bazilion 0.13.0 → 0.14.0

package/dist/web/server/assets/{telegram-DUbDIVGX.js → telegram-Dj4Wwhd6.js}

@@ -1,6 +1,7 @@
-import { t as Route } from "./telegram-J4T0XhwQ.js";
+import { t as Route } from "./telegram-DbOFpTFm.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
-import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
+import { t as ConfirmDialog } from "./ConfirmDialog-C-MPYYSU.js";
+import { t as ConfigPage } from "./ConfigPage-CiQ-gxmJ.js";
 import { useEffect, useState } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
@@ -13,10 +14,16 @@ function TelegramIntegrationPage() {
 	const [saving, setSaving] = useState(false);
 	const [saveError, setSaveError] = useState(null);
 	const [saveOk, setSaveOk] = useState(false);
+	const [confirmDisconnect, setConfirmDisconnect] = useState(false);
 	const [health, setHealth] = useState(null);
 	const [checking, setChecking] = useState(false);
 	async function save(e) {
 		e.preventDefault();
+		if (initial.configured && token.trim().length === 0) {
+			setSaveOk(false);
+			setSaveError(chatId.trim() === initial.chatId ? "Nothing changed. Paste a replacement token to update credentials." : "Paste the bot token again when changing the supergroup, so the existing secret is never cleared or reused silently.");
+			return;
+		}
 		setSaving(true);
 		setSaveError(null);
 		setSaveOk(false);
@@ -43,18 +50,17 @@ function TelegramIntegrationPage() {
 		}
 	}
 	async function disconnect() {
-		if (!confirm("Clear the saved Telegram credentials?")) return;
-		try {
-			await fetch("/api/config/telegram", { method: "DELETE" });
-			setToken("");
-			setChatId("");
-			setHealth(null);
-			setSaveOk(false);
-			setSaveError(null);
-			await router.invalidate();
-		} catch (e) {
-			setSaveError(e.message);
+		const response = await fetch("/api/config/telegram", { method: "DELETE" });
+		if (!response.ok && response.status !== 204) {
+			const body = await response.json().catch(() => null);
+			throw new Error(body?.error ?? `Could not clear Telegram credentials (${response.status})`);
 		}
+		setToken("");
+		setChatId("");
+		setHealth(null);
+		setSaveOk(false);
+		setSaveError(null);
+		await router.invalidate();
 	}
 	async function runHealth() {
 		setChecking(true);
@@ -119,7 +125,10 @@ function TelegramIntegrationPage() {
 										type: "password",
 										autoComplete: "off",
 										value: token,
-										onChange: (e) => setToken(e.target.value),
+										onChange: (e) => {
+											setToken(e.target.value);
+											setSaveError(null);
+										},
 										placeholder: initial.configured ? "(leave blank to keep stored value)" : "1234567890:ABC...",
 										className: "w-full rounded-md border bg-background px-2 py-1.5 font-mono text-sm outline-none focus:ring-2 focus:ring-ring/30",
 										required: !initial.configured
@@ -131,6 +140,10 @@ function TelegramIntegrationPage() {
 											/* @__PURE__ */ jsx("em", { children: "Bot Settings → Team Privacy → Turn off" }),
 											"."
 										]
+									}),
+									initial.configured && /* @__PURE__ */ jsx("p", {
+										className: "mt-1 text-xs text-muted-foreground",
+										children: "Blank preserves the stored token. To remove it, use clear credentials and confirm the integration shutdown."
