@samyx/preview-stacks-ui 0.39.1 → 0.40.0

package/dist/assets/{SsoView-CxFylJ9d.js → SsoView-wGpab5Q8.js}

@@ -1,2 +1,2 @@
-import{d as pe,p as E,c as i,a as s,f as c,z as q,F as h,e as b,t as r,g as d,L as me,n as p,v as u,r as D,h as K,i as y,j as U,C as N,a6 as O,k as ve,o as n,u as ce,M as R,D as fe,ak as ye}from"./index-D_Ks6aQi.js";import{A as Q}from"./ActionButton-OewKsFrK.js";import{_ as X}from"./ErrorNote.vue_vue_type_script_setup_true_lang-FEOV8vdM.js";import{_ as ke}from"./RelativeTime.vue_vue_type_script_setup_true_lang-BxIqRu_b.js";import{_ as ge}from"./SelectMenu.vue_vue_type_script_setup_true_lang-CMLYr7A7.js";import{_ as he}from"./SkeletonList.vue_vue_type_script_setup_true_lang-D4pkKZAr.js";import{_ as T}from"./SsoMark.vue_vue_type_script_setup_true_lang-BU6ThRhq.js";import{_ as be}from"./_plugin-vue_export-helper-DlAUqK2U.js";const Ue={class:"page-head"},we={class:"panel"},Ce={class:"phead"},xe={class:"section"},$e={class:"mute"},_e={class:"check"},Re={key:0,class:"banner plain"},Ve=["href"],Se={class:"field"},Ie={class:"row sso-copy"},Ae={class:"sso-url"},Le={key:1,class:"field"},Ee={class:"field"},De=["placeholder"],Oe={class:"hint"},ze=["for"],Me=["id","onUpdate:modelValue"],je={class:"field"},qe=["data-incomplete"],Ke={key:1,class:"field"},Ne={class:"field"},Te={class:"field"},Be={class:"hint"},Ge={class:"field"},Pe=["placeholder"],We=["open"],Fe={class:"field"},He={class:"field"},Je={class:"field"},Qe={class:"field"},Xe={class:"field"},Ye={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},Ze=["for"],es=["id","onUpdate:modelValue"],ss={class:"panel"},ls={class:"field"},os={class:"field"},ts={key:0,class:"field"},as={class:"field"},ns={class:"hint"},is={class:"row",style:{gap:"var(--s3)"}},rs={key:3,class:"panel"},ds={class:"phead"},us={class:"section"},ps={class:"sso-tiles"},ms=["onClick"],vs={class:"sso-tile-mode"},cs={class:"panel"},fs={class:"sso-cards stagger"},ys={class:"sso-card-main"},ks={class:"sso-card-head"},gs={class:"mute"},hs={key:0,class:"badge off"},bs={class:"sso-card-sub"},Us={class:"row-actions"},ws=["onClick"],Cs={class:"panel"},xs={class:"row sso-copy"},$s={class:"sso-url"},B="inherit",_s=pe({__name:"SsoView",setup(Rs){const z={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},G=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",groupsUrl:"",scopes:"",claimMap:{...z},allowedEmailDomains:[],allowedUsernames:[],requiredGroups:[],defaultRole:""}),Y={viewer:"reads everything",developer:"deploys and tears down",maintainer:"host configuration",admin:"accounts and sign-on"},x=y("");E.get("/api/settings").then(l=>{var e;l.ok&&(x.value=String(((e=l.body.settings.find(a=>a.key==="default_role"))==null?void 0:e.value)??""))});const Z=U(()=>[{value:B,label:"The host default",hint:x.value?`${R(x.value)} today — follows Settings`:"set in Settings"},...ye.map(l=>({value:l,label:R(l),hint:Y[l]}))]),w=y([]),V=y([]),S=y(""),I=y(!1),k=y(""),o=y(null),P=U({get:()=>{var l;return((l=o.value)==null?void 0:l.form.defaultRole)||B},set:l=>{o.value&&(o.value.form.defaultRole=l===B?"":l)}}),$=y(!1),A=y(!1),C=y("");async function M(){const l=await E.get("/api/sso/config");if(I.value=!0,!l.ok){k.value=N(l,"read the sign-on settings");return}k.value="",w.value=l.body.providers??[],V.value=l.body.presets??[],S.value=l.body.callbackUrl}M();const W=U(()=>!o.value&&($.value||I.value&&!k.value&&w.value.length===0)),ee=U(()=>[...V.value.map(l=>({preset:l,id:l.key,label:l.label,mode:l.mode})),{preset:null,id:"custom-oauth2",label:"Custom OAuth 2.0",mode:"oauth2"},{preset:null,id:"custom-oidc",label:"Custom OpenID Connect",mode:"oidc"}]);function se(l){const e=new Set(w.value.map(a=>a.key));if(!e.has(l))return l;for(let a=2;;a++)if(!e.has(`${l}-${a}`))return`${l}-${a}`}function le(l){const e=l.preset,a=G();a.mode=l.mode,a.provider=e?e.key:l.mode==="oauth2"?"custom":"",e&&(a.label=e.label,a.scopes=e.scopes,a.claimMap={...z,...e.claimMap},e.mode==="oauth2"?(a.authorizeUrl=e.authorizeUrl,a.tokenUrl=e.tokenUrl,a.userInfoUrl=e.userInfoUrl):e.discoveryUrl.includes("<")||(a.discoveryUrl=e.discoveryUrl)),o.value={originalKey:null,key:se(e?e.key:l.mode==="oauth2"?"custom":"oidc"),preset:e,form:a,secret:"",secretSet:!1,domains:"",usernames:"",groups:"",placeholders:{}},C.value="",$.value=!1}function oe(l){o.value={originalKey:l.key,key:l.key,preset:V.value.find(e=>e.key===l.config.provider)??null,form:{...G(),...l.config,claimMap:{...z,...l.config.claimMap}},secret:"",secretSet:l.secretSet,domains:(l.config.allowedEmailDomains??[]).join(", "),usernames:(l.config.allowedUsernames??[]).join(", "),groups:(l.config.requiredGroups??[]).join(", "),placeholders:{}},C.value="",$.value=!1}const _=U(()=>{const l=o.value;if(!l||l.originalKey!==null||!l.preset||l.form.mode!=="oidc")return null;const e=l.preset.discoveryUrl;if(!e.includes("<"))return null;const a=[],m=/<([^>]+)>/g;let v=0;for(let f=m.exec(e);f;f=m.exec(e))f.index>v&&a.push(e.slice(v,f.index)),a.push({ph:f[1]??""}),v=f.index+f[0].length;return v<e.length&&a.push(e.slice(v)),a}),te=U(()=>(_.value??[]).flatMap(l=>typeof l=="string"?[]:[l.ph])),L=U(()=>{const l=_.value,e=o.value;return!l||!e?"":l.map(a=>{var m;return typeof a=="string"?a:((m=e.placeholders[a.ph])==null?void 0:m.trim())||`<${a.ph}>`}).join("")}),ae=/^[a-z0-9][a-z0-9-]{0,31}$/,F=U(()=>{const l=o.value;if(!l)return"nothing is being edited";const e=l.key.trim();if(!ae.test(e))return"the key must be a lowercase slug of letters, digits and dashes (32 at most)";if(l.originalKey===null&&w.value.some(a=>a.key===e))return`a provider is already stored under "${e}" — edit that one instead, or pick another key`;if(!l.form.clientId.trim())return"the client id is required";if(!l.secretSet&&!l.secret.trim())return"the client secret is required";if(l.form.mode==="oidc"){const a=_.value?L.value:l.form.discoveryUrl.trim();if(!a)return"the issuer is required";if(a.includes("<"))return"fill in the issuer placeholder first"}else if(!l.form.authorizeUrl.trim()||!l.form.tokenUrl.trim())return"the authorize and token URLs are required";return""}),j=l=>l.split(",").map(e=>e.trim()).filter(Boolean);async function ne(){const l=o.value;if(!l)return;A.value=!0;const e={...l.form,key:l.key.trim(),clientSecret:l.secret.trim(),discoveryUrl:_.value?L.value:l.form.discoveryUrl,allowedEmailDomains:j(l.domains),allowedUsernames:j(l.usernames),requiredGroups:l.form.mode==="oidc"?[]:j(l.groups)},a=await E.put("/api/sso/config",e);if(A.value=!1,!a.ok){C.value=N(a,"save the provider");return}C.value="",O("ok",l.originalKey?"Saved.":`Added ${e.key}.`),o.value=null,M()}async function ie(l){const e=await E.del(`/api/sso/config/${l.key}`);if(!e.ok){k.value=N(e,"remove the provider");return}O("ok",`Removed ${l.key}. Its accounts keep working.`),M()}async function H(){try{await navigator.clipboard.writeText(S.value),O("ok","Copied.")}catch{O("error","Copy failed — select it and copy by hand.")}}function re(l){if(l.mode==="oidc")try{return`OpenID Connect · ${new URL(l.discoveryUrl).hostname}`}catch{return"OpenID Connect"}const e=V.value.find(a=>a.key===l.provider);return e?`OAuth 2.0 · ${e.label}`:"OAuth 2.0 · custom endpoints"}function de(l){return l.defaultRole?`new accounts: ${R(l.defaultRole)}`:`new accounts: the host default${x.value?` (${R(x.value)})`:""}`}function ue(l){var a,m,v;const e=[];return(a=l.allowedEmailDomains)!=null&&a.length&&e.push(`domains ${l.allowedEmailDomains.join(", ")}`),(m=l.allowedUsernames)!=null&&m.length&&e.push(`usernames ${l.allowedUsernames.join(", ")}`),(v=l.requiredGroups)!=null&&v.length&&e.push(`groups ${l.requiredGroups.join(", ")}`),e.length?`lets in ${e.join("; ")}`:"lets in anyone the provider allows"}return(l,e)=>{var m,v,f;const a=ve("RouterLink");return n(),i("div",null,[s("div",Ue,[e[19]||(e[19]=s("div",null,[s("h1",null,"Single sign-on"),s("div",{class:"sub"},"Sign in with the identity providers you already run")],-1)),e[20]||(e[20]=s("span",{class:"grow"},null,-1)),I.value&&!k.value&&!o.value&&!W.value?(n(),i("button",{key:0,class:"primary",onClick:e[0]||(e[0]=t=>$.value=!0)},"Add provider")):c("",!0)]),k.value?(n(),q(X,{key:0,text:k.value,title:"Could not read the sign-on settings."},null,8,["text"])):c("",!0),I.value?o.value?(n(),i(h,{key:2},[s("section",we,[s("div",Ce,[b(T,{preset:o.value.form.provider,size:20},null,8,["preset"]),s("h2",xe,r(o.value.originalKey?`Edit ${o.value.originalKey}`:`Add ${((m=o.value.preset)==null?void 0:m.label)??(o.value.form.mode==="oidc"?"an OpenID Connect issuer":"a custom OAuth 2.0 provider")}`),1),s("span",$e,r(o.value.form.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1),e[22]||(e[22]=s("span",{class:"grow"},null,-1)),s("label",_e,[d(s("input",{"onUpdate:modelValue":e[1]||(e[1]=t=>o.value.form.enabled=t),type:"checkbox"},null,512),[[me,o.value.form.enabled]]),e[21]||(e[21]=p(" Enabled",-1))])]),o.value.preset?(n(),i("div",Re,[s("p",null,[s("a",{href:o.value.preset.setupUrl,target:"_blank",rel:"noopener"}," Create the app in "+r(o.value.preset.label)+" → ",9,Ve)])])):c("",!0),s("div",Se,[e[23]||(e[23]=s("label",null,"Redirect URI",-1)),s("div",Ie,[s("code",Ae,r(S.value),1),s("button",{type:"button",onClick:H},"Copy")]),e[24]||(e[24]=s("p",{class:"hint"},"Must match the provider's registered callback exactly.",-1))]),o.value.originalKey?c("",!0):(n(),i("div",Le,[e[25]||(e[25]=s("label",{for:"sso-key"},"Key",-1)),d(s("input",{id:"sso-key","onUpdate:modelValue":e[2]||(e[2]=t=>o.value.key=t),type:"text",spellcheck:"false",class:"sso-key"},null,512),[[u,o.value.key]]),e[26]||(e[26]=s("p",{class:"hint"},"Lowercase letters, digits, dashes.",-1))])),s("div",Ee,[e[27]||(e[27]=s("label",{for:"sso-label"},"Button text",-1)),d(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=t=>o.value.form.label=t),type:"text",placeholder:((v=o.value.preset)==null?void 0:v.label)||"Acme SSO"},null,8,De),[[u,o.value.form.label]]),s("p",Oe,"“Continue with "+r(o.value.form.label||((f=o.value.preset)==null?void 0:f.label)||"…")+"”",1)]),o.value.form.mode==="oidc"?(n(),i(h,{key:2},[_.value?(n(),i(h,{key:0},[(n(!0),i(h,null,D(te.value,t=>(n(),i("div",{key:t,class:"field"},[s("label",{for:`ph-${t}`},r(ce(R)(t)),9,ze),d(s("input",{id:`ph-${t}`,"onUpdate:modelValue":g=>o.value.placeholders[t]=g,type:"text",spellcheck:"false",class:"sso-key"},null,8,Me),[[u,o.value.placeholders[t]]])]))),128)),s("div",je,[e[28]||(e[28]=s("label",null,"Issuer",-1)),s("code",{class:"sso-url","data-incomplete":L.value.includes("<")||void 0},r(L.value),9,qe),e[29]||(e[29]=s("p",{class:"hint"},"Fetched when you save.",-1))])],64)):(n(),i("div",Ke,[e[30]||(e[30]=s("label",{for:"sso-issuer"},"Issuer",-1)),d(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=t=>o.value.form.discoveryUrl=t),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[u,o.value.form.discoveryUrl]]),e[31]||(e[31]=s("p",{class:"hint"},"Fetched when you save.",-1))]))],64)):c("",!0),s("div",Ne,[e[32]||(e[32]=s("label",{for:"sso-client"},"Client id",-1)),d(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=t=>o.value.form.clientId=t),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[u,o.value.form.clientId]])]),s("div",Te,[e[33]||(e[33]=s("label",{for:"sso-secret"},"Client secret",-1)),d(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=t=>o.value.secret=t),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[u,o.value.secret]]),s("p",Be," Write-only. "+r(o.value.secretSet?"Leave empty to keep the stored secret.":"Never returned once saved."),1)]),s("div",Ge,[e[34]||(e[34]=s("label",{for:"sso-scopes"},"Scopes",-1)),d(s("input",{id:"sso-scopes","onUpdate:modelValue":e[7]||(e[7]=t=>o.value.form.scopes=t),type:"text",spellcheck:"false",placeholder:o.value.form.mode==="oidc"?"openid profile email":""},null,8,Pe),[[u,o.value.form.scopes]])]),o.value.form.mode==="oauth2"?(n(),i("details",{key:3,class:"sso-adv",open:!o.value.preset},[e[40]||(e[40]=s("summary",null,"Endpoints and claim mapping",-1)),s("div",Fe,[e[35]||(e[35]=s("label",{for:"sso-auth"},"Authorize URL",-1)),d(s("input",{id:"sso-auth","onUpdate:modelValue":e[8]||(e[8]=t=>o.value.form.authorizeUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.authorizeUrl]])]),s("div",He,[e[36]||(e[36]=s("label",{for:"sso-token"},"Token URL",-1)),d(s("input",{id:"sso-token","onUpdate:modelValue":e[9]||(e[9]=t=>o.value.form.tokenUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.tokenUrl]])]),s("div",Je,[e[37]||(e[37]=s("label",{for:"sso-userinfo"},"User info URL",-1)),d(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[10]||(e[10]=t=>o.value.form.userInfoUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.userInfoUrl]])]),s("div",Qe,[e[38]||(e[38]=s("label",{for:"sso-emails"},[p("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),d(s("input",{id:"sso-emails","onUpdate:modelValue":e[11]||(e[11]=t=>o.value.form.emailsUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.emailsUrl]])]),s("div",Xe,[e[39]||(e[39]=s("label",{for:"sso-groups-url"},[p("Groups URL "),s("span",{class:"mute"},"(optional)")],-1)),d(s("input",{id:"sso-groups-url","onUpdate:modelValue":e[12]||(e[12]=t=>o.value.form.groupsUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.groupsUrl]])]),e[41]||(e[41]=s("h3",{class:"section",style:{"margin-top":"var(--s4)"}},"Claim mapping",-1)),s("div",Ye,[(n(),i(h,null,D(["subject","username","email","name","avatar"],t=>s("div",{key:t,class:"field inline"},[s("label",{for:`cm-${t}`},r(t),9,Ze),d(s("input",{id:`cm-${t}`,"onUpdate:modelValue":g=>o.value.form.claimMap[t]=g,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,es),[[u,o.value.form.claimMap[t]]])])),64))])],8,We)):c("",!0)]),s("section",ss,[e[52]||(e[52]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets in")],-1)),e[53]||(e[53]=s("p",{class:"dim"}," Every filled list must match; empty lists restrict nobody. ",-1)),s("div",ls,[e[42]||(e[42]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),d(s("input",{id:"sso-domains","onUpdate:modelValue":e[13]||(e[13]=t=>o.value.domains=t),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[u,o.value.domains]]),e[43]||(e[43]=s("p",{class:"hint"},[p(" Comma-separated; subdomains count. "),s("b",null,"When set, a login with no address is refused.")],-1))]),s("div",os,[e[44]||(e[44]=s("label",{for:"sso-usernames"},"Allowed usernames",-1)),d(s("input",{id:"sso-usernames","onUpdate:modelValue":e[14]||(e[14]=t=>o.value.usernames=t),type:"text",spellcheck:"false",placeholder:"octocat, qa-[0-9]*"},null,512),[[u,o.value.usernames]]),e[45]||(e[45]=s("p",{class:"hint"},[p(" Comma-separated patterns: "),s("code",null,"*"),p(", "),s("code",null,"?"),p(", "),s("code",null,"[0-9]"),p(". "),s("b",null,"When set, a login with no username is refused.")],-1))]),o.value.form.mode==="oauth2"?