@termix-ssh/plugin-sdk 1.0.12 → 1.0.15

package/dist/host/types/src/ui/plugin-host/sdk-ui.d.ts

@@ -103,15 +103,14 @@ export { ConnectionGate, useConnectionGate, type ConnectionGateController, type
 export { type ConnectionUnavailable } from "../components/connection/ConnectionScreen";
 export { APP_VERSION } from "../lib/app-version";
 export { Command as CommandPrimitive } from "cmdk";
-export { buildExportPayload, hostKey, maskSecrets, pluginSecretKeys, type ExportPayload, type FieldGroup, } from "../sidebar/host-export-payload";
 export { type AuthOverrideProtocol, SSH_AUTH_PROTOCOL, } from "../../types/auth-protocols";
 export { CREDENTIAL_ROW_FIELD_KEYS, type CredentialDensity, type CredentialRowFields, type CredentialSidebarFilterState, type CredentialSidebarPreferences, type CredentialSortKey, type CredentialTrayTrigger, defaultCredentialRowFields, defaultCredentialSidebarPreferences, sanitizeCredentialSidebarPreferences, } from "../../types/credential-sidebar-preferences";
 export { CORE_HOST_DEFAULTS, CORE_NAMESPACE, type DefaultOverrides, defaultValuesEqual, findCoreHostDefault, type HostDefaultsLevel, type ResolvedHostDefault, splitDefaultKey, } from "../../types/host-defaults";
 export { defaultHostRowFields, defaultHostSidebarPreferences, type HostClickBehavior, type HostDensity, type HostGroupKey, type HostRowFields, type HostSidebarFilterState, type HostSidebarPreferences, type HostTrayTrigger, sanitizeHostSidebarPreferences, type SortKey, } from "../../types/host-sidebar-preferences";
-export type { HostData, HostProtocolAuthInput, ProxyNode, SSHHost, SSHHostData, } from "../../types";
-export { UI_AREA_KEYS, type UiAreaKey, type UiPreset, } from "../../types/ui-preferences";
+export type { HostData, HostLock, HostProtocolAuthInput, ProxyNode, SSHHost, SSHHostData, } from "../../types";
+export { PRESETS, UI_AREA_KEYS, type UiAreaKey, type UiPreset, } from "../../types/ui-preferences";
 export type { AdminSection, Credential, DashboardCardId, FontSizeId, Host, HostFolder, SharePermissionLevel, Tab, TabType, ThemeId, ToolsTab, UiFontId, } from "../../types/ui-types";
-export { type AuditLog, type AuditLogFilters, getAuditForwarding, getAuditLogActions, getAuditLogs, updateAuditForwarding, } from "../api/audit-log-api";
+export { type AuditLog, type AuditLogFilters, getAuditLogActions, getAuditLogs, } from "../api/audit-log-api";
 export { getUserSecondFactors, resetUserSecondFactors, type UserSecondFactorSummary, } from "../api/auth-methods-api";
 export { getCredentials } from "../api/credentials-api";
 export { getFolderDefaultsId, getHostDefaultsLevel, type HostDefaultsChange, type HostDefaultsTarget, previewHostDefaultsLevel, resetHostToDefaults, resolveHostDefaults, saveHostDefaultsLevel, waitForDefaultsJob, } from "../api/host-defaults-api";
@@ -120,7 +119,7 @@ export { getSessionTimeoutMinutes, getUserPreferences, parseCustomKeybindings, s
 export { getDeveloperMode, getPluginAdminSettings, getPluginHostSettings, getPlugins, getPluginUserSettings, type PluginSettingsErrors, type PluginSettingsField, PluginSettingsValidationError, type PluginSummary, setAllPluginChannels, setDeveloperMode, setPluginOptions, updatePluginAdminSettings, updatePluginHostSettings, updatePluginUserSettings, } from "../api/plugins-api";
 export { getNotificationPrivateEndpoints, setNotificationPrivateEndpoints, } from "../api/private-endpoints-api";
 export { type CredentialPermissionLevel, type FolderAccessRule, getCredentialAccess, getFolderAccess, getRoles, revokeCredentialAccess, revokeFolderAccess, shareCredential, type ShareTarget, } from "../api/rbac-api";
-export { type BrandingSettings, getBranding, updateBranding, } from "../api/settings-api";
+export { type BrandingSettings, getBranding } from "../api/settings-api";
 export { getSyncConflicts, getSyncErrors, retrySyncErrors, settleSyncConflict, type SyncBasicAuth, type SyncConflictItem, type SyncEntityInfo, type SyncErrorItem, syncNow, type SyncProxyHeader, type SyncStatus, unlinkServer, updateSyncSettings, } from "../api/sync-api";
 export { getChannelReleases, getUpdateChannel, type ReleaseInfo, setUpdateChannel, type UpdateChannelState, } from "../api/system-status-api";
 export { getTlsStatus, type TlsStatus, uploadTlsCertificate, } from "../api/tls-api";
@@ -166,7 +165,7 @@ export { tabJumpHotkeyKeys } from "../lib/tab-jump-hotkey";
 export { ACCENT_PRESET_COLORS, applyAccentColor, applyFontSize, applyUiFont, DASHBOARD_CARDS, FONT_SIZES, UI_FONTS, } from "../lib/theme";
 export { registerLayout } from "../look/layout-registry";
 export { useChooseTheme } from "../look/use-look-theme";