 									})
 								]
 							}),
@@ -144,7 +157,10 @@ function TelegramIntegrationPage() {
 									/* @__PURE__ */ jsx("input", {
 										type: "text",
 										value: chatId,
-										onChange: (e) => setChatId(e.target.value),
+										onChange: (e) => {
+											setChatId(e.target.value);
+											setSaveError(null);
+										},
 										placeholder: "-1001234567890",
 										className: "w-full rounded-md border bg-background px-2 py-1.5 font-mono text-sm outline-none focus:ring-2 focus:ring-ring/30",
 										required: true
@@ -174,7 +190,7 @@ function TelegramIntegrationPage() {
 									}),
 									initial.configured && /* @__PURE__ */ jsx(Button, {
 										variant: "danger",
-										onClick: disconnect,
+										onClick: () => setConfirmDisconnect(true),
 										children: "clear credentials"
 									}),
 									saveOk && /* @__PURE__ */ jsx("span", {
@@ -182,6 +198,7 @@ function TelegramIntegrationPage() {
 										children: "saved ✓"
 									}),
 									saveError && /* @__PURE__ */ jsxs("span", {
+										role: "alert",
 										className: "text-xs text-danger",
 										children: ["error: ", saveError]
 									})
@@ -223,7 +240,22 @@ function TelegramIntegrationPage() {
 				]
 			}),
 			initial.configured && /* @__PURE__ */ jsx(OwnerPairingCard, {}),
-			initial.configured && /* @__PURE__ */ jsx(AccessControlCard, {})
+			initial.configured && /* @__PURE__ */ jsx(AccessControlCard, {}),
+			/* @__PURE__ */ jsx(ConfirmDialog, {
+				open: confirmDisconnect,
+				title: "Disconnect Telegram?",
+				description: /* @__PURE__ */ jsx("p", { children: "This permanently removes the saved bot token and supergroup ID. Telegram polling, ingress, and outbound delivery stop until new credentials are saved and pairing is completed again." }),
+				confirmLabel: "clear credentials and disconnect",
+				onConfirm: async () => {
+					try {
+						await disconnect();
+					} catch (error) {
+						setSaveError(error instanceof Error ? error.message : String(error));
+						throw error;
+					}
+				},
+				onOpenChange: setConfirmDisconnect
+			})
 		]
 	});
 }
@@ -231,6 +263,7 @@ function OwnerPairingCard() {
 	const [status, setStatus] = useState(null);
 	const [code, setCode] = useState(null);
 	const [err, setErr] = useState(null);
+	const [confirmReset, setConfirmReset] = useState(false);
 	const load = async () => {
 		const res = await fetch("/api/config/telegram/pairing");
 		if (!res.ok) throw new Error(res.statusText);
@@ -248,17 +281,24 @@ function OwnerPairingCard() {
 		setStatus(body);
 	}
 	async function cancelChallenge() {
-		await fetch("/api/config/telegram/pairing/challenge", { method: "DELETE" });
+		const res = await fetch("/api/config/telegram/pairing/challenge", { method: "DELETE" });
+		if (!res.ok && res.status !== 204) {
+			const body = await res.json().catch(() => null);
+			throw new Error(body?.error ?? "Could not cancel the pairing code");
+		}
 		setCode(null);
 		await load();
 	}
 	async function resetOwner() {
-		if (!confirm("Revoke the Telegram owner now? Ingress will close until a new owner pairs.")) return;
-		if (!(await fetch("/api/config/telegram/pairing/reset", {
+		const res = await fetch("/api/config/telegram/pairing/reset", {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify({ confirm: true })
-		})).ok) return setErr("Could not reset Telegram owner");
+		});
+		if (!res.ok) {
+			const body = await res.json().catch(() => null);
