaced")+" — stack ",1),t("b",null,m(r.value.stack),1),p(d,{to:`/deployments/${encodeURIComponent(r.value.id)}`,style:{"margin-left":"8px"}},{default:y(()=>[...e[47]||(e[47]=[o(" open → ",-1)])]),_:1},8,["to"])])):v("",!0)]),(U=(u=r.value)==null?void 0:u.stackSharedWith)!=null&&U.length?(a(),n("div",Fe,[t("b",null,"Another deployment already resolves to stack “"+m(r.value.stack)+"”.",1),t("p",null,[(a(!0),n(w,null,q(r.value.stackSharedWith,(i,Y)=>(a(),n(w,{key:i},[p(d,{to:`/deployments/${encodeURIComponent(i)}`},{default:y(()=>[o(m(i),1)]),_:2},1032,["to"]),Y<r.value.stackSharedWith.length-1?(a(),n("span",qe,", ")):v("",!0)],64))),128)),e[48]||(e[48]=o("— both records now drive the same compose project, so ",-1)),e[49]||(e[49]=t("code",null,"down",-1)),e[50]||(e[50]=o(" on either stops the other's containers and ",-1)),e[51]||(e[51]=t("code",null,"verify",-1)),e[52]||(e[52]=o(" on either reports the other's leaks. If that was not intended, change this one's ",-1)),e[53]||(e[53]=t("code",null,"stack",-1)),e[54]||(e[54]=o(" and save again. ",-1))])])):v("",!0),(D=(j=r.value)==null?void 0:j.swarmNotes)!=null&&D.length?(a(),n("div",Me,[e[55]||(e[55]=t("b",null,"Swarm will not run this compose file as written.",-1)),e[56]||(e[56]=t("p",null,[o(" Some keys are dropped and others are rewritten — "),t("code",null,"docker stack deploy"),o(" reports that once, to a terminal nobody is watching. Every change it makes to what you submitted: ")],-1)),t("ul",null,[(a(!0),n(w,null,q(r.value.swarmNotes,i=>(a(),n("li",{key:i},m(i),1))),128))])])):v("",!0),g.value?(a(),ee(ue,{key:8,text:g.value,title:"The server rejected this submission."},null,8,["text"])):v("",!0)])])}}});export{_e as default};
-//# sourceMappingURL=SubmitView-Dxre5OJU.js.map
+//# sourceMappingURL=SubmitView-D5UffFTS.js.map