@tapflowio/relay 0.20.0 → 0.21.0

package/dist/lib/adminBootstrap.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Create the first Admin from the environment, once, at boot.
+ *
+ * **Why this exists at all.** `POST /api/v1/auth/init` requires `resolveClient(req).isLocal`, which
+ * stops a public instance being claimed by a stranger between first boot and the owner setting a
+ * password. A container is always behind its bridge gateway, so that check can never pass there —
+ * measured against the published image: the call answers 403 from the host's own browser and from
+ * the LAN alike. The error text points at `tapflow admin init`, but the image is relay-only by
+ * design (`pnpm deploy --filter @tapflowio/relay`) and carries no CLI. A Docker install therefore
+ * had no way to make its first account at all.
+ *
+ * This path does not go through HTTP, so the `isLocal` gate is not weakened — it is simply not on
+ * this road. Whoever can set the container's environment already controls the install.
+ *
+ * **Idempotent and silent when there is nothing to do.** It runs on every boot, and an install that
+ * already has an owner must not accumulate a log line per restart, nor have its account touched.
+ */
+export interface BootstrapLogger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+export interface BootstrapEnv {
+    TAPFLOW_ADMIN_EMAIL?: string;
+    TAPFLOW_ADMIN_PASSWORD?: string;
+}
+/** Thrown when the environment asks for a first account and cannot get one. Fatal at boot. */
+export declare class AdminBootstrapError extends Error {
+}
+/**
+ * **Misconfiguration refuses to boot, and the first draft had this backwards.**
+ *
+ * That draft warned and carried on, reasoning that these variables are first-run-only and a typo in
+ * them must not keep a running relay down. Review pointed out that the reasoning describes a state
+ * this function cannot reach: `isInitialized()` returns above every one of these branches, so an
+ * install that already has an owner never gets here whatever its environment says. The only state
+ * that does reach them is *the operator asked for a first account, there is none, and the settings
+ * are wrong* — and serving anyway leaves the install ownerless and claimable by anything that can
+ * reach loopback, indefinitely, behind one line of boot spam.
+ *
+ * Refusing costs nothing, which is what makes the trade one-sided: an ownerless relay cannot be
+ * logged into by anyone legitimate either, so there is no working service to lose, and a container
+ * that will not stay up is far louder than a warning.
+ *
+ * Neither the password nor its length is ever written to the log.
+ */
+export declare function bootstrapAdminFromEnv(env: BootstrapEnv, logger: BootstrapLogger): void;
+//# sourceMappingURL=adminBootstrap.d.ts.map

package/dist/lib/adminBootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/adminBootstrap.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,8FAA8F;AAC9F,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAoDtF"}

package/dist/lib/adminBootstrap.js

@@ -0,0 +1,68 @@
+import { isInitialized, createAdminAccount } from './adminAccount.js';
+/** Thrown when the environment asks for a first account and cannot get one. Fatal at boot. */
+export class AdminBootstrapError extends Error {
+}
+/**
+ * **Misconfiguration refuses to boot, and the first draft had this backwards.**
+ *
+ * That draft warned and carried on, reasoning that these variables are first-run-only and a typo in
+ * them must not keep a running relay down. Review pointed out that the reasoning describes a state
+ * this function cannot reach: `isInitialized()` returns above every one of these branches, so an
+ * install that already has an owner never gets here whatever its environment says. The only state
+ * that does reach them is *the operator asked for a first account, there is none, and the settings
+ * are wrong* — and serving anyway leaves the install ownerless and claimable by anything that can
+ * reach loopback, indefinitely, behind one line of boot spam.
+ *
+ * Refusing costs nothing, which is what makes the trade one-sided: an ownerless relay cannot be
+ * logged into by anyone legitimate either, so there is no working service to lose, and a container
+ * that will not stay up is far louder than a warning.
+ *
+ * Neither the password nor its length is ever written to the log.
+ */
+export function bootstrapAdminFromEnv(env, logger) {
+    const email = env.TAPFLOW_ADMIN_EMAIL?.trim();
+    const password = env.TAPFLOW_ADMIN_PASSWORD;
+    // Neither set is the ordinary case — every install that is not a fresh container.
+    if (!email && !password)
+        return;
+    if (isInitialized())
+        return;
+    const fail = (message) => {
+        logger.error(message);
+        throw new AdminBootstrapError(message);
+    };
+    if (!email || !password) {
+        const missing = email ? 'TAPFLOW_ADMIN_PASSWORD' : 'TAPFLOW_ADMIN_EMAIL';
+        // `return` so the compiler narrows both to `string` below — `fail` returning `never` is not
+        // enough on its own when it is called as a statement.
+        return fail(`${missing} is not set, so the first admin account could not be created. ` +
+            'Set both TAPFLOW_ADMIN_EMAIL and TAPFLOW_ADMIN_PASSWORD, or neither.');
+    }
+    let result;
+    try {
+        result = createAdminAccount(email, password);
+    }
+    catch (err) {
+        // **A second container on the same volume is a race, not a misconfiguration.** `users.email` is
+        // `UNIQUE`, so two replicas booting together have one of them lose the INSERT. The install ends
+        // up with an owner either way, which is the outcome that was asked for — carry on rather than
+        // crash-looping whichever replica arrived second.
+        if (isInitialized()) {
+            logger.warn('Another process created the first admin account while this one was starting.');
+            return;
+        }
+        throw err;
+    }
+    switch (result) {
+        case 'password-too-short':
+            return fail('TAPFLOW_ADMIN_PASSWORD is shorter than 8 characters, so the first admin account could not ' +
+                'be created. Set a longer one.');
+        case 'missing-fields':
+            // Unreachable: both are non-empty by the checks above. Handled so a later change to
+            // `createAdminAccount` cannot silently fall through to "created".
+            return fail('The first admin account could not be created: the configured email or password was empty.');
+        case 'ok':
+            logger.info(`Created the first admin account for ${email} from the environment.`);
+    }
+}
+//# sourceMappingURL=adminBootstrap.js.map

package/dist/lib/adminBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../src/lib/adminBootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AA8BrE,8FAA8F;AAC9F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAiB,EAAE,MAAuB;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAA;IAE3C,kFAAkF;IAClF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAM;IAE/B,IAAI,aAAa,EAAE;QAAE,OAAM;IAE3B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACrB,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC,CAAA;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,CAAA;QACxE,4FAA4F;QAC5F,sDAAsD;QACtD,OAAO,IAAI,CACT,GAAG,OAAO,gEAAgE;YAC1E,sEAAsE,CACvE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gGAAgG;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,kDAAkD;QAClD,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;YAC3F,OAAM;QACR,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,OAAO,IAAI,CACT,4FAA4F;gBAC5F,+BAA+B,CAChC,CAAA;QACH,KAAK,gBAAgB;YACnB,oFAAoF;YACpF,kEAAkE;YAClE,OAAO,IAAI,CAAC,2FAA2F,CAAC,CAAA;QAC1G,KAAK,IAAI;YACP,MAAM,CAAC,IAAI,CAAC,uCAAuC,KAAK,wBAAwB,CAAC,CAAA;IACrF,CAAC;AACH,CAAC"}

package/dist/lib/buildTickets.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Single-use, short-lived credentials that let an agent download one build over HTTP.
+ *
+ * **Why a ticket rather than a scope on the agent's PAT.** The relay used to hand the agent its own
+ * filesystem path and let it open the file, which works only when the two share a disk. Opening
+ * `/uploads/` to the `agent` scope would have given every agent token the whole upload directory,
+ * and a `builds/:id` route reachable with that scope gives it the whole builds table one row at a
+ * time — the id is chosen by whoever calls. A ticket is minted where session ownership has *already*
+ * been checked, so the permission is the one build that request is about.
+ *
+ * It also removes an authentication problem rather than adding one: `tapflow start` runs an agent on
+ * loopback with **no token at all** (the relay accepts loopback agents unauthenticated), so any
+ * design that required a PAT would have broken every all-in-one install.
+ *
+ * **What is actually enforced**, stated exactly because the previous draft claimed more: 32 bytes of
+ * entropy, one use, one build, and `TICKET_TTL_MS`. There is no binding to a particular agent — the
+ * relay does not record the agent socket's address, so it cannot check one at HTTP time, and a field
+ * that looks like a check but is not is worse than its absence.
+ */
+export interface BuildTicket {
+    buildId: number;
+    filePath: string;
+    expiresAt: number;
+}
+/**
+ * Longer than every caller's deadline, so a ticket never expires under a request that is still
+ * being awaited: `flow-runner` allows 120s (`RelayClient.ts`), `mcp-server` 120s after this change.
+ * A download that outlives this was already going to fail its caller first.
+ */
+export declare const TICKET_TTL_MS = 180000;
+/** Exported for the sweep test, which asserts the store fills before asserting it empties. */
+export declare class BuildTicketStore {
+    private readonly tickets;
+    /** Test-only view. Asserting a sweep emptied the map means nothing without asserting it filled. */
+    get size(): number;
+    mint(buildId: number, filePath: string, now?: number): string;
+    /**
+     * Resolves and **consumes** a ticket. Distinguishes "never existed / already used" from "expired"
+     * so the agent can say which — a download that fails has three causes a user acts on differently,
+     * and collapsing them is the defect this whole change exists to stop repeating.
+     */
+    redeem(ticket: string, now?: number): BuildTicket | 'unknown' | 'expired';
+    /**
+     * Drops what nobody redeemed. Without it the map grows for the life of the process: a session
+     * owner who presses install repeatedly mints a ticket each time and only the used ones are
+     * removed.
+     */
+    sweep(now?: number): void;
+}
+//# sourceMappingURL=buildTickets.d.ts.map