+			throw new Error(body?.error ?? "Could not reset Telegram owner");
+		}
 		setCode(null);
 		await load();
 	}
@@ -288,7 +328,7 @@ function OwnerPairingCard() {
 					children: "✓ owner paired"
 				}), /* @__PURE__ */ jsx(Button, {
 					variant: "danger",
-					onClick: resetOwner,
+					onClick: () => setConfirmReset(true),
 					children: "reset owner"
 				})]
 			}) : /* @__PURE__ */ jsxs("div", {
@@ -317,15 +357,31 @@ function OwnerPairingCard() {
 							children: "generate pairing code"
 						}), status?.challengeActive && /* @__PURE__ */ jsx(Button, {
 							variant: "ghost",
-							onClick: cancelChallenge,
+							onClick: () => void cancelChallenge().catch((error) => setErr(error instanceof Error ? error.message : String(error))),
 							children: "cancel code"
 						})]
 					})
 				]
 			}),
 			err && /* @__PURE__ */ jsx("p", {
+				role: "alert",
 				className: "mt-2 text-xs text-danger",
 				children: err
+			}),
+			/* @__PURE__ */ jsx(ConfirmDialog, {
+				open: confirmReset,
+				title: "Revoke the paired Telegram owner?",
+				description: /* @__PURE__ */ jsx("p", { children: "This immediately revokes the current owner and closes all Telegram ingress. No one can use the bot until a new one-time pairing code is generated and consumed." }),
+				confirmLabel: "revoke owner and close ingress",
+				onConfirm: async () => {
+					try {
+						await resetOwner();
+					} catch (error) {
+						setErr(error instanceof Error ? error.message : String(error));
+						throw error;
+					}
+				},
+				onOpenChange: setConfirmReset
 			})
 		]
 	});
@@ -336,6 +392,7 @@ function AccessControlCard() {
 	const [label, setLabel] = useState("");
 	const [busy, setBusy] = useState(false);
 	const [err, setErr] = useState(null);
+	const [removeTarget, setRemoveTarget] = useState(null);
 	async function load() {
 		try {
 			const res = await fetch("/api/config/telegram/acl");
@@ -381,16 +438,12 @@ function AccessControlCard() {
 	}
 	async function remove(id) {
 		setErr(null);
-		try {
-			const res = await fetch(`/api/config/telegram/acl/${id}`, { method: "DELETE" });
-			if (!res.ok) {
-				const j = await res.json().catch(() => ({}));
-				throw new Error(j.error ?? res.statusText);
-			}
-			await load();
-		} catch (e) {
-			setErr(e.message);
+		const res = await fetch(`/api/config/telegram/acl/${id}`, { method: "DELETE" });
+		if (!res.ok) {
+			const j = await res.json().catch(() => ({}));
+			throw new Error(j.error ?? res.statusText);
 		}
+		await load();
 	}
 	return /* @__PURE__ */ jsxs("section", {
 		className: "rounded-lg border bg-card p-5",
@@ -434,10 +487,10 @@ function AccessControlCard() {
 								u.role
 							]
 						}),
-						u.role !== "owner" && /* @__PURE__ */ jsx("button", {
-							type: "button",
-							onClick: () => void remove(u.userId),
-							className: "ghost-btn text-xs text-rose-baziu",
+						u.role !== "owner" && /* @__PURE__ */ jsx(Button, {
+							variant: "danger",
+							className: "text-xs",
+							onClick: () => setRemoveTarget(u),
 							children: "remove"
 						})
 					]
@@ -445,19 +498,33 @@ function AccessControlCard() {
 			}),
 			/* @__PURE__ */ jsxs("form", {
 				onSubmit: add,
-				className: "flex flex-col gap-2 sm:flex-row sm:flex-wrap sm:items-center",
+				className: "flex flex-col gap-2 sm:flex-row sm:flex-wrap sm:items-end",
 				children: [
-					/* @__PURE__ */ jsx("input", {
-						value: userId,
-						onChange: (e) => setUserId(e.target.value),
-						placeholder: "user id",