(n(),i("div",ts,[e[46]||(e[46]=s("label",{for:"sso-groups"},"Required groups",-1)),d(s("input",{id:"sso-groups","onUpdate:modelValue":e[15]||(e[15]=t=>o.value.groups=t),type:"text",spellcheck:"false",placeholder:"acme, acme/backend"},null,512),[[u,o.value.groups]]),e[47]||(e[47]=s("p",{class:"hint"},[s("b",null,"Exact names, not patterns"),p(", comma-separated. Needs the matching scope above, or the save is refused. ")],-1))])):c("",!0),s("div",as,[e[51]||(e[51]=s("label",{for:"sso-role"},"New account role",-1)),b(ge,{id:"sso-role",modelValue:P.value,"onUpdate:modelValue":e[16]||(e[16]=t=>P.value=t),label:"Role for the accounts this provider creates",options:Z.value},null,8,["modelValue","options"]),s("p",ns,[e[49]||(e[49]=p(" Set at first sign-in. Host default follows ",-1)),b(a,{to:"/settings"},{default:K(()=>[...e[48]||(e[48]=[p("Settings",-1)])]),_:1}),e[50]||(e[50]=p(". ",-1))])])]),C.value?(n(),q(X,{key:0,text:C.value,title:"Not saved."},null,8,["text"])):c("",!0),s("div",is,[b(Q,{variant:"primary",pending:A.value,disabled:A.value||!!F.value,title:F.value||void 0,onClick:ne},{default:K(()=>[p(r(o.value.originalKey?"Save changes":"Add provider"),1)]),_:1},8,["pending","disabled","title"]),s("button",{class:"ghost",onClick:e[17]||(e[17]=t=>o.value=null)},"Cancel")])],64)):W.value?(n(),i("section",rs,[s("div",ds,[s("h2",us,r(w.value.length?"Add a provider":"Pick a provider"),1),e[54]||(e[54]=s("span",{class:"grow"},null,-1)),w.value.length?(n(),i("button",{key:0,class:"ghost",onClick:e[18]||(e[18]=t=>$.value=!1)},"Cancel")):c("",!0)]),e[55]||(e[55]=s("p",{class:"dim"},"Pick where your team already signs in.",-1)),s("div",ps,[(n(!0),i(h,null,D(ee.value,t=>{var g;return n(),i("button",{key:t.id,class:"sso-tile",onClick:J=>le(t)},[b(T,{preset:((g=t.preset)==null?void 0:g.key)??"custom",size:22},null,8,["preset"]),s("span",null,r(t.label),1),s("span",vs,r(t.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1)],8,ms)}),128))])])):k.value?c("",!0):(n(),i(h,{key:4},[s("section",cs,[e[57]||(e[57]=s("div",{class:"phead"},[s("h2",{class:"section"},"Providers")],-1)),s("div",fs,[(n(!0),i(h,null,D(w.value,(t,g)=>(n(),i("div",{key:t.key,class:"sso-card",style:fe({"--i":g})},[b(T,{preset:t.config.provider,size:22},null,8,["preset"]),s("div",ys,[s("div",ks,[s("b",null,r(t.config.label),1),s("code",gs,r(t.key),1),t.config.enabled?c("",!0):(n(),i("span",hs,"disabled"))]),s("div",bs,[p(r(re(t.config))+" · "+r(ue(t.config))+" · "+r(de(t.config))+" · updated ",1),b(ke,{at:t.updatedAt},null,8,["at"])])]),s("div",Us,[s("button",{class:"ghost sm",onClick:J=>oe(t)},"Edit",8,ws),b(Q,{variant:"ghost",class:"sm sso-remove",confirm:`Remove ${t.key}?`,onRun:J=>ie(t)},{default:K(()=>[...e[56]||(e[56]=[p(" Remove ",-1)])]),_:1},8,["confirm","onRun"])])],4))),128))])]),s("section",Cs,[e[58]||(e[58]=s("div",{class:"phead"},[s("h2",{class:"section"},"Callback URL")],-1)),e[59]||(e[59]=s("p",{class:"dim"},"Register this with every provider.",-1)),s("div",xs,[s("code",$s,r(S.value),1),s("button",{type:"button",onClick:H},"Copy")])])],64)):(n(),q(he,{key:1,rows:4}))])}}}),zs=be(_s,[["__scopeId","data-v-b02d5dfc"]]);export{zs as default};
-//# sourceMappingURL=SsoView-CxFylJ9d.js.map
+import{d as pe,p as E,c as i,a as s,f as c,z as q,F as h,e as b,t as r,g as d,L as me,n as p,v as u,r as D,h as K,i as y,j as U,C as N,a6 as O,k as ve,o as n,u as ce,M as R,D as fe,ak as ye}from"./index-DlhYSSKq.js";import{A as Q}from"./ActionButton-BaGfzZKv.js";import{_ as X}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DU01Dqor.js";import{_ as ke}from"./RelativeTime.vue_vue_type_script_setup_true_lang-B1_l0Vtf.js";import{_ as ge}from"./SelectMenu.vue_vue_type_script_setup_true_lang-PIaLSNsk.js";import{_ as he}from"./SkeletonList.vue_vue_type_script_setup_true_lang-7pKEuaEM.js";import{_ as T}from"./SsoMark.vue_vue_type_script_setup_true_lang-rMP20d_u.js";import{_ as be}from"./_plugin-vue_export-helper-DlAUqK2U.js";const Ue={class:"page-head"},we={class:"panel"},Ce={class:"phead"},xe={class:"section"},$e={class:"mute"},_e={class:"check"},Re={key:0,class:"banner plain"},Ve=["href"],Se={class:"field"},Ie={class:"row sso-copy"},Ae={class:"sso-url"},Le={key:1,class:"field"},Ee={class:"field"},De=["placeholder"],Oe={class:"hint"},ze=["for"],Me=["id","onUpdate:modelValue"],je={class:"field"},qe=["data-incomplete"],Ke={key:1,class:"field"},Ne={class:"field"},Te={class:"field"},Be={class:"hint"},Ge={class:"field"},Pe=["placeholder"],We=["open"],Fe={class:"field"},He={class:"field"},Je={class:"field"},Qe={class:"field"},Xe={class:"field"},Ye={class:"row",style:{"flex-wrap":"wrap",gap:"var(--s3)"}},Ze=["for"],es=["id","onUpdate:modelValue"],ss={class:"panel"},ls={class:"field"},os={class:"field"},ts={key:0,class:"field"},as={class:"field"},ns={class:"hint"},is={class:"row",style:{gap:"var(--s3)"}},rs={key:3,class:"panel"},ds={class:"phead"},us={class:"section"},ps={class:"sso-tiles"},ms=["onClick"],vs={class:"sso-tile-mode"},cs={class:"panel"},fs={class:"sso-cards stagger"},ys={class:"sso-card-main"},ks={class:"sso-card-head"},gs={class:"mute"},hs={key:0,class:"badge off"},bs={class:"sso-card-sub"},Us={class:"row-actions"},ws=["onClick"],Cs={class:"panel"},xs={class:"row sso-copy"},$s={class:"sso-url"},B="inherit",_s=pe({__name:"SsoView",setup(Rs){const z={subject:"sub",username:"preferred_username",email:"email",name:"name",avatar:"picture"},G=()=>({mode:"oidc",enabled:!0,label:"",clientId:"",discoveryUrl:"",provider:"",authorizeUrl:"",tokenUrl:"",userInfoUrl:"",emailsUrl:"",groupsUrl:"",scopes:"",claimMap:{...z},allowedEmailDomains:[],allowedUsernames:[],requiredGroups:[],defaultRole:""}),Y={viewer:"reads everything",developer:"deploys and tears down",maintainer:"host configuration",admin:"accounts and sign-on"},x=y("");E.get("/api/settings").then(l=>{var e;l.ok&&(x.value=String(((e=l.body.settings.find(a=>a.key==="default_role"))==null?void 0:e.value)??""))});const Z=U(()=>[{value:B,label:"The host default",hint:x.value?`${R(x.value)} today — follows Settings`:"set in Settings"},...ye.map(l=>({value:l,label:R(l),hint:Y[l]}))]),w=y([]),V=y([]),S=y(""),I=y(!1),k=y(""),o=y(null),P=U({get:()=>{var l;return((l=o.value)==null?void 0:l.form.defaultRole)||B},set:l=>{o.value&&(o.value.form.defaultRole=l===B?"":l)}}),$=y(!1),A=y(!1),C=y("");async function M(){const l=await E.get("/api/sso/config");if(I.value=!0,!l.ok){k.value=N(l,"read the sign-on settings");return}k.value="",w.value=l.body.providers??[],V.value=l.body.presets??[],S.value=l.body.callbackUrl}M();const W=U(()=>!o.value&&($.value||I.value&&!k.value&&w.value.length===0)),ee=U(()=>[...V.value.map(l=>({preset:l,id:l.key,label:l.label,mode:l.mode})),{preset:null,id:"custom-oauth2",label:"Custom OAuth 2.0",mode:"oauth2"},{preset:null,id:"custom-oidc",label:"Custom OpenID Connect",mode:"oidc"}]);function se(l){const e=new Set(w.value.map(a=>a.key));if(!e.has(l))return l;for(let a=2;;a++)if(!e.has(`${l}-${a}`))return`${l}-${a}`}function le(l){const e=l.preset,a=G();a.mode=l.mode,a.provider=e?e.key:l.mode==="oauth2"?"custom":"",e&&(a.label=e.label,a.scopes=e.scopes,a.claimMap={...z,...e.claimMap},e.mode==="oauth2"?(a.authorizeUrl=e.authorizeUrl,a.tokenUrl=e.tokenUrl,a.userInfoUrl=e.userInfoUrl):e.discoveryUrl.includes("<")||(a.discoveryUrl=e.discoveryUrl)),o.value={originalKey:null,key:se(e?e.key:l.mode==="oauth2"?"custom":"oidc"),preset:e,form:a,secret:"",secretSet:!1,domains:"",usernames:"",groups:"",placeholders:{}},C.value="",$.value=!1}function oe(l){o.value={originalKey:l.key,key:l.key,preset:V.value.find(e=>e.key===l.config.provider)??null,form:{...G(),...l.config,claimMap:{...z,...l.config.claimMap}},secret:"",secretSet:l.secretSet,domains:(l.config.allowedEmailDomains??[]).join(", "),usernames:(l.config.allowedUsernames??[]).join(", "),groups:(l.config.requiredGroups??[]).join(", "),placeholders:{}},C.value="",$.value=!1}const _=U(()=>{const l=o.value;if(!l||l.originalKey!==null||!l.preset||l.form.mode!=="oidc")return null;const e=l.preset.discoveryUrl;if(!e.includes("<"))return null;const a=[],m=/<([^>]+)>/g;let v=0;for(let f=m.exec(e);f;f=m.exec(e))f.index>v&&a.push(e.slice(v,f.index)),a.push({ph:f[1]??""}),v=f.index+f[0].length;return v<e.length&&a.push(e.slice(v)),a}),te=U(()=>(_.value??[]).flatMap(l=>typeof l=="string"?[]:[l.ph])),L=U(()=>{const l=_.value,e=o.value;return!l||!e?"":l.map(a=>{var m;return typeof a=="string"?a:((m=e.placeholders[a.ph])==null?void 0:m.trim())||`<${a.ph}>`}).join("")}),ae=/^[a-z0-9][a-z0-9-]{0,31}$/,F=U(()=>{const l=o.value;if(!l)return"nothing is being edited";const e=l.key.trim();if(!ae.test(e))return"the key must be a lowercase slug of letters, digits and dashes (32 at most)";if(l.originalKey===null&&w.value.some(a=>a.key===e))return`a provider is already stored under "${e}" — edit that one instead, or pick another key`;if(!l.form.clientId.trim())return"the client id is required";if(!l.secretSet&&!l.secret.trim())return"the client secret is required";if(l.form.mode==="oidc"){const a=_.value?L.value:l.form.discoveryUrl.trim();if(!a)return"the issuer is required";if(a.includes("<"))return"fill in the issuer placeholder first"}else if(!l.form.authorizeUrl.trim()||!l.form.tokenUrl.trim())return"the authorize and token URLs are required";return""}),j=l=>l.split(",").map(e=>e.trim()).filter(Boolean);async function ne(){const l=o.value;if(!l)return;A.value=!0;const e={...l.form,key:l.key.trim(),clientSecret:l.secret.trim(),discoveryUrl:_.value?L.value:l.form.discoveryUrl,allowedEmailDomains:j(l.domains),allowedUsernames:j(l.usernames),requiredGroups:l.form.mode==="oidc"?[]:j(l.groups)},a=await E.put("/api/sso/config",e);if(A.value=!1,!a.ok){C.value=N(a,"save the provider");return}C.value="",O("ok",l.originalKey?"Saved.":`Added ${e.key}.`),o.value=null,M()}async function ie(l){const e=await E.del(`/api/sso/config/${l.key}`);if(!e.ok){k.value=N(e,"remove the provider");return}O("ok",`Removed ${l.key}. Its accounts keep working.`),M()}async function H(){try{await navigator.clipboard.writeText(S.value),O("ok","Copied.")}catch{O("error","Copy failed — select it and copy by hand.")}}function re(l){if(l.mode==="oidc")try{return`OpenID Connect · ${new URL(l.discoveryUrl).hostname}`}catch{return"OpenID Connect"}const e=V.value.find(a=>a.key===l.provider);return e?`OAuth 2.0 · ${e.label}`:"OAuth 2.0 · custom endpoints"}function de(l){return l.defaultRole?`new accounts: ${R(l.defaultRole)}`:`new accounts: the host default${x.value?` (${R(x.value)})`:""}`}function ue(l){var a,m,v;const e=[];return(a=l.allowedEmailDomains)!=null&&a.length&&e.push(`domains ${l.allowedEmailDomains.join(", ")}`),(m=l.allowedUsernames)!=null&&m.length&&e.push(`usernames ${l.allowedUsernames.join(", ")}`),(v=l.requiredGroups)!=null&&v.length&&e.push(`groups ${l.requiredGroups.join(", ")}`),e.length?`lets in ${e.join("; ")}`:"lets in anyone the provider allows"}return(l,e)=>{var m,v,f;const a=ve("RouterLink");return n(),i("div",null,[s("div",Ue,[e[19]||(e[19]=s("div",null,[s("h1",null,"Single sign-on"),s("div",{class:"sub"},"Sign in with the identity providers you already run")],-1)),e[20]||(e[20]=s("span",{class:"grow"},null,-1)),I.value&&!k.value&&!o.value&&!W.value?(n(),i("button",{key:0,class:"primary",onClick:e[0]||(e[0]=t=>$.value=!0)},"Add provider")):c("",!0)]),k.value?(n(),q(X,{key:0,text:k.value,title:"Could not read the sign-on settings."},null,8,["text"])):c("",!0),I.value?o.value?(n(),i(h,{key:2},[s("section",we,[s("div",Ce,[b(T,{preset:o.value.form.provider,size:20},null,8,["preset"]),s("h2",xe,r(o.value.originalKey?`Edit ${o.value.originalKey}`:`Add ${((m=o.value.preset)==null?void 0:m.label)??(o.value.form.mode==="oidc"?"an OpenID Connect issuer":"a custom OAuth 2.0 provider")}`),1),s("span",$e,r(o.value.form.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1),e[22]||(e[22]=s("span",{class:"grow"},null,-1)),s("label",_e,[d(s("input",{"onUpdate:modelValue":e[1]||(e[1]=t=>o.value.form.enabled=t),type:"checkbox"},null,512),[[me,o.value.form.enabled]]),e[21]||(e[21]=p(" Enabled",-1))])]),o.value.preset?(n(),i("div",Re,[s("p",null,[s("a",{href:o.value.preset.setupUrl,target:"_blank",rel:"noopener"}," Create the app in "+r(o.value.preset.label)+" → ",9,Ve)])])):c("",!0),s("div",Se,[e[23]||(e[23]=s("label",null,"Redirect URI",-1)),s("div",Ie,[s("code",Ae,r(S.value),1),s("button",{type:"button",onClick:H},"Copy")]),e[24]||(e[24]=s("p",{class:"hint"},"Must match the provider's registered callback exactly.",-1))]),o.value.originalKey?c("",!0):(n(),i("div",Le,[e[25]||(e[25]=s("label",{for:"sso-key"},"Key",-1)),d(s("input",{id:"sso-key","onUpdate:modelValue":e[2]||(e[2]=t=>o.value.key=t),type:"text",spellcheck:"false",class:"sso-key"},null,512),[[u,o.value.key]]),e[26]||(e[26]=s("p",{class:"hint"},"Lowercase letters, digits, dashes.",-1))])),s("div",Ee,[e[27]||(e[27]=s("label",{for:"sso-label"},"Button text",-1)),d(s("input",{id:"sso-label","onUpdate:modelValue":e[3]||(e[3]=t=>o.value.form.label=t),type:"text",placeholder:((v=o.value.preset)==null?void 0:v.label)||"Acme SSO"},null,8,De),[[u,o.value.form.label]]),s("p",Oe,"“Continue with "+r(o.value.form.label||((f=o.value.preset)==null?void 0:f.label)||"…")+"”",1)]),o.value.form.mode==="oidc"?(n(),i(h,{key:2},[_.value?(n(),i(h,{key:0},[(n(!0),i(h,null,D(te.value,t=>(n(),i("div",{key:t,class:"field"},[s("label",{for:`ph-${t}`},r(ce(R)(t)),9,ze),d(s("input",{id:`ph-${t}`,"onUpdate:modelValue":g=>o.value.placeholders[t]=g,type:"text",spellcheck:"false",class:"sso-key"},null,8,Me),[[u,o.value.placeholders[t]]])]))),128)),s("div",je,[e[28]||(e[28]=s("label",null,"Issuer",-1)),s("code",{class:"sso-url","data-incomplete":L.value.includes("<")||void 0},r(L.value),9,qe),e[29]||(e[29]=s("p",{class:"hint"},"Fetched when you save.",-1))])],64)):(n(),i("div",Ke,[e[30]||(e[30]=s("label",{for:"sso-issuer"},"Issuer",-1)),d(s("input",{id:"sso-issuer","onUpdate:modelValue":e[4]||(e[4]=t=>o.value.form.discoveryUrl=t),type:"text",spellcheck:"false",placeholder:"https://accounts.google.com"},null,512),[[u,o.value.form.discoveryUrl]]),e[31]||(e[31]=s("p",{class:"hint"},"Fetched when you save.",-1))]))],64)):c("",!0),s("div",Ne,[e[32]||(e[32]=s("label",{for:"sso-client"},"Client id",-1)),d(s("input",{id:"sso-client","onUpdate:modelValue":e[5]||(e[5]=t=>o.value.form.clientId=t),type:"text",spellcheck:"false",autocomplete:"off"},null,512),[[u,o.value.form.clientId]])]),s("div",Te,[e[33]||(e[33]=s("label",{for:"sso-secret"},"Client secret",-1)),d(s("input",{id:"sso-secret","onUpdate:modelValue":e[6]||(e[6]=t=>o.value.secret=t),type:"password",spellcheck:"false",autocomplete:"new-password"},null,512),[[u,o.value.secret]]),s("p",Be," Write-only. "+r(o.value.secretSet?"Leave empty to keep the stored secret.":"Never returned once saved."),1)]),s("div",Ge,[e[34]||(e[34]=s("label",{for:"sso-scopes"},"Scopes",-1)),d(s("input",{id:"sso-scopes","onUpdate:modelValue":e[7]||(e[7]=t=>o.value.form.scopes=t),type:"text",spellcheck:"false",placeholder:o.value.form.mode==="oidc"?"openid profile email":""},null,8,Pe),[[u,o.value.form.scopes]])]),o.value.form.mode==="oauth2"?