bazilion 0.12.2 → 0.13.0

package/dist/web/server/assets/{telegram-CBF8SJzB.js → telegram-DUbDIVGX.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./telegram-XwyKSEtj.js";
+import { t as Route } from "./telegram-J4T0XhwQ.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
 import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
 import { useEffect, useState } from "react";
@@ -222,10 +222,114 @@ function TelegramIntegrationPage() {
 					health?.polling && /* @__PURE__ */ jsx(PollingState, { polling: health.polling })
 				]
 			}),
+			initial.configured && /* @__PURE__ */ jsx(OwnerPairingCard, {}),
 			initial.configured && /* @__PURE__ */ jsx(AccessControlCard, {})
 		]
 	});
 }
+function OwnerPairingCard() {
+	const [status, setStatus] = useState(null);
+	const [code, setCode] = useState(null);
+	const [err, setErr] = useState(null);
+	const load = async () => {
+		const res = await fetch("/api/config/telegram/pairing");
+		if (!res.ok) throw new Error(res.statusText);
+		setStatus(await res.json());
+	};
+	useEffect(() => {
+		load().catch((e) => setErr(e.message));
+	}, []);
+	async function createChallenge() {
+		setErr(null);
+		const res = await fetch("/api/config/telegram/pairing/challenge", { method: "POST" });
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok || !body.code) return setErr(body.error ?? res.statusText);
+		setCode(body.code);
+		setStatus(body);
+	}
+	async function cancelChallenge() {
+		await fetch("/api/config/telegram/pairing/challenge", { method: "DELETE" });
+		setCode(null);
+		await load();
+	}
+	async function resetOwner() {
+		if (!confirm("Revoke the Telegram owner now? Ingress will close until a new owner pairs.")) return;
+		if (!(await fetch("/api/config/telegram/pairing/reset", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ confirm: true })
+		})).ok) return setErr("Could not reset Telegram owner");
+		setCode(null);
+		await load();
+	}
+	return /* @__PURE__ */ jsxs("section", {
+		className: "rounded-lg border bg-card p-5",
+		children: [
+			/* @__PURE__ */ jsx("h3", {
+				className: "text-sm font-semibold uppercase tracking-wide text-muted-foreground mb-1",
+				children: "Owner pairing"
+			}),
+			/* @__PURE__ */ jsxs("p", {
+				className: "text-xs text-muted-foreground mb-3",
+				children: [
+					"Telegram stays closed until one owner consumes a short-lived code in the configured",
+					" ",
+					/* @__PURE__ */ jsx("code", {
+						className: "font-mono",
+						children: "⚙ bazilion"
+					}),
+					" service topic."
+				]
+			}),
+			status?.paired ? /* @__PURE__ */ jsxs("div", {
+				className: "flex flex-wrap items-center gap-3",
+				children: [/* @__PURE__ */ jsx("span", {
+					className: "text-sm text-success",
+					children: "✓ owner paired"
+				}), /* @__PURE__ */ jsx(Button, {
+					variant: "danger",
+					onClick: resetOwner,
+					children: "reset owner"
+				})]
+			}) : /* @__PURE__ */ jsxs("div", {
+				className: "space-y-2",
+				children: [
+					/* @__PURE__ */ jsx("p", {
+						className: "text-sm text-warning",
+						children: "Unpaired — all Telegram ingress is closed."
+					}),
+					code ? /* @__PURE__ */ jsxs("div", {
+						className: "rounded-md border bg-muted/30 p-3 text-sm",
+						children: [
+							"Send ",
+							/* @__PURE__ */ jsxs("code", {
+								className: "font-mono",
+								children: ["/pair ", code]
+							}),
+							" in the service topic. This code is shown once and expires in ten minutes."