-						className: "w-full rounded-md border bg-background px-2 py-1 font-mono text-sm sm:w-28"
+					/* @__PURE__ */ jsxs("label", {
+						className: "m-0 flex flex-col gap-1 text-xs font-medium text-foreground",
+						children: ["Telegram user ID", /* @__PURE__ */ jsx("input", {
+							value: userId,
+							onChange: (e) => setUserId(e.target.value),
+							placeholder: "123456789",
+							inputMode: "numeric",
+							className: "w-full rounded-md border bg-background px-2 py-1 font-mono text-sm sm:w-32"
+						})]
 					}),
-					/* @__PURE__ */ jsx("input", {
-						value: label,
-						onChange: (e) => setLabel(e.target.value),
-						placeholder: "label (optional)",
-						className: "w-full rounded-md border bg-background px-2 py-1 text-sm sm:w-40"
+					/* @__PURE__ */ jsxs("label", {
+						className: "m-0 flex flex-col gap-1 text-xs font-medium text-foreground",
+						children: [
+							"Label ",
+							/* @__PURE__ */ jsx("span", {
+								className: "font-normal text-muted-foreground",
+								children: "(optional)"
+							}),
+							/* @__PURE__ */ jsx("input", {
+								value: label,
+								onChange: (e) => setLabel(e.target.value),
+								placeholder: "e.g. Pat",
+								className: "w-full rounded-md border bg-background px-2 py-1 text-sm sm:w-40"
+							})
+						]
 					}),
 					/* @__PURE__ */ jsx(Button, {
 						variant: "ghost",
@@ -466,10 +533,36 @@ function AccessControlCard() {
 						children: "add"
 					}),
 					err && /* @__PURE__ */ jsx("span", {
+						role: "alert",
 						className: "text-xs text-danger",
 						children: err
 					})
 				]
+			}),
+			/* @__PURE__ */ jsx(ConfirmDialog, {
+				open: removeTarget !== null,
+				title: `Remove ${removeTarget?.label ?? removeTarget?.username ?? removeTarget?.userId ?? ""}?`,
+				description: /* @__PURE__ */ jsxs("p", { children: [
+					"Telegram user ",
+					/* @__PURE__ */ jsx("code", {
+						className: "font-mono",
+						children: removeTarget?.userId
+					}),
+					" immediately loses command and chat access. Their Telegram account is not changed, and they can be allowlisted again later."
+				] }),
+				confirmLabel: "remove Telegram access",
+				onConfirm: async () => {
+					if (!removeTarget) return;
+					try {
+						await remove(removeTarget.userId);
+					} catch (error) {
+						setErr(error instanceof Error ? error.message : String(error));
+						throw error;
+					}
+				},
+				onOpenChange: (open) => {
+					if (!open) setRemoveTarget(null);
+				}
 			})
 		]
 	});
@@ -523,6 +616,7 @@ function MigrationBanner({ toChatId }) {
 				children: busy ? "reconnecting…" : `Reconnect to ${toChatId}`
 			}),
 			err && /* @__PURE__ */ jsx("span", {
+				role: "alert",
 				className: "ml-3 text-xs text-danger",
 				children: err
 			})
@@ -556,6 +650,7 @@ function PollingState({ polling }) {
 				]
 			}),
 			polling.error && /* @__PURE__ */ jsxs("p", {
+				role: "alert",
 				className: "text-danger",
 				children: ["error: ", polling.error]
 			})
@@ -564,6 +659,7 @@ function PollingState({ polling }) {
 }
 function PreflightResult({ health }) {
 	if (health.error) return /* @__PURE__ */ jsxs("div", {
+		role: "alert",
 		className: "rounded-md border border-danger/25 bg-danger/10 px-3 py-2 text-sm",
 		children: [
 			/* @__PURE__ */ jsxs("p", {
@@ -581,11 +677,15 @@ function PreflightResult({ health }) {
 		]
 	});
 	if (!health.preflight) return /* @__PURE__ */ jsx("p", {
+		role: "status",
 		className: "text-xs text-muted-foreground italic",
 		children: "No preflight data."