-export { type AccessRecord, type ActiveSessionInfo, adminCreateUser, adminCreateUserCredential, adminCreateUserHost, adminDeleteUserCredential, adminDeleteUserHost, adminExportUserData, adminGetHostPassword, adminGetUserCredentials, adminGetUserHosts, adminResetUserPassword, adminUpdateUserCredential, adminUpdateUserHost, type ApiKey, assignRoleToUser, bulkImportSSHHosts, bulkUpdateSSHHosts, changePassword, createApiKey, createCredential, type CreatedApiKey, createRole, createSSHHost, deleteAccount, deleteAllHostsInFolder, deleteApiKey, deleteCredential, deleteOpenTab, deleteRole, deleteSSHHost, deleteUser, deployCredentialToHost, duplicateCredential, exportAllSSHHosts, generateKeyPair, generatePublicKeyFromPrivate, getActiveSessions, getApiKeys, getCredentialDetails, getCredentialSidebarPreferences, getExternalAutoProvision, getHostAccess, getHostAuthOverride, getHostPassword, getHostSidebarPreferences, getLogLevel, getPasswordLoginAllowed, getPasswordResetAllowed, getPermissionsCatalog, getRegistrationAllowed, getSecondFactorAfterExternalLogin, getSessions, getSessionTimeout, getSSHFolders, getSSHHosts, getStatusCheckSettings, getUserInfo, getUserList, getUserRoles, importSSHConfigHosts, type LinkedAccountInfo, linkExternalToPasswordAccount, logoutUser, makeUserAdmin, type OpenTabRecord, type PermissionCatalogEntry, releaseUrlFrom, removeAdminStatus, removeRoleFromUser, renameCredentialFolder, renameFolder, reorderCredentials, reorderFolders, reorderSSHHosts, resetRecentActivity, revokeAllUserSessions, revokeHostAccess, revokeSession, type Role, saveCredentialSidebarPreferences, saveHostSidebarPreferences, setHostAuthOverride, shareFolder, shareHost, type SSHHostWithStatus, unlinkExternalFromPasswordAccount, updateCredential, updateExternalAutoProvision, updateFolderMetadata, updateHostAccess, updateLogLevel, updatePasswordLoginAllowed, updatePasswordResetAllowed, updateRegistrationAllowed, updateRole, updateSecondFactorAfterExternalLogin, updateSessionTimeout, updateSSHHost, updateStatusCheckSettings, type UserPreferences, type UserRole, } from "../main-axios";
+export { type AccessRecord, type ActiveSessionInfo, adminCreateUser, adminCreateUserCredential, adminCreateUserHost, adminDeleteUserCredential, adminDeleteUserHost, adminExportUserData, adminGetHostPassword, adminGetUserCredentials, adminGetUserHosts, adminResetUserPassword, adminUpdateUserCredential, adminUpdateUserHost, type ApiKey, assignRoleToUser, bulkUpdateSSHHosts, changePassword, createApiKey, createCredential, type CreatedApiKey, createRole, createSSHHost, deleteAccount, deleteAllHostsInFolder, deleteApiKey, deleteCredential, deleteOpenTab, deleteRole, deleteSSHHost, deleteUser, duplicateCredential, getActiveSessions, getApiKeys, getCredentialDetails, getCredentialSidebarPreferences, getExternalAutoProvision, getHostAccess, getHostAuthOverride, getHostPassword, getHostPolicy, type HostPolicy, getHostSidebarPreferences, getHttpsSettings, type HttpsSettings, getLogLevel, getPasswordLoginAllowed, getPasswordResetAllowed, getPermissionsCatalog, getRegistrationAllowed, getSecondFactorAfterExternalLogin, getSessions, getSessionTimeout, getSSHFolders, getSSHHosts, getStatusCheckSettings, getUserInfo, getUserList, getUserRoles, type LinkedAccountInfo, linkExternalToPasswordAccount, logoutUser, makeUserAdmin, type OpenTabRecord, type PermissionCatalogEntry, releaseUrlFrom, removeAdminStatus, removeRoleFromUser, renameCredentialFolder, renameFolder, reorderCredentials, reorderFolders, reorderSSHHosts, resetRecentActivity, revokeAllUserSessions, revokeHostAccess, revokeSession, type Role, saveCredentialSidebarPreferences, saveHostSidebarPreferences, setHostAuthOverride, shareFolder, shareHost, type SSHHostWithStatus, unlinkExternalFromPasswordAccount, updateCredential, updateExternalAutoProvision, updateFolderMetadata, updateHostAccess, updateHttpsSettings, updateLogLevel, updatePasswordLoginAllowed, updatePasswordResetAllowed, updateRegistrationAllowed, updateRole, updateSecondFactorAfterExternalLogin, updateSessionTimeout, updateSSHHost, updateStatusCheckSettings, type UserPreferences, type UserRole, } from "../main-axios";
 export { MANAGE_REQUEST_EVENT, type ManageMode, type ManageRequest, requestFromLegacyEvent, requestManage, takePendingManageRequest, } from "../manage/manage-requests";
 export { useSshAuthEditors } from "./auth-registry";
 export { usePluginStore } from "./plugin-store";
@@ -196,7 +195,7 @@ export { markTabSurfaceUsed, preloadTabSurface, tabIcon, } from "../shell/tabUti
 export { AuthEnrollmentSections } from "../sidebar/AuthEnrollmentSections";
 export { mapCredentials, sshHostToHost } from "../sidebar/HostManagerData";
 export { getHostEditorSection, makeHostSshSubTabs, makeHostTabs, useHostEditorSections, } from "../sidebar/HostManagerTabs";
-export { actionOrder, defaultConnectAction, type HostActionDef, hostActionsFor, hostBadgesFor, hostMenuItemsFor, listHostActions, runHostAction, useHostActions, useHostBadges, useHostContextMenuItems, } from "../sidebar/host-contributions";
+export { actionOrder, defaultConnectAction, type HostActionDef, hostActionsFor, hostBadgesFor, hostEditorToolbarItemsFor, hostMenuItemsFor, hostStatusIndicatorsFor, listHostActions, runHostAction, useHostActions, useHostBadges, useHostContextMenuItems, useHostEditorToolbarItems, useHostStatusIndicators, } from "../sidebar/host-contributions";
 export { useEditorDefaultKeys } from "../sidebar/host-defaults/catalog";
 export { enabledHostProtocols, type HostProtocolDef, hostProtocolFlags, type HostProtocols, listHostProtocols, protocolEnabled, protocolPort, useHostProtocols, withProtocolSettings, } from "../sidebar/host-protocols";
 export { quickConnectTargets } from "../sidebar/quick-connect-host";