+						]
+					}) : null,
+					/* @__PURE__ */ jsxs("div", {
+						className: "flex flex-wrap gap-2",
+						children: [/* @__PURE__ */ jsx(Button, {
+							variant: "primary",
+							onClick: createChallenge,
+							children: "generate pairing code"
+						}), status?.challengeActive && /* @__PURE__ */ jsx(Button, {
+							variant: "ghost",
+							onClick: cancelChallenge,
+							children: "cancel code"
+						})]
+					})
+				]
+			}),
+			err && /* @__PURE__ */ jsx("p", {
+				className: "mt-2 text-xs text-danger",
+				children: err
+			})
+		]
+	});
+}
 function AccessControlCard() {
 	const [users, setUsers] = useState(null);
 	const [userId, setUserId] = useState("");
@@ -298,7 +402,7 @@ function AccessControlCard() {
 			/* @__PURE__ */ jsxs("p", {
 				className: "text-xs text-muted-foreground mb-3",
 				children: [
-					"Allowlisted Telegram users can use the bot (commands + chat). While the list is empty the bot is open and the first person to message it becomes owner. Users find their id via",
+					"Allowlisted Telegram users can use the bot (commands + chat). An empty list is closed; ownership begins only through the one-time pairing flow. Users find their id via",
 					" ",
 					/* @__PURE__ */ jsx("code", {
 						className: "font-mono",
@@ -312,7 +416,7 @@ function AccessControlCard() {
 				children: "loading…"
 			}) : users.length === 0 ? /* @__PURE__ */ jsx("p", {
 				className: "text-xs text-warning mb-3",
-				children: "Open — no allowlist yet. The first user to message the bot claims owner."
+				children: "Closed — no paired owner or allowlisted members."
 			}) : /* @__PURE__ */ jsx("ul", {
 				className: "mb-3 space-y-1 text-sm",
 				children: users.map((u) => /* @__PURE__ */ jsxs("li", {
@@ -508,6 +612,21 @@ function PreflightResult({ health }) {
 				ok: p.privacyModeOff,
 				label: "Privacy Mode is OFF",
 				children: p.privacyModeOff ? "can_read_all_group_messages: true" : "BotFather → /mybots → select bot → Bot Settings → Team Privacy → Turn off"
+			}),
+			/* @__PURE__ */ jsx(Check, {
+				ok: p.chatIsPrivate,
+				label: "Supergroup is private",
+				children: p.chatIsPrivate ? "no public @username" : "public groups expose topic content to readers"
+			}),
+			/* @__PURE__ */ jsx(Check, {
+				ok: p.memberCount === 2,
+				label: "Expected membership",
+				children: p.memberCount === null ? "member count unavailable — verify one owner plus the bot manually" : `${p.memberCount} members reported; secure posture is one owner plus the bot`
+			}),
+			p.ownerPresent !== null && /* @__PURE__ */ jsx(Check, {
+				ok: p.ownerPresent,
+				label: "Paired owner is present",
+				children: p.ownerPresent ? "owner membership confirmed" : "owner missing — Telegram ingress is degraded"
 			})
 		]
 	});

package/dist/web/server/assets/{telegram-XwyKSEtj.js → telegram-J4T0XhwQ.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/integrations/telegram.tsx
-var $$splitComponentImporter = () => import("./telegram-CBF8SJzB.js");
+var $$splitComponentImporter = () => import("./telegram-DUbDIVGX.js");
 var fetchTelegramConfig = createServerFn({ method: "GET" }).handler(createSsrRpc("00a157dd07824e1f126f06646effd1d876f280f6fc64c144d2f6429414a4e58a"));
 var Route = createFileRoute("/config/integrations/telegram")({