package/dist/lib/buildTickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildTickets.d.ts","sourceRoot":"","sources":["../../src/lib/buildTickets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAOD;;;;GAIG;AACH,eAAO,MAAM,aAAa,SAAU,CAAA;AAEpC,8FAA8F;AAC9F,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,mGAAmG;IACnG,IAAI,IAAI,IAAI,MAAM,CAA6B;IAE/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM;IAOjE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS;IAO7E;;;;OAIG;IACH,KAAK,CAAC,GAAG,SAAa,GAAG,IAAI;CAK9B"}

package/dist/lib/buildTickets.js

@@ -0,0 +1,47 @@
+import crypto from 'crypto';
+// **No `bytes` here.** A first version carried one described as what the agent compares against —
+// and nothing read it: the route stats the file for its own `Content-Length`, and the agent compares
+// against `buildBytes` from the WebSocket payload. The paragraph above says a field that looks like a
+// check but is not is worse than its absence; this was one, twenty lines below that sentence.
+/**
+ * Longer than every caller's deadline, so a ticket never expires under a request that is still
+ * being awaited: `flow-runner` allows 120s (`RelayClient.ts`), `mcp-server` 120s after this change.
+ * A download that outlives this was already going to fail its caller first.
+ */
+export const TICKET_TTL_MS = 180_000;
+/** Exported for the sweep test, which asserts the store fills before asserting it empties. */
+export class BuildTicketStore {
+    tickets = new Map();
+    /** Test-only view. Asserting a sweep emptied the map means nothing without asserting it filled. */
+    get size() { return this.tickets.size; }
+    mint(buildId, filePath, now = Date.now()) {
+        this.sweep(now);
+        const ticket = crypto.randomBytes(32).toString('hex');
+        this.tickets.set(ticket, { buildId, filePath, expiresAt: now + TICKET_TTL_MS });
+        return ticket;
+    }
+    /**
+     * Resolves and **consumes** a ticket. Distinguishes "never existed / already used" from "expired"
+     * so the agent can say which — a download that fails has three causes a user acts on differently,
+     * and collapsing them is the defect this whole change exists to stop repeating.
+     */
+    redeem(ticket, now = Date.now()) {
+        const found = this.tickets.get(ticket);
+        if (!found)
+            return 'unknown';
+        this.tickets.delete(ticket);
+        return found.expiresAt <= now ? 'expired' : found;
+    }
+    /**
+     * Drops what nobody redeemed. Without it the map grows for the life of the process: a session
+     * owner who presses install repeatedly mints a ticket each time and only the used ones are
+     * removed.
+     */
+    sweep(now = Date.now()) {
+        for (const [ticket, rec] of this.tickets) {
+            if (rec.expiresAt <= now)
+                this.tickets.delete(ticket);
+        }
+    }
+}
+//# sourceMappingURL=buildTickets.js.map

package/dist/lib/buildTickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildTickets.js","sourceRoot":"","sources":["../../src/lib/buildTickets.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AA2B3B,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,8FAA8F;AAE9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAA;AAEpC,8FAA8F;AAC9F,MAAM,OAAO,gBAAgB;IACV,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAA;IAEzD,mGAAmG;IACnG,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA,CAAC,CAAC;IAE/C,IAAI,CAAC,OAAe,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC,CAAA;QAC/E,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3B,OAAO,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACpB,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/lib/config.d.ts

@@ -75,15 +75,15 @@ export declare const config: {
         publicUrl?: string | undefined;
     } | null;
     tls: {
+        mode: "import-cert";
+        certPath: string;
+        keyPath: string;
+    } | {
         mode: "byo-api-token";
         domain: string;
         dnsProvider: string;
         publishAddress?: boolean | undefined;
         address?: string | undefined;
-    } | {
-        mode: "import-cert";
-        certPath: string;
-        keyPath: string;
     } | null;
     smtp: {
         host: string;

package/dist/lib/loadEnvFile.d.ts

@@ -1,2 +1,2 @@
-export declare function loadDataDirEnv(dataDir: string): string | null;
+export declare function loadDataDirEnv(dataDir: string, warn?: (m: string) => void): string | null;
 //# sourceMappingURL=loadEnvFile.d.ts.map

package/dist/lib/loadEnvFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnvFile.d.ts","sourceRoot":"","sources":["../../src/lib/loadEnvFile.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7D"}
+{"version":3,"file":"loadEnvFile.d.ts","sourceRoot":"","sources":["../../src/lib/loadEnvFile.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAA6B,GAAG,MAAM,GAAG,IAAI,CAoBjH"}

package/dist/lib/loadEnvFile.js

@@ -3,11 +3,21 @@ import path from 'path';
 // gitignore된 <dataDir>/.env 에서 자격 증명(JWT_SECRET·SMTP·DNS/ACME 토큰 등)을 로드한다.
 // config.load()가 secret을 읽기 전에 호출되어 .env가 모든 비밀의 기본 경로가 된다(#287에서 시작).
 // process.loadEnvFile 은 기존 process.env 값을 안 덮으므로 ambient(셸) 가 항상 우선.
-export function loadDataDirEnv(dataDir) {
+export function loadDataDirEnv(dataDir, warn = (m) => console.warn(m)) {
     const envPath = path.join(dataDir, '.env');
     if (!fs.existsSync(envPath))
         return null;
     try {
+        // **Everything else that writes a secret into dataDir sets 0600 and this file trusted its
+        // caller.** `config.ts` writes `jwt-secret` with `{ mode: 0o600 }` and chmods it; `tapflow init`
+        // does the same for this file. The relay-only image has no CLI, so a container operator writes
+        // it by hand under their own umask — 0644 — and the admin bootstrap now tells them to put a
+        // plaintext password in it. Warn rather than refuse: an unreadable-by-others file is the goal,
+        // but a relay that will not start because of a permission bit helps nobody.
+        const mode = fs.statSync(envPath).mode & 0o777;
+        if (mode & 0o077) {
+            warn(`${envPath} is readable by other users (mode ${mode.toString(8)}). Run: chmod 600 ${envPath}`);
+        }
         process.loadEnvFile(envPath);
         return envPath;
     }

package/dist/lib/loadEnvFile.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnvFile.js","sourceRoot":"","sources":["../../src/lib/loadEnvFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,2EAA2E;AAC3E,uEAAuE;AACvE,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"loadEnvFile.js","sourceRoot":"","sources":["../../src/lib/loadEnvFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,2EAA2E;AAC3E,uEAAuE;AACvE,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAA4B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,CAAC;QACH,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,4FAA4F;QAC5F,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;QAC9C,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,OAAO,qCAAqC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA;QACrG,CAAC;QACD,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/server.js