package/dist/host/types/src/ui/plugins/plugin-model.d.ts

@@ -49,6 +49,12 @@ export interface PluginEntry {
     managedByServer: boolean;
     /** The app is drawn with it by default, so it can be swapped but not uninstalled. */
     defaultLook: boolean;
+    /** Contribution keys from the manifest or the registry, like layouts. */
+    kinds: string[];
+    /** Listed, but no release runs on this build. */
+    unsupported: boolean;
+    /** The Termix range the newest release needs, when this build is too old. */
+    needsTermix: string | null;
 }
 export type PluginSource = "bundled" | "official" | "community" | "custom" | "unverified";
 export declare function isPrerelease(version: string | null | undefined): boolean;
@@ -64,6 +70,20 @@ export type SortKey = "popular" | "name" | "updated" | "category";
 export declare function sortPlugins(rows: PluginEntry[], key: SortKey): PluginEntry[];
 export declare function matchesQuery(row: PluginEntry, query: string): boolean;
 export declare function categoriesOf(rows: PluginEntry[]): string[];
+/** Contribution keys worth filtering by, in the order the filter lists them. */
+export declare const PLUGIN_KINDS: readonly ["layouts", "themes", "tabs", "panels", "dashboardCards", "protocols", "auth", "actions", "hostCapability"];
+export type PluginKind = (typeof PLUGIN_KINDS)[number];
+/** The filterable kinds present in a set of rows, with how many have each. */
+export declare function kindsOf(rows: PluginEntry[]): Array<{
+    kind: PluginKind;
+    count: number;
+}>;
+/** One page of rows, with the page clamped to what exists. */
+export declare function pageOf<T>(rows: T[], page: number, size: number): {
+    items: T[];
+    page: number;
+    pages: number;
+};
 export declare function capabilityRisk(capability: string): CapabilityRisk;
 /** Worst first, the order the consent copy is read in. */
 export declare function orderByRisk(capabilities: string[]): string[];