 	loader: () => fetchTelegramConfig(),

package/dist/web/server/assets/{tokens-yyTSfBSN.js → tokens-CJM_0NDa.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./tokens-BnwFbV7T.js";
+import { t as Route } from "./tokens-DO5BzNOn.js";
 import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
 import { useState } from "react";
 import { useRouter } from "@tanstack/react-router";
@@ -8,12 +8,13 @@ function fmtTs(ts) {
 	return new Date(ts).toISOString().slice(0, 16).replace("T", " ");
 }
 function TokensPage() {
-	const { tokens } = Route.useLoaderData();
+	const { tokens, sessions } = Route.useLoaderData();
 	const { all } = Route.useSearch();
 	const includeRevoked = all === "1";
 	const router = useRouter();
 	const [label, setLabel] = useState("");
 	const [created, setCreated] = useState(null);
+	const [expiresDays, setExpiresDays] = useState("90");
 	const [err, setErr] = useState(null);
 	const [busy, setBusy] = useState(false);
 	async function mint(e) {
@@ -24,7 +25,10 @@ function TokensPage() {
 			const res = await fetch("/api/tokens", {
 				method: "POST",
 				headers: { "content-type": "application/json" },
-				body: JSON.stringify({ label })
+				body: JSON.stringify({
+					label,
+					expiresInDays: Number(expiresDays)
+				})
 			});
 			if (!res.ok) {
 				const j = await res.json().catch(() => ({}));
@@ -43,6 +47,14 @@ function TokensPage() {
 		await fetch(`/api/tokens/${id}`, { method: "DELETE" });
 		await router.invalidate();
 	}
+	async function revokeSession(id) {
+		const response = await fetch(`/api/sessions/${encodeURIComponent(id)}`, { method: "DELETE" });
+		if (!response.ok) {
+			setErr((await response.json().catch(() => ({}))).error ?? "Could not revoke browser session");
+			return;
+		}
+		await router.invalidate();
+	}
 	return /* @__PURE__ */ jsxs(ConfigPage, {
 		active: "tokens",
 		title: "API tokens",
@@ -72,23 +84,38 @@ function TokensPage() {
 					/* @__PURE__ */ jsxs("form", {
 						onSubmit: mint,
 						className: "mb-3 flex flex-col items-stretch gap-2 sm:flex-row sm:items-end",
-						children: [/* @__PURE__ */ jsxs("label", {
-							className: "w-full text-sm sm:w-auto",
-							children: ["Label", /* @__PURE__ */ jsx("input", {
-								type: "text",
-								value: label,
-								onChange: (e) => setLabel(e.target.value),
-								required: true,
-								placeholder: "e.g. laptop-tailscale",
-								autoComplete: "off",
-								className: "mt-1 block w-full rounded-md border bg-background px-3 py-2 text-sm sm:w-72"
-							})]
-						}), /* @__PURE__ */ jsx("button", {
-							type: "submit",
-							disabled: busy,
-							className: "rounded-md bg-primary px-3 py-2 text-sm font-medium text-primary-foreground disabled:opacity-50",
-							children: busy ? "creating…" : "create"
-						})]
+						children: [
+							/* @__PURE__ */ jsxs("label", {
+								className: "w-full text-sm sm:w-auto",
+								children: ["Label", /* @__PURE__ */ jsx("input", {
+									type: "text",
+									value: label,
+									onChange: (e) => setLabel(e.target.value),
+									required: true,
+									placeholder: "e.g. laptop-tailscale",
+									autoComplete: "off",
+									className: "mt-1 block w-full rounded-md border bg-background px-3 py-2 text-sm sm:w-72"
+								})]