 	});
 	const p = health.preflight;
 	return /* @__PURE__ */ jsxs("ul", {
+		role: "status",
+		"aria-live": "polite",
+		"aria-atomic": "true",
 		className: "space-y-1.5",
 		children: [
 			/* @__PURE__ */ jsxs(Check, {

package/dist/web/server/assets/{tokens-CJM_0NDa.js → tokens-DDwtO15P.js}

@@ -1,5 +1,7 @@
-import { t as Route } from "./tokens-DO5BzNOn.js";
-import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
+import { t as Route } from "./tokens-_2hptHP6.js";
+import { t as Button } from "./Button-Dsnw22OF.js";
+import { t as ConfirmDialog } from "./ConfirmDialog-C-MPYYSU.js";
+import { t as ConfigPage } from "./ConfigPage-CiQ-gxmJ.js";
 import { useState } from "react";
 import { useRouter } from "@tanstack/react-router";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
@@ -17,6 +19,8 @@ function TokensPage() {
 	const [expiresDays, setExpiresDays] = useState("90");
 	const [err, setErr] = useState(null);
 	const [busy, setBusy] = useState(false);
+	const [revokeTokenTarget, setRevokeTokenTarget] = useState(null);
+	const [revokeSessionTarget, setRevokeSessionTarget] = useState(null);
 	async function mint(e) {
 		e.preventDefault();
 		setErr(null);
@@ -43,17 +47,23 @@ function TokensPage() {
 			setBusy(false);
 		}
 	}
-	async function revoke(id) {
-		await fetch(`/api/tokens/${id}`, { method: "DELETE" });
-		await router.invalidate();
+	async function revoke(id, revokesCurrentSession) {
+		const response = await fetch(`/api/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
+		if (!response.ok && response.status !== 204) {
+			const body = await response.json().catch(() => ({}));
+			throw new Error(body.error ?? "Could not revoke API token");
+		}
+		if (revokesCurrentSession) window.location.assign("/login");
+		else await router.invalidate();
 	}
-	async function revokeSession(id) {
+	async function revokeSession(id, current) {
 		const response = await fetch(`/api/sessions/${encodeURIComponent(id)}`, { method: "DELETE" });
 		if (!response.ok) {
-			setErr((await response.json().catch(() => ({}))).error ?? "Could not revoke browser session");
-			return;
+			const body = await response.json().catch(() => ({}));
+			throw new Error(body.error ?? "Could not revoke browser session");
 		}
-		await router.invalidate();
+		if (current) window.location.assign("/login");
+		else await router.invalidate();
 	}
 	return /* @__PURE__ */ jsxs(ConfigPage, {
 		active: "tokens",
@@ -109,10 +119,10 @@ function TokensPage() {
 									className: "mt-1 block w-full rounded-md border bg-background px-3 py-2 text-sm sm:w-36"
 								})]
 							}),
-							/* @__PURE__ */ jsx("button", {
+							/* @__PURE__ */ jsx(Button, {
+								variant: "primary",
 								type: "submit",
 								disabled: busy,
-								className: "rounded-md bg-primary px-3 py-2 text-sm font-medium text-primary-foreground disabled:opacity-50",
 								children: busy ? "creating…" : "create"
 							})
 						]
@@ -128,6 +138,7 @@ function TokensPage() {
 						})]
 					}),
 					err && /* @__PURE__ */ jsx("p", {
+						role: "alert",
 						className: "text-sm text-danger",
 						children: err
 					})
@@ -202,10 +213,13 @@ function TokensPage() {
 									className: "text-muted-foreground text-xs",
 									children: t.expiresAt ? fmtTs(t.expiresAt) : "(never)"
 								}),
-								/* @__PURE__ */ jsx("td", { children: !t.revokedAt && !isBootstrap && /* @__PURE__ */ jsx("button", {
-									type: "button",
-									onClick: () => revoke(t.id),
-									className: "rounded-md border px-2 py-1 text-xs text-danger hover:bg-danger/10",
+								/* @__PURE__ */ jsx("td", { children: !t.revokedAt && !isBootstrap && /* @__PURE__ */ jsx(Button, {
+									variant: "danger",
+									className: "text-xs",
+									onClick: () => {
+										setErr(null);
+										setRevokeTokenTarget(t);
+									},
 									children: "revoke"
 								}) })
 							]
@@ -272,16 +286,71 @@ function TokensPage() {
 									className: "text-xs text-muted-foreground",
 									children: fmtTs(session.absoluteExpiresAt)
 								}),
-								/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx("button", {
-									type: "button",
-									onClick: () => revokeSession(session.id),
-									className: "rounded-md border px-2 py-1 text-xs text-danger hover:bg-danger/10",
+								/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx(Button, {
+									variant: "danger",
+									className: "text-xs",
+									onClick: () => {
+										setErr(null);
+										setRevokeSessionTarget(session);
+									},
 									children: "revoke"
 								}) })
 							]
 						}, session.id))] })]
 					})
 				})]
+			}),
+			/* @__PURE__ */ jsx(ConfirmDialog, {
+				open: revokeTokenTarget !== null,
+				title: `Revoke ${revokeTokenTarget?.label ?? ""}?`,
+				description: /* @__PURE__ */ jsxs("p", { children: [
+					"This permanently revokes device token",
+					" ",
+					/* @__PURE__ */ jsx("code", {
+						className: "font-mono",
+						children: revokeTokenTarget?.id
+					}),
+					" and every browser session created from it. Clients using it will be signed out and cannot reconnect with this credential.",
+					sessions.some((session) => session.current && session.deviceTokenId === revokeTokenTarget?.id) && " This includes the browser session you are using now."