package/dist/host/types/src/ui/plugins/use-plugins-manager.d.ts

@@ -40,6 +40,9 @@ export declare function usePluginsManager(): {
         registryName: string | null;
         managedByServer: boolean;
         defaultLook: boolean;
+        kinds: string[];
+        unsupported: boolean;
+        needsTermix: string | null;
     }[];
     loading: boolean;
     refreshing: boolean;

package/dist/host/types/src/ui/sidebar/AuthEnrollmentSections.d.ts

@@ -2,4 +2,7 @@
  * Enrolment sections login methods and second factors register, such as
  * adding a passkey or setting up an authenticator app.
  */
-export declare function AuthEnrollmentSections(): import("react").JSX.Element;
+export declare function AuthEnrollmentSections({ factorsOnly, }?: {
+    /** Only second factors, for a login policy that requires one. */
+    factorsOnly?: boolean;
+}): import("react").JSX.Element;

package/dist/host/types/src/ui/sidebar/host-contributions.d.ts

@@ -45,6 +45,10 @@ export interface HostBadgeDef {
     }>;
     order?: number;
 }
+/** The dot or stripe on a host row that shows its status. */
+export type HostStatusIndicatorDef = HostBadgeDef;
+/** A button in the host editor's toolbar. */
+export type HostEditorToolbarItemDef = HostBadgeDef;
 export interface HostContextMenuItemDef {
     id: string;
     pluginId?: string;
@@ -61,12 +65,18 @@ export declare function actionOrder(action: HostActionDef): number;
 export declare const listHostActions: () => HostActionDef[];
 export declare const registerHostBadge: (item: HostBadgeDef) => () => void;
 export declare const useHostBadges: () => HostBadgeDef[];
+export declare const registerHostStatusIndicator: (item: HostBadgeDef) => () => void;
+export declare const useHostStatusIndicators: () => HostBadgeDef[];
+export declare const registerHostEditorToolbarItem: (item: HostBadgeDef) => () => void;
+export declare const useHostEditorToolbarItems: () => HostBadgeDef[];
 export declare const registerHostContextMenuItem: (item: HostContextMenuItemDef) => () => void;
 export declare const useHostContextMenuItems: () => HostContextMenuItemDef[];
 export declare function hostActionsFor(all: HostActionDef[], host: Host, kind?: HostActionDef["kind"]): HostActionDef[];
 /** The connect action a click on the host should run, by priority. */
 export declare function defaultConnectAction(all: HostActionDef[], host: Host): HostActionDef | undefined;
 export declare function hostBadgesFor(all: HostBadgeDef[], host: Host): HostBadgeDef[];
+export declare function hostStatusIndicatorsFor(all: HostStatusIndicatorDef[], host: Host): HostStatusIndicatorDef[];
+export declare function hostEditorToolbarItemsFor(all: HostEditorToolbarItemDef[], host: Host): HostEditorToolbarItemDef[];
 export declare function hostMenuItemsFor(all: HostContextMenuItemDef[], host: Host): HostContextMenuItemDef[];
 /** Runs an action, falling back to opening its tab type. */
 export declare function runHostAction(action: HostActionDef, host: Host, shell: TabShellCallbacks): void;