@@ -3,6 +3,7 @@ import { initDb } from './db.js';
 import { RelayServer } from './RelayServer.js';
 import { config, loadedEnvPath } from './lib/config.js';
 import { buildCorsOrigins, proxyWithoutPublicUrlWarning } from './lib/proxyConfig.js';
+import { bootstrapAdminFromEnv, AdminBootstrapError } from './lib/adminBootstrap.js';
 import { createCertProvider, resolveRelayDisplayHost } from './lib/cert/index.js';
 import { startTlsBackgroundTasks } from './lib/tlsTasks.js';
 import { createLogger } from '@tapflowio/agent-core';
@@ -14,6 +15,27 @@ if (loadedEnvPath)
 const dbPath = path.join(dataDir, 'tapflow.db');
 const uploadsDir = path.join(dataDir, 'uploads');
 initDb(dbPath);
+// After the schema exists and before anything is served: a container cannot reach the HTTP
+// bootstrap, because that one requires a local client and a container is always behind its bridge.
+//
+// **Fatal on failure.** The only way to get here with a problem is "an admin was asked for, there is
+// none, and the settings are wrong" — serving that would leave the install ownerless and claimable
+// from loopback. See `lib/adminBootstrap.ts`.
+try {
+    bootstrapAdminFromEnv(process.env, logger);
+}
+catch (err) {
+    // The reason is already logged where it was decided; re-logging it here printed every refusal
+    // twice. Anything that is not a refusal has no message of its own yet, so that one is logged.
+    if (!(err instanceof AdminBootstrapError))
+        logger.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
+// **The password does not outlive its use.** It is read once here, and every `spawnSync` in
+// `api/builds.ts` — twelve of them, over user-uploaded archives — inherits `process.env` without
+// passing one explicitly. Nothing reads these names again; `<dataDir>/.env` is re-read each boot.
+delete process.env.TAPFLOW_ADMIN_PASSWORD;
+delete process.env.TAPFLOW_ADMIN_EMAIL;
 const corsOrigins = buildCorsOrigins(config, port);
 const proxyWarning = proxyWithoutPublicUrlWarning(config);
 if (proxyWarning)

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AAEpC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAA;AACtC,qGAAqG;AACrG,IAAI,aAAa;IAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAA;AAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;AAEhD,MAAM,CAAC,MAAM,CAAC,CAAA;AAEd,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAClD,MAAM,YAAY,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAA;AACzD,IAAI,YAAY;IAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AAE3C,KAAK,UAAU,IAAI;IACjB,IAAI,GAA8C,CAAA;IAClD,IAAI,QAAQ,GAAiD,IAAI,CAAA;IACjE,IAAI,WAAW,GAAG,WAAW,CAAA;IAE7B,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAA;QAC5C,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QAChD,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,uGAAuG;YACvG,iDAAiD,CAClD,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1K,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,EAAE,EAAE,CAAA;QACX,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AAEpC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAA;AACtC,qGAAqG;AACrG,IAAI,aAAa;IAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,aAAa,EAAE,CAAC,CAAA;AAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;AAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;AAEhD,MAAM,CAAC,MAAM,CAAC,CAAA;AAEd,2FAA2F;AAC3F,mGAAmG;AACnG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,8CAA8C;AAC9C,IAAI,CAAC;IACH,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,CAAC,CAAC,GAAG,YAAY,mBAAmB,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,4FAA4F;AAC5F,iGAAiG;AACjG,kGAAkG;AAClG,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;AACzC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;AAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAClD,MAAM,YAAY,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAA;AACzD,IAAI,YAAY;IAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AAE3C,KAAK,UAAU,IAAI;IACjB,IAAI,GAA8C,CAAA;IAClD,IAAI,QAAQ,GAAiD,IAAI,CAAA;IACjE,IAAI,WAAW,GAAG,WAAW,CAAA;IAE7B,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAA;QAC5C,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QAChD,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACrG,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,uGAAuG;YACvG,iDAAiD,CAClD,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1K,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACpB,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,EAAE,EAAE,CAAA;QACX,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapflowio/relay",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "WebSocket relay server for tapflow — NAT traversal, session routing, JWT auth, bundled dashboard",
   "keywords": [
     "tapflow",
@@ -49,11 +49,11 @@
     "better-sqlite3": "^12.11.1",
     "busboy": "^1.6.0",
     "jsonwebtoken": "^9.0.3",
-    "nodemailer": "^9.0.5",
+    "nodemailer": "^9.1.1",
     "ws": "^8.21.3",
-    "zod": "^4.4.3",
-    "@tapflowio/agent-core": "0.20.0",
-    "@tapflowio/protocol": "0.20.0"
+    "zod": "^4.5.4",
+    "@tapflowio/agent-core": "0.21.0",
+    "@tapflowio/protocol": "0.21.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -63,7 +63,7 @@
     "@types/nodemailer": "^8.0.1",
     "@types/ws": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "@tapflowio/test-utils": "0.0.0"
   },
   "scripts": {

package/public/assets/{AppCenter-Dg4dscW-.js → AppCenter-BkSQFKRv.js}

@@ -1,20 +1,20 @@
-import{i as r,j as e}from"./vendor-react-AJpf4YZ0.js";import{W as C,B as y,L as b,a4 as k,J,I as M,S as Q,f as W}from"./index-9vdYIm7s.js";import{e as Y,S as K,P as X,g as ee,h as se,i as ae,b as te,d as le,s as ne,u as re}from"./build-format-BFC8gLoh.js";import{D as O,f as L,a as U,d as E,e as V,S as A,i as _,j as B,g as z,h as i,C as ce}from"./dialog-DK9a3b4z.js";import{P as ie,T as oe}from"./trash-2-CGxISX8x.js";import{B as T}from"./badge-B6Nf3A0Y.js";import{A as de,c as ue,f as he,g as xe,d as pe,e as me,b as fe,a as ge}from"./alert-dialog-CgatMXjB.js";import{b as je,c as ve}from"./vendor-router-ChFy8CZ1.js";/**
- * @license lucide-react v1.33.0 - ISC
+import{i as r,j as e}from"./vendor-react-AJpf4YZ0.js";import{W as C,B as y,L as b,a4 as k,J,I as M,S as Q,f as W}from"./index-CBfjqtE-.js";import{e as Y,S as K,P as X,g as ee,h as se,i as ae,b as te,d as le,s as ne,u as re}from"./build-format-DsApFPHy.js";import{D as O,f as L,a as U,d as E,e as V,S as A,i as _,j as B,g as z,h as i,C as ce}from"./dialog-B4Wg7TCg.js";import{P as ie,T as oe}from"./trash-VgeHmI8N.js";import{B as T}from"./badge-CikXk90N.js";import{A as de,c as ue,f as he,g as xe,d as pe,e as me,b as fe,a as ge}from"./alert-dialog-Cc_pQpe6.js";import{b as je,c as ve}from"./vendor-router-BFibuab1.js";/**
+ * @license lucide-react v1.41.0 - ISC
  *
  * This source code is licensed under the ISC license.
  * See the LICENSE file in the root directory of this source tree.
  */const Ne=[["path",{d:"M12.83 2.18a2 2 0 0 0-1.66 0L2.6 6.08a1 1 0 0 0 0 1.83l8.58 3.91a2 2 0 0 0 1.66 0l8.58-3.9a1 1 0 0 0 0-1.83z",key:"zw3jo"}],["path",{d:"M2 12a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 12",key:"1wduqc"}],["path",{d:"M2 17a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 17",key:"kqbvx6"}]],Se=C("layers",Ne);/**
- * @license lucide-react v1.33.0 - ISC
+ * @license lucide-react v1.41.0 - ISC
  *
  * This source code is licensed under the ISC license.
  * See the LICENSE file in the root directory of this source tree.
  */const ye=[["path",{d:"M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z",key:"1a0edw"}],["path",{d:"M12 22V12",key:"d0xqtd"}],["polyline",{points:"3.29 7 12 12 20.71 7",key:"ousv84"}],["path",{d:"m7.5 4.27 9 5.15",key:"1c824w"}]],we=C("package",ye);/**
- * @license lucide-react v1.33.0 - ISC
+ * @license lucide-react v1.41.0 - ISC
  *
  * This source code is licensed under the ISC license.
  * See the LICENSE file in the root directory of this source tree.
  */const be=[["path",{d:"M10 2h4",key:"n1abiw"}],["path",{d:"M4.6 11a8 8 0 0 0 1.7 8.7 8 8 0 0 0 8.7 1.7",key:"10he05"}],["path",{d:"M7.4 7.4a8 8 0 0 1 10.3 1 8 8 0 0 1 .9 10.2",key:"15f7sh"}],["path",{d:"m2 2 20 20",key:"1ooewy"}],["path",{d:"M12 12v-2",key:"fwoke6"}]],ke=C("timer-off",be);/**
- * @license lucide-react v1.33.0 - ISC
+ * @license lucide-react v1.41.0 - ISC
  *
  * This source code is licensed under the ISC license.
  * See the LICENSE file in the root directory of this source tree.