+							}),
+							/* @__PURE__ */ jsxs("label", {
+								className: "w-full text-sm sm:w-auto",
+								children: ["Expires in days", /* @__PURE__ */ jsx("input", {
+									type: "number",
+									min: 1,
+									max: 365,
+									value: expiresDays,
+									onChange: (e) => setExpiresDays(e.target.value),
+									required: true,
+									className: "mt-1 block w-full rounded-md border bg-background px-3 py-2 text-sm sm:w-36"
+								})]
+							}),
+							/* @__PURE__ */ jsx("button", {
+								type: "submit",
+								disabled: busy,
+								className: "rounded-md bg-primary px-3 py-2 text-sm font-medium text-primary-foreground disabled:opacity-50",
+								children: busy ? "creating…" : "create"
+							})
+						]
 					}),
 					created && /* @__PURE__ */ jsxs("div", {
 						className: "rounded-md border border-warning/25 bg-warning/10 p-3",
@@ -127,18 +154,20 @@ function TokensPage() {
 								className: "py-2",
 								children: "label"
 							}),
+							/* @__PURE__ */ jsx("th", { children: "kind" }),
 							/* @__PURE__ */ jsx("th", { children: "id" }),
 							/* @__PURE__ */ jsx("th", { children: "state" }),
 							/* @__PURE__ */ jsx("th", { children: "created" }),
 							/* @__PURE__ */ jsx("th", { children: "last used" }),
+							/* @__PURE__ */ jsx("th", { children: "expires" }),
 							/* @__PURE__ */ jsx("th", {})
 						] })
 					}), /* @__PURE__ */ jsxs("tbody", { children: [tokens.length === 0 && /* @__PURE__ */ jsx("tr", { children: /* @__PURE__ */ jsx("td", {
-						colSpan: 6,
+						colSpan: 8,
 						className: "py-6 text-center text-muted-foreground italic",
 						children: "no tokens yet — mint one above"
 					}) }), tokens.map((t) => {
-						const isBootstrap = t.label === "bootstrap";
+						const isBootstrap = t.kind === "bootstrap";
 						return /* @__PURE__ */ jsxs("tr", {
 							className: "border-b last:border-0 hover:bg-accent/30",
 							children: [
@@ -149,6 +178,7 @@ function TokensPage() {
 										children: "auth.json"
 									})]
 								}),
+								/* @__PURE__ */ jsx("td", { children: t.kind }),
 								/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx("code", {
 									className: "font-mono text-xs",
 									children: t.id
@@ -168,6 +198,10 @@ function TokensPage() {
 									className: "text-muted-foreground text-xs",
 									children: t.lastUsedAt ? fmtTs(t.lastUsedAt) : "(never)"
 								}),
+								/* @__PURE__ */ jsx("td", {
+									className: "text-muted-foreground text-xs",
+									children: t.expiresAt ? fmtTs(t.expiresAt) : "(never)"
+								}),
 								/* @__PURE__ */ jsx("td", { children: !t.revokedAt && !isBootstrap && /* @__PURE__ */ jsx("button", {
 									type: "button",
 									onClick: () => revoke(t.id),
@@ -178,6 +212,76 @@ function TokensPage() {
 						}, t.id);
 					})] })]
 				})
+			}),
+			/* @__PURE__ */ jsxs("section", {
+				className: "space-y-3",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h3", {
+					className: "font-serif text-xl",
+					children: "Browser sessions"
+				}), /* @__PURE__ */ jsx("p", {
+					className: "text-sm text-muted-foreground",
+					children: "Sessions expire after 12 idle hours or seven days absolute. Revoking a device also revokes every session created from it."