package/dist/host/ui.js

@@ -52,6 +52,7 @@ import {
   getPollingEnvironmentMultiplier,
   getPreferredHostAction,
   getRegisteredDashboardCard,
+  getRememberDeviceAllowed,
   getStatusClasses,
   getSyncConflicts,
   getSyncErrors,
@@ -61,8 +62,10 @@ import {
   hostActionsFor,
   hostBadgesFor,
   hostEditorSectionList,
+  hostEditorToolbarItemsFor,
   hostMenuItemsFor,
   hostProtocolFlags,
+  hostStatusIndicatorsFor,
   i18n_default,
   installPluginHostBridge,
   isCoreRailView,
@@ -139,8 +142,10 @@ import {
   useHostBadges,
   useHostContextMenuItems,
   useHostEditorSections,
+  useHostEditorToolbarItems,
   useHostProtocols,
   useHostStatus,
+  useHostStatusIndicators,
   useInstalledPlugins,
   useIsMobile,
   useKeybindingActions,
@@ -169,10 +174,10 @@ import {
   useThemes,
   verifySecondFactor,
   withProtocolSettings
-} from "./chunk-XKA3DBB2.js";
+} from "./chunk-V44FCJBQ.js";
 import {
   usePermissions
-} from "./chunk-VEWOYAMZ.js";
+} from "./chunk-57DJU2ZA.js";
 import {
   AddButton,
   Card,
@@ -193,7 +198,7 @@ import {
   isPrerelease,
   reportBetaFeedbackUrl,
   reportCoreIssueUrl
-} from "./chunk-X4QZKO5G.js";
+} from "./chunk-VFTB2RDP.js";
 import {
   Action,
   Activity,
@@ -383,7 +388,7 @@ import {
   useSurfaceKind,
   useUiPreference,
   useUiPreferencesContext
-} from "./chunk-AWR6FYDO.js";
+} from "./chunk-2IV3VX7F.js";
 import {
   CREDENTIAL_ROW_FIELD_KEYS,
   PRESETS,
@@ -404,7 +409,6 @@ import {
   assignRoleToUser,
   authApi,
   buildOriginWsUrl,
-  bulkImportSSHHosts,
   bulkUpdateSSHHosts,
   changePassword,
   completePasswordReset,
@@ -426,11 +430,7 @@ import {
   deleteRole,
   deleteSSHHost,
   deleteUser,
-  deployCredentialToHost,
   duplicateCredential,
-  exportAllSSHHosts,
-  generateKeyPair,
-  generatePublicKeyFromPrivate,
   getActiveSessions,
   getApiKeys,
   getBackendUrl,
@@ -451,7 +451,9 @@ import {
   getHostAccess,
   getHostAuthOverride,
   getHostPassword,
+  getHostPolicy,
   getHostSidebarPreferences,
+  getHttpsSettings,
   getLogLevel,
   getPasswordLoginAllowed,
   getPasswordResetAllowed,
@@ -480,7 +482,6 @@ import {
   handleApiError,
   hostApi,
   hydrateLocalSharedHostAuth,
-  importSSHConfigHosts,
   initiatePasswordReset,
   invalidateHostsAndStatusCaches,
   invalidateServerStatusCache,
@@ -529,11 +530,11 @@ import {
   sshHostApi,
   tabTypeForActivity,
   unlinkExternalFromPasswordAccount,
-  updateBranding,
   updateCredential,
   updateExternalAutoProvision,
   updateFolderMetadata,
   updateHostAccess,
+  updateHttpsSettings,
   updateLogLevel,
   updatePasswordLoginAllowed,
   updatePasswordResetAllowed,
@@ -547,7 +548,7 @@ import {
   useTabs,
   useTabsSafe,
   verifyPasswordResetCode
-} from "./chunk-RUPLD6RF.js";
+} from "./chunk-3L45NNT5.js";
 import {
   define_import_meta_env_default,
   init_define_import_meta_env
@@ -4346,6 +4347,7 @@ function Auth({ onLogin }) {
   const [username, setUsername] = useState7("");
   const [password, setPassword] = useState7("");
   const [confirmPassword, setConfirmPassword] = useState7("");
+  const [rememberAllowed, setRememberAllowed] = useState7(true);
   const [rememberMe, setRememberMe] = useState7(() => {
     try {
       return localStorage.getItem("rememberMe") === "true";
@@ -4466,6 +4468,11 @@ function Auth({ onLogin }) {
     getPasswordResetAllowed().then((allowed) => setPasswordResetAllowed(allowed)).catch(() => setPasswordResetAllowed(false));
     void startPreLoginPlugins().catch(() => {
     }).finally(() => setAuthPluginsLoading(false));
+    getRememberDeviceAllowed().then((allowed) => {
+      setRememberAllowed(allowed);
+      if (!allowed) setRememberMe(false);
+    }).catch(() => {
+    });
     getLoginMethods().then((methods) => setAuthMethods(methods)).catch(() => setAuthMethods([])).finally(() => setAuthMethodsLoaded(true));
   }, [localDesktopAuth]);
   useEffect6(() => {
@@ -5361,7 +5368,7 @@ function Auth({ onLogin }) {
           /* @__PURE__ */ jsx28("p", { className: "text-xs text-muted-foreground", children: view === "login" ? t3("auth.loginSubtitle", "") : view === "register" ? t3("auth.registerSubtitle", "") : t3("auth.loginWithExternalDesc") })
         ] }),
         view === "external" && /* @__PURE__ */ jsxs20("div", { className: "flex flex-col gap-4", children: [
-          /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
+          rememberAllowed && /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
             /* @__PURE__ */ jsx28(
               Checkbox,
               {
@@ -5412,7 +5419,7 @@ function Auth({ onLogin }) {
             }
           ) }),
           /* @__PURE__ */ jsxs20("div", { className: "flex items-center justify-between", children: [
-            /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
+            rememberAllowed ? /* @__PURE__ */ jsxs20("div", { className: "flex items-center gap-2", children: [
               /* @__PURE__ */ jsx28(
                 Checkbox,
                 {
@@ -5430,7 +5437,7 @@ function Auth({ onLogin }) {
                   children: t3("auth.rememberMe")
                 }
               )
-            ] }),
+            ] }) : /* @__PURE__ */ jsx28("span", {}),
             passwordResetAllowed && /* @__PURE__ */ jsx28(
               "button",
               {
@@ -32199,167 +32206,6 @@ function B2({ asChild: r, children: o }, n) {
 }
 var Te = { position: "absolute", width: "1px", height: "1px", padding: "0", margin: "-1px", overflow: "hidden", clip: "rect(0, 0, 0, 0)", whiteSpace: "nowrap", borderWidth: "0" };
 