package/public/assets/{Default-Dxi8aZ1t.js → Default-D1inA8sU.js}

@@ -1 +1 @@
-import{i,j as e}from"./vendor-react-AJpf4YZ0.js";import{ai as X,a6 as Z,ad as S,a5 as y,ah as I,C as g,c as j,d as v,a as w,L as m,I as h,S as M,h as O,a4 as n,B as u,E as ee,J as se,H as ae,a2 as C,_ as $,a3 as p}from"./index-9vdYIm7s.js";import{B as re}from"./badge-B6Nf3A0Y.js";import{A as te,h as oe,c as ne,f as ie,g as le,d as ce,e as de,b as me,a as he}from"./alert-dialog-CgatMXjB.js";import{P as W}from"./pencil-BeLNLEKe.js";import"./vendor-router-ChFy8CZ1.js";const ue=C({teamName:p().min(1),logo:$(File).nullable().optional()}),pe=C({displayName:p().min(1),avatar:$(File).nullable().optional()}),fe=C({currentPassword:p().min(1),newPassword:p().min(8),confirmPassword:p()}).refine(f=>f.newPassword===f.confirmPassword,{message:"Passwords do not match",path:["confirmPassword"]});function Ne(){const{resolvedTheme:f}=X(),J=f==="dark"?"/logo-dark.svg":"/logo.svg",{user:o}=Z(),b=(o==null?void 0:o.role)==="Admin",N=(o==null?void 0:o.role)==="Admin"||(o==null?void 0:o.role)==="Developer",[V,P]=i.useState(null),A=i.useRef(null),d=S({resolver:y(ue),mode:"onBlur",defaultValues:{teamName:"",logo:null}});i.useEffect(()=>{b&&fetch("/api/v1/settings",{credentials:"include"}).then(s=>s.ok?s.json():null).then(s=>{s&&(d.reset({teamName:s.team_name,logo:null}),P(s.logo_url))})},[b]);async function Q(s){const a=new FormData;a.append("team_name",s.teamName),s.logo&&a.append("logo",s.logo);try{if(!(await fetch("/api/v1/settings",{method:"PATCH",credentials:"include",body:a})).ok){n.error("Failed to update workspace");return}n.success("Workspace updated")}catch{n.error("Failed to update workspace")}}const[k,F]=i.useState(null),D=i.useRef(null),c=S({resolver:y(pe),mode:"onBlur",defaultValues:{displayName:"",avatar:null}});i.useEffect(()=>{o&&(c.reset({displayName:o.displayName??"",avatar:null}),F(o.avatarUrl??null))},[o]);async function Y(s){const a=new FormData;a.append("display_name",s.displayName),s.avatar&&a.append("avatar",s.avatar);try{if(!(await fetch("/api/v1/profile",{method:"PATCH",credentials:"include",body:a})).ok){n.error("Failed to update profile");return}n.success("Profile updated")}catch{n.error("Failed to update profile")}}const t=S({resolver:y(fe),mode:"onBlur"});async function q(s){try{const a=await fetch("/api/v1/auth/change-password",{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({currentPassword:s.currentPassword,newPassword:s.newPassword})});if(!a.ok){const r=await a.json();t.setError("root",{message:r.error??"Failed to change password"});return}t.reset(),n.success("Password changed")}catch{t.setError("root",{message:"Network error"})}}const[T,E]=i.useState([]),[B,L]=i.useState({}),[U,z]=i.useState({}),[R,_]=i.useState({});i.useEffect(()=>{N&&fetch("/api/v1/apps",{credentials:"include"}).then(s=>s.ok?s.json():null).then(s=>{if(!s)return;E(s.items);const a={};s.items.forEach(r=>{a[r.id]=r.name}),L(a)})},[N]);async function G(s){_(a=>({...a,[s]:!0}));try{if(!(await fetch(`/api/v1/apps/${s}`,{method:"DELETE",credentials:"include"})).ok){n.error("Failed to delete app");return}E(r=>r.filter(l=>l.id!==s)),n.success("App deleted")}catch{n.error("Failed to delete app")}finally{_(a=>({...a,[s]:!1}))}}async function K(s){z(a=>({...a,[s]:!0}));try{if(!(await fetch(`/api/v1/apps/${s}`,{method:"PATCH",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:B[s]})})).ok){n.error("Failed to update app");return}n.success("App updated")}catch{n.error("Failed to update app")}finally{z(a=>({...a,[s]:!1}))}}const x=I({control:c.control,name:"displayName"});return e.jsxs("div",{className:"flex flex-col gap-6 max-w-[900px] mx-auto w-full p-6",children:[e.jsx("h1",{className:"text-xl font-semibold tracking-display-sm",children:"Settings"}),b&&e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Workspace"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:d.handleSubmit(Q),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"team-name",children:"Team name"}),e.jsx(h,{id:"team-name",placeholder:"My QA Team",...d.register("teamName")}),d.formState.errors.teamName&&e.jsx("p",{className:"text-sm text-destructive",children:d.formState.errors.teamName.message})]}),e.jsx(M,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(m,{children:["Logo ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(png · jpg, max 2MB)"})]}),e.jsx(O,{name:"logo",control:d.control,render:({field:s})=>e.jsxs("div",{className:"relative w-16 h-16",children:[e.jsx("img",{src:V??J,alt:"Workspace logo",className:"w-16 h-16 rounded-lg object-contain"}),e.jsx("button",{type:"button","aria-label":"Change logo",onClick:()=>{var a;return(a=A.current)==null?void 0:a.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(W,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:A,type:"file",accept:".png,.jpg,.jpeg",className:"hidden",onChange:a=>{var l;const r=(l=a.target.files)==null?void 0:l[0];if(r&&r.size>2*1024*1024){n.error("Image must be 2MB or less");return}r&&(s.onChange(r),P(URL.createObjectURL(r)))}})]})})]}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:d.formState.isSubmitting,children:d.formState.isSubmitting?"Saving…":"Save changes"})})]})})]}),e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Profile"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:c.handleSubmit(Y),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"display-name",children:"Nickname"}),e.jsx(h,{id:"display-name",placeholder:"Your name",...c.register("displayName")}),c.formState.errors.displayName&&e.jsx("p",{className:"text-sm text-destructive",children:c.formState.errors.displayName.message})]}),e.jsx(M,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(m,{children:["Avatar ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(png · jpg, max 2MB)"})]}),e.jsx(O,{name:"avatar",control:c.control,render:({field:s})=>{var a;return e.jsxs("div",{className:"relative w-14 h-14",children:[k?e.jsx("img",{src:k,alt:"Profile avatar",className:"w-14 h-14 rounded-full object-cover border"}):e.jsx("div",{className:"w-14 h-14 rounded-full flex items-center justify-center text-lg font-medium",style:(()=>{const r=ee(x||(o==null?void 0:o.email)||"");return{backgroundColor:r.bg,color:r.fg}})(),children:((a=x==null?void 0:x[0])==null?void 0:a.toUpperCase())??"?"}),e.jsx("button",{type:"button","aria-label":"Change avatar",onClick:()=>{var r;return(r=D.current)==null?void 0:r.