(n(),i("details",{key:3,class:"sso-adv",open:!o.value.preset},[e[40]||(e[40]=s("summary",null,"Endpoints and claim mapping",-1)),s("div",Fe,[e[35]||(e[35]=s("label",{for:"sso-auth"},"Authorize URL",-1)),d(s("input",{id:"sso-auth","onUpdate:modelValue":e[8]||(e[8]=t=>o.value.form.authorizeUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.authorizeUrl]])]),s("div",He,[e[36]||(e[36]=s("label",{for:"sso-token"},"Token URL",-1)),d(s("input",{id:"sso-token","onUpdate:modelValue":e[9]||(e[9]=t=>o.value.form.tokenUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.tokenUrl]])]),s("div",Je,[e[37]||(e[37]=s("label",{for:"sso-userinfo"},"User info URL",-1)),d(s("input",{id:"sso-userinfo","onUpdate:modelValue":e[10]||(e[10]=t=>o.value.form.userInfoUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.userInfoUrl]])]),s("div",Qe,[e[38]||(e[38]=s("label",{for:"sso-emails"},[p("Emails URL "),s("span",{class:"mute"},"(optional)")],-1)),d(s("input",{id:"sso-emails","onUpdate:modelValue":e[11]||(e[11]=t=>o.value.form.emailsUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.emailsUrl]])]),s("div",Xe,[e[39]||(e[39]=s("label",{for:"sso-groups-url"},[p("Groups URL "),s("span",{class:"mute"},"(optional)")],-1)),d(s("input",{id:"sso-groups-url","onUpdate:modelValue":e[12]||(e[12]=t=>o.value.form.groupsUrl=t),type:"text",spellcheck:"false"},null,512),[[u,o.value.form.groupsUrl]])]),e[41]||(e[41]=s("h3",{class:"section",style:{"margin-top":"var(--s4)"}},"Claim mapping",-1)),s("div",Ye,[(n(),i(h,null,D(["subject","username","email","name","avatar"],t=>s("div",{key:t,class:"field inline"},[s("label",{for:`cm-${t}`},r(t),9,Ze),d(s("input",{id:`cm-${t}`,"onUpdate:modelValue":g=>o.value.form.claimMap[t]=g,type:"text",spellcheck:"false",style:{width:"11rem"}},null,8,es),[[u,o.value.form.claimMap[t]]])])),64))])],8,We)):c("",!0)]),s("section",ss,[e[52]||(e[52]=s("div",{class:"phead"},[s("h2",{class:"section"},"Who gets in")],-1)),e[53]||(e[53]=s("p",{class:"dim"}," Every filled list must match; empty lists restrict nobody. ",-1)),s("div",ls,[e[42]||(e[42]=s("label",{for:"sso-domains"},"Allowed email domains",-1)),d(s("input",{id:"sso-domains","onUpdate:modelValue":e[13]||(e[13]=t=>o.value.domains=t),type:"text",spellcheck:"false",placeholder:"example.com, corp.example"},null,512),[[u,o.value.domains]]),e[43]||(e[43]=s("p",{class:"hint"},[p(" Comma-separated; subdomains count. "),s("b",null,"When set, a login with no address is refused.")],-1))]),s("div",os,[e[44]||(e[44]=s("label",{for:"sso-usernames"},"Allowed usernames",-1)),d(s("input",{id:"sso-usernames","onUpdate:modelValue":e[14]||(e[14]=t=>o.value.usernames=t),type:"text",spellcheck:"false",placeholder:"octocat, qa-[0-9]*"},null,512),[[u,o.value.usernames]]),e[45]||(e[45]=s("p",{class:"hint"},[p(" Comma-separated patterns: "),s("code",null,"*"),p(", "),s("code",null,"?"),p(", "),s("code",null,"[0-9]"),p(". "),s("b",null,"When set, a login with no username is refused.")],-1))]),o.value.form.mode==="oauth2"?(n(),i("div",ts,[e[46]||(e[46]=s("label",{for:"sso-groups"},"Required groups",-1)),d(s("input",{id:"sso-groups","onUpdate:modelValue":e[15]||(e[15]=t=>o.value.groups=t),type:"text",spellcheck:"false",placeholder:"acme, acme/backend"},null,512),[[u,o.value.groups]]),e[47]||(e[47]=s("p",{class:"hint"},[s("b",null,"Exact names, not patterns"),p(", comma-separated. Needs the matching scope above, or the save is refused. ")],-1))])):c("",!0),s("div",as,[e[51]||(e[51]=s("label",{for:"sso-role"},"New account role",-1)),b(ge,{id:"sso-role",modelValue:P.value,"onUpdate:modelValue":e[16]||(e[16]=t=>P.value=t),label:"Role for the accounts this provider creates",options:Z.value},null,8,["modelValue","options"]),s("p",ns,[e[49]||(e[49]=p(" Set at first sign-in. Host default follows ",-1)),b(a,{to:"/settings"},{default:K(()=>[...e[48]||(e[48]=[p("Settings",-1)])]),_:1}),e[50]||(e[50]=p(". ",-1))])])]),C.value?(n(),q(X,{key:0,text:C.value,title:"Not saved."},null,8,["text"])):c("",!0),s("div",is,[b(Q,{variant:"primary",pending:A.value,disabled:A.value||!!F.value,title:F.value||void 0,onClick:ne},{default:K(()=>[p(r(o.value.originalKey?"Save changes":"Add provider"),1)]),_:1},8,["pending","disabled","title"]),s("button",{class:"ghost",onClick:e[17]||(e[17]=t=>o.value=null)},"Cancel")])],64)):W.value?(n(),i("section",rs,[s("div",ds,[s("h2",us,r(w.value.length?"Add a provider":"Pick a provider"),1),e[54]||(e[54]=s("span",{class:"grow"},null,-1)),w.value.length?(n(),i("button",{key:0,class:"ghost",onClick:e[18]||(e[18]=t=>$.value=!1)},"Cancel")):c("",!0)]),e[55]||(e[55]=s("p",{class:"dim"},"Pick where your team already signs in.",-1)),s("div",ps,[(n(!0),i(h,null,D(ee.value,t=>{var g;return n(),i("button",{key:t.id,class:"sso-tile",onClick:J=>le(t)},[b(T,{preset:((g=t.preset)==null?void 0:g.key)??"custom",size:22},null,8,["preset"]),s("span",null,r(t.label),1),s("span",vs,r(t.mode==="oidc"?"OpenID Connect":"OAuth 2.0"),1)],8,ms)}),128))])])):k.value?c("",!0):(n(),i(h,{key:4},[s("section",cs,[e[57]||(e[57]=s("div",{class:"phead"},[s("h2",{class:"section"},"Providers")],-1)),s("div",fs,[(n(!0),i(h,null,D(w.value,(t,g)=>(n(),i("div",{key:t.key,class:"sso-card",style:fe({"--i":g})},[b(T,{preset:t.config.provider,size:22},null,8,["preset"]),s("div",ys,[s("div",ks,[s("b",null,r(t.config.label),1),s("code",gs,r(t.key),1),t.config.enabled?c("",!0):(n(),i("span",hs,"disabled"))]),s("div",bs,[p(r(re(t.config))+" · "+r(ue(t.config))+" · "+r(de(t.config))+" · updated ",1),b(ke,{at:t.updatedAt},null,8,["at"])])]),s("div",Us,[s("button",{class:"ghost sm",onClick:J=>oe(t)},"Edit",8,ws),b(Q,{variant:"ghost",class:"sm sso-remove",confirm:`Remove ${t.key}?`,onRun:J=>ie(t)},{default:K(()=>[...e[56]||(e[56]=[p(" Remove ",-1)])]),_:1},8,["confirm","onRun"])])],4))),128))])]),s("section",Cs,[e[58]||(e[58]=s("div",{class:"phead"},[s("h2",{class:"section"},"Callback URL")],-1)),e[59]||(e[59]=s("p",{class:"dim"},"Register this with every provider.",-1)),s("div",xs,[s("code",$s,r(S.value),1),s("button",{type:"button",onClick:H},"Copy")])])],64)):(n(),q(he,{key:1,rows:4}))])}}}),zs=be(_s,[["__scopeId","data-v-b02d5dfc"]]);export{zs as default};
+//# sourceMappingURL=SsoView-wGpab5Q8.js.map

package/dist/assets/{SsoView-CxFylJ9d.js.map → SsoView-wGpab5Q8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"SsoView-CxFylJ9d.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * FOUR THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n *   4. The role its accounts are created at is ON SCREEN, and its resting state is INHERIT. This\n *      field existed on the wire from the start and was never drawn, so the form sent whatever\n *      `blank()` happened to hold — which was `admin`, explicitly, for every provider anyone added\n *      here. Inherit is the empty string, resolved against the host's `default_role` when an\n *      account is provisioned rather than frozen at save time; it can only ever resolve to viewer\n *      on a host that set nothing, never to admin by omission.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport { ROLES, type ClaimMap, type HostSettings, type Role, type SsoConfig, type SsoConfigResponse, type SsoPreset, type SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  // EMPTY = INHERIT the host's default role, resolved when the account is provisioned rather than\n  // frozen into the provider now — so raising or lowering the host default moves every inheriting\n  // provider with it. It resolves to viewer on a host where nobody set one, and never to admin.\n  //\n  // THE HISTORY, because losing it is how this comes back: this line said 'admin', and since the\n  // form never rendered the field, every provider added here sent `defaultRole: \"admin\"`\n  // EXPLICITLY — which the server honours. Anyone who completed the OAuth flow against such a\n  // provider became a full administrator, and the viewer default the server grew in 0.32.0 was\n  // defeated through the most common path there is. It then said 'viewer', which was safe but still\n  // a value chosen by a form nobody could see.\n  //\n  // Now the field is on screen with this as its resting state, so granting the most privilege this\n  // product has is something a person picked, in words.\n  defaultRole: '',\n});\n\n/**\n * The select's stand-in for \"inherit\". It cannot be `''`: reka's `SelectItem` throws on an\n * empty-string value (that is how it clears a selection and shows the placeholder), so the empty\n * string the API wants is mapped at the binding rather than stored in the form.\n */\nconst INHERIT = 'inherit';\n\n/** One line each, in the picker itself — a role name alone does not say what it costs to grant. */\nconst ROLE_WHAT: Record<Role, string> = {\n  viewer: 'reads everything',\n  developer: 'deploys and tears down',\n  maintainer: 'host configuration',\n  admin: 'accounts and sign-on',\n};\n\n/**\n * The host's own default, read only so \"inherit\" can say what it currently resolves to. Best\n * effort: an older server has no such route, and the option still reads correctly without it.\n */\nconst hostDefaultRole = ref('');\nvoid api.get<HostSettings>('/api/settings').then((r) => {\n  if (r.ok) hostDefaultRole.value = String(r.body.settings.find((s) => s.key === 'default_role')?.value ?? '');\n});\n\nconst roleOptions = computed(() => [\n  {\n    value: INHERIT,\n    label: 'The host default',\n    hint: hostDefaultRole.value ? `${sentence(hostDefaultRole.value)} today — follows Settings` : 'set in Settings',\n  },\n  ...ROLES.map((r) => ({ value: r, label: sentence(r), hint: ROLE_WHAT[r] })),\n]);\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup link and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\n\n/** `''` on the wire, the sentinel in the control. Nothing else in the form needs translating. */\nconst roleChoice = computed<string>({\n  get: () => editing.value?.form.defaultRole || INHERIT,\n  set: (v) => {\n    if (editing.value) editing.value.form.defaultRole = v === INHERIT ? '' : v;\n  },\n});\n\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.originalKey ? 'Saved.' : `Added ${body.key}.`);\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Its accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Copy failed — select it and copy by hand.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/**\n * The card's third fact: what an account this provider mints is created as — visible in the list\n * because a provider that hands out admin should not need opening to find that out.\n */\nfunction roleLine(c: SsoConfig): string {\n  if (c.defaultRole) return `new accounts: ${sentence(c.defaultRole)}`;\n  return `new accounts: the host default${hostDefaultRole.value ? ` (${sentence(hostDefaultRole.value)})` : ''}`;\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Single sign-on</h1>\n        <div class=\"sub\">Sign in with the identity providers you already run</div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Could not read the sign-on settings.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- Where to create the app. The preset's own `setupHint` prose is deliberately not drawn. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">Must match the provider's registered callback exactly.</p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">Lowercase letters, digits, dashes.</p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">“Continue with {{ editing.form.label || editing.preset?.label || '…' }}”</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">Fetched when you save.</p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">Fetched when you save.</p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'Leave empty to keep the stored secret.' : 'Never returned once saved.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n\n          <!-- Which key of the provider's user response holds each field; a preset fills these in. -->\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">Claim mapping</h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets in</h2></div>\n        <p class=\"dim\">\n          Every filled list must match; empty lists restrict nobody.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. <b>When set, a login with no address is refused.</b>\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns: <code>*</code>, <code>?</code>, <code>[0-9]</code>.\n            <b>When set, a login with no username is refused.</b>\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            <b>Exact names, not patterns</b>, comma-separated. Needs the matching scope above, or\n            the save is refused.\n          </p>\n        </div>\n\n        <!-- Never rendered before today, while the form quietly sent `admin`. Every account this\n             provider mints is created at this role, so it is the one field on the page that decides\n             what a stranger who completes the OAuth flow can do. -->\n        <div class=\"field\">\n          <label for=\"sso-role\">New account role</label>\n          <SelectMenu\n            id=\"sso-role\"\n            v-model=\"roleChoice\"\n            label=\"Role for the accounts this provider creates\"\n            :options=\"roleOptions\"\n          />\n          <p class=\"hint\">\n            Set at first sign-in. Host default follows\n            <RouterLink to=\"/settings\">Settings</RouterLink>.\n          </p>\n        </div>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">Pick where your team already signs in.</p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} · {{ roleLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">Register this with every provider.