-// src/ui/sidebar/host-export-payload.ts
-init_define_import_meta_env();
-var FIELD_GROUP_KEYS = {
-  connection: [
-    "connectionType",
-    "name",
-    "ip",
-    "port",
-    "username",
-    "folder",
-    "domain",
-    "security",
-    "ignoreCert"
-  ],
-  notes: ["notes"],
-  tags: ["tags", "pin"],
-  proxy: [
-    "useSocks5",
-    "socks5Host",
-    "socks5Port",
-    "socks5Username",
-    "socks5ProxyChain"
-  ],
-  jumpHosts: ["jumpHosts"],
-  // Every plugin's host settings, enable switches included.
-  featureFlags: ["pluginSettings", "forceKeyboardInteractive"],
-  advanced: [
-    "statusCheckEnabled",
-    "statusCheckInterval",
-    "terminalConfig",
-    "sshOptions"
-  ]
-};
-var SECRET_KEYS = [
-  "password",
-  "key",
-  "keyPassword",
-  "sudoPassword",
-  "socks5Password"
-];
-var CREDENTIAL_KEYS = [
-  ...SECRET_KEYS,
-  "authType",
-  "keyType",
-  "credentialAlias",
-  "credentialId",
-  "overrideCredentialUsername"
-];
-var TUPLE_KEYS = ["name", "ip", "port", "username", "connectionType"];
-function pluginSecretKeys(summaries) {
-  const result = {};
-  for (const summary of summaries) {
-    for (const field of summary.contributes?.settings?.host?.fields ?? []) {
-      if (!field.secretKeys?.length) continue;
-      (result[summary.id] ??= {})[field.key] = field.secretKeys;
-    }
-  }
-  return result;
-}
-var NESTED_SECRET_ARRAYS = [
-  { container: "socks5ProxyChain", field: "password" }
-];
-function mapPluginSecrets(pluginSettings, secrets, replace2) {
-  if (!pluginSettings || typeof pluginSettings !== "object") {
-    return pluginSettings;
-  }
-  const perPlugin = {};
-  for (const [pluginId, values] of Object.entries(
-    pluginSettings
-  )) {
-    const copy = { ...values };
-    for (const [field, keys2] of Object.entries(secrets[pluginId] ?? {})) {
-      const blob = copy[field];
-      if (!blob || typeof blob !== "object") continue;
-      const record = { ...blob };
-      for (const key of keys2) {
-        if (key in record) record[key] = replace2(record[key]);
-      }
-      copy[field] = record;
-    }
-    perPlugin[pluginId] = copy;
-  }
-  return perPlugin;
-}
-function hostKey(host) {
-  return JSON.stringify(TUPLE_KEYS.map((k3) => String(host[k3] ?? "")));
-}
-function buildExportPayload(raw, selected, groups, withCredentials, pluginSecrets = {}) {
-  const allowed = /* @__PURE__ */ new Set([
-    "exportId",
-    ...CREDENTIAL_KEYS,
-    ...FIELD_GROUP_KEYS.connection
-  ]);
-  for (const group of groups) {
-    for (const key of FIELD_GROUP_KEYS[group]) allowed.add(key);
-  }
-  const hosts = (raw.hosts ?? []).filter((host) => selected === null || selected.has(hostKey(host))).map((host) => {
-    const shaped = {};
-    for (const [key, value] of Object.entries(host)) {
-      if (allowed.has(key)) shaped[key] = value;
-    }
-    if (!withCredentials) {
-      shaped.pluginSettings = mapPluginSecrets(
-        shaped.pluginSettings,
-        pluginSecrets,
-        () => null
-      );
-      for (const { container, field } of NESTED_SECRET_ARRAYS) {
-        const arr = shaped[container];
-        if (Array.isArray(arr)) {
-          shaped[container] = arr.map(
-            (entry) => entry && typeof entry === "object" ? { ...entry, [field]: null } : entry
-          );
-        }
-      }
-    }
-    return shaped;
-  });
-  const result = { ...raw, hosts };
-  if (raw.credentials) {
-    const used = new Set(
-      hosts.map((host) => host.credentialAlias).filter(Boolean)
-    );
-    result.credentials = raw.credentials.filter(
-      (entry) => used.has(entry.alias)
-    );
-  }
-  return result;
-}
-function maskSecrets(payload, pluginSecrets = {}) {
-  return {
-    ...payload,
-    hosts: payload.hosts.map((host) => {
-      const masked = { ...host };
-      for (const key of SECRET_KEYS) {
-        if (masked[key] !== void 0 && masked[key] !== null && masked[key] !== "") {
-          masked[key] = "<included>";
-        }
-      }
-      masked.pluginSettings = mapPluginSecrets(
-        masked.pluginSettings,
-        pluginSecrets,
-        (value) => value ? "<included>" : value
-      );
-      for (const { container, field } of NESTED_SECRET_ARRAYS) {
-        const arr = masked[container];
-        if (Array.isArray(arr)) {
-          masked[container] = arr.map((entry) => {
-            if (entry && typeof entry === "object") {
-              const record = entry;
-              if (record[field]) return { ...record, [field]: "<included>" };
-            }
-            return entry;
-          });
-        }
-      }
-      return masked;
-    })
-  };
-}
-
 // src/types/auth-protocols.ts
 init_define_import_meta_env();
 var SSH_AUTH_PROTOCOL = "ssh";
@@ -32428,25 +32274,6 @@ async function getAuditLogActions() {
     handleApiError(error, "fetch audit log actions");
   }
 }
-async function getAuditForwarding() {
-  try {
-    const response = await authApi.get("/users/audit-forwarding");
-    return response.data;
-  } catch (error) {
-    throw handleApiError(error, "get audit forwarding settings");
-  }
-}
-async function updateAuditForwarding(url, token) {
-  try {
-    const response = await authApi.patch("/users/audit-forwarding", {
-      url,
-      token
-    });
-    return response.data;
-  } catch (error) {
-    throw handleApiError(error, "update audit forwarding settings");
-  }
-}
 