+				})] }), /* @__PURE__ */ jsx("div", {
+					className: "overflow-x-auto",
+					children: /* @__PURE__ */ jsxs("table", {
+						className: "w-full min-w-[720px] text-sm",
+						children: [/* @__PURE__ */ jsx("thead", {
+							className: "border-b text-left text-muted-foreground",
+							children: /* @__PURE__ */ jsxs("tr", { children: [
+								/* @__PURE__ */ jsx("th", {
+									className: "py-2",
+									children: "device"
+								}),
+								/* @__PURE__ */ jsx("th", { children: "session" }),
+								/* @__PURE__ */ jsx("th", { children: "last seen" }),
+								/* @__PURE__ */ jsx("th", { children: "idle expiry" }),
+								/* @__PURE__ */ jsx("th", { children: "absolute expiry" }),
+								/* @__PURE__ */ jsx("th", {})
+							] })
+						}), /* @__PURE__ */ jsxs("tbody", { children: [sessions.length === 0 && /* @__PURE__ */ jsx("tr", { children: /* @__PURE__ */ jsx("td", {
+							colSpan: 6,
+							className: "py-6 text-center italic text-muted-foreground",
+							children: "no active browser sessions"
+						}) }), sessions.map((session) => /* @__PURE__ */ jsxs("tr", {
+							className: "border-b last:border-0 hover:bg-accent/30",
+							children: [
+								/* @__PURE__ */ jsxs("td", {
+									className: "py-2",
+									children: [
+										session.deviceLabel,
+										" ",
+										session.current && /* @__PURE__ */ jsx("span", {
+											className: "text-xs text-success",
+											children: "current"
+										})
+									]
+								}),
+								/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx("code", {
+									className: "font-mono text-xs",
+									children: session.id
+								}) }),
+								/* @__PURE__ */ jsx("td", {
+									className: "text-xs text-muted-foreground",
+									children: fmtTs(session.lastSeenAt)
+								}),
+								/* @__PURE__ */ jsx("td", {
+									className: "text-xs text-muted-foreground",
+									children: fmtTs(session.idleExpiresAt)
+								}),
+								/* @__PURE__ */ jsx("td", {
+									className: "text-xs text-muted-foreground",
+									children: fmtTs(session.absoluteExpiresAt)
+								}),
+								/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx("button", {
+									type: "button",
+									onClick: () => revokeSession(session.id),
+									className: "rounded-md border px-2 py-1 text-xs text-danger hover:bg-danger/10",
+									children: "revoke"
+								}) })
+							]
+						}, session.id))] })]
+					})
+				})]
 			})
 		]
 	});

package/dist/web/server/assets/{tokens-BnwFbV7T.js → tokens-DO5BzNOn.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/tokens.tsx
-var $$splitComponentImporter = () => import("./tokens-yyTSfBSN.js");
-var fetchTokens = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(createSsrRpc("46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1"));
+var $$splitComponentImporter = () => import("./tokens-CJM_0NDa.js");
+var fetchTokens = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1"));
 var Route = createFileRoute("/config/tokens")({
 	validateSearch: (s) => ({ all: s.all === "1" ? "1" : void 0 }),
 	loaderDeps: ({ search }) => ({ all: search.all === "1" }),

package/dist/web/server/assets/tokens-DjM8GsgS.js

@@ -0,0 +1,19 @@
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
+//#region src/routes/config/tokens.tsx?tss-serverfn-split
+var fetchTokens_createServerFn_handler = createServerRpc({
+	id: "46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1",
+	name: "fetchTokens",
+	filename: "src/routes/config/tokens.tsx"
+}, (opts) => fetchTokens.__executeServer(opts));
+var fetchTokens = createServerFn({ method: "POST" }).validator((d) => d).handler(fetchTokens_createServerFn_handler, async ({ data }) => {
+	const client = daemonClient();
+	const [tokenResult, sessionResult] = await Promise.all([client.get(`/api/tokens${data.all ? "?includeRevoked=1" : ""}`), client.get("/api/sessions")]);
+	return {
+		...tokenResult,
+		...sessionResult
+	};
+});
+//#endregion
+export { fetchTokens_createServerFn_handler };

package/dist/web/server/assets/{triggers-CSNNzRIi.js → triggers-B87fycBl.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./triggers-BZPl5CHs.js";
+import { t as Route } from "./triggers-BdBx-HwR.js";
 import { r as PageShell } from "./Page-LENulSXY.js";
 import { t as AgentTabs } from "./AgentTabs-aXdsiiMp.js";
 import { useState } from "react";

package/dist/web/server/assets/{triggers-BZPl5CHs.js → triggers-BdBx-HwR.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
 //#region src/routes/agents/$id/triggers.tsx
-var $$splitComponentImporter = () => import("./triggers-CSNNzRIi.js");
-var fetchTriggers = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(createSsrRpc("57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d"));
+var $$splitComponentImporter = () => import("./triggers-B87fycBl.js");
+var fetchTriggers = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d"));
 var Route = createFileRoute("/agents/$id/triggers")({
 	loader: async ({ params }) => {
 		const data = await fetchTriggers({ data: { id: params.id } });

package/dist/web/server/assets/{triggers-D79NoSXk.js → triggers-Nezfw-Bd.js}

@@ -1,13 +1,13 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient, r as ApiClientError } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient, r as ApiClientError } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/agents/$id/triggers.tsx?tss-serverfn-split
 var fetchTriggers_createServerFn_handler = createServerRpc({
 	id: "57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d",
 	name: "fetchTriggers",
 	filename: "src/routes/agents/$id/triggers.tsx"
 }, (opts) => fetchTriggers.__executeServer(opts));
-var fetchTriggers = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(fetchTriggers_createServerFn_handler, async ({ data }) => {
+var fetchTriggers = createServerFn({ method: "POST" }).validator((d) => d).handler(fetchTriggers_createServerFn_handler, async ({ data }) => {
 	const c = daemonClient();
 	let resolved;
 	try {

package/dist/web/server/server.js

@@ -3558,7 +3558,7 @@ var defaultSerovalPlugins = [
 * the dev styles URL for route-scoped CSS collection.