</p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["INHERIT","OIDC_CLAIMS","blank","ROLE_WHAT","hostDefaultRole","ref","api","r","_a","s","roleOptions","computed","sentence","ROLES","providers","presets","callbackUrl","loaded","listError","editing","roleChoice","v","picking","saving","formError","load","problem","showPicker","pickerTiles","p","suggestKey","base","taken","n","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","keyRe","cannotSave","key","url","list","save","body","toast","remove","copyCallback","whereLine","c","roleLine","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createBlock","ErrorNote","_Fragment","_hoisted_2","_hoisted_3","_createVNode","SsoMark","_hoisted_4","_toDisplayString","_hoisted_5","_hoisted_6","$event","_openBlock","_hoisted_7","_hoisted_8","_hoisted_9","_cache","_hoisted_10","_hoisted_11","_hoisted_12","_vModelText","_hoisted_13","_hoisted_15","_renderList","ph","_unref","_hoisted_16","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_27","_hoisted_28","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","k","_hoisted_33","_hoisted_35","_hoisted_36","_hoisted_37","_hoisted_38","_hoisted_39","SelectMenu","_hoisted_40","_component_RouterLink","_hoisted_41","ActionButton","_createTextVNode","_hoisted_42","_hoisted_43","_hoisted_44","_hoisted_45","_hoisted_47","_hoisted_48","_hoisted_49","i","_hoisted_50","_hoisted_51","_hoisted_52","_hoisted_53","_hoisted_54","RelativeTime","_hoisted_55","_hoisted_56","_hoisted_57","_hoisted_58","_hoisted_59","SkeletonList"],"mappings":"m/DAwFMA,EAAU,4CAxChB,MAAMC,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAchB,YAAa,EAAA,GAWTE,EAAkC,CACtC,OAAQ,mBACR,UAAW,yBACX,WAAY,qBACZ,MAAO,sBAAA,EAOHC,EAAkBC,EAAI,EAAE,EACzBC,EAAI,IAAkB,eAAe,EAAE,KAAMC,GAAM,OAClDA,EAAE,KAAIH,EAAgB,MAAQ,SAAOI,EAAAD,EAAE,KAAK,SAAS,KAAME,GAAMA,EAAE,MAAQ,cAAc,IAApD,YAAAD,EAAuD,QAAS,EAAE,EAC7G,CAAC,EAED,MAAME,EAAcC,EAAS,IAAM,CACjC,CACE,MAAOX,EACP,MAAO,mBACP,KAAMI,EAAgB,MAAQ,GAAGQ,EAASR,EAAgB,KAAK,CAAC,4BAA8B,iBAAA,EAEhG,GAAGS,GAAM,IAAKN,IAAO,CAAE,MAAOA,EAAG,MAAOK,EAASL,CAAC,EAAG,KAAMJ,EAAUI,CAAC,GAAI,CAAA,CAC3E,EAEKO,EAAYT,EAAwB,EAAE,EACtCU,EAAUV,EAAiB,EAAE,EAC7BW,EAAcX,EAAI,EAAE,EACpBY,EAASZ,EAAI,EAAK,EAClBa,EAAYb,EAAI,EAAE,EAmBlBc,EAAUd,EAAoB,IAAI,EAGlCe,EAAaT,EAAiB,CAClC,IAAK,IAAA,OAAM,QAAAH,EAAAW,EAAQ,QAAR,YAAAX,EAAe,KAAK,cAAeR,GAC9C,IAAMqB,GAAM,CACNF,EAAQ,QAAOA,EAAQ,MAAM,KAAK,YAAcE,IAAMrB,EAAU,GAAKqB,EAC3E,CAAA,CACD,EAEKC,EAAUjB,EAAI,EAAK,EACnBkB,EAASlB,EAAI,EAAK,EAClBmB,EAAYnB,EAAI,EAAE,EAExB,eAAeoB,GAAsB,CACnC,MAAMlB,EAAI,MAAMD,EAAI,IAAuB,iBAAiB,EAE5D,GADAW,EAAO,MAAQ,GACX,CAACV,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,2BAA2B,EACxD,MACF,CACAW,EAAU,MAAQ,GAClBJ,EAAU,MAAQP,EAAE,KAAK,WAAa,CAAA,EACtCQ,EAAQ,MAAQR,EAAE,KAAK,SAAW,CAAA,EAClCS,EAAY,MAAQT,EAAE,KAAK,WAC7B,CACKkB,EAAA,EAGL,MAAME,EAAahB,EAAS,IAAM,CAACQ,EAAQ,QAAUG,EAAQ,OAAUL,EAAO,OAAS,CAACC,EAAU,OAASJ,EAAU,MAAM,SAAW,EAAG,EAEnIc,GAAcjB,EAAS,IAAM,CACjC,GAAGI,EAAQ,MAAM,IAAKc,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,GAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIlB,EAAU,MAAM,IAAKe,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAASE,EAAI,GAAKA,IAAK,GAAI,CAACD,EAAM,IAAI,GAAGD,CAAI,IAAIE,CAAC,EAAE,QAAU,GAAGF,CAAI,IAAIE,CAAC,EAC5E,CAEA,SAASC,GAASC,EAAmE,CACnF,MAAMN,EAAIM,EAAK,OACTC,EAAIlC,EAAA,EACVkC,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWP,EAAIA,EAAE,IAAMM,EAAK,OAAS,SAAW,SAAW,GACzDN,IACFO,EAAE,MAAQP,EAAE,MACZO,EAAE,OAASP,EAAE,OACbO,EAAE,SAAW,CAAE,GAAGnC,EAAa,GAAG4B,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbO,EAAE,aAAeP,EAAE,aACnBO,EAAE,SAAWP,EAAE,SACfO,EAAE,YAAcP,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCO,EAAE,aAAeP,EAAE,eAGvBV,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKW,GAAWD,EAAIA,EAAE,IAAMM,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQN,EACR,KAAMO,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBZ,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASe,GAAUC,EAA+B,CAChDnB,EAAQ,MAAQ,CACd,YAAamB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQvB,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAGpC,IAAS,GAAGoC,EAAM,OAAQ,SAAU,CAAE,GAAGrC,EAAa,GAAGqC,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBd,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMkB,EAAgB7B,EAAgD,IAAM,CAC1E,MAAM8B,EAAItB,EAAQ,MAClB,GAAI,CAACsB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,GAAmBpC,EAAS,KAC/B6B,EAAc,OAAS,CAAA,GAAI,QAASX,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EmB,EAAqBrC,EAAS,IAAM,CACxC,MAAMgC,EAAQH,EAAc,MACtB,EAAIrB,EAAQ,MAClB,MAAI,CAACwB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKd,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAIrB,EAAA,EAAE,aAAaqB,EAAE,EAAE,IAAnB,YAAArB,EAAsB,SAAU,IAAIqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKoB,GAAQ,4BAGRC,EAAavC,EAAiB,IAAM,CACxC,MAAM8B,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,MAAO,0BACf,MAAMU,EAAMV,EAAE,IAAI,KAAA,EAClB,GAAI,CAACQ,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIV,EAAE,cAAgB,MAAQ3B,EAAU,MAAM,KAAMe,GAAMA,EAAE,MAAQsB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACV,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMW,EAAMZ,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACW,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACX,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKY,EAAQ5C,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKY,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAeiC,IAAsB,CACnC,MAAMb,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,OACRlB,EAAO,MAAQ,GAIf,MAAMgC,EAA0D,CAC9D,GAAGd,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBY,EAAKZ,EAAE,OAAO,EACnC,iBAAkBY,EAAKZ,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKY,EAAKZ,EAAE,MAAM,CAAA,EAEvDlC,EAAI,MAAMD,EAAI,IAAkC,kBAAmBiD,CAAI,EAE7E,GADAhC,EAAO,MAAQ,GACX,CAAChB,EAAE,GAAI,CAGTiB,EAAU,MAAQE,EAAQnB,EAAG,mBAAmB,EAChD,MACF,CACAiB,EAAU,MAAQ,GAClBgC,EAAM,KAAMf,EAAE,YAAc,SAAW,SAASc,EAAK,GAAG,GAAG,EAC3DpC,EAAQ,MAAQ,KACXM,EAAA,CACP,CAEA,eAAegC,GAAOnB,EAAwC,CAC5D,MAAM/B,EAAI,MAAMD,EAAI,IAAI,mBAAmBgC,EAAM,GAAG,EAAE,EACtD,GAAI,CAAC/B,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,qBAAqB,EAClD,MACF,CACAiD,EAAM,KAAM,WAAWlB,EAAM,GAAG,8BAA8B,EACzDb,EAAA,CACP,CAEA,eAAeiC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAU1C,EAAY,KAAK,EACrDwC,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,2CAA2C,CAC5D,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAM/B,EAAId,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQqB,EAAE,QAAQ,EACxD,OAAO/B,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAMA,SAASgC,GAASD,EAAsB,CACtC,OAAIA,EAAE,YAAoB,iBAAiBhD,EAASgD,EAAE,WAAW,CAAC,GAC3D,iCAAiCxD,EAAgB,MAAQ,KAAKQ,EAASR,EAAgB,KAAK,CAAC,IAAM,EAAE,EAC9G,CAGA,SAAS0D,GAAUF,EAAsB,WACvC,MAAMjB,EAAkB,CAAA,EACxB,OAAInC,EAAAoD,EAAE,sBAAF,MAAApD,EAAuB,QAAQmC,EAAM,KAAK,WAAWiB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFG,EAAAH,EAAE,mBAAF,MAAAG,EAAoB,QAAQpB,EAAM,KAAK,aAAaiB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFI,EAAAJ,EAAE,iBAAF,MAAAI,EAAkB,QAAQrB,EAAM,KAAK,UAAUiB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEjB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,6DAIEsB,EA6PM,MAAA,KAAA,CA5PJC,EAOM,MAPNC,GAOM,eANJD,EAGM,MAAA,KAAA,CAFJA,EAAuB,UAAnB,gBAAc,EAClBA,EAA0E,MAAA,CAArE,MAAM,KAAA,EAAM,qDAAmD,CAAA,qBAEtEA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJjD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDsC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO3C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGJ,EAAA,WAAjBkD,EAA6FC,EAAA,OAAhE,KAAMnD,EAAA,MAAW,MAAM,sCAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArB8C,EAqLWK,EAAA,CAAA,IAAA,GAAA,CApLTJ,EAwHU,UAxHVK,GAwHU,CAvHRL,EAYM,MAZNM,GAYM,CAXJC,EAAsDC,EAAA,CAA5C,OAAQvD,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChD+C,EAMK,KANLS,GAMKC,EAJDzD,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4BX,EAAAW,EAAA,MAAQ,SAAR,YAAAX,EAAgB,SAAUW,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5I+C,EAA6F,OAA7FW,GAA6FD,EAAvEzD,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvC+C,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FY,GAA6F,GAAxEZ,EAAwD,QAAA,sCAAxC/C,EAAA,MAAQ,KAAK,QAAO4D,GAAE,KAAK,UAAA,iBAA3B5D,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnB6D,IAAAf,EAMM,MANNgB,GAMM,CALJf,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAM/C,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAA+D,EAAA,CAAA,eAKJhB,EAOM,MAPNiB,GAOM,CANJC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNmB,GAGM,CAFJnB,EAA8C,OAA9CoB,GAA8CV,EAArB5D,EAAA,KAAW,EAAA,CAAA,EACpCkD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,GAElD0B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0E,IAAA,CAAvE,MAAM,QAAO,yDAAsD,EAAA,EAAA,GAG5D/C,EAAA,MAAQ,sBAApB6D,IAAAf,EAIM,MAJNsB,GAIM,CAHJH,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAkB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,GAAA5D,EAAA,MAAQ,IAAG4D,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAS,EAAArE,EAAA,MAAQ,GAAG,CAAA,GACxCiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsD,IAAA,CAAnD,MAAM,QAAO,qCAAkC,EAAA,EAAA,IAGpDA,EAIM,MAJNuB,GAIM,CAHJL,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqB/C,EAAA,MAAQ,KAAK,MAAK4D,GAAE,KAAK,OAAQ,cAAahB,EAAA5C,EAAA,MAAQ,SAAR,YAAA4C,EAAgB,QAAK,UAAA,iBAAnE5C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjD+C,EAA4F,IAA5FwB,GAAgB,kBAAed,EAAGzD,QAAQ,KAAK,SAAS6C,EAAA7C,EAAA,MAAQ,SAAR,YAAA6C,EAAgB,aAAe,IAAC,CAAA,CAAA,GAI1E7C,EAAA,MAAQ,KAAK,OAAI,YAAjC8C,EAiBWK,EAAA,CAAA,IAAA,CAAA,EAAA,CAhBO9B,EAAA,WAAhByB,EAUWK,EAAA,CAAA,IAAA,GAAA,QATTL,EAGMK,EAAA,KAAAqB,EAHY5C,GAAA,MAAN6C,QAAZ3B,EAGM,MAAA,CAH+B,IAAK2B,EAAI,MAAM,OAAA,GAClD1B,EAAmD,QAAA,CAA3C,UAAW0B,CAAE,EAAA,EAAOhB,EAAAiB,GAAAjF,CAAA,EAASgF,CAAE,CAAA,EAAA,EAAAE,EAAA,IACvC5B,EAA4G,QAAA,CAApG,SAAU0B,CAAE,4BAAazE,EAAA,MAAQ,aAAayE,CAAE,EAAAb,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/D5D,EAAA,MAAQ,aAAayE,CAAE,CAAA,CAAA,aAE1D1B,EAIM,MAJN6B,GAIM,CAHJX,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBlB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAgD,EAAA,EAC5GZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,IAAA,CAAvC,MAAM,QAAO,yBAAsB,EAAA,EAAA,UAG1Cc,IAAAf,EAIM,MAJNgC,GAIM,CAHJb,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,aAAY4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtE5D,EAAA,MAAQ,KAAK,YAAY,CAAA,GACzDiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,IAAA,CAAvC,MAAM,QAAO,yBAAsB,EAAA,EAAA,mBAI1CA,EAGM,MAHNgC,GAGM,CAFJd,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,SAAQ4D,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnE5D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvD+C,EAOM,MAPNiC,GAOM,CANJf,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAkB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,GAAA5D,EAAA,MAAQ,OAAM4D,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAS,EAAArE,EAAA,MAAQ,MAAM,CAAA,GAC9C+C,EAGI,IAHJkC,GAAgB,gBAEdxB,EAAGzD,EAAA,MAAQ,UAAS,yCAAA,4BAAA,EAAA,CAAA,CAAA,GAIxB+C,EAGM,MAHNmC,GAGM,CAFJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,OAAM4D,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa5D,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhC8C,EAgCU,UAAA,OAhCqC,MAAM,UAAW,KAAI,CAAG9C,EAAA,MAAQ,MAAA,GAC7EiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHNoC,GAGM,CAFJlB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoB/C,EAAA,MAAQ,KAAK,aAAY4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlD5D,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzD+C,EAGM,MAHNqC,GAGM,CAFJnB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqB/C,EAAA,MAAQ,KAAK,SAAQ4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9C5D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtD+C,EAGM,MAHNsC,GAGM,CAFJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwB/C,EAAA,MAAQ,KAAK,YAAW4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjD5D,EAAA,MAAQ,KAAK,WAAW,CAAA,KAE5D+C,EAGM,MAHNuC,GAGM,eAFJvC,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsB/C,EAAA,MAAQ,KAAK,UAAS4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C5D,EAAA,MAAQ,KAAK,SAAS,CAAA,KAExD+C,EAGM,MAHNwC,GAGM,eAFJxC,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0B/C,EAAA,MAAQ,KAAK,UAAS4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C5D,EAAA,MAAQ,KAAK,SAAS,CAAA,mBAI5D+C,EAAoE,KAAA,CAAhE,MAAM,UAAU,MAAA,CAAA,aAAA,WAAA,CAAA,EAA8B,gBAAa,EAAA,GAC/DA,EAKM,MALNyC,GAKM,MAJJ1C,EAGMK,EAAA,KAAAqB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALiB,GAAZ1C,EAGM,MAAA,CAH2E,IAAK0C,EAAG,MAAM,cAAA,GAC7F1C,EAAuC,QAAA,CAA/B,UAAW0C,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5B3C,EAAgH,QAAA,CAAxG,SAAU0C,CAAC,GAAa,sBAAA7B,GAAA5D,EAAA,MAAQ,KAAK,SAASyF,CAAC,EAAA7B,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAS,EAAArE,EAAA,MAAQ,KAAK,SAASyF,CAAC,CAAA,CAAA,gCAO/D1C,EA+CU,UA/CV4C,GA+CU,eA9CR5C,EAA6D,MAAA,CAAxD,MAAM,SAAO,CAACA,EAAoC,KAAA,CAAhC,MAAM,SAAA,EAAU,aAAW,CAAA,OAClDkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAEI,IAAA,CAFD,MAAM,KAAA,EAAM,+DAEf,EAAA,GACAA,EAMM,MANN6C,GAMM,CALJ3B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,QAAO4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAS,EAAArE,EAAA,MAAQ,OAAO,CAAA,iBAChD+C,EAEI,IAAA,CAFD,MAAM,QAAM,GAAC,sCACqB,EAAAA,EAAoD,SAAjD,+CAA6C,CAAA,SAIvFA,EAOM,MAPN8C,GAOM,CANJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,UAAS4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAS,EAAArE,EAAA,MAAQ,SAAS,CAAA,iBACpD+C,EAGI,IAAA,CAHD,MAAM,QAAM,GAAC,6BACY,EAAAA,EAAc,YAAR,GAAC,IAAO,IAAE,EAAAA,EAAc,YAAR,GAAC,IAAO,IAAE,EAAAA,EAAkB,YAAZ,OAAK,IAAO,IAC5E,EAAAA,EAAqD,SAAlD,gDAA8C,CAAA,SAI1C/C,EAAA,MAAQ,KAAK,OAAI,UAA5B6D,IAAAf,EAOM,MAPNgD,GAOM,CANJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,OAAM4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAS,EAAArE,EAAA,MAAQ,MAAM,CAAA,iBAC9C+C,EAGI,IAAA,CAHD,MAAM,QAAM,CACbA,EAAgC,SAA7B,2BAAyB,IAAI,6EAElC,CAAA,mBAMFA,EAYM,MAZNgD,GAYM,CAXJ9B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA8C,QAAA,CAAvC,IAAI,UAAA,EAAW,mBAAgB,EAAA,GACtCO,EAKE0C,GAAA,CAJA,GAAG,sBACM/F,EAAA,6CAAAA,EAAU,MAAA2D,GACnB,MAAM,8CACL,QAASrE,EAAA,KAAA,mCAEZwD,EAGI,IAHJkD,GAGI,iBAHY,+CAEd,EAAA,GAAA3C,EAAgD4C,EAAA,CAApC,GAAG,aAAW,WAAC,IAAQ,CAAA,GAAAjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAR,WAAQ,EAAA,CAAA,2BAAa,KAClD,EAAA,EAAA,OAIa5D,EAAA,WAAjB4C,EAAmEC,EAAA,OAAtC,KAAM7C,EAAA,MAAW,MAAM,YAAA,6BAEpD0C,EAKM,MALNoD,GAKM,CAJJ7C,EAEe8C,EAAA,CAFD,QAAQ,UAAW,QAAShG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM2B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOI,EAAA,aAC5H,IAA2D,CAAxDkE,EAAA5C,EAAAzD,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExB+C,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAO/C,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnBqD,EAAA,EAAAf,EAcU,UAdVwD,GAcU,CAbRvD,EAIM,MAJNwD,GAIM,CAHJxD,EAAsF,KAAtFyD,GAAsF/C,EAA/D9D,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCoD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJpD,EAAA,MAAU,YAAxBmD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO3C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/E8D,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAyD,IAAA,CAAtD,MAAM,KAAA,EAAM,yCAAsC,EAAA,GACrDA,EAMM,MANN0D,GAMM,QALJ3D,EAISK,EAAA,KAAAqB,EAJW/D,GAAA,MAAL,GAAC,kBAAhBqC,EAIS,SAAA,CAJyB,IAAK,EAAE,GAAI,MAAM,WAAY,QAAKc,GAAE7C,GAAS,CAAC,CAAA,GAC9EuC,EAA0DC,EAAA,CAAhD,SAAQlE,EAAA,EAAE,SAAF,YAAAA,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpD0D,EAA0B,OAAA,KAAAU,EAAjB,EAAE,KAAK,EAAA,CAAA,EAChBV,EAA2F,OAA3F2D,GAA2FjD,EAA5D,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvB1D,EAAA,oBAAtB+C,EAmCWK,EAAA,CAAA,IAAA,GAAA,CAlCTJ,EAwBU,UAxBV4D,GAwBU,eAvBR5D,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBN6D,GAqBM,EApBJ/C,EAAA,EAAA,EAAAf,EAmBMK,EAAA,KAAAqB,EAnBgB7E,EAAA,MAAS,CAAlBe,EAAGmG,SAAhB/D,EAmBM,MAAA,CAnB4B,IAAKpC,EAAE,IAAK,MAAM,WAAY,gBAAgBmG,EAAC,CAAA,GAC/EvD,EAAkDC,EAAA,CAAxC,OAAQ7C,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CqC,EAUM,MAVN+D,GAUM,CATJ/D,EAIM,MAJNgE,GAIM,CAHJhE,EAA2B,IAAA,KAAAU,EAArB/C,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBqC,EAAqC,OAArCiE,GAAqCvD,EAAf/C,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBoC,EAAgE,OAAhEmE,GAAiD,UAAQ,KAE3DlE,EAGM,MAHNmE,GAGM,KAFD1E,GAAU9B,EAAE,MAAM,GAAI,MAAG+C,EAAGd,GAAUjC,EAAE,MAAM,CAAA,EAAI,MAAG+C,EAAGf,GAAShC,EAAE,MAAM,CAAA,EAAI,cACxE,CAAA,EAAA4C,EAAkC6D,GAAA,CAAnB,GAAIzG,EAAE,SAAA,qBAGjCqC,EAKM,MALNqE,GAKM,CAJJrE,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKa,GAAE1C,GAAUR,CAAC,CAAA,EAAG,OAAI,EAAA2G,EAAA,EACnD/D,EAEe8C,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAY1F,EAAE,GAAG,IAAM,MAAGkD,GAAEtB,GAAO5B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAAuD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,mDAMRlB,EAOU,UAPVuE,GAOU,eANRvE,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAqD,IAAA,CAAlD,MAAM,KAAA,EAAM,qCAAkC,EAAA,GACjDA,EAGM,MAHNwE,GAGM,CAFJxE,EAA8C,OAA9CyE,GAA8C/D,EAArB5D,EAAA,KAAW,EAAA,CAAA,EACpCkD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,gBA9OtDU,EAAyCwE,GAAA,OAAX,KAAM,CAAA"}