 // src/ui/api/host-defaults-api.ts
 init_define_import_meta_env();
@@ -34081,9 +33908,13 @@ function SplitLayoutMenu({
 init_define_import_meta_env();
 import { useTranslation as useTranslation28 } from "react-i18next";
 import { jsx as jsx57, jsxs as jsxs44 } from "react/jsx-runtime";
-function AuthEnrollmentSections() {
+function AuthEnrollmentSections({
+  factorsOnly = false
+} = {}) {
   const { t: t3 } = useTranslation28();
-  const sections = [...useLoginMethods(), ...useSecondFactors()].filter(
+  const methods = useLoginMethods();
+  const factors = useSecondFactors();
+  const sections = [...factorsOnly ? [] : methods, ...factors].filter(
     (entry) => entry.enrollment
   );
   if (sections.length === 0) return null;
@@ -34226,6 +34057,7 @@ export {
   NumberField,
   OPEN_PLUGINS_EVENT,
   PANEL,
+  PRESETS,
   PROMPT_BUTTON,
   PROMPT_DESTRUCTIVE_BUTTON,
   PROMPT_PRIMARY_BUTTON,
@@ -34323,9 +34155,7 @@ export {
   applyUiFont,
   assignRoleToUser,
   beginSplitDrag,
-  buildExportPayload,
   buildOriginWsUrl,
-  bulkImportSSHHosts,
   bulkUpdateSSHHosts,
   canConfigureUpdates,
   canJoinSplit,
@@ -34354,22 +34184,17 @@ export {
   deleteRole,
   deleteSSHHost,
   deleteUser,
-  deployCredentialToHost,
   desktopUpdates,
   docsUrl,
   duplicateCredential,
   enabledHostProtocols,
   endSplitDrag,
-  exportAllSSHHosts,
   filterPaletteItems,
   findCoreHostDefault,
   findMatchingKeybinding,
-  generateKeyPair,
-  generatePublicKeyFromPrivate,
   getActiveSessions,
   getAdaptiveResourceBudget,
   getApiKeys,
-  getAuditForwarding,
   getAuditLogActions,
   getAuditLogs,
   getBasePath,
@@ -34394,8 +34219,10 @@ export {
   getHostDefaultsLevel,
   getHostEditorSection,
   getHostPassword,
+  getHostPolicy,
   getHostSidebarPreferences,
   getHostTags,
+  getHttpsSettings,
   getLiveHostStatus,
   getLogLevel,
   getNotificationPrivateEndpoints,
@@ -34438,11 +34265,11 @@ export {
   hasVisibleFields,
   hostActionsFor,
   hostBadgesFor,
-  hostKey,
+  hostEditorToolbarItemsFor,
   hostMenuItemsFor,
   hostProtocolFlags,
+  hostStatusIndicatorsFor,
   hydrateLocalSharedHostAuth,
-  importSSHConfigHosts,
   invalidateHostsAndStatusCaches,
   invalidateServerStatusCache,
   isCoreRailView,
@@ -34467,7 +34294,6 @@ export {
   mapCredentials,
   markAdaptiveResourceUsed,
   markTabSurfaceUsed,
-  maskSecrets,
   moveRailItem,
   moveSplitDrag,
   normalizeLanguageCode,
@@ -34478,7 +34304,6 @@ export {
   parseServerTime,
   pluginKey,
   pluginName,
-  pluginSecretKeys,
   pluginWsUrl,
   preloadTabSurface,
   previewHostDefaultsLevel,
@@ -34551,12 +34376,11 @@ export {
   takePendingManageRequest,
   unlinkExternalFromPasswordAccount,
   unlinkServer,
-  updateAuditForwarding,
-  updateBranding,
   updateCredential,
   updateExternalAutoProvision,
   updateFolderMetadata,
   updateHostAccess,
+  updateHttpsSettings,
   updateLogLevel,
   updatePasswordLoginAllowed,
   updatePasswordResetAllowed,
@@ -34588,8 +34412,10 @@ export {
   useHostBadges,
   useHostContextMenuItems,
   useHostEditorSections,
+  useHostEditorToolbarItems,
   useHostProtocols,
   useHostStatus,
+  useHostStatusIndicators,
   useInstalledPlugins,
   useIsDefaultsEditor,
   useIsMobile,

