bazilion 0.13.0 → 0.14.0

package/dist/daemon.js

@@ -36081,7 +36081,19 @@ function isLoopbackHost(hostname) {
 
 // ../daemon/src/lib/middleware-auth.ts
 var PUBLIC_PATHS = /* @__PURE__ */ new Set(["/api/login", "/api/health"]);
-var SETUP_OPEN_PREFIXES = ["/api/config", "/api/auth", "/api/health"];
+var SETUP_OPEN_PREFIXES = [
+  "/api/config",
+  "/api/auth",
+  "/api/health",
+  // Credential management must remain usable during setup: the first-run
+  // browser exchange is bounded, and the local CLI can mint a named device
+  // credential before provider setup has unlocked the rest of the API.
+  "/api/tokens",
+  "/api/sessions",
+  // A fresh installation must be able to prove provider connectivity before
+  // the provider gate opens the rest of the product.
+  "/api/providers/test"
+];
 function isSetupOpen(path) {
   for (const prefix of SETUP_OPEN_PREFIXES) {
     if (path === prefix || path.startsWith(`${prefix}/`)) return true;
@@ -40011,6 +40023,7 @@ authRouter.post("/providers/test", async (c) => {
       messages: [{ role: "user", content: message }],
       maxTokens: 256
     });
+    ensureSetupSeeded(db, getCtx().paths);
     const out = { content: res.content, usage: res.usage };
     return c.json(out);
   } catch (err) {
@@ -40028,14 +40041,21 @@ authRouter.post("/login", async (c) => {
     const v2 = form?.get("token");
     if (typeof v2 === "string") token = v2;
   }
+  const ctx = getCtx();
   const principal = token ? authenticateToken(token) : null;
-  if (principal?.kind !== "device") {
+  let deviceTokenId = principal?.kind === "device" ? principal.tokenId : null;
+  if (principal?.kind === "bootstrap" && !isSetupComplete(ctx.db)) {
+    deviceTokenId = webTokens_exports.create(ctx.db, "first-run browser session", {
+      expiresAt: Date.now() + webSessions_exports.SESSION_ABSOLUTE_MS
+    }).meta.id;
+  }
+  if (!deviceTokenId) {
     if (ct.startsWith("application/json")) {
       return c.json({ error: "invalid token" }, 401);
     }
-    return c.redirect("/login?error=1", 302);
+    return c.redirect("/login?error=token", 302);
   }
-  const created = webSessions_exports.create(getCtx().db, principal.tokenId);
+  const created = webSessions_exports.create(ctx.db, deviceTokenId);
   const origin = resolvePublicOrigin();
   setCookie(c, origin.sessionCookie, created.cookieValue, {
     path: "/",
@@ -40054,7 +40074,7 @@ authRouter.post("/login", async (c) => {
   if (ct.startsWith("application/json")) {
     return c.json({ ok: true });
   }
-  return c.redirect("/", 302);
+  return c.redirect(isSetupComplete(ctx.db) ? "/" : "/welcome", 302);
 });
 authRouter.post("/logout", (c) => {
   const principal = c.get("authPrincipal");