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(W,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:D,type:"file",accept:".png,.jpg,.jpeg",className:"hidden",onChange:r=>{var H;const l=(H=r.target.files)==null?void 0:H[0];if(l&&l.size>2*1024*1024){n.error("Image must be 2MB or less");return}l&&(s.onChange(l),F(URL.createObjectURL(l)))}})]})}})]}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:c.formState.isSubmitting,children:c.formState.isSubmitting?"Saving…":"Save changes"})})]})})]}),e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Password"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:t.handleSubmit(q),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"current-password",children:"Current password"}),e.jsx(h,{id:"current-password",type:"password",...t.register("currentPassword")}),t.formState.errors.currentPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.currentPassword.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"new-password",children:"New password"}),e.jsx(h,{id:"new-password",type:"password",...t.register("newPassword")}),t.formState.errors.newPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.newPassword.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"confirm-password",children:"Confirm new password"}),e.jsx(h,{id:"confirm-password",type:"password",...t.register("confirmPassword")}),t.formState.errors.confirmPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.confirmPassword.message})]}),t.formState.errors.root&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.root.message}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:t.formState.isSubmitting,children:t.formState.isSubmitting?"Saving…":"Change password"})})]})})]}),N&&T.length>0&&e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Apps"})}),e.jsx(w,{children:e.jsx("div",{className:"flex flex-col divide-y divide-border",children:T.map(s=>e.jsxs("div",{className:"flex flex-col gap-2 py-4 first:pt-0 last:pb-0",children:[e.jsx(m,{htmlFor:`app-${s.id}`,children:"App Name"}),e.jsx(h,{id:`app-${s.id}`,value:B[s.id]??"",onChange:a=>L(r=>({...r,[s.id]:a.target.value}))}),e.jsxs("div",{className:"flex flex-col gap-1.5 mt-1",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"text-xs text-muted-foreground font-mono",children:s.bundle_id_key}),e.jsx(re,{tone:s.platform==="ios"?"ios":s.platform==="android"?"android":void 0,variant:s.platform==="both"?"secondary":void 0,className:"capitalize",children:s.platform})]}),e.jsxs("div",{className:"flex items-center justify-end gap-2",children:[e.jsx(u,{size:"sm",variant:"outline",disabled:U[s.id],onClick:()=>K(s.id),children:U[s.id]?"Saving…":"Save"}),e.jsxs(te,{children:[e.jsx(oe,{asChild:!0,children:e.jsx(u,{size:"sm",variant:"destructive",disabled:R[s.id],children:R[s.id]?"Deleting…":"Delete"})}),e.jsxs(ne,{children:[e.jsxs(ie,{children:[e.jsx(le,{children:"Delete app?"}),e.jsxs(ce,{children:["This will permanently delete ",e.jsx("strong",{children:s.name})," and all its builds. This action cannot be undone."]})]}),e.jsxs(de,{children:[e.jsx(me,{className:"w-24",children:"Cancel"}),e.jsx(he,{className:se(ae({variant:"destructive"}),"w-24"),onClick:()=>G(s.id),children:"Delete"})]})]})]})]})]})]},s.id))})})]})]})}export{Ne as DefaultSettings};
+import{i,j as e}from"./vendor-react-AJpf4YZ0.js";import{ai as X,a6 as Z,ad as S,a5 as y,ah as I,C as g,c as j,d as v,a as w,L as m,I as h,S as M,h as O,a4 as n,B as u,E as ee,J as se,H as ae,a2 as C,_ as $,a3 as p}from"./index-CBfjqtE-.js";import{B as re}from"./badge-CikXk90N.js";import{A as te,h as oe,c as ne,f as ie,g as le,d as ce,e as de,b as me,a as he}from"./alert-dialog-Cc_pQpe6.js";import{P as W}from"./pencil-DMswV31e.js";import"./vendor-router-BFibuab1.js";const ue=C({teamName:p().min(1),logo:$(File).nullable().optional()}),pe=C({displayName:p().min(1),avatar:$(File).nullable().optional()}),fe=C({currentPassword:p().min(1),newPassword:p().min(8),confirmPassword:p()}).refine(f=>f.newPassword===f.confirmPassword,{message:"Passwords do not match",path:["confirmPassword"]});function Ne(){const{resolvedTheme:f}=X(),J=f==="dark"?"/logo-dark.svg":"/logo.svg",{user:o}=Z(),b=(o==null?void 0:o.role)==="Admin",N=(o==null?void 0:o.role)==="Admin"||(o==null?void 0:o.role)==="Developer",[V,P]=i.useState(null),A=i.useRef(null),d=S({resolver:y(ue),mode:"onBlur",defaultValues:{teamName:"",logo:null}});i.useEffect(()=>{b&&fetch("/api/v1/settings",{credentials:"include"}).then(s=>s.ok?s.json():null).then(s=>{s&&(d.reset({teamName:s.team_name,logo:null}),P(s.logo_url))})},[b]);async function Q(s){const a=new FormData;a.append("team_name",s.teamName),s.logo&&a.append("logo",s.logo);try{if(!(await fetch("/api/v1/settings",{method:"PATCH",credentials:"include",body:a})).ok){n.error("Failed to update workspace");return}n.success("Workspace updated")}catch{n.error("Failed to update workspace")}}const[k,F]=i.useState(null),D=i.useRef(null),c=S({resolver:y(pe),mode:"onBlur",defaultValues:{displayName:"",avatar:null}});i.useEffect(()=>{o&&(c.reset({displayName:o.displayName??"",avatar:null}),F(o.avatarUrl??null))},[o]);async function Y(s){const a=new FormData;a.append("display_name",s.displayName),s.avatar&&a.append("avatar",s.avatar);try{if(!(await fetch("/api/v1/profile",{method:"PATCH",credentials:"include",body:a})).ok){n.error("Failed to update profile");return}n.success("Profile updated")}catch{n.error("Failed to update profile")}}const t=S({resolver:y(fe),mode:"onBlur"});async function q(s){try{const a=await fetch("/api/v1/auth/change-password",{method:"POST",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({currentPassword:s.currentPassword,newPassword:s.newPassword})});if(!a.ok){const r=await a.json();t.setError("root",{message:r.error??"Failed to change password"});return}t.reset(),n.success("Password changed")}catch{t.setError("root",{message:"Network error"})}}const[T,E]=i.useState([]),[B,L]=i.useState({}),[U,z]=i.useState({}),[R,_]=i.useState({});i.useEffect(()=>{N&&fetch("/api/v1/apps",{credentials:"include"}).then(s=>s.ok?s.json():null).then(s=>{if(!s)return;E(s.items);const a={};s.items.forEach(r=>{a[r.id]=r.name}),L(a)})},[N]);async function G(s){_(a=>({...a,[s]:!0}));try{if(!(await fetch(`/api/v1/apps/${s}`,{method:"DELETE",credentials:"include"})).ok){n.error("Failed to delete app");return}E(r=>r.filter(l=>l.id!==s)),n.success("App deleted")}catch{n.error("Failed to delete app")}finally{_(a=>({...a,[s]:!1}))}}async function K(s){z(a=>({...a,[s]:!0}));try{if(!