+				] }),
+				confirmLabel: "revoke token and sessions",
+				onConfirm: async () => {
+					if (!revokeTokenTarget) return;
+					try {
+						await revoke(revokeTokenTarget.id, sessions.some((session) => session.current && session.deviceTokenId === revokeTokenTarget.id));
+					} catch (error) {
+						setErr(error instanceof Error ? error.message : String(error));
+						throw error;
+					}
+				},
+				onOpenChange: (open) => {
+					if (!open) setRevokeTokenTarget(null);
+				}
+			}),
+			/* @__PURE__ */ jsx(ConfirmDialog, {
+				open: revokeSessionTarget !== null,
+				title: `Revoke ${revokeSessionTarget?.deviceLabel ?? ""} browser session?`,
+				description: /* @__PURE__ */ jsxs("p", { children: [
+					"This ends browser session ",
+					/* @__PURE__ */ jsx("code", {
+						className: "font-mono",
+						children: revokeSessionTarget?.id
+					}),
+					revokeSessionTarget?.current ? " and signs this browser out immediately." : ". The device token remains active for future logins."
+				] }),
+				confirmLabel: revokeSessionTarget?.current ? "sign out this browser" : "revoke session",
+				onConfirm: async () => {
+					if (!revokeSessionTarget) return;
+					try {
+						await revokeSession(revokeSessionTarget.id, revokeSessionTarget.current);
+					} catch (error) {
+						setErr(error instanceof Error ? error.message : String(error));
+						throw error;
+					}
+				},
+				onOpenChange: (open) => {
+					if (!open) setRevokeSessionTarget(null);
+				}
 			})
 		]
 	});

package/dist/web/server/assets/{tokens-DO5BzNOn.js → tokens-_2hptHP6.js}

@@ -2,7 +2,7 @@ import { n as createServerFn } from "../server.js";
 import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/tokens.tsx
-var $$splitComponentImporter = () => import("./tokens-CJM_0NDa.js");
+var $$splitComponentImporter = () => import("./tokens-DDwtO15P.js");
 var fetchTokens = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("46e35c9f1afc79423cb49703b454ef684344db08ec19775efd70a8768c7837f1"));
 var Route = createFileRoute("/config/tokens")({
 	validateSearch: (s) => ({ all: s.all === "1" ? "1" : void 0 }),

package/dist/web/server/assets/{triggers-BdBx-HwR.js → triggers-BvjYNmmY.js}

@@ -2,7 +2,7 @@ import { n as createServerFn } from "../server.js";
 import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent, redirect } from "@tanstack/react-router";
 //#region src/routes/agents/$id/triggers.tsx
-var $$splitComponentImporter = () => import("./triggers-B87fycBl.js");
+var $$splitComponentImporter = () => import("./triggers-CHk9O3rU.js");
 var fetchTriggers = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("57ebf437fdb3fcfc63b176e796a55f04bdfec0b230059673196e98d413d15c4d"));
 var Route = createFileRoute("/agents/$id/triggers")({
 	loader: async ({ params }) => {