 */
 async function getStartManifest(matchedRoutes) {
-	const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-BGDBdnUs.js");
+	const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-COkJjXt_.js");
 	const startManifest = tsrStartManifest();
 	let routes = startManifest.routes;
 	routes[rootRouteId];
@@ -3582,107 +3582,107 @@ async function getStartManifest(matchedRoutes) {
 var manifest = {
 	"00a157dd07824e1f126f06646effd1d876f280f6fc64c144d2f6429414a4e58a": {
 		functionName: "fetchTelegramConfig_createServerFn_handler",
-		importer: () => import("./assets/telegram-DNgCWebD.js")
+		importer: () => import("./assets/telegram-1AWL6lFw.js")
 	},
 	"032d74b7d41c718191dbdde6b06ba44993340ce1154af1fa6723a6d4f7a7236e": {
 		functionName: "fetchProfile_createServerFn_handler",
-		importer: () => import("./assets/_id-D27T85mU.js")
+		importer: () => import("./assets/_id-BZWunvy7.js")
 	},
 	"0a6e766d2b4ea526da34cefed5342a6ecc5ff35ad1ce38fba4129b8c24d8e6e5": {
 		functionName: "fetchMembers_createServerFn_handler",
-		importer: () => import("./assets/members-CW5aBe81.js")
+		importer: () => import("./assets/members-BP3UTqu1.js")
 	},
 	"1ab05a58944792f34ad279deeaa56f70e9360687856b18327f335b022e8d21a5": {
 		functionName: "fetchTeamsData_createServerFn_handler",
-		importer: () => import("./assets/teams-DqfrEoH6.js")
+		importer: () => import("./assets/teams-DPnAX4wD.js")
 	},
 	"1bb12262aaa902fa208aafaa70b69c63da34c1fe523ab0322fe766903fc6b4c1": {
 		functionName: "fetchTeams_createServerFn_handler",
-		importer: () => import("./assets/teams-MjqgsmC3.js")
+		importer: () => import("./assets/teams-be05ci17.js")
 	},
 	"26dbbcbe40063e8aedfd343cf1dfd4dfe5589f24591c0ba35e80c611d7c57c7c": {
 		functionName: "fetchHomeData_createServerFn_handler",
-		importer: () => import("./assets/routes-BrA-U_Hm.js")
+		importer: () => import("./assets/routes-CNRzy79H.js")
 	},
 	"278849457893891c3d22806d15e11a0a42cc3630b30e9e62b74cf2d3b982ded7": {
 		functionName: "fetchServers_createServerFn_handler",
-		importer: () => import("./assets/mcp-2pwT9HU8.js")
+		importer: () => import("./assets/mcp-BvnvlVFd.js")
 	},
 	"2cd8c6ec40e2e2d9518b5f127a518ecd83a2222d85665cc61d5144bcf59ed4fb": {
 		functionName: "fetchInbox_createServerFn_handler",
-		importer: () => import("./assets/inbox-CzlKT9Wg.js")
+		importer: () => import("./assets/inbox-Dv55rGYq.js")
 	},
 	"46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1": {
 		functionName: "fetchTokens_createServerFn_handler",
-		importer: () => import("./assets/tokens-DPDMSN5O.js")
+		importer: () => import("./assets/tokens-DjM8GsgS.js")
 	},
 	"4773184b3ddd3656fb80ec74375a6d304e25acb56b79f1d349dcabf9f0914359": {
 		functionName: "fetchGroup_createServerFn_handler",
-		importer: () => import("./assets/_id-IzadFZV9.js")
+		importer: () => import("./assets/_id-DvlDkk04.js")