(await fetch(`/api/v1/apps/${s}`,{method:"PATCH",credentials:"include",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:B[s]})})).ok){n.error("Failed to update app");return}n.success("App updated")}catch{n.error("Failed to update app")}finally{z(a=>({...a,[s]:!1}))}}const x=I({control:c.control,name:"displayName"});return e.jsxs("div",{className:"flex flex-col gap-6 max-w-[900px] mx-auto w-full p-6",children:[e.jsx("h1",{className:"text-xl font-semibold tracking-display-sm",children:"Settings"}),b&&e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Workspace"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:d.handleSubmit(Q),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"team-name",children:"Team name"}),e.jsx(h,{id:"team-name",placeholder:"My QA Team",...d.register("teamName")}),d.formState.errors.teamName&&e.jsx("p",{className:"text-sm text-destructive",children:d.formState.errors.teamName.message})]}),e.jsx(M,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(m,{children:["Logo ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(png · jpg, max 2MB)"})]}),e.jsx(O,{name:"logo",control:d.control,render:({field:s})=>e.jsxs("div",{className:"relative w-16 h-16",children:[e.jsx("img",{src:V??J,alt:"Workspace logo",className:"w-16 h-16 rounded-lg object-contain"}),e.jsx("button",{type:"button","aria-label":"Change logo",onClick:()=>{var a;return(a=A.current)==null?void 0:a.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(W,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:A,type:"file",accept:".png,.jpg,.jpeg",className:"hidden",onChange:a=>{var l;const r=(l=a.target.files)==null?void 0:l[0];if(r&&r.size>2*1024*1024){n.error("Image must be 2MB or less");return}r&&(s.onChange(r),P(URL.createObjectURL(r)))}})]})})]}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:d.formState.isSubmitting,children:d.formState.isSubmitting?"Saving…":"Save changes"})})]})})]}),e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Profile"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:c.handleSubmit(Y),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"display-name",children:"Nickname"}),e.jsx(h,{id:"display-name",placeholder:"Your name",...c.register("displayName")}),c.formState.errors.displayName&&e.jsx("p",{className:"text-sm text-destructive",children:c.formState.errors.displayName.message})]}),e.jsx(M,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(m,{children:["Avatar ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(png · jpg, max 2MB)"})]}),e.jsx(O,{name:"avatar",control:c.control,render:({field:s})=>{var a;return e.jsxs("div",{className:"relative w-14 h-14",children:[k?e.jsx("img",{src:k,alt:"Profile avatar",className:"w-14 h-14 rounded-full object-cover border"}):e.jsx("div",{className:"w-14 h-14 rounded-full flex items-center justify-center text-lg font-medium",style:(()=>{const r=ee(x||(o==null?void 0:o.email)||"");return{backgroundColor:r.bg,color:r.fg}})(),children:((a=x==null?void 0:x[0])==null?void 0:a.toUpperCase())??"?"}),e.jsx("button",{type:"button","aria-label":"Change avatar",onClick:()=>{var r;return(r=D.current)==null?void 0:r.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(W,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:D,type:"file",accept:".png,.jpg,.jpeg",className:"hidden",onChange:r=>{var H;const l=(H=r.target.files)==null?void 0:H[0];if(l&&l.size>2*1024*1024){n.error("Image must be 2MB or less");return}l&&(s.onChange(l),F(URL.createObjectURL(l)))}})]})}})]}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:c.formState.isSubmitting,children:c.formState.isSubmitting?"Saving…":"Save changes"})})]})})]}),e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Password"})}),e.jsx(w,{children:e.jsxs("form",{onSubmit:t.handleSubmit(q),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"current-password",children:"Current password"}),e.jsx(h,{id:"current-password",type:"password",...t.register("currentPassword")}),t.formState.errors.currentPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.currentPassword.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"new-password",children:"New password"}),e.jsx(h,{id:"new-password",type:"password",...t.register("newPassword")}),t.formState.errors.newPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.newPassword.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(m,{htmlFor:"confirm-password",children:"Confirm new password"}),e.jsx(h,{id:"confirm-password",type:"password",...t.register("confirmPassword")}),t.formState.errors.confirmPassword&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.confirmPassword.message})]}),t.formState.errors.root&&e.jsx("p",{className:"text-sm text-destructive",children:t.formState.errors.root.message}),e.jsx("div",{className:"flex justify-end",children:e.jsx(u,{type:"submit",size:"sm",disabled:t.formState.isSubmitting,children:t.formState.isSubmitting?"Saving…":"Change password"})})]})})]}),N&&T.length>0&&e.jsxs(g,{children:[e.jsx(j,{children:e.jsx(v,{children:"Apps"})}),e.jsx(w,{children:e.jsx("div",{className:"flex flex-col divide-y divide-border",children:T.map(s=>e.jsxs("div",{className:"flex flex-col gap-2 py-4 first:pt-0 last:pb-0",children:[e.jsx(m,{htmlFor:`app-${s.id}`,children:"App Name"}),e.jsx(h,{id:`app-${s.id}`,value:B[s.id]??"",onChange:a=>L(r=>({...r,[s.id]:a.target.value}))}),e.jsxs("div",{className:"flex flex-col gap-1.5 mt-1",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"text-xs text-muted-foreground font-mono",children:s.bundle_id_key}),e.jsx(re,{tone:s.platform==="ios"?"ios":s.platform==="android"?"android":void 0,variant:s.platform==="both"?"secondary":void 0,className:"capitalize",children:s.platform})]}),e.jsxs("div",{className:"flex items-center justify-end gap-2",children:[e.jsx(u,{size:"sm",variant:"outline",disabled:U[s.id],onClick:()=>K(s.id),children:U[s.id]?"Saving…":"Save"}),e.jsxs(te,{children:[e.jsx(oe,{asChild:!0,children:e.jsx(u,{size:"sm",variant:"destructive",disabled:R[s.id],children:R[s.id]?"Deleting…":"Delete"})}),e.jsxs(ne,{children:[e.jsxs(ie,{children:[e.jsx(le,{children:"Delete app?"}),e.jsxs(ce,{children:["This will permanently delete ",e.jsx("strong",{children:s.name})," and all its builds. This action cannot be undone."]})]}),e.jsxs(de,{children:[e.jsx(me,{className:"w-24",children:"Cancel"}),e.jsx(he,{className:se(ae({variant:"destructive"}),"w-24"),onClick:()=>G(s.id),children:"Delete"})]})]})]})]})]})]},s.id))})})]})]})}export{Ne as DefaultSettings};