+{"version":3,"file":"SsoView-wGpab5Q8.js","sources":["../../src/views/SsoView.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * Single sign-on: the identity providers this host lets people sign in with.\n *\n * THE POINT OF THE PAGE is that nobody has to create accounts here any more. Whoever can\n * authenticate against the operator's directory can sign in, and the account appears on first\n * login. The provider keeps owning who is allowed — Google Workspace restricts to internal users,\n * a GitHub OAuth app can be org-approved — and this page deliberately does not rebuild that policy.\n *\n * The page is a LIST now, not one form: a host stores several providers, each under an\n * operator-chosen key. Three states, exclusive by construction —\n *   - the list        the stored providers as cards, plus the callback URL;\n *   - the picker      \"Add provider\": a grid of preset tiles. A preset knows everything about a\n *                     provider except the two values only the operator has (client id + secret),\n *                     so picking one leaves a form that is mostly already filled in;\n *   - the form        one provider being added or edited.\n *\n * FOUR THINGS THE FORM MUST NOT GET WRONG:\n *\n *   1. The callback URL is READ-ONLY and comes from the server. It has to match what is registered\n *      on the provider's side byte for byte, and a value typed here (or derived from\n *      `location.origin`) would drift from the one the flow actually sends the moment the UI is\n *      reached by a second hostname. It is ONE URL for every provider.\n *   2. The client secret is write-only. A read answers `secretSet` and nothing else; on an\n *      existing provider an EMPTY field means \"keep what is stored\" (the server's rule), so an\n *      operator editing the label cannot silently wipe it.\n *   3. A template preset's issuer (`https://<your-domain>.okta.com/…`) is not a value — the\n *      placeholder renders as its own required field and the URL is assembled in view, because the\n *      server refuses the template saved verbatim and the operator should never meet that refusal.\n *   4. The role its accounts are created at is ON SCREEN, and its resting state is INHERIT. This\n *      field existed on the wire from the start and was never drawn, so the form sent whatever\n *      `blank()` happened to hold — which was `admin`, explicitly, for every provider anyone added\n *      here. Inherit is the empty string, resolved against the host's `default_role` when an\n *      account is provisioned rather than frozen at save time; it can only ever resolve to viewer\n *      on a host that set nothing, never to admin by omission.\n */\nimport { computed, ref } from 'vue';\nimport { api, problem } from '../api/client';\nimport { ROLES, type ClaimMap, type HostSettings, type Role, type SsoConfig, type SsoConfigResponse, type SsoPreset, type SsoProviderEntry } from '../api/types';\nimport { sentence } from '../composables/useFormat';\nimport { toast } from '../composables/useToasts';\nimport ActionButton from '../components/ActionButton.vue';\nimport ErrorNote from '../components/ErrorNote.vue';\nimport RelativeTime from '../components/RelativeTime.vue';\nimport SelectMenu from '../components/SelectMenu.vue';\nimport SkeletonList from '../components/SkeletonList.vue';\nimport SsoMark from '../components/SsoMark.vue';\n\nconst OIDC_CLAIMS: ClaimMap = { subject: 'sub', username: 'preferred_username', email: 'email', name: 'name', avatar: 'picture' };\n\nconst blank = (): SsoConfig => ({\n  mode: 'oidc',\n  enabled: true,\n  label: '',\n  clientId: '',\n  discoveryUrl: '',\n  provider: '',\n  authorizeUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  emailsUrl: '',\n  groupsUrl: '',\n  scopes: '',\n  claimMap: { ...OIDC_CLAIMS },\n  allowedEmailDomains: [],\n  allowedUsernames: [],\n  requiredGroups: [],\n  // EMPTY = INHERIT the host's default role, resolved when the account is provisioned rather than\n  // frozen into the provider now — so raising or lowering the host default moves every inheriting\n  // provider with it. It resolves to viewer on a host where nobody set one, and never to admin.\n  //\n  // THE HISTORY, because losing it is how this comes back: this line said 'admin', and since the\n  // form never rendered the field, every provider added here sent `defaultRole: \"admin\"`\n  // EXPLICITLY — which the server honours. Anyone who completed the OAuth flow against such a\n  // provider became a full administrator, and the viewer default the server grew in 0.32.0 was\n  // defeated through the most common path there is. It then said 'viewer', which was safe but still\n  // a value chosen by a form nobody could see.\n  //\n  // Now the field is on screen with this as its resting state, so granting the most privilege this\n  // product has is something a person picked, in words.\n  defaultRole: '',\n});\n\n/**\n * The select's stand-in for \"inherit\". It cannot be `''`: reka's `SelectItem` throws on an\n * empty-string value (that is how it clears a selection and shows the placeholder), so the empty\n * string the API wants is mapped at the binding rather than stored in the form.\n */\nconst INHERIT = 'inherit';\n\n/** One line each, in the picker itself — a role name alone does not say what it costs to grant. */\nconst ROLE_WHAT: Record<Role, string> = {\n  viewer: 'reads everything',\n  developer: 'deploys and tears down',\n  maintainer: 'host configuration',\n  admin: 'accounts and sign-on',\n};\n\n/**\n * The host's own default, read only so \"inherit\" can say what it currently resolves to. Best\n * effort: an older server has no such route, and the option still reads correctly without it.\n */\nconst hostDefaultRole = ref('');\nvoid api.get<HostSettings>('/api/settings').then((r) => {\n  if (r.ok) hostDefaultRole.value = String(r.body.settings.find((s) => s.key === 'default_role')?.value ?? '');\n});\n\nconst roleOptions = computed(() => [\n  {\n    value: INHERIT,\n    label: 'The host default',\n    hint: hostDefaultRole.value ? `${sentence(hostDefaultRole.value)} today — follows Settings` : 'set in Settings',\n  },\n  ...ROLES.map((r) => ({ value: r, label: sentence(r), hint: ROLE_WHAT[r] })),\n]);\n\nconst providers = ref<SsoProviderEntry[]>([]);\nconst presets = ref<SsoPreset[]>([]);\nconst callbackUrl = ref('');\nconst loaded = ref(false);\nconst listError = ref('');\n\ntype Editing = {\n  /** null while adding; otherwise the stored key being edited. The key is the row's identity. */\n  originalKey: string | null;\n  key: string;\n  /** The preset the config came from, for the setup link and the template flow. */\n  preset: SsoPreset | null;\n  form: SsoConfig;\n  secret: string;\n  secretSet: boolean;\n  // The three rule lists are edited as comma-separated text, split on save. A `string[]` bound to\n  // an input cannot hold \"acme,\" while someone is still typing the second entry.\n  domains: string;\n  usernames: string;\n  groups: string;\n  /** One value per `<placeholder>` in a template preset's issuer, keyed by placeholder name. */\n  placeholders: Record<string, string>;\n};\nconst editing = ref<Editing | null>(null);\n\n/** `''` on the wire, the sentinel in the control. Nothing else in the form needs translating. */\nconst roleChoice = computed<string>({\n  get: () => editing.value?.form.defaultRole || INHERIT,\n  set: (v) => {\n    if (editing.value) editing.value.form.defaultRole = v === INHERIT ? '' : v;\n  },\n});\n\nconst picking = ref(false);\nconst saving = ref(false);\nconst formError = ref('');\n\nasync function load(): Promise<void> {\n  const r = await api.get<SsoConfigResponse>('/api/sso/config');\n  loaded.value = true;\n  if (!r.ok) {\n    listError.value = problem(r, 'read the sign-on settings');\n    return;\n  }\n  listError.value = '';\n  providers.value = r.body.providers ?? [];\n  presets.value = r.body.presets ?? [];\n  callbackUrl.value = r.body.callbackUrl;\n}\nvoid load();\n\n/** With nothing configured the picker IS the page — an empty list with a button would be a detour. */\nconst showPicker = computed(() => !editing.value && (picking.value || (loaded.value && !listError.value && providers.value.length === 0)));\n\nconst pickerTiles = computed(() => [\n  ...presets.value.map((p) => ({ preset: p as SsoPreset | null, id: p.key, label: p.label, mode: p.mode })),\n  { preset: null, id: 'custom-oauth2', label: 'Custom OAuth 2.0', mode: 'oauth2' as const },\n  { preset: null, id: 'custom-oidc', label: 'Custom OpenID Connect', mode: 'oidc' as const },\n]);\n\n/** A free slug for a second provider on the same preset: github, github-2, github-3… */\nfunction suggestKey(base: string): string {\n  const taken = new Set(providers.value.map((p) => p.key));\n  if (!taken.has(base)) return base;\n  for (let n = 2; ; n++) if (!taken.has(`${base}-${n}`)) return `${base}-${n}`;\n}\n\nfunction startAdd(tile: { preset: SsoPreset | null; mode: 'oidc' | 'oauth2' }): void {\n  const p = tile.preset;\n  const f = blank();\n  f.mode = tile.mode;\n  f.provider = p ? p.key : tile.mode === 'oauth2' ? 'custom' : '';\n  if (p) {\n    f.label = p.label;\n    f.scopes = p.scopes;\n    f.claimMap = { ...OIDC_CLAIMS, ...p.claimMap };\n    if (p.mode === 'oauth2') {\n      f.authorizeUrl = p.authorizeUrl;\n      f.tokenUrl = p.tokenUrl;\n      f.userInfoUrl = p.userInfoUrl;\n      // emailsUrl/groupsUrl left blank on purpose: the server fills the preset's own back in, and\n      // only while userInfoUrl is still the preset's — a self-hosted host's token must not be sent\n      // to the public endpoints.\n    } else if (!p.discoveryUrl.includes('<')) {\n      f.discoveryUrl = p.discoveryUrl;\n    }\n  }\n  editing.value = {\n    originalKey: null,\n    key: suggestKey(p ? p.key : tile.mode === 'oauth2' ? 'custom' : 'oidc'),\n    preset: p,\n    form: f,\n    secret: '',\n    secretSet: false,\n    domains: '',\n    usernames: '',\n    groups: '',\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\nfunction startEdit(entry: SsoProviderEntry): void {\n  editing.value = {\n    originalKey: entry.key,\n    key: entry.key,\n    preset: presets.value.find((x) => x.key === entry.config.provider) ?? null,\n    form: { ...blank(), ...entry.config, claimMap: { ...OIDC_CLAIMS, ...entry.config.claimMap } },\n    secret: '',\n    secretSet: entry.secretSet,\n    domains: (entry.config.allowedEmailDomains ?? []).join(', '),\n    usernames: (entry.config.allowedUsernames ?? []).join(', '),\n    groups: (entry.config.requiredGroups ?? []).join(', '),\n    placeholders: {},\n  };\n  formError.value = '';\n  picking.value = false;\n}\n\n/**\n * The template flow, add-mode only: an existing row's issuer is already concrete, whatever preset\n * it came from. Splits `https://<your-domain>.okta.com/…` into literals and placeholder names.\n */\nconst templateParts = computed<Array<string | { ph: string }> | null>(() => {\n  const e = editing.value;\n  if (!e || e.originalKey !== null || !e.preset || e.form.mode !== 'oidc') return null;\n  const t = e.preset.discoveryUrl;\n  if (!t.includes('<')) return null;\n  const parts: Array<string | { ph: string }> = [];\n  const re = /<([^>]+)>/g;\n  let last = 0;\n  for (let m = re.exec(t); m; m = re.exec(t)) {\n    if (m.index > last) parts.push(t.slice(last, m.index));\n    parts.push({ ph: m[1] ?? '' });\n    last = m.index + m[0].length;\n  }\n  if (last < t.length) parts.push(t.slice(last));\n  return parts;\n});\n\nconst placeholderNames = computed(() =>\n  (templateParts.value ?? []).flatMap((p) => (typeof p === 'string' ? [] : [p.ph])),\n);\n\n/** The issuer as assembled so far. An unfilled placeholder stays visible as `<name>`. */\nconst assembledDiscovery = computed(() => {\n  const parts = templateParts.value;\n  const e = editing.value;\n  if (!parts || !e) return '';\n  return parts.map((p) => (typeof p === 'string' ? p : e.placeholders[p.ph]?.trim() || `<${p.ph}>`)).join('');\n});\n\nconst keyRe = /^[a-z0-9][a-z0-9-]{0,31}$/;\n\n/** Why the save button is disabled — shown as its title, per the disabled-controls rule. */\nconst cannotSave = computed<string>(() => {\n  const e = editing.value;\n  if (!e) return 'nothing is being edited';\n  const key = e.key.trim();\n  if (!keyRe.test(key)) return 'the key must be a lowercase slug of letters, digits and dashes (32 at most)';\n  if (e.originalKey === null && providers.value.some((p) => p.key === key))\n    return `a provider is already stored under \"${key}\" — edit that one instead, or pick another key`;\n  if (!e.form.clientId.trim()) return 'the client id is required';\n  if (!e.secretSet && !e.secret.trim()) return 'the client secret is required';\n  if (e.form.mode === 'oidc') {\n    const url = templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl.trim();\n    if (!url) return 'the issuer is required';\n    if (url.includes('<')) return 'fill in the issuer placeholder first';\n  } else if (!e.form.authorizeUrl.trim() || !e.form.tokenUrl.trim()) {\n    return 'the authorize and token URLs are required';\n  }\n  return '';\n});\n\nconst list = (s: string): string[] => s.split(',').map((v) => v.trim()).filter(Boolean);\n\nasync function save(): Promise<void> {\n  const e = editing.value;\n  if (!e) return;\n  saving.value = true;\n  // Annotated, not inline: `api.put` takes `unknown`, so without a type here a mistyped field\n  // (`allowedUsernams`) would compile, the server would see no such field, the rule would silently\n  // restrict nobody, and the form would say \"Saved\".\n  const body: SsoConfig & { key: string; clientSecret: string } = {\n    ...e.form,\n    key: e.key.trim(),\n    clientSecret: e.secret.trim(),\n    discoveryUrl: templateParts.value ? assembledDiscovery.value : e.form.discoveryUrl,\n    allowedEmailDomains: list(e.domains),\n    allowedUsernames: list(e.usernames),\n    requiredGroups: e.form.mode === 'oidc' ? [] : list(e.groups),\n  };\n  const r = await api.put<{ ok: boolean; key: string }>('/api/sso/config', body);\n  saving.value = false;\n  if (!r.ok) {\n    // Verbatim, right above the button that was pressed — the refusals are written to be read\n    // (the scope refusal names the scope; the template refusal names the placeholder).\n    formError.value = problem(r, 'save the provider');\n    return;\n  }\n  formError.value = '';\n  toast('ok', e.originalKey ? 'Saved.' : `Added ${body.key}.`);\n  editing.value = null;\n  void load();\n}\n\nasync function remove(entry: SsoProviderEntry): Promise<void> {\n  const r = await api.del(`/api/sso/config/${entry.key}`);\n  if (!r.ok) {\n    listError.value = problem(r, 'remove the provider');\n    return;\n  }\n  toast('ok', `Removed ${entry.key}. Its accounts keep working.