 	},
 	"57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d": {
 		functionName: "fetchTriggers_createServerFn_handler",
-		importer: () => import("./assets/triggers-D79NoSXk.js")
+		importer: () => import("./assets/triggers-Nezfw-Bd.js")
 	},
 	"5cdb81f2b930818ee9ab1d626ac99828ea652ff447fcbfc21b24dea415f8b39e": {
 		functionName: "fetchActivity_createServerFn_handler",
-		importer: () => import("./assets/activity-DohitgwW.js")
+		importer: () => import("./assets/activity-9VP6QDTH.js")
 	},
 	"6afd81bef0ee381d6e3641cd8e269968429c874e2f9d56c8f818cc9d180ee477": {
 		functionName: "fetchServices_createServerFn_handler",
-		importer: () => import("./assets/services-wG8I06oS.js")
+		importer: () => import("./assets/services-DozuJtzX.js")
 	},
 	"816fcbc7b3c7f2952660d3a2c8f49bb0c91084627a284c185b333b1d418fadf8": {
 		functionName: "loadApprovals_createServerFn_handler",
-		importer: () => import("./assets/approvals-BGU-XGIO.js")
+		importer: () => import("./assets/approvals-BYi84gwl.js")
 	},
 	"846c9081aed17057351730985f133b0aab67a5dabfca9562552829a90ff30849": {
 		functionName: "fetchAgent_createServerFn_handler",
-		importer: () => import("./assets/_id-BhOB8Umi.js")
+		importer: () => import("./assets/_id-DxCnEFpm.js")
 	},
 	"883b401299422096ee31ee824f9a24b49d06bdcedce398789778c4c549a92f3a": {
 		functionName: "loadAttention_createServerFn_handler",
-		importer: () => import("./assets/attention-CM-Ks1N9.js")
+		importer: () => import("./assets/attention-UhqPK_Ro.js")
 	},
 	"a0bbbee5d0c1240a05e35c04d56a0e95ec78f05265e4e937eec48c8ac2041e58": {
 		functionName: "fetchTeam_createServerFn_handler",
-		importer: () => import("./assets/_id-tB47Vsfp.js")
+		importer: () => import("./assets/_id-HMy7jM3P.js")
 	},
 	"a5d3825fc69573bb55bab6df578c750ebb0240dd394c3acee3adea02918a5dc2": {
 		functionName: "fetchAuthState_createServerFn_handler",
-		importer: () => import("./assets/auth-byfSx6Ja.js")
+		importer: () => import("./assets/auth-7BHTH-KS.js")
 	},
 	"ae1d30575b229c1e2622fbaf2252800a9a7acc84afdd68cba025ca890b8d52c5": {
 		functionName: "fetchSkills_createServerFn_handler",
-		importer: () => import("./assets/skills-a9VSWHWq.js")
+		importer: () => import("./assets/skills-DfGSJTCB.js")
 	},
 	"b18a227687dba45b99ea5a2ac7a5bf8efcd9bc54387bc279cd87510fd2f83f7e": {
 		functionName: "fetchProvidersData_createServerFn_handler",
-		importer: () => import("./assets/config-BDCJdtj2.js")
+		importer: () => import("./assets/config-BMiajTZP.js")
 	},
 	"b859e1340a80871c50b0d3e60bd3f3b48fe3c66b083f8ff9d5b2981720d36a81": {
 		functionName: "fetchContext_createServerFn_handler",
-		importer: () => import("./assets/context-B-XDf6Ym.js")
+		importer: () => import("./assets/context-DMc0KyHh.js")
 	},
 	"b96a98e3ed6c8a3ab5f6a4ed8458e93da753ffd74e2912ef1724bb6e58030cb5": {