package/public/assets/{Invite-0EwoClX6.js → Invite-ChaVEWvP.js}

@@ -1 +1 @@
-import{i as n,j as e}from"./vendor-react-AJpf4YZ0.js";import{ad as I,a5 as A,ah as L,C as b,c as y,d as C,b as k,a as M,L as d,I as h,h as T,E as U,S as _,B as D,a2 as O,a3 as x,_ as Y}from"./index-9vdYIm7s.js";import{b as z,c as H}from"./vendor-router-ChFy8CZ1.js";import{P as V}from"./pencil-BeLNLEKe.js";const W=O({displayName:x().optional(),avatar:Y(File).nullable().optional(),password:x().min(8),confirm:x()}).refine(o=>o.password===o.confirm,{message:"Passwords do not match",path:["confirm"]});function K(){const o=z(),[S]=H(),c=S.get("token")??"",[f,m]=n.useState("loading"),[P,F]=n.useState(""),[v,R]=n.useState(null),j=n.useRef(null),{register:p,handleSubmit:B,control:g,setError:u,formState:{errors:t,isSubmitting:w}}=I({resolver:A(W),mode:"onBlur",defaultValues:{displayName:"",avatar:null}}),l=L({control:g,name:"displayName"})??"";n.useEffect(()=>{if(!c){m("invalid");return}fetch(`/api/v1/invitations/verify?token=${c}`).then(a=>a.ok?a.json():Promise.reject()).then(a=>{F(a.role),m("valid")}).catch(()=>m("invalid"))},[c]);async function E(a){var r;try{const s=new FormData;if(s.append("token",c),s.append("password",a.password),(r=a.displayName)!=null&&r.trim()&&s.append("display_name",a.displayName.trim()),a.avatar&&s.append("avatar",a.avatar),!(await fetch("/api/v1/invitations/accept",{method:"POST",body:s})).ok){u("root",{message:"Failed to accept invitation"});return}o("/app-center",{replace:!0})}catch{u("root",{message:"Network error. Please try again."})}}return f==="loading"?e.jsx("div",{className:"flex min-h-svh items-center justify-center"}):f==="invalid"?e.jsx("div",{className:"bg-mesh-gradient flex min-h-svh items-center justify-center overflow-hidden p-4",children:e.jsx(b,{level:4,className:"w-full max-w-sm text-center",children:e.jsxs(y,{children:[e.jsx(C,{children:"Invitation expired"}),e.jsx(k,{children:"This invite link is invalid or has expired. Ask your admin for a new one."})]})})}):e.jsx("div",{className:"bg-mesh-gradient flex min-h-svh items-center justify-center overflow-hidden p-4",children:e.jsxs(b,{level:4,className:"w-full max-w-sm",children:[e.jsxs(y,{className:"text-center",children:[e.jsx(C,{children:"Set up your account"}),e.jsxs(k,{children:["You're joining as ",e.jsx("strong",{children:P})]})]}),e.jsx(M,{children:e.jsxs("form",{onSubmit:B(E),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(d,{htmlFor:"display-name",children:["Nickname ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(optional)"})]}),e.jsx(h,{id:"display-name",placeholder:"Your name",...p("displayName")})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(d,{children:["Avatar ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(optional, png · jpg, max 2MB)"})]}),e.jsx(T,{name:"avatar",control:g,render:({field:a})=>{var r;return e.jsxs("div",{className:"relative w-14 h-14",children:[v?e.jsx("img",{src:v,alt:"Avatar preview",className:"w-14 h-14 rounded-full object-cover border"}):e.jsx("div",{className:"w-14 h-14 rounded-full flex items-center justify-center text-lg font-medium",style:(()=>{const s=U(l);return{backgroundColor:s.bg,color:s.fg}})(),children:((r=l==null?void 0:l[0])==null?void 0:r.toUpperCase())??"?"}),e.jsx("button",{type:"button","aria-label":"Change avatar",onClick:()=>{var s;return(s=j.current)==null?void 0:s.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(V,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:j,type:"file",accept:"image/png,image/jpeg",className:"hidden",onChange:s=>{var N;const i=(N=s.target.files)==null?void 0:N[0];if(i){if(i.size>2*1024*1024){u("avatar",{message:"Max 2MB for avatar"});return}a.onChange(i),R(URL.createObjectURL(i))}}})]})}}),t.avatar&&e.jsx("p",{className:"text-sm text-destructive",children:t.avatar.message})]}),e.jsx(_,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(d,{htmlFor:"password",children:"Password"}),e.jsx(h,{id:"password",type:"password",...p("password")}),t.password&&e.jsx("p",{className:"text-sm text-destructive",children:t.password.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(d,{htmlFor:"confirm",children:"Confirm password"}),e.jsx(h,{id:"confirm",type:"password",...p("confirm")}),t.confirm&&e.jsx("p",{className:"text-sm text-destructive",children:t.confirm.message})]}),t.root&&e.jsx("p",{className:"text-sm text-destructive",children:t.root.message}),e.jsx(D,{type:"submit",disabled:w,className:"w-full",children:w?"Creating account…":"Create account"})]})})]})})}export{K as Invite};
+import{i as n,j as e}from"./vendor-react-AJpf4YZ0.js";import{ad as I,a5 as A,ah as L,C as b,c as y,d as C,b as k,a as M,L as d,I as h,h as T,E as U,S as _,B as D,a2 as O,a3 as x,_ as Y}from"./index-CBfjqtE-.js";import{b as z,c as H}from"./vendor-router-BFibuab1.js";import{P as V}from"./pencil-DMswV31e.js";const W=O({displayName:x().optional(),avatar:Y(File).nullable().optional(),password:x().min(8),confirm:x()}).refine(o=>o.password===o.confirm,{message:"Passwords do not match",path:["confirm"]});function K(){const o=z(),[S]=H(),c=S.get("token")??"",[f,m]=n.useState("loading"),[P,F]=n.useState(""),[v,R]=n.useState(null),j=n.useRef(null),{register:p,handleSubmit:B,control:g,setError:u,formState:{errors:t,isSubmitting:w}}=I({resolver:A(W),mode:"onBlur",defaultValues:{displayName:"",avatar:null}}),l=L({control:g,name:"displayName"})??"";n.useEffect(()=>{if(!c){m("invalid");return}fetch(`/api/v1/invitations/verify?token=${c}`).then(a=>a.ok?a.json():Promise.reject()).then(a=>{F(a.role),m("valid")}).catch(()=>m("invalid"))},[c]);async function E(a){var r;try{const s=new FormData;if(s.append("token",c),s.append("password",a.password),(r=a.displayName)!=null&&r.trim()&&s.append("display_name",a.displayName.trim()),a.avatar&&s.append("avatar",a.avatar),!(await fetch("/api/v1/invitations/accept",{method:"POST",body:s})).ok){u("root",{message:"Failed to accept invitation"});return}o("/app-center",{replace:!0})}catch{u("root",{message:"Network error. Please try again."})}}return f==="loading"?e.jsx("div",{className:"flex min-h-svh items-center justify-center"}):f==="invalid"?e.jsx("div",{className:"bg-mesh-gradient flex min-h-svh items-center justify-center overflow-hidden p-4",children:e.jsx(b,{level:4,className:"w-full max-w-sm text-center",children:e.jsxs(y,{children:[e.jsx(C,{children:"Invitation expired"}),e.jsx(k,{children:"This invite link is invalid or has expired. Ask your admin for a new one."})]})})}):e.jsx("div",{className:"bg-mesh-gradient flex min-h-svh items-center justify-center overflow-hidden p-4",children:e.jsxs(b,{level:4,className:"w-full max-w-sm",children:[e.jsxs(y,{className:"text-center",children:[e.jsx(C,{children:"Set up your account"}),e.jsxs(k,{children:["You're joining as ",e.jsx("strong",{children:P})]})]}),e.jsx(M,{children:e.jsxs("form",{onSubmit:B(E),className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(d,{htmlFor:"display-name",children:["Nickname ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(optional)"})]}),e.jsx(h,{id:"display-name",placeholder:"Your name",...p("displayName")})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsxs(d,{children:["Avatar ",e.jsx("span",{className:"text-muted-foreground text-xs",children:"(optional, png · jpg, max 2MB)"})]}),e.jsx(T,{name:"avatar",control:g,render:({field:a})=>{var r;return e.jsxs("div",{className:"relative w-14 h-14",children:[v?e.jsx("img",{src:v,alt:"Avatar preview",className:"w-14 h-14 rounded-full object-cover border"}):e.jsx("div",{className:"w-14 h-14 rounded-full flex items-center justify-center text-lg font-medium",style:(()=>{const s=U(l);return{backgroundColor:s.bg,color:s.fg}})(),children:((r=l==null?void 0:l[0])==null?void 0:r.toUpperCase())??"?"}),e.jsx("button",{type:"button","aria-label":"Change avatar",onClick:()=>{var s;return(s=j.current)==null?void 0:s.click()},className:"absolute bottom-0 right-0 w-6 h-6 rounded-full bg-background border border-border shadow-sm flex items-center justify-center hover:bg-accent transition-colors",children:e.jsx(V,{className:"w-3 h-3","aria-hidden":"true"})}),e.jsx("input",{ref:j,type:"file",accept:"image/png,image/jpeg",className:"hidden",onChange:s=>{var N;const i=(N=s.target.files)==null?void 0:N[0];if(i){if(i.size>2*1024*1024){u("avatar",{message:"Max 2MB for avatar"});return}a.onChange(i),R(URL.createObjectURL(i))}}})]})}}),t.avatar&&e.jsx("p",{className:"text-sm text-destructive",children:t.avatar.message})]}),e.jsx(_,{}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(d,{htmlFor:"password",children:"Password"}),e.jsx(h,{id:"password",type:"password",...p("password")}),t.password&&e.jsx("p",{className:"text-sm text-destructive",children:t.password.message})]}),e.jsxs("div",{className:"grid gap-2",children:[e.jsx(d,{htmlFor:"confirm",children:"Confirm password"}),e.jsx(h,{id:"confirm",type:"password",...p("confirm")}),t.confirm&&e.jsx("p",{className:"text-sm text-destructive",children:t.confirm.message})]}),t.root&&e.jsx("p",{className:"text-sm text-destructive",children:t.root.message}),e.jsx(D,{type:"submit",disabled:w,className:"w-full",children:w?"Creating account…":"Create account"})]})})]})})}export{K as Invite};