`);\n  void load();\n}\n\nasync function copyCallback(): Promise<void> {\n  try {\n    await navigator.clipboard.writeText(callbackUrl.value);\n    toast('ok', 'Copied.');\n  } catch {\n    toast('error', 'Copy failed — select it and copy by hand.');\n  }\n}\n\n/** The card's second line, first half: what kind of provider this row talks to. */\nfunction whereLine(c: SsoConfig): string {\n  if (c.mode === 'oidc') {\n    try {\n      return `OpenID Connect · ${new URL(c.discoveryUrl).hostname}`;\n    } catch {\n      return 'OpenID Connect';\n    }\n  }\n  const p = presets.value.find((x) => x.key === c.provider);\n  return p ? `OAuth 2.0 · ${p.label}` : 'OAuth 2.0 · custom endpoints';\n}\n\n/**\n * The card's third fact: what an account this provider mints is created as — visible in the list\n * because a provider that hands out admin should not need opening to find that out.\n */\nfunction roleLine(c: SsoConfig): string {\n  if (c.defaultRole) return `new accounts: ${sentence(c.defaultRole)}`;\n  return `new accounts: the host default${hostDefaultRole.value ? ` (${sentence(hostDefaultRole.value)})` : ''}`;\n}\n\n/** The card's second line, second half: the sign-in rules, or the honest default. */\nfunction rulesLine(c: SsoConfig): string {\n  const parts: string[] = [];\n  if (c.allowedEmailDomains?.length) parts.push(`domains ${c.allowedEmailDomains.join(', ')}`);\n  if (c.allowedUsernames?.length) parts.push(`usernames ${c.allowedUsernames.join(', ')}`);\n  if (c.requiredGroups?.length) parts.push(`groups ${c.requiredGroups.join(', ')}`);\n  return parts.length ? `lets in ${parts.join('; ')}` : 'lets in anyone the provider allows';\n}\n</script>\n\n<template>\n  <div>\n    <div class=\"page-head\">\n      <div>\n        <h1>Single sign-on</h1>\n        <div class=\"sub\">Sign in with the identity providers you already run</div>\n      </div>\n      <span class=\"grow\" />\n      <button v-if=\"loaded && !listError && !editing && !showPicker\" class=\"primary\" @click=\"picking = true\">Add provider</button>\n    </div>\n\n    <ErrorNote v-if=\"listError\" :text=\"listError\" title=\"Could not read the sign-on settings.\" />\n    <SkeletonList v-if=\"!loaded\" :rows=\"4\" />\n\n    <!-- ============================ the form: one provider ============================ -->\n    <template v-else-if=\"editing\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <SsoMark :preset=\"editing.form.provider\" :size=\"20\" />\n          <h2 class=\"section\">\n            {{\n              editing.originalKey\n                ? `Edit ${editing.originalKey}`\n                : `Add ${editing.preset?.label ?? (editing.form.mode === 'oidc' ? 'an OpenID Connect issuer' : 'a custom OAuth 2.0 provider')}`\n            }}\n          </h2>\n          <span class=\"mute\">{{ editing.form.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          <span class=\"grow\" />\n          <label class=\"check\"><input v-model=\"editing.form.enabled\" type=\"checkbox\" /> Enabled</label>\n        </div>\n\n        <!-- Where to create the app. The preset's own `setupHint` prose is deliberately not drawn. -->\n        <div v-if=\"editing.preset\" class=\"banner plain\">\n          <p>\n            <a :href=\"editing.preset.setupUrl\" target=\"_blank\" rel=\"noopener\">\n              Create the app in {{ editing.preset.label }} →\n            </a>\n          </p>\n        </div>\n\n        <!-- THE thing every operator hunts for, so it lives inside the form, first. -->\n        <div class=\"field\">\n          <label>Redirect URI</label>\n          <div class=\"row sso-copy\">\n            <code class=\"sso-url\">{{ callbackUrl }}</code>\n            <button type=\"button\" @click=\"copyCallback\">Copy</button>\n          </div>\n          <p class=\"hint\">Must match the provider's registered callback exactly.</p>\n        </div>\n\n        <div v-if=\"!editing.originalKey\" class=\"field\">\n          <label for=\"sso-key\">Key</label>\n          <input id=\"sso-key\" v-model=\"editing.key\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n          <p class=\"hint\">Lowercase letters, digits, dashes.</p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-label\">Button text</label>\n          <input id=\"sso-label\" v-model=\"editing.form.label\" type=\"text\" :placeholder=\"editing.preset?.label || 'Acme SSO'\" />\n          <p class=\"hint\">“Continue with {{ editing.form.label || editing.preset?.label || '…' }}”</p>\n        </div>\n\n        <!-- ── OIDC: the issuer. A template preset assembles it from the placeholder(s). -->\n        <template v-if=\"editing.form.mode === 'oidc'\">\n          <template v-if=\"templateParts\">\n            <div v-for=\"ph in placeholderNames\" :key=\"ph\" class=\"field\">\n              <label :for=\"`ph-${ph}`\">{{ sentence(ph) }}</label>\n              <input :id=\"`ph-${ph}`\" v-model=\"editing.placeholders[ph]\" type=\"text\" spellcheck=\"false\" class=\"sso-key\" />\n            </div>\n            <div class=\"field\">\n              <label>Issuer</label>\n              <code class=\"sso-url\" :data-incomplete=\"assembledDiscovery.includes('<') || undefined\">{{ assembledDiscovery }}</code>\n              <p class=\"hint\">Fetched when you save.</p>\n            </div>\n          </template>\n          <div v-else class=\"field\">\n            <label for=\"sso-issuer\">Issuer</label>\n            <input id=\"sso-issuer\" v-model=\"editing.form.discoveryUrl\" type=\"text\" spellcheck=\"false\" placeholder=\"https://accounts.google.com\" />\n            <p class=\"hint\">Fetched when you save.</p>\n          </div>\n        </template>\n\n        <div class=\"field\">\n          <label for=\"sso-client\">Client id</label>\n          <input id=\"sso-client\" v-model=\"editing.form.clientId\" type=\"text\" spellcheck=\"false\" autocomplete=\"off\" />\n        </div>\n        <div class=\"field\">\n          <label for=\"sso-secret\">Client secret</label>\n          <input id=\"sso-secret\" v-model=\"editing.secret\" type=\"password\" spellcheck=\"false\" autocomplete=\"new-password\" />\n          <p class=\"hint\">\n            Write-only.\n            {{ editing.secretSet ? 'Leave empty to keep the stored secret.' : 'Never returned once saved.' }}\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-scopes\">Scopes</label>\n          <input id=\"sso-scopes\" v-model=\"editing.form.scopes\" type=\"text\" spellcheck=\"false\" :placeholder=\"editing.form.mode === 'oidc' ? 'openid profile email' : ''\" />\n        </div>\n\n        <!-- ── OAuth 2.0: the endpoints and the claim mapping. Filled in by the preset, needed\n             open only for a custom provider or a self-hosted host — which is exactly the gitlab\n             preset with its URLs replaced, so everything stays editable. -->\n        <details v-if=\"editing.form.mode === 'oauth2'\" class=\"sso-adv\" :open=\"!editing.preset\">\n          <summary>Endpoints and claim mapping</summary>\n\n          <div class=\"field\">\n            <label for=\"sso-auth\">Authorize URL</label>\n            <input id=\"sso-auth\" v-model=\"editing.form.authorizeUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-token\">Token URL</label>\n            <input id=\"sso-token\" v-model=\"editing.form.tokenUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-userinfo\">User info URL</label>\n            <input id=\"sso-userinfo\" v-model=\"editing.form.userInfoUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-emails\">Emails URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-emails\" v-model=\"editing.form.emailsUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n          <div class=\"field\">\n            <label for=\"sso-groups-url\">Groups URL <span class=\"mute\">(optional)</span></label>\n            <input id=\"sso-groups-url\" v-model=\"editing.form.groupsUrl\" type=\"text\" spellcheck=\"false\" />\n          </div>\n\n          <!-- Which key of the provider's user response holds each field; a preset fills these in. -->\n          <h3 class=\"section\" style=\"margin-top: var(--s4)\">Claim mapping</h3>\n          <div class=\"row\" style=\"flex-wrap: wrap; gap: var(--s3)\">\n            <div v-for=\"k in (['subject', 'username', 'email', 'name', 'avatar'] as const)\" :key=\"k\" class=\"field inline\">\n              <label :for=\"`cm-${k}`\">{{ k }}</label>\n              <input :id=\"`cm-${k}`\" v-model=\"editing.form.claimMap[k]\" type=\"text\" spellcheck=\"false\" style=\"width: 11rem\" />\n            </div>\n          </div>\n        </details>\n      </section>\n\n      <!-- ============================ who gets in ============================ -->\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Who gets in</h2></div>\n        <p class=\"dim\">\n          Every filled list must match; empty lists restrict nobody.\n        </p>\n        <div class=\"field\">\n          <label for=\"sso-domains\">Allowed email domains</label>\n          <input id=\"sso-domains\" v-model=\"editing.domains\" type=\"text\" spellcheck=\"false\" placeholder=\"example.com, corp.example\" />\n          <p class=\"hint\">\n            Comma-separated; subdomains count. <b>When set, a login with no address is refused.</b>\n          </p>\n        </div>\n\n        <div class=\"field\">\n          <label for=\"sso-usernames\">Allowed usernames</label>\n          <input id=\"sso-usernames\" v-model=\"editing.usernames\" type=\"text\" spellcheck=\"false\" placeholder=\"octocat, qa-[0-9]*\" />\n          <p class=\"hint\">\n            Comma-separated patterns: <code>*</code>, <code>?</code>, <code>[0-9]</code>.\n            <b>When set, a login with no username is refused.</b>\n          </p>\n        </div>\n\n        <div v-if=\"editing.form.mode === 'oauth2'\" class=\"field\">\n          <label for=\"sso-groups\">Required groups</label>\n          <input id=\"sso-groups\" v-model=\"editing.groups\" type=\"text\" spellcheck=\"false\" placeholder=\"acme, acme/backend\" />\n          <p class=\"hint\">\n            <b>Exact names, not patterns</b>, comma-separated. Needs the matching scope above, or\n            the save is refused.\n          </p>\n        </div>\n\n        <!-- Never rendered before today, while the form quietly sent `admin`. Every account this\n             provider mints is created at this role, so it is the one field on the page that decides\n             what a stranger who completes the OAuth flow can do. -->\n        <div class=\"field\">\n          <label for=\"sso-role\">New account role</label>\n          <SelectMenu\n            id=\"sso-role\"\n            v-model=\"roleChoice\"\n            label=\"Role for the accounts this provider creates\"\n            :options=\"roleOptions\"\n          />\n          <p class=\"hint\">\n            Set at first sign-in. Host default follows\n            <RouterLink to=\"/settings\">Settings</RouterLink>.\n          </p>\n        </div>\n      </section>\n\n      <ErrorNote v-if=\"formError\" :text=\"formError\" title=\"Not saved.\" />\n\n      <div class=\"row\" style=\"gap: var(--s3)\">\n        <ActionButton variant=\"primary\" :pending=\"saving\" :disabled=\"saving || !!cannotSave\" :title=\"cannotSave || undefined\" @click=\"save\">\n          {{ editing.originalKey ? 'Save changes' : 'Add provider' }}\n        </ActionButton>\n        <button class=\"ghost\" @click=\"editing = null\">Cancel</button>\n      </div>\n    </template>\n\n    <!-- ============================ the picker ============================ -->\n    <template v-else-if=\"showPicker\">\n      <section class=\"panel\">\n        <div class=\"phead\">\n          <h2 class=\"section\">{{ providers.length ? 'Add a provider' : 'Pick a provider' }}</h2>\n          <span class=\"grow\" />\n          <button v-if=\"providers.length\" class=\"ghost\" @click=\"picking = false\">Cancel</button>\n        </div>\n        <p class=\"dim\">Pick where your team already signs in.</p>\n        <div class=\"sso-tiles\">\n          <button v-for=\"t in pickerTiles\" :key=\"t.id\" class=\"sso-tile\" @click=\"startAdd(t)\">\n            <SsoMark :preset=\"t.preset?.key ?? 'custom'\" :size=\"22\" />\n            <span>{{ t.label }}</span>\n            <span class=\"sso-tile-mode\">{{ t.mode === 'oidc' ? 'OpenID Connect' : 'OAuth 2.0' }}</span>\n          </button>\n        </div>\n      </section>\n    </template>\n\n    <!-- ============================ the list ============================ -->\n    <template v-else-if=\"!listError\">\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Providers</h2></div>\n        <div class=\"sso-cards stagger\">\n          <div v-for=\"(p, i) in providers\" :key=\"p.key\" class=\"sso-card\" :style=\"{ '--i': i }\">\n            <SsoMark :preset=\"p.config.provider\" :size=\"22\" />\n            <div class=\"sso-card-main\">\n              <div class=\"sso-card-head\">\n                <b>{{ p.config.label }}</b>\n                <code class=\"mute\">{{ p.key }}</code>\n                <span v-if=\"!p.config.enabled\" class=\"badge off\">disabled</span>\n              </div>\n              <div class=\"sso-card-sub\">\n                {{ whereLine(p.config) }} · {{ rulesLine(p.config) }} · {{ roleLine(p.config) }} ·\n                updated <RelativeTime :at=\"p.updatedAt\" />\n              </div>\n            </div>\n            <div class=\"row-actions\">\n              <button class=\"ghost sm\" @click=\"startEdit(p)\">Edit</button>\n              <ActionButton variant=\"ghost\" class=\"sm sso-remove\" :confirm=\"`Remove ${p.key}?`\" @run=\"remove(p)\">\n                Remove\n              </ActionButton>\n            </div>\n          </div>\n        </div>\n      </section>\n\n      <section class=\"panel\">\n        <div class=\"phead\"><h2 class=\"section\">Callback URL</h2></div>\n        <p class=\"dim\">Register this with every provider.