 		functionName: "fetchMemory_createServerFn_handler",
-		importer: () => import("./assets/memory-Dngc13Nw.js")
+		importer: () => import("./assets/memory-BqV-Afy1.js")
 	},
 	"bc31355f2be9889a616d03c35062d483ea77c3f967af9432d721626a81078ef3": {
 		functionName: "fetchProfiles_createServerFn_handler",
-		importer: () => import("./assets/agents-BY74v7fM.js")
+		importer: () => import("./assets/agents-BJAv919x.js")
 	},
 	"f715bab0037380aa3db7e237e7cf1e74168c363f48a960bb1ddfa5560de3a74e": {
 		functionName: "fetchAgents_createServerFn_handler",
-		importer: () => import("./assets/agents-BPKOshR5.js")
+		importer: () => import("./assets/agents-DjyQk94u.js")
 	},
 	"fc940d6dec5305aa64bdb9b9f5f7d4f925b2ba0608cb6d39af854a94872fc867": {
 		functionName: "fetchPolicy_createServerFn_handler",
-		importer: () => import("./assets/policy-Bb-vEgqg.js")
+		importer: () => import("./assets/policy-18fdTFO4.js")
 	},
 	"fcdd0f08b635c7c501caa840d01d1376ace6683e26cc5ac7dead28d7870f98b9": {
 		functionName: "fetchLearning_createServerFn_handler",
-		importer: () => import("./assets/learning-8zav4pIT.js")
+		importer: () => import("./assets/learning-C2upa1CE.js")
 	}
 };
 async function getServerFnById(id, access) {
@@ -5560,8 +5560,8 @@ var getBaseManifest = getProdBaseManifest;
 var createEarlyHintsForRequest = createEarlyHintsCollector;
 async function loadEntries() {
 	const [routerEntry, startEntry, pluginAdapters] = await Promise.all([
-		import("./assets/router-CIVjTgNp.js"),
-		import("./assets/start-WH8WzTL_.js"),
+		import("./assets/router-D-6TzLRZ.js"),
+		import("./assets/start-uKQNK6if.js"),
 		import("./assets/empty-plugin-adapters-Cq4--YW-.js")
 	]);
 	return {
@@ -5947,4 +5947,4 @@ function createServerEntry(entry) {
 }
 var server_default = createServerEntry({ fetch: fetch$1 });
 //#endregion
-export { createServerEntry, server_default as default, getCookie as i, TSS_SERVER_FUNCTION as n, getServerFnById as r, createServerFn as t };
+export { getCookie as a, createServerEntry, server_default as default, getServerFnById as i, createServerFn as n, TSS_SERVER_FUNCTION as r, createMiddleware as t };

package/dist/web-server.js

@@ -12,6 +12,10 @@ var port = Number.parseInt(process.env.WEB_PORT ?? "4322", 10);
 var webDist = process.env.BAZILION_WEB_DIST ?? join(import.meta.dirname, "web");
 var clientDir = join(webDist, "client");
 var serverEntry = join(webDist, "server", "server.js");
+if (process.env.BAZILION_PUBLIC_ORIGIN && !["127.0.0.1", "localhost", "::1"].includes(host)) {
+  console.error("BAZILION_PUBLIC_ORIGIN requires the web server to bind loopback only");
+  process.exit(1);
+}
 if (!existsSync(clientDir) || !existsSync(serverEntry)) {
   console.error("error: bundled bazilion web UI not found");
   console.error(`  expected client assets at ${clientDir}`);