package/public/assets/MacResources-CLChFyJW.js

@@ -0,0 +1 @@
+import{i,j as e}from"./vendor-react-AJpf4YZ0.js";import{u as Z,T as K,b as ee,c as te}from"./tabs-pPYCRfmT.js";import{a7 as se,M as ne}from"./index-CBfjqtE-.js";import{u as oe,h as re,g as ae,e as ie,c as le,G as ce,A as de,m as W,d as ue,a as he,b as me,L as fe,B as xe,l as pe,P as ge,f as je}from"./vendor-charts-DyX5CBcf.js";import"./vendor-router-BFibuab1.js";const ve={cpu:{label:"CPU",color:"#60a5fa"},mem:{label:"RAM",color:"#a78bfa"}},z={"1h":"1h","6h":"6h","24h":"24h","7d":"7d"},be={"1h":36e5,"6h":216e5,"24h":864e5,"7d":6048e5},ye={"1h":6e5,"6h":36e5,"24h":108e5,"7d":864e5};function ke(o,p){const n=new Date(o);return p==="7d"?`${n.getMonth()+1}/${n.getDate()}`:`${String(n.getHours()).padStart(2,"0")}:${String(n.getMinutes()).padStart(2,"0")}`}function Le(){const[o,p]=i.useState([]),[n,l]=i.useState([]),[a,d]=i.useState(null),[u,h]=i.useState("24h"),[w,b]=i.useState([]),[y,$]=i.useState(()=>Date.now()),[L,T]=i.useState(!1),{setNode:N}=se();i.useEffect(()=>(N(e.jsx("span",{className:"text-sm font-medium",children:"Mac Resources"})),()=>N(null)),[N]);const E=i.useCallback(t=>{t.type==="agents:listed"&&p(t.sessions??[])},[]),{send:M,connected:m}=Z(E);i.useEffect(()=>{if(!m)return;M({type:"agents:list"});const t=setInterval(()=>M({type:"agents:list"}),1e4);return()=>clearInterval(t)},[m,M]),i.useEffect(()=>{fetch("/api/v1/agents",{credentials:"include"}).then(t=>t.ok?t.json():[]).then(l)},[]);const g=o.map(t=>t.agentName).filter(Boolean),c=[...new Set([...g,...n])],S=new Set(g);i.useEffect(()=>{!a&&c.length>0&&d(c[0])},[c.join(",")]),i.useEffect(()=>{a&&(T(!0),fetch(`/api/v1/agents/${encodeURIComponent(a)}/resources?range=${u}`,{credentials:"include"}).then(t=>t.ok?t.json():[]).then(t=>{b(t),$(Date.now())}).finally(()=>T(!1)))},[a,u]);const k=w.map(t=>({time:t.recorded_at,cpu:Math.round(t.cpu_percent*10)/10,mem:Math.round(t.mem_percent*10)/10}));return e.jsxs("div",{className:"flex h-full min-h-0",children:[e.jsx("h1",{className:"sr-only",children:"Mac Resources"}),e.jsxs("aside",{"aria-labelledby":"macs-heading",className:"w-64 shrink-0 border-r flex flex-col gap-1 p-3 overflow-y-auto",children:[e.jsx("h2",{id:"macs-heading",className:"px-2 pb-1 font-mono text-xs font-medium text-muted-foreground uppercase tracking-wider",children:"Macs"}),c.length===0?e.jsx("span",{className:"px-2 text-sm text-muted-foreground",children:m?"No agents yet.":"Connecting…"}):c.map(t=>{const j=S.has(t),f=a===t;return e.jsxs("button",{onClick:()=>d(t),"aria-current":f?"true":void 0,className:["flex items-center gap-2 rounded-md px-2 py-2 text-left text-sm hover:bg-accent transition-colors",f?"bg-accent font-medium":""].join(" "),children:[e.jsx("span",{className:`inline-block h-1.5 w-1.5 shrink-0 rounded-full ${j?"bg-emerald-400":"bg-muted-foreground/40"}`,"aria-hidden":"true"}),e.jsx("span",{className:"truncate min-w-0",children:t}),e.jsx("span",{className:"sr-only",children:j?"Online":"Offline"})]},t)})]}),e.jsx("div",{className:"flex-1 min-w-0 overflow-auto",children:a?e.jsxs("div",{className:"flex flex-col gap-6 p-6",children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsx("h2",{className:"text-base font-semibold",children:a}),e.jsx(K,{value:u,onValueChange:t=>h(t),children:e.jsx(ee,{children:Object.keys(z).map(t=>e.jsx(te,{value:t,children:z[t]},t))})})]}),L?e.jsx("div",{className:"flex h-40 items-center justify-center text-sm text-muted-foreground",children:"Loading…"}):k.length===0?e.jsx("div",{className:"flex h-40 items-center justify-center text-sm text-muted-foreground",children:"No data yet for this range. Data is collected every minute while the agent is connected."}):e.jsxs("div",{className:"flex flex-col gap-6",children:[e.jsx(Y,{title:"CPU %",color:"cpu",data:k,dataKey:"cpu",range:u,now:y}),e.jsx(Y,{title:"RAM %",color:"mem",data:k,dataKey:"mem",range:u,now:y})]})]}):e.jsxs("div",{className:"flex h-full items-center justify-center gap-2 text-muted-foreground",children:[e.jsx(ne,{className:"h-8 w-8"}),e.jsx("p",{className:"text-sm",children:"Select a Mac to view resource history."})]})})]})}const A=o=>new Date(o.time).getTime(),H=o=>new Date(o.time).toLocaleString(void 0,{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}),I=o=>`${Math.round(o*10)/10}%`,we=je(A).left,x={top:8,right:24,bottom:24,left:40},X=16;function Y({title:o,color:p,data:n,dataKey:l,range:a,now:d}){const u=ve[p].color;return e.jsxs("div",{className:"rounded-lg border p-4 flex flex-col gap-3",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"inline-block h-2.5 w-2.5 rounded-full",style:{background:u}}),e.jsx("h2",{className:"text-sm font-medium",children:o})]}),e.jsx("div",{className:"relative h-[220px] w-full",children:e.jsx(ge,{children:({width:h,height:w})=>h>0&&w>0?e.jsx(Ne,{width:h,height:w,data:n,dataKey:l,hex:u,range:a,now:d,label:o}):null})})]})}function Ne({width:o,height:p,data:n,dataKey:l,hex:a,range:d,now:u,label:h}){const{showTooltip:w,hideTooltip:b,tooltipData:y,tooltipLeft:$,tooltipTop:L}=oe(),T=`chart-hint-${l}`,[N,E]=i.useState(null),M=Math.max(0,n.length-1),m=N===null?M:Math.min(N,M),g=o-x.left-x.right,c=p-x.top-x.bottom,S=ye[d],k=u,t=k-be[d],j=re({domain:[t,k],range:[0,Math.max(0,g)]}),f=ae({domain:[0,100],range:[c,X]}),O=Math.floor(k/S)*S,P=Math.floor((O-t)/S)+1,q=Array.from({length:P},(s,r)=>new Date(O-(P-1-r)*S)),_=`fill-${l}`,B=`plot-${l}`,R=s=>{const r=n[s];r&&(E(s),w({tooltipData:r,tooltipLeft:j(A(r)),tooltipTop:f(r[l])}))},J=s=>{if(n.length===0)return;if(s.key==="Escape"){b();return}const r=m,v=s.key==="ArrowLeft"||s.key==="ArrowDown"?Math.max(0,r-1):s.key==="ArrowRight"||s.key==="ArrowUp"?Math.min(n.length-1,r+1):s.key==="Home"?0:s.key==="End"?n.length-1:null;v!==null&&(s.preventDefault(),R(v))},G=s=>{const r=pe(s);if(!r)return;const v=j.invert(r.x-x.left).getTime(),U=we(n,v),C=n[U-1],D=n[U],V=C&&D?v-A(C)<A(D)-v?C:D:C??D;V&&R(n.indexOf(V))},F=n[n.length-1],Q=s=>`${h}, ${H(s)}, ${I(s[l])}`;return e.jsxs(e.Fragment,{children:[e.jsxs("svg",{width:o,height:p,role:"group","aria-label":F?`${h}, last ${d}. Latest ${I(F[l])}.`:`${h}, last ${d}. No samples.`,children:[e.jsx(ie,{id:_,from:a,to:a,fromOpacity:.3,toOpacity:0,fromOffset:"5%",toOffset:"95%"}),e.jsx("clipPath",{id:B,children:e.jsx("rect",{x:0,y:0,width:Math.max(0,g),height:Math.max(0,c)})}),e.jsxs(le,{left:x.left,top:x.top,children:[e.jsx(ce,{scale:f,width:g,tickValues:[0,25,50,75,100],strokeDasharray:"3 3",stroke:"hsl(var(--border))"}),e.jsxs("g",{clipPath:`url(#${B})`,children:[e.jsx(de,{data:n,x:s=>j(A(s)),y:s=>f(s[l]),yScale:f,curve:W,fill:`url(#${_})`}),e.jsx(ue,{data:n,x:s=>j(A(s)),y:s=>f(s[l]),curve:W,stroke:a,strokeWidth:1.5})]}),e.jsx(he,{top:c,scale:j,tickValues:q,tickFormat:s=>ke(new Date(+s).toISOString(),d),hideAxisLine:!0,hideTicks:!0,tickLength:0,tickLabelProps:(s,r,v)=>({fontSize:11,fill:"currentColor",textAnchor:r===0?"start":r===v.length-1?"end":"middle",dy:6,className:"fill-muted-foreground"})}),e.jsx(me,{scale:f,tickValues:[0,25,50,75,100],tickFormat:s=>`${s}%`,hideAxisLine:!0,hideTicks:!0,tickLabelProps:()=>({fontSize:11,fill:"currentColor",textAnchor:"end",dx:-4,dy:3,className:"fill-muted-foreground"})}),y&&e.jsxs("g",{style:{transition:"transform 0.25s ease-out",transform:`translateX(${$??0}px)`},pointerEvents:"none",children:[e.jsx(fe,{from:{x:0,y:X},to:{x:0,y:c},stroke:"hsl(var(--border))",strokeWidth:1}),e.jsx("circle",{cx:0,cy:0,r:3,fill:a,stroke:"hsl(var(--background))",strokeWidth:1.5,style:{transition:"transform 0.25s ease-out",transform:`translateY(${L??0}px)`}})]}),e.jsx(xe,{x:0,y:0,width:Math.max(0,g),height:Math.max(0,c),fill:"transparent",tabIndex:0,role:"slider","aria-label":`${h} samples`,"aria-valuemin":0,"aria-valuemax":Math.max(0,n.length-1),"aria-valuenow":m,"aria-valuetext":n[m]?Q(n[m]):void 0,"aria-describedby":T,className:"outline-none focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring",onFocus:()=>R(m),onBlur:b,onKeyDown:J,onMouseMove:G,onMouseLeave:b,onTouchMove:G,onTouchEnd:b,onTouchCancel:b})]})]}),e.jsx("p",{id:T,className:"sr-only",children:"Use the arrow keys to read individual samples. Escape hides the reading."}),y&&e.jsxs("div",{"aria-hidden":"true",className:"pointer-events-none absolute top-0 left-0 whitespace-nowrap rounded-lg border bg-background px-3 py-2 text-xs text-foreground shadow-md",style:{transform:`translate(${($??0)+x.left}px, ${(L??0)+x.top}px) translate(${($??0)>g*.6?"calc(-100% - 12px)":"12px"}, -50%)`,transition:"transform 0.25s ease-out"},children:[e.jsxs("p",{className:"mb-1",children:["Date:"," ",H(y)]}),e.jsxs("p",{children:[h,": ",I(y[l])]})]})]})}export{Ne as AreaChartInner,Le as MacResources};