</p>\n        <div class=\"row sso-copy\">\n          <code class=\"sso-url\">{{ callbackUrl }}</code>\n          <button type=\"button\" @click=\"copyCallback\">Copy</button>\n        </div>\n      </section>\n    </template>\n  </div>\n</template>\n\n<style scoped>\n/* ── the picker tiles: brand mark, name, protocol. Grouped boxes inside a panel → r2. */\n.sso-tiles {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));\n  gap: var(--s3);\n}\n.sso-tile {\n  flex-direction: column;\n  justify-content: center;\n  gap: var(--s2);\n  padding: var(--s4) var(--s3);\n  border-radius: var(--r2);\n}\n.sso-tile-mode {\n  font-size: var(--t-xs);\n  font-weight: 400;\n  color: var(--fg-mute);\n}\n\n/* ── the provider cards. */\n.sso-cards {\n  display: flex;\n  flex-direction: column;\n  gap: var(--s3);\n}\n.sso-card {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: var(--s3);\n  border: 1px solid var(--line);\n  border-radius: var(--r2);\n  padding: var(--s3) var(--s4);\n}\n.sso-card > svg {\n  flex: none;\n}\n.sso-card-main {\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  flex-direction: column;\n  gap: var(--s1);\n}\n.sso-card-head {\n  display: flex;\n  align-items: center;\n  gap: var(--s2);\n}\n.sso-card-sub {\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  overflow-wrap: anywhere;\n}\n/* Ghost so the row stays quiet, red so nobody mistakes what it does. */\n.sso-remove {\n  color: var(--fail);\n}\n\n/* ── the callback URL: the one element here allowed to scroll sideways, never to wrap. */\n.sso-copy {\n  align-items: center;\n  gap: var(--s3);\n}\n.sso-url {\n  flex: 1;\n  min-width: 0;\n  overflow-x: auto;\n  white-space: nowrap;\n}\n/* Block display when it sits alone in a field (the assembled issuer). */\n.field > .sso-url {\n  display: block;\n  flex: none;\n}\n.sso-url[data-incomplete] {\n  color: var(--fg-mute);\n}\n\n/* Slugs and placeholders are short — a 560px input for \"acme\" reads as a text editor. */\n.sso-key {\n  max-width: 260px;\n}\n\n/* ── the collapsed endpoint block for a preset. */\n.sso-adv > summary {\n  cursor: pointer;\n  font-size: var(--t-sm);\n  color: var(--fg-dim);\n  margin: var(--s4) 0 var(--s2);\n}\n</style>\n"],"names":["INHERIT","OIDC_CLAIMS","blank","ROLE_WHAT","hostDefaultRole","ref","api","r","_a","s","roleOptions","computed","sentence","ROLES","providers","presets","callbackUrl","loaded","listError","editing","roleChoice","v","picking","saving","formError","load","problem","showPicker","pickerTiles","p","suggestKey","base","taken","n","startAdd","tile","f","startEdit","entry","x","templateParts","e","t","parts","re","last","m","placeholderNames","assembledDiscovery","keyRe","cannotSave","key","url","list","save","body","toast","remove","copyCallback","whereLine","c","roleLine","rulesLine","_b","_c","_createElementBlock","_createElementVNode","_hoisted_1","_createBlock","ErrorNote","_Fragment","_hoisted_2","_hoisted_3","_createVNode","SsoMark","_hoisted_4","_toDisplayString","_hoisted_5","_hoisted_6","$event","_openBlock","_hoisted_7","_hoisted_8","_hoisted_9","_cache","_hoisted_10","_hoisted_11","_hoisted_12","_vModelText","_hoisted_13","_hoisted_15","_renderList","ph","_unref","_hoisted_16","_hoisted_18","_hoisted_19","_hoisted_20","_hoisted_21","_hoisted_22","_hoisted_23","_hoisted_24","_hoisted_27","_hoisted_28","_hoisted_29","_hoisted_30","_hoisted_31","_hoisted_32","k","_hoisted_33","_hoisted_35","_hoisted_36","_hoisted_37","_hoisted_38","_hoisted_39","SelectMenu","_hoisted_40","_component_RouterLink","_hoisted_41","ActionButton","_createTextVNode","_hoisted_42","_hoisted_43","_hoisted_44","_hoisted_45","_hoisted_47","_hoisted_48","_hoisted_49","i","_hoisted_50","_hoisted_51","_hoisted_52","_hoisted_53","_hoisted_54","RelativeTime","_hoisted_55","_hoisted_56","_hoisted_57","_hoisted_58","_hoisted_59","SkeletonList"],"mappings":"m/DAwFMA,EAAU,4CAxChB,MAAMC,EAAwB,CAAE,QAAS,MAAO,SAAU,qBAAsB,MAAO,QAAS,KAAM,OAAQ,OAAQ,SAAA,EAEhHC,EAAQ,KAAkB,CAC9B,KAAM,OACN,QAAS,GACT,MAAO,GACP,SAAU,GACV,aAAc,GACd,SAAU,GACV,aAAc,GACd,SAAU,GACV,YAAa,GACb,UAAW,GACX,UAAW,GACX,OAAQ,GACR,SAAU,CAAE,GAAGD,CAAA,EACf,oBAAqB,CAAA,EACrB,iBAAkB,CAAA,EAClB,eAAgB,CAAA,EAchB,YAAa,EAAA,GAWTE,EAAkC,CACtC,OAAQ,mBACR,UAAW,yBACX,WAAY,qBACZ,MAAO,sBAAA,EAOHC,EAAkBC,EAAI,EAAE,EACzBC,EAAI,IAAkB,eAAe,EAAE,KAAMC,GAAM,OAClDA,EAAE,KAAIH,EAAgB,MAAQ,SAAOI,EAAAD,EAAE,KAAK,SAAS,KAAME,GAAMA,EAAE,MAAQ,cAAc,IAApD,YAAAD,EAAuD,QAAS,EAAE,EAC7G,CAAC,EAED,MAAME,EAAcC,EAAS,IAAM,CACjC,CACE,MAAOX,EACP,MAAO,mBACP,KAAMI,EAAgB,MAAQ,GAAGQ,EAASR,EAAgB,KAAK,CAAC,4BAA8B,iBAAA,EAEhG,GAAGS,GAAM,IAAKN,IAAO,CAAE,MAAOA,EAAG,MAAOK,EAASL,CAAC,EAAG,KAAMJ,EAAUI,CAAC,GAAI,CAAA,CAC3E,EAEKO,EAAYT,EAAwB,EAAE,EACtCU,EAAUV,EAAiB,EAAE,EAC7BW,EAAcX,EAAI,EAAE,EACpBY,EAASZ,EAAI,EAAK,EAClBa,EAAYb,EAAI,EAAE,EAmBlBc,EAAUd,EAAoB,IAAI,EAGlCe,EAAaT,EAAiB,CAClC,IAAK,IAAA,OAAM,QAAAH,EAAAW,EAAQ,QAAR,YAAAX,EAAe,KAAK,cAAeR,GAC9C,IAAMqB,GAAM,CACNF,EAAQ,QAAOA,EAAQ,MAAM,KAAK,YAAcE,IAAMrB,EAAU,GAAKqB,EAC3E,CAAA,CACD,EAEKC,EAAUjB,EAAI,EAAK,EACnBkB,EAASlB,EAAI,EAAK,EAClBmB,EAAYnB,EAAI,EAAE,EAExB,eAAeoB,GAAsB,CACnC,MAAMlB,EAAI,MAAMD,EAAI,IAAuB,iBAAiB,EAE5D,GADAW,EAAO,MAAQ,GACX,CAACV,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,2BAA2B,EACxD,MACF,CACAW,EAAU,MAAQ,GAClBJ,EAAU,MAAQP,EAAE,KAAK,WAAa,CAAA,EACtCQ,EAAQ,MAAQR,EAAE,KAAK,SAAW,CAAA,EAClCS,EAAY,MAAQT,EAAE,KAAK,WAC7B,CACKkB,EAAA,EAGL,MAAME,EAAahB,EAAS,IAAM,CAACQ,EAAQ,QAAUG,EAAQ,OAAUL,EAAO,OAAS,CAACC,EAAU,OAASJ,EAAU,MAAM,SAAW,EAAG,EAEnIc,GAAcjB,EAAS,IAAM,CACjC,GAAGI,EAAQ,MAAM,IAAKc,IAAO,CAAE,OAAQA,EAAuB,GAAIA,EAAE,IAAK,MAAOA,EAAE,MAAO,KAAMA,EAAE,MAAO,EACxG,CAAE,OAAQ,KAAM,GAAI,gBAAiB,MAAO,mBAAoB,KAAM,QAAA,EACtE,CAAE,OAAQ,KAAM,GAAI,cAAe,MAAO,wBAAyB,KAAM,MAAA,CAAgB,CAC1F,EAGD,SAASC,GAAWC,EAAsB,CACxC,MAAMC,EAAQ,IAAI,IAAIlB,EAAU,MAAM,IAAKe,GAAMA,EAAE,GAAG,CAAC,EACvD,GAAI,CAACG,EAAM,IAAID,CAAI,EAAG,OAAOA,EAC7B,QAASE,EAAI,GAAKA,IAAK,GAAI,CAACD,EAAM,IAAI,GAAGD,CAAI,IAAIE,CAAC,EAAE,QAAU,GAAGF,CAAI,IAAIE,CAAC,EAC5E,CAEA,SAASC,GAASC,EAAmE,CACnF,MAAMN,EAAIM,EAAK,OACTC,EAAIlC,EAAA,EACVkC,EAAE,KAAOD,EAAK,KACdC,EAAE,SAAWP,EAAIA,EAAE,IAAMM,EAAK,OAAS,SAAW,SAAW,GACzDN,IACFO,EAAE,MAAQP,EAAE,MACZO,EAAE,OAASP,EAAE,OACbO,EAAE,SAAW,CAAE,GAAGnC,EAAa,GAAG4B,EAAE,QAAA,EAChCA,EAAE,OAAS,UACbO,EAAE,aAAeP,EAAE,aACnBO,EAAE,SAAWP,EAAE,SACfO,EAAE,YAAcP,EAAE,aAIRA,EAAE,aAAa,SAAS,GAAG,IACrCO,EAAE,aAAeP,EAAE,eAGvBV,EAAQ,MAAQ,CACd,YAAa,KACb,IAAKW,GAAWD,EAAIA,EAAE,IAAMM,EAAK,OAAS,SAAW,SAAW,MAAM,EACtE,OAAQN,EACR,KAAMO,EACN,OAAQ,GACR,UAAW,GACX,QAAS,GACT,UAAW,GACX,OAAQ,GACR,aAAc,CAAA,CAAC,EAEjBZ,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAEA,SAASe,GAAUC,EAA+B,CAChDnB,EAAQ,MAAQ,CACd,YAAamB,EAAM,IACnB,IAAKA,EAAM,IACX,OAAQvB,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQD,EAAM,OAAO,QAAQ,GAAK,KACtE,KAAM,CAAE,GAAGpC,IAAS,GAAGoC,EAAM,OAAQ,SAAU,CAAE,GAAGrC,EAAa,GAAGqC,EAAM,OAAO,SAAS,EAC1F,OAAQ,GACR,UAAWA,EAAM,UACjB,SAAUA,EAAM,OAAO,qBAAuB,CAAA,GAAI,KAAK,IAAI,EAC3D,WAAYA,EAAM,OAAO,kBAAoB,CAAA,GAAI,KAAK,IAAI,EAC1D,QAASA,EAAM,OAAO,gBAAkB,CAAA,GAAI,KAAK,IAAI,EACrD,aAAc,CAAA,CAAC,EAEjBd,EAAU,MAAQ,GAClBF,EAAQ,MAAQ,EAClB,CAMA,MAAMkB,EAAgB7B,EAAgD,IAAM,CAC1E,MAAM8B,EAAItB,EAAQ,MAClB,GAAI,CAACsB,GAAKA,EAAE,cAAgB,MAAQ,CAACA,EAAE,QAAUA,EAAE,KAAK,OAAS,OAAQ,OAAO,KAChF,MAAMC,EAAID,EAAE,OAAO,aACnB,GAAI,CAACC,EAAE,SAAS,GAAG,EAAG,OAAO,KAC7B,MAAMC,EAAwC,CAAA,EACxCC,EAAK,aACX,IAAIC,EAAO,EACX,QAASC,EAAIF,EAAG,KAAKF,CAAC,EAAGI,EAAGA,EAAIF,EAAG,KAAKF,CAAC,EACnCI,EAAE,MAAQD,GAAMF,EAAM,KAAKD,EAAE,MAAMG,EAAMC,EAAE,KAAK,CAAC,EACrDH,EAAM,KAAK,CAAE,GAAIG,EAAE,CAAC,GAAK,GAAI,EAC7BD,EAAOC,EAAE,MAAQA,EAAE,CAAC,EAAE,OAExB,OAAID,EAAOH,EAAE,QAAQC,EAAM,KAAKD,EAAE,MAAMG,CAAI,CAAC,EACtCF,CACT,CAAC,EAEKI,GAAmBpC,EAAS,KAC/B6B,EAAc,OAAS,CAAA,GAAI,QAASX,GAAO,OAAOA,GAAM,SAAW,CAAA,EAAK,CAACA,EAAE,EAAE,CAAE,CAAA,EAI5EmB,EAAqBrC,EAAS,IAAM,CACxC,MAAMgC,EAAQH,EAAc,MACtB,EAAIrB,EAAQ,MAClB,MAAI,CAACwB,GAAS,CAAC,EAAU,GAClBA,EAAM,IAAKd,GAAA,OAAO,cAAOA,GAAM,SAAWA,IAAIrB,EAAA,EAAE,aAAaqB,EAAE,EAAE,IAAnB,YAAArB,EAAsB,SAAU,IAAIqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5G,CAAC,EAEKoB,GAAQ,4BAGRC,EAAavC,EAAiB,IAAM,CACxC,MAAM8B,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,MAAO,0BACf,MAAMU,EAAMV,EAAE,IAAI,KAAA,EAClB,GAAI,CAACQ,GAAM,KAAKE,CAAG,EAAG,MAAO,8EAC7B,GAAIV,EAAE,cAAgB,MAAQ3B,EAAU,MAAM,KAAMe,GAAMA,EAAE,MAAQsB,CAAG,EACrE,MAAO,uCAAuCA,CAAG,iDACnD,GAAI,CAACV,EAAE,KAAK,SAAS,KAAA,EAAQ,MAAO,4BACpC,GAAI,CAACA,EAAE,WAAa,CAACA,EAAE,OAAO,KAAA,EAAQ,MAAO,gCAC7C,GAAIA,EAAE,KAAK,OAAS,OAAQ,CAC1B,MAAMW,EAAMZ,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aAAa,KAAA,EACjF,GAAI,CAACW,EAAK,MAAO,yBACjB,GAAIA,EAAI,SAAS,GAAG,EAAG,MAAO,sCAChC,SAAW,CAACX,EAAE,KAAK,aAAa,QAAU,CAACA,EAAE,KAAK,SAAS,KAAA,EACzD,MAAO,4CAET,MAAO,EACT,CAAC,EAEKY,EAAQ5C,GAAwBA,EAAE,MAAM,GAAG,EAAE,IAAKY,GAAMA,EAAE,KAAA,CAAM,EAAE,OAAO,OAAO,EAEtF,eAAeiC,IAAsB,CACnC,MAAMb,EAAItB,EAAQ,MAClB,GAAI,CAACsB,EAAG,OACRlB,EAAO,MAAQ,GAIf,MAAMgC,EAA0D,CAC9D,GAAGd,EAAE,KACL,IAAKA,EAAE,IAAI,KAAA,EACX,aAAcA,EAAE,OAAO,KAAA,EACvB,aAAcD,EAAc,MAAQQ,EAAmB,MAAQP,EAAE,KAAK,aACtE,oBAAqBY,EAAKZ,EAAE,OAAO,EACnC,iBAAkBY,EAAKZ,EAAE,SAAS,EAClC,eAAgBA,EAAE,KAAK,OAAS,OAAS,GAAKY,EAAKZ,EAAE,MAAM,CAAA,EAEvDlC,EAAI,MAAMD,EAAI,IAAkC,kBAAmBiD,CAAI,EAE7E,GADAhC,EAAO,MAAQ,GACX,CAAChB,EAAE,GAAI,CAGTiB,EAAU,MAAQE,EAAQnB,EAAG,mBAAmB,EAChD,MACF,CACAiB,EAAU,MAAQ,GAClBgC,EAAM,KAAMf,EAAE,YAAc,SAAW,SAASc,EAAK,GAAG,GAAG,EAC3DpC,EAAQ,MAAQ,KACXM,EAAA,CACP,CAEA,eAAegC,GAAOnB,EAAwC,CAC5D,MAAM/B,EAAI,MAAMD,EAAI,IAAI,mBAAmBgC,EAAM,GAAG,EAAE,EACtD,GAAI,CAAC/B,EAAE,GAAI,CACTW,EAAU,MAAQQ,EAAQnB,EAAG,qBAAqB,EAClD,MACF,CACAiD,EAAM,KAAM,WAAWlB,EAAM,GAAG,8BAA8B,EACzDb,EAAA,CACP,CAEA,eAAeiC,GAA8B,CAC3C,GAAI,CACF,MAAM,UAAU,UAAU,UAAU1C,EAAY,KAAK,EACrDwC,EAAM,KAAM,SAAS,CACvB,MAAQ,CACNA,EAAM,QAAS,2CAA2C,CAC5D,CACF,CAGA,SAASG,GAAUC,EAAsB,CACvC,GAAIA,EAAE,OAAS,OACb,GAAI,CACF,MAAO,oBAAoB,IAAI,IAAIA,EAAE,YAAY,EAAE,QAAQ,EAC7D,MAAQ,CACN,MAAO,gBACT,CAEF,MAAM/B,EAAId,EAAQ,MAAM,KAAMwB,GAAMA,EAAE,MAAQqB,EAAE,QAAQ,EACxD,OAAO/B,EAAI,eAAeA,EAAE,KAAK,GAAK,8BACxC,CAMA,SAASgC,GAASD,EAAsB,CACtC,OAAIA,EAAE,YAAoB,iBAAiBhD,EAASgD,EAAE,WAAW,CAAC,GAC3D,iCAAiCxD,EAAgB,MAAQ,KAAKQ,EAASR,EAAgB,KAAK,CAAC,IAAM,EAAE,EAC9G,CAGA,SAAS0D,GAAUF,EAAsB,WACvC,MAAMjB,EAAkB,CAAA,EACxB,OAAInC,EAAAoD,EAAE,sBAAF,MAAApD,EAAuB,QAAQmC,EAAM,KAAK,WAAWiB,EAAE,oBAAoB,KAAK,IAAI,CAAC,EAAE,GACvFG,EAAAH,EAAE,mBAAF,MAAAG,EAAoB,QAAQpB,EAAM,KAAK,aAAaiB,EAAE,iBAAiB,KAAK,IAAI,CAAC,EAAE,GACnFI,EAAAJ,EAAE,iBAAF,MAAAI,EAAkB,QAAQrB,EAAM,KAAK,UAAUiB,EAAE,eAAe,KAAK,IAAI,CAAC,EAAE,EACzEjB,EAAM,OAAS,WAAWA,EAAM,KAAK,IAAI,CAAC,GAAK,oCACxD,6DAIEsB,EA6PM,MAAA,KAAA,CA5PJC,EAOM,MAPNC,GAOM,eANJD,EAGM,MAAA,KAAA,CAFJA,EAAuB,UAAnB,gBAAc,EAClBA,EAA0E,MAAA,CAArE,MAAM,KAAA,EAAM,qDAAmD,CAAA,qBAEtEA,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJjD,EAAA,OAAM,CAAKC,EAAA,OAAS,CAAKC,EAAA,QAAYQ,EAAA,WAAnDsC,EAA4H,SAAA,OAA7D,MAAM,UAAW,uBAAO3C,EAAA,MAAO,GAAA,EAAS,cAAY,cAGpGJ,EAAA,WAAjBkD,EAA6FC,EAAA,OAAhE,KAAMnD,EAAA,MAAW,MAAM,sCAAA,6BAC/BD,EAAA,MAGAE,EAAA,WAArB8C,EAqLWK,EAAA,CAAA,IAAA,GAAA,CApLTJ,EAwHU,UAxHVK,GAwHU,CAvHRL,EAYM,MAZNM,GAYM,CAXJC,EAAsDC,EAAA,CAA5C,OAAQvD,EAAA,MAAQ,KAAK,SAAW,KAAM,EAAA,qBAChD+C,EAMK,KANLS,GAMKC,EAJDzD,EAAA,MAAQ,YAAsC,QAAAA,EAAA,MAAQ,WAAW,YAA4BX,EAAAW,EAAA,MAAQ,SAAR,YAAAX,EAAgB,SAAUW,EAAA,MAAQ,KAAK,OAAI,OAAA,2BAAA,8BAAA,EAAA,EAAA,CAAA,EAK5I+C,EAA6F,OAA7FW,GAA6FD,EAAvEzD,QAAQ,KAAK,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,gBACvC+C,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GAClBA,EAA6F,QAA7FY,GAA6F,GAAxEZ,EAAwD,QAAA,sCAAxC/C,EAAA,MAAQ,KAAK,QAAO4D,GAAE,KAAK,UAAA,iBAA3B5D,EAAA,MAAQ,KAAK,OAAO,CAAA,mBAAoB,WAAQ,EAAA,EAAA,KAI5EA,EAAA,MAAQ,QAAnB6D,IAAAf,EAMM,MANNgB,GAMM,CALJf,EAII,IAAA,KAAA,CAHFA,EAEI,IAAA,CAFA,KAAM/C,EAAA,MAAQ,OAAO,SAAU,OAAO,SAAS,IAAI,UAAA,EAAW,wBAC3CA,EAAA,MAAQ,OAAO,KAAK,EAAG,MAC9C,EAAA+D,EAAA,CAAA,eAKJhB,EAOM,MAPNiB,GAOM,CANJC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA2B,aAApB,eAAY,EAAA,GACnBA,EAGM,MAHNmB,GAGM,CAFJnB,EAA8C,OAA9CoB,GAA8CV,EAArB5D,EAAA,KAAW,EAAA,CAAA,EACpCkD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,GAElD0B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0E,IAAA,CAAvE,MAAM,QAAO,yDAAsD,EAAA,EAAA,GAG5D/C,EAAA,MAAQ,sBAApB6D,IAAAf,EAIM,MAJNsB,GAIM,CAHJH,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAgC,QAAA,CAAzB,IAAI,SAAA,EAAU,MAAG,EAAA,KACxBA,EAA2F,QAAA,CAApF,GAAG,UAAmB,sBAAAkB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,GAAA5D,EAAA,MAAQ,IAAG4D,GAAE,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,aAAlD,CAAAS,EAAArE,EAAA,MAAQ,GAAG,CAAA,GACxCiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsD,IAAA,CAAnD,MAAM,QAAO,qCAAkC,EAAA,EAAA,IAGpDA,EAIM,MAJNuB,GAIM,CAHJL,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,QAAA,CAAnC,IAAI,WAAA,EAAY,cAAW,EAAA,KAClCA,EAAoH,QAAA,CAA7G,GAAG,iDAAqB/C,EAAA,MAAQ,KAAK,MAAK4D,GAAE,KAAK,OAAQ,cAAahB,EAAA5C,EAAA,MAAQ,SAAR,YAAA4C,EAAgB,QAAK,UAAA,iBAAnE5C,EAAA,MAAQ,KAAK,KAAK,CAAA,GACjD+C,EAA4F,IAA5FwB,GAAgB,kBAAed,EAAGzD,QAAQ,KAAK,SAAS6C,EAAA7C,EAAA,MAAQ,SAAR,YAAA6C,EAAgB,aAAe,IAAC,CAAA,CAAA,GAI1E7C,EAAA,MAAQ,KAAK,OAAI,YAAjC8C,EAiBWK,EAAA,CAAA,IAAA,CAAA,EAAA,CAhBO9B,EAAA,WAAhByB,EAUWK,EAAA,CAAA,IAAA,GAAA,QATTL,EAGMK,EAAA,KAAAqB,EAHY5C,GAAA,MAAN6C,QAAZ3B,EAGM,MAAA,CAH+B,IAAK2B,EAAI,MAAM,OAAA,GAClD1B,EAAmD,QAAA,CAA3C,UAAW0B,CAAE,EAAA,EAAOhB,EAAAiB,GAAAjF,CAAA,EAASgF,CAAE,CAAA,EAAA,EAAAE,EAAA,IACvC5B,EAA4G,QAAA,CAApG,SAAU0B,CAAE,4BAAazE,EAAA,MAAQ,aAAayE,CAAE,EAAAb,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAM,SAAA,iBAA/D5D,EAAA,MAAQ,aAAayE,CAAE,CAAA,CAAA,aAE1D1B,EAIM,MAJN6B,GAIM,CAHJX,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAqB,aAAd,SAAM,EAAA,GACbA,EAAsH,OAAA,CAAhH,MAAM,UAAW,kBAAiBlB,EAAA,MAAmB,eAAiB,MAAA,IAAcA,EAAA,KAAkB,EAAA,EAAAgD,EAAA,EAC5GZ,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,IAAA,CAAvC,MAAM,QAAO,yBAAsB,EAAA,EAAA,UAG1Cc,IAAAf,EAIM,MAJNgC,GAIM,CAHJb,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAsI,QAAA,CAA/H,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,aAAY4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,6BAAA,gBAAtE5D,EAAA,MAAQ,KAAK,YAAY,CAAA,GACzDiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA0C,IAAA,CAAvC,MAAM,QAAO,yBAAsB,EAAA,EAAA,mBAI1CA,EAGM,MAHNgC,GAGM,CAFJd,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAyC,QAAA,CAAlC,IAAI,YAAA,EAAa,YAAS,EAAA,KACjCA,EAA2G,QAAA,CAApG,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,SAAQ4D,GAAE,KAAK,OAAO,WAAW,QAAQ,aAAa,KAAA,gBAAnE5D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEvD+C,EAOM,MAPNiC,GAOM,CANJf,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA6C,QAAA,CAAtC,IAAI,YAAA,EAAa,gBAAa,EAAA,KACrCA,EAAiH,QAAA,CAA1G,GAAG,aAAsB,sBAAAkB,EAAA,CAAA,IAAAA,EAAA,CAAA,EAAAL,GAAA5D,EAAA,MAAQ,OAAM4D,GAAE,KAAK,WAAW,WAAW,QAAQ,aAAa,cAAA,aAAhE,CAAAS,EAAArE,EAAA,MAAQ,MAAM,CAAA,GAC9C+C,EAGI,IAHJkC,GAAgB,gBAEdxB,EAAGzD,EAAA,MAAQ,UAAS,yCAAA,4BAAA,EAAA,CAAA,CAAA,GAIxB+C,EAGM,MAHNmC,GAGM,CAFJjB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsC,QAAA,CAA/B,IAAI,YAAA,EAAa,SAAM,EAAA,KAC9BA,EAAgK,QAAA,CAAzJ,GAAG,kDAAsB/C,EAAA,MAAQ,KAAK,OAAM4D,GAAE,KAAK,OAAO,WAAW,QAAS,YAAa5D,EAAA,MAAQ,KAAK,OAAI,OAAA,uBAAA,EAAA,iBAAnFA,EAAA,MAAQ,KAAK,MAAM,CAAA,KAMtCA,EAAA,MAAQ,KAAK,OAAI,cAAhC8C,EAgCU,UAAA,OAhCqC,MAAM,UAAW,KAAI,CAAG9C,EAAA,MAAQ,MAAA,GAC7EiE,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA8C,eAArC,8BAA2B,EAAA,GAEpCA,EAGM,MAHNoC,GAGM,CAFJlB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA2C,QAAA,CAApC,IAAI,UAAA,EAAW,gBAAa,EAAA,KACnCA,EAA0F,QAAA,CAAnF,GAAG,gDAAoB/C,EAAA,MAAQ,KAAK,aAAY4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAlD5D,EAAA,MAAQ,KAAK,YAAY,CAAA,KAEzD+C,EAGM,MAHNqC,GAGM,CAFJnB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAwC,QAAA,CAAjC,IAAI,WAAA,EAAY,YAAS,EAAA,KAChCA,EAAuF,QAAA,CAAhF,GAAG,iDAAqB/C,EAAA,MAAQ,KAAK,SAAQ4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA9C5D,EAAA,MAAQ,KAAK,QAAQ,CAAA,KAEtD+C,EAGM,MAHNsC,GAGM,CAFJpB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA+C,QAAA,CAAxC,IAAI,cAAA,EAAe,gBAAa,EAAA,KACvCA,EAA6F,QAAA,CAAtF,GAAG,sDAAwB/C,EAAA,MAAQ,KAAK,YAAW4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAAjD5D,EAAA,MAAQ,KAAK,WAAW,CAAA,KAE5D+C,EAGM,MAHNuC,GAGM,eAFJvC,EAA+E,QAAA,CAAxE,IAAI,cAAY,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SAChEA,EAAyF,QAAA,CAAlF,GAAG,oDAAsB/C,EAAA,MAAQ,KAAK,UAAS4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C5D,EAAA,MAAQ,KAAK,SAAS,CAAA,KAExD+C,EAGM,MAHNwC,GAGM,eAFJxC,EAAmF,QAAA,CAA5E,IAAI,kBAAgB,GAAC,aAAW,EAAAA,EAAoC,OAAA,CAA9B,MAAM,MAAA,EAAO,YAAU,CAAA,SACpEA,EAA6F,QAAA,CAAtF,GAAG,wDAA0B/C,EAAA,MAAQ,KAAK,UAAS4D,GAAE,KAAK,OAAO,WAAW,OAAA,gBAA/C5D,