package/dist/host/{use-permissions-6VSHHUMB.js → use-permissions-LLN6TLAL.js}

@@ -7,7 +7,7 @@ import {
   resetPermissionsCache,
   setPermissionsForTesting,
   usePermissions
-} from "./chunk-VEWOYAMZ.js";
+} from "./chunk-57DJU2ZA.js";
 import "./chunk-YGYBM7SQ.js";
 export {
   hasPermission,

package/dist/manifest.d.ts

@@ -20,7 +20,7 @@ export { ENV_NAME_PATTERN, MAX_ENV_DESCRIPTION_LENGTH, pluginDocsPage, pluginDoc
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export declare const PLUGIN_API_VERSION = "1.4.0";
+export declare const PLUGIN_API_VERSION = "1.7.0";
 /** The API major, the default engine.api for a new plugin. */
 export declare const SUPPORTED_PLUGIN_API_VERSION: string;
 /** Whether this build's plugin API satisfies a manifest's engine.api. */
@@ -500,7 +500,16 @@ export interface PluginManifest {
     nativeDependencies?: string[];
     /** How a linked desktop treats this plugin. Defaults to "mirror". */
     desktop?: PluginDesktopMode;
+    /**
+     * "desktop": the plugin only loads on a desktop app's own embedded backend,
+     * never on a server. It implies desktop "local" and may declare desktop:local.
+     */
+    runtime?: PluginRuntime;
 }
+export type PluginRuntime = "desktop";
+export declare const PLUGIN_RUNTIMES: readonly PluginRuntime[];
+/** The desktop mode a manifest resolves to. */
+export declare function resolvePluginDesktopMode(m: Pick<PluginManifest, "desktop" | "runtime">): PluginDesktopMode;
 export declare const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
 export declare const DEFAULT_FRONTEND_ENTRY = "dist/frontend.js";
 export declare const DEFAULT_LOCALES_DIR = "locales";