EAAA,MAAQ,KAAK,SAAS,CAAA,mBAI5D+C,EAAoE,KAAA,CAAhE,MAAM,UAAU,MAAA,CAAA,aAAA,WAAA,CAAA,EAA8B,gBAAa,EAAA,GAC/DA,EAKM,MALNyC,GAKM,MAJJ1C,EAGMK,EAAA,KAAAqB,EAHW,CAAA,UAAA,WAAA,QAAA,OAAA,QAAA,EAALiB,GAAZ1C,EAGM,MAAA,CAH2E,IAAK0C,EAAG,MAAM,cAAA,GAC7F1C,EAAuC,QAAA,CAA/B,UAAW0C,CAAC,EAAA,IAAOA,CAAC,EAAA,EAAAC,EAAA,IAC5B3C,EAAgH,QAAA,CAAxG,SAAU0C,CAAC,GAAa,sBAAA7B,GAAA5D,EAAA,MAAQ,KAAK,SAASyF,CAAC,EAAA7B,EAAG,KAAK,OAAO,WAAW,QAAQ,MAAA,CAAA,MAAA,OAAA,CAAA,cAAzD,CAAAS,EAAArE,EAAA,MAAQ,KAAK,SAASyF,CAAC,CAAA,CAAA,gCAO/D1C,EA+CU,UA/CV4C,GA+CU,eA9CR5C,EAA6D,MAAA,CAAxD,MAAM,SAAO,CAACA,EAAoC,KAAA,CAAhC,MAAM,SAAA,EAAU,aAAW,CAAA,OAClDkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAEI,IAAA,CAFD,MAAM,KAAA,EAAM,+DAEf,EAAA,GACAA,EAMM,MANN6C,GAMM,CALJ3B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAsD,QAAA,CAA/C,IAAI,aAAA,EAAc,wBAAqB,EAAA,KAC9CA,EAA2H,QAAA,CAApH,GAAG,cAAuB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,QAAO4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,2BAAA,aAA5D,CAAAS,EAAArE,EAAA,MAAQ,OAAO,CAAA,iBAChD+C,EAEI,IAAA,CAFD,MAAM,QAAM,GAAC,sCACqB,EAAAA,EAAoD,SAAjD,+CAA6C,CAAA,SAIvFA,EAOM,MAPN8C,GAOM,CANJ5B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAoD,QAAA,CAA7C,IAAI,eAAA,EAAgB,oBAAiB,EAAA,KAC5CA,EAAwH,QAAA,CAAjH,GAAG,gBAAyB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,UAAS4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA9D,CAAAS,EAAArE,EAAA,MAAQ,SAAS,CAAA,iBACpD+C,EAGI,IAAA,CAHD,MAAM,QAAM,GAAC,6BACY,EAAAA,EAAc,YAAR,GAAC,IAAO,IAAE,EAAAA,EAAc,YAAR,GAAC,IAAO,IAAE,EAAAA,EAAkB,YAAZ,OAAK,IAAO,IAC5E,EAAAA,EAAqD,SAAlD,gDAA8C,CAAA,SAI1C/C,EAAA,MAAQ,KAAK,OAAI,UAA5B6D,IAAAf,EAOM,MAPNgD,GAOM,CANJ7B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA+C,QAAA,CAAxC,IAAI,YAAA,EAAa,kBAAe,EAAA,KACvCA,EAAkH,QAAA,CAA3G,GAAG,aAAsB,sBAAAkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAL,GAAA5D,EAAA,MAAQ,OAAM4D,GAAE,KAAK,OAAO,WAAW,QAAQ,YAAY,oBAAA,aAA3D,CAAAS,EAAArE,EAAA,MAAQ,MAAM,CAAA,iBAC9C+C,EAGI,IAAA,CAHD,MAAM,QAAM,CACbA,EAAgC,SAA7B,2BAAyB,IAAI,6EAElC,CAAA,mBAMFA,EAYM,MAZNgD,GAYM,CAXJ9B,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAA8C,QAAA,CAAvC,IAAI,UAAA,EAAW,mBAAgB,EAAA,GACtCO,EAKE0C,GAAA,CAJA,GAAG,sBACM/F,EAAA,6CAAAA,EAAU,MAAA2D,GACnB,MAAM,8CACL,QAASrE,EAAA,KAAA,mCAEZwD,EAGI,IAHJkD,GAGI,iBAHY,+CAEd,EAAA,GAAA3C,EAAgD4C,EAAA,CAApC,GAAG,aAAW,WAAC,IAAQ,CAAA,GAAAjC,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAAR,WAAQ,EAAA,CAAA,2BAAa,KAClD,EAAA,EAAA,OAIa5D,EAAA,WAAjB4C,EAAmEC,EAAA,OAAtC,KAAM7C,EAAA,MAAW,MAAM,YAAA,6BAEpD0C,EAKM,MALNoD,GAKM,CAJJ7C,EAEe8C,EAAA,CAFD,QAAQ,UAAW,QAAShG,EAAA,MAAS,SAAUA,EAAA,OAAM,CAAA,CAAM2B,EAAA,MAAa,MAAOA,EAAA,OAAc,OAAY,QAAOI,EAAA,aAC5H,IAA2D,CAAxDkE,EAAA5C,EAAAzD,EAAA,MAAQ,YAAW,eAAA,cAAA,EAAA,CAAA,CAAA,0CAExB+C,EAA6D,SAAA,CAArD,MAAM,QAAS,yBAAO/C,EAAA,MAAO,KAAA,EAAS,QAAM,CAAA,SAKnCQ,EAAA,OACnBqD,EAAA,EAAAf,EAcU,UAdVwD,GAcU,CAbRvD,EAIM,MAJNwD,GAIM,CAHJxD,EAAsF,KAAtFyD,GAAsF/C,EAA/D9D,EAAA,MAAU,OAAM,iBAAA,iBAAA,EAAA,CAAA,gBACvCoD,EAAqB,OAAA,CAAf,MAAM,MAAA,EAAM,KAAA,EAAA,GACJpD,EAAA,MAAU,YAAxBmD,EAAsF,SAAA,OAAtD,MAAM,QAAS,yBAAO3C,EAAA,MAAO,GAAA,EAAU,QAAM,cAE/E8D,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAyD,IAAA,CAAtD,MAAM,KAAA,EAAM,yCAAsC,EAAA,GACrDA,EAMM,MANN0D,GAMM,QALJ3D,EAISK,EAAA,KAAAqB,EAJW/D,GAAA,MAAL,GAAC,kBAAhBqC,EAIS,SAAA,CAJyB,IAAK,EAAE,GAAI,MAAM,WAAY,QAAKc,GAAE7C,GAAS,CAAC,CAAA,GAC9EuC,EAA0DC,EAAA,CAAhD,SAAQlE,EAAA,EAAE,SAAF,YAAAA,EAAU,MAAG,SAAe,KAAM,EAAA,qBACpD0D,EAA0B,OAAA,KAAAU,EAAjB,EAAE,KAAK,EAAA,CAAA,EAChBV,EAA2F,OAA3F2D,GAA2FjD,EAA5D,EAAE,OAAI,OAAA,iBAAA,WAAA,EAAA,CAAA,CAAA,qBAOvB1D,EAAA,oBAAtB+C,EAmCWK,EAAA,CAAA,IAAA,GAAA,CAlCTJ,EAwBU,UAxBV4D,GAwBU,eAvBR5D,EAA2D,MAAA,CAAtD,MAAM,SAAO,CAACA,EAAkC,KAAA,CAA9B,MAAM,SAAA,EAAU,WAAS,CAAA,OAChDA,EAqBM,MArBN6D,GAqBM,EApBJ/C,EAAA,EAAA,EAAAf,EAmBMK,EAAA,KAAAqB,EAnBgB7E,EAAA,MAAS,CAAlBe,EAAGmG,SAAhB/D,EAmBM,MAAA,CAnB4B,IAAKpC,EAAE,IAAK,MAAM,WAAY,gBAAgBmG,EAAC,CAAA,GAC/EvD,EAAkDC,EAAA,CAAxC,OAAQ7C,EAAE,OAAO,SAAW,KAAM,EAAA,qBAC5CqC,EAUM,MAVN+D,GAUM,CATJ/D,EAIM,MAJNgE,GAIM,CAHJhE,EAA2B,IAAA,KAAAU,EAArB/C,EAAE,OAAO,KAAK,EAAA,CAAA,EACpBqC,EAAqC,OAArCiE,GAAqCvD,EAAf/C,EAAE,GAAG,EAAA,CAAA,EACdA,EAAE,OAAO,sBAAtBoC,EAAgE,OAAhEmE,GAAiD,UAAQ,KAE3DlE,EAGM,MAHNmE,GAGM,KAFD1E,GAAU9B,EAAE,MAAM,GAAI,MAAG+C,EAAGd,GAAUjC,EAAE,MAAM,CAAA,EAAI,MAAG+C,EAAGf,GAAShC,EAAE,MAAM,CAAA,EAAI,cACxE,CAAA,EAAA4C,EAAkC6D,GAAA,CAAnB,GAAIzG,EAAE,SAAA,qBAGjCqC,EAKM,MALNqE,GAKM,CAJJrE,EAA4D,SAAA,CAApD,MAAM,WAAY,QAAKa,GAAE1C,GAAUR,CAAC,CAAA,EAAG,OAAI,EAAA2G,EAAA,EACnD/D,EAEe8C,EAAA,CAFD,QAAQ,QAAQ,MAAM,gBAAiB,QAAO,UAAY1F,EAAE,GAAG,IAAM,MAAGkD,GAAEtB,GAAO5B,CAAC,CAAA,aAAG,IAEnG,CAAA,GAAAuD,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAA,GAFmG,WAEnG,EAAA,CAAA,mDAMRlB,EAOU,UAPVuE,GAOU,eANRvE,EAA8D,MAAA,CAAzD,MAAM,SAAO,CAACA,EAAqC,KAAA,CAAjC,MAAM,SAAA,EAAU,cAAY,CAAA,OACnDkB,EAAA,EAAA,IAAAA,EAAA,EAAA,EAAAlB,EAAqD,IAAA,CAAlD,MAAM,KAAA,EAAM,qCAAkC,EAAA,GACjDA,EAGM,MAHNwE,GAGM,CAFJxE,EAA8C,OAA9CyE,GAA8C/D,EAArB5D,EAAA,KAAW,EAAA,CAAA,EACpCkD,EAAyD,SAAA,CAAjD,KAAK,SAAU,QAAOR,CAAA,EAAc,MAAI,CAAA,gBA9OtDU,EAAyCwE,GAAA,OAAX,KAAM,CAAA"}

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-CfjzlWSc.js → StateBadge.vue_vue_type_script_setup_true_lang-aK93ZMhG.js}

@@ -1,2 +1,2 @@
-import{d as s,c as t,E as n,a as o,n as r,t as c,u as l,M as p,o as d}from"./index-D_Ks6aQi.js";const u=s({__name:"StateBadge",props:{state:{}},setup(e){return(m,a)=>(d(),t("span",{class:n(["badge",e.state])},[a[0]||(a[0]=o("span",{class:"dot"},null,-1)),r(" "+c(l(p)(e.state)),1)],2))}});export{u as _};
-//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-CfjzlWSc.js.map
+import{d as s,c as t,E as n,a as o,n as r,t as c,u as l,M as p,o as d}from"./index-DlhYSSKq.js";const u=s({__name:"StateBadge",props:{state:{}},setup(e){return(m,a)=>(d(),t("span",{class:n(["badge",e.state])},[a[0]||(a[0]=o("span",{class:"dot"},null,-1)),r(" "+c(l(p)(e.state)),1)],2))}});export{u as _};
+//# sourceMappingURL=StateBadge.vue_vue_type_script_setup_true_lang-aK93ZMhG.js.map

package/dist/assets/{StateBadge.vue_vue_type_script_setup_true_lang-CfjzlWSc.js.map → StateBadge.vue_vue_type_script_setup_true_lang-aK93ZMhG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-CfjzlWSc.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing\n *   queued  grey · cancelled  grey · superseded  grey\n *\n * THE THREE GREYS ARE DELIBERATE, and they are grey because none of them is an alarm:\n *\n *   `cancelled` — someone meant to stop it. Not `ok` either: whatever the job had already done was\n *   left exactly as it was, which is why the job page puts a banner under this badge.\n *   `queued`    — it has not started. Waiting is the system working as designed (one job per stack,\n *   and a host-wide cap), so it must not borrow `running`'s blue, and it must not PULSE — the pulse\n *   is what says \"something is happening right now\", and nothing is.\n *   `superseded` — a newer job for the same stack replaced it while it waited. It never ran, so\n *   there is nothing out there from it; routine, and quieter than cancelled if anything.\n *\n * Only `running` pulses (`.badge.running .dot` in app.css). The three greys fall through to the\n * base `.badge` rule with no colour of their own — which is the correct severity, not an oversight,\n * so do not \"finish\" them with a hue.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2KAiCEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}
+{"version":3,"file":"StateBadge.vue_vue_type_script_setup_true_lang-aK93ZMhG.js","sources":["../../src/components/StateBadge.vue"],"sourcesContent":["<script setup lang=\"ts\">\n/**\n * The job states, and only these. Kept in one component so the colour of `leaked` can never drift\n * from the colour of `failed` in one view and not another:\n *\n *   ok  green · failed  red · leaked  AMBER · running  blue, pulsing\n *   queued  grey · cancelled  grey · superseded  grey\n *\n * THE THREE GREYS ARE DELIBERATE, and they are grey because none of them is an alarm:\n *\n *   `cancelled` — someone meant to stop it. Not `ok` either: whatever the job had already done was\n *   left exactly as it was, which is why the job page puts a banner under this badge.\n *   `queued`    — it has not started. Waiting is the system working as designed (one job per stack,\n *   and a host-wide cap), so it must not borrow `running`'s blue, and it must not PULSE — the pulse\n *   is what says \"something is happening right now\", and nothing is.\n *   `superseded` — a newer job for the same stack replaced it while it waited. It never ran, so\n *   there is nothing out there from it; routine, and quieter than cancelled if anything.\n *\n * Only `running` pulses (`.badge.running .dot` in app.css). The three greys fall through to the\n * base `.badge` rule with no colour of their own — which is the correct severity, not an oversight,\n * so do not \"finish\" them with a hue.\n *\n * `leaked` must be unmistakably distinct from `failed`. They are different problems with different\n * owners — \"teardown errored\" versus \"teardown ran and something survived\" — which is why the CLI\n * gives leaked its own exit code, and why this app never renders them in the same colour.\n */\nimport type { JobState } from '../api/types';\nimport { sentence } from '../composables/useFormat';\n\ndefineProps<{ state: JobState }>();\n</script>\n\n<template>\n  <span class=\"badge\" :class=\"state\">\n    <span class=\"dot\" />\n    {{ sentence(state) }}\n  </span>\n</template>\n"],"names":["_createElementBlock","_normalizeClass","__props","_createElementVNode","_toDisplayString","_unref","sentence"],"mappings":"2KAiCEA,EAGO,OAAA,CAHD,MAAKC,EAAA,CAAC,QAAgBC,EAAA,KAAK,CAAA,CAAA,eAC/BC,EAAoB,OAAA,CAAd,MAAM,KAAA,EAAK,KAAA,EAAA,KAAG,IACpBC,EAAGC,EAAAC,CAAA,EAASJ,EAAA,KAAK,CAAA,EAAA,CAAA,CAAA"}

package/dist/assets/{SubmitView-BcAcTlwC.js → SubmitView-BTK9zNDd.js}

@@ -1,4 +1,4 @@
-import{d as Q,i as c,p as U,N as O,c as a,a as s,t as v,n,F as w,e as y,h as b,f as p,E as Y,g as R,v as E,_ as Z,ah as j,r as F,z as ee,j as N,k as te,o as l,m as se,J as oe,a6 as le,C as ae,ae as M}from"./index-D_Ks6aQi.js";import{a as ne,w as ie,p as q,r as re}from"./useVars-VN9gYdR6.js";import{A as ue}from"./ActionButton-OewKsFrK.js";import{_ as de}from"./ErrorNote.vue_vue_type_script_setup_true_lang-FEOV8vdM.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-BNQTEru_.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-CMLYr7A7.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";import"./VarIO-BFBaI8oU.js";const me={class:"page-head"},ce={class:"sub"},ye={class:"panel"},ke={key:0,class:"banner warn"},fe={key:0},he={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},Ce={class:"field",style:{"max-width":"280px"}},xe={class:"hint mute"},$e={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Ve={class:"check"},Re={class:"check"},Ne={class:"field",style:{"max-width":"340px"}},Ae={key:0,class:"hint"},Te={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"row",style:{"margin-top":"var(--s5)"}},We={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},De={key:1,class:"s-ok"},Oe={key:6,class:"banner warn"},je={key:0},Fe={key:7,class:"banner warn"},Me=`services:
+import{d as Q,i as c,p as U,N as O,c as a,a as s,t as v,n,F as w,e as y,h as b,f as p,E as Y,g as R,v as E,_ as Z,ah as j,r as F,z as ee,j as N,k as te,o as l,m as se,J as oe,a6 as le,C as ae,ae as M}from"./index-DlhYSSKq.js";import{a as ne,w as ie,p as q,r as re}from"./useVars-VN9gYdR6.js";import{A as ue}from"./ActionButton-BaGfzZKv.js";import{_ as de}from"./ErrorNote.vue_vue_type_script_setup_true_lang-DU01Dqor.js";import{_ as pe}from"./VarEditor.vue_vue_type_script_setup_true_lang-Dg_ORvZN.js";import{_ as ve}from"./SelectMenu.vue_vue_type_script_setup_true_lang-PIaLSNsk.js";import"./_plugin-vue_export-helper-DlAUqK2U.js";import"./VarIO-CNugbzeb.js";const me={class:"page-head"},ce={class:"sub"},ye={class:"panel"},ke={key:0,class:"banner warn"},fe={key:0},he={key:1},be={key:2},ge={key:3},we={key:2,class:"banner warn"},Se={class:"row",style:{"margin-bottom":"var(--s4)"}},Ce={class:"field",style:{"max-width":"280px"}},xe={class:"hint mute"},$e={key:3,class:"row",style:{"margin-bottom":"var(--s4)"}},Ve={class:"check"},Re={class:"check"},Ne={class:"field",style:{"max-width":"340px"}},Ae={key:0,class:"hint"},Te={key:0},Le={key:1},Ue={key:2},Ee={class:"field"},Ie={class:"field",style:{"margin-top":"var(--s3)"}},Pe={class:"row",style:{"margin-top":"var(--s5)"}},We={key:0,class:"mute",style:{"font-size":"var(--t-sm)"}},De={key:1,class:"s-ok"},Oe={key:6,class:"banner warn"},je={key:0},Fe={key:7,class:"banner warn"},Me=`services:
   app:
     image: nginx:alpine
     profiles: [app]
@@ -47,4 +47,4 @@ axes:
 kind: isolated
 stack: pr-\${PR}
 axes: []`},null,512),[[E,o.value.spec]])]),s("div",Ie,[e[31]||(e[31]=s("label",{for:"compose"},[n("compose.yml "),s("span",{class:"mute"},"(optional)")],-1)),R(s("textarea",{id:"compose","onUpdate:modelValue":e[5]||(e[5]=i=>o.value.compose=i),rows:"6",spellcheck:"false",placeholder:"Written next to spec.yml"},null,512),[[E,o.value.compose]])]),e[32]||(e[32]=s("p",{class:"hint"},"Hooks must be inline shell or an absolute path.",-1))],64)),e[40]||(e[40]=s("h2",{class:"section",style:{margin:"var(--s5) 0 var(--s3)"}},"Variables",-1)),y(pe,{modelValue:k.value,"onUpdate:modelValue":e[6]||(e[6]=i=>k.value=i)},null,8,["modelValue"]),e[41]||(e[41]=s("p",{class:"hint"},"Saved with the deployment, so teardown targets the same stack.",-1)),s("div",Pe,[y(ue,{variant:"primary",pending:C.value,disabled:!K.value,onClick:_},{default:b(()=>[n(v(C.value?"Submitting…":"Submit"),1)]),_:1},8,["pending","disabled"]),r.value?p("",!0):(l(),a("span",We," Nothing is saved until the spec is valid ")),r.value?(l(),a("span",De,[n(v(r.value.created?"Created":"Replaced")+" — stack ",1),s("b",null,v(r.value.stack),1),y(u,{to:`/deployments/${encodeURIComponent(r.value.id)}`,style:{"margin-left":"8px"}},{default:b(()=>[...e[33]||(e[33]=[n(" open → ",-1)])]),_:1},8,["to"])])):p("",!0)]),(L=(d=r.value)==null?void 0:d.stackSharedWith)!=null&&L.length?(l(),a("div",Oe,[s("b",null,"Stack “"+v(r.value.stack)+"” is already in use.",1),s("p",null,[(l(!0),a(w,null,F(r.value.stackSharedWith,(i,G)=>(l(),a(w,{key:i},[y(u,{to:`/deployments/${encodeURIComponent(i)}`},{default:b(()=>[n(v(i),1)]),_:2},1032,["to"]),G<r.value.stackSharedWith.length-1?(l(),a("span",je,", ")):p("",!0)],64))),128)),e[34]||(e[34]=n("— ",-1)),e[35]||(e[35]=s("code",null,"down",-1)),e[36]||(e[36]=n(" on either stops both. Change this one's ",-1)),e[37]||(e[37]=s("code",null,"stack",-1)),e[38]||(e[38]=n(" if that was not intended. ",-1))])])):p("",!0),(D=(W=r.value)==null?void 0:W.swarmNotes)!=null&&D.length?(l(),a("div",Fe,[e[39]||(e[39]=s("b",null,"Swarm will change this compose file.",-1)),s("ul",null,[(l(!0),a(w,null,F(r.value.swarmNotes,i=>(l(),a("li",{key:i},v(i),1))),128))])])):p("",!0),g.value?(l(),ee(de,{key:8,text:g.value,title:"The server rejected this submission."},null,8,["text"])):p("",!0)])])}}});export{Ge as default};
-//# sourceMappingURL=SubmitView-BcAcTlwC.js.map
+//# sourceMappingURL=SubmitView-BTK9zNDd.js.map