madarx 2.16.0 → 2.16.1

package/app/login/login-client.jsx

@@ -27,13 +27,22 @@ const secondaryButtonStyle = {
   ...buttonStyle, background: 'rgba(232,232,229,.06)', color: '#E8E8E5', border: '1px solid rgba(232,232,229,.16)',
 };
 
-export default function LoginClient({ authMode, nextPath = '/', errorCode = '', forceSupabase = false }) {
+export default function LoginClient({ authMode, nextPath = '/', errorCode = '', forceSupabase = false, initialView = '' }) {
+  const isLocalServer = authMode === 'local';
+  const safeNext = typeof nextPath === 'string' && nextPath.startsWith('/') ? nextPath : '/';
+
+  // Personal (this device / local) vs Team (org via Supabase). Default to the
+  // path that matches how the server is already running, but the user can switch.
+  const defaultView = initialView === 'personal' || initialView === 'team'
+    ? initialView
+    : (isLocalServer && !forceSupabase ? 'personal' : 'team');
+  const [view, setView] = useState(defaultView);
+
   const [mode, setMode] = useState('password');
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
   const [loading, setLoading] = useState(false);
   const [message, setMessage] = useState(errorCode ? 'Supabase could not complete sign-in. Try again.' : '');
-  const safeNext = typeof nextPath === 'string' && nextPath.startsWith('/') ? nextPath : '/';
 
   // Runtime auth config (mode + Supabase URL/anon key) is UI-driven and lives
   // server-side, so fetch it instead of reading build-time NEXT_PUBLIC_* vars.
@@ -41,6 +50,12 @@ export default function LoginClient({ authMode, nextPath = '/', errorCode = '',
   const [resetting, setResetting] = useState(false);
   const [resetOpen, setResetOpen] = useState(false);
   const [recoveryToken, setRecoveryToken] = useState('');
+
+  // "Join with a link" + inline "Create a team" (fresh-install team setup).
+  const [inviteLink, setInviteLink] = useState('');
+  const [ct, setCt] = useState({ url: '', anonKey: '', serviceKey: '' });
+  const [ctBusy, setCtBusy] = useState('');
+
   useEffect(() => {
     let alive = true;
     fetch('/api/auth/config', { cache: 'no-store' })
@@ -50,14 +65,14 @@ export default function LoginClient({ authMode, nextPath = '/', errorCode = '',
     return () => { alive = false; };
   }, [authMode]);
 
-  const isLocalServer = authMode === 'local';
   const supabaseConfigured = Boolean(cfg?.supabaseUrl && cfg?.supabaseAnonKey);
-  // Show the Supabase form whenever the server runs in supabase mode, or the
-  // user explicitly asked for account sign-in via /login?supabase=1.
-  const showSupabaseForm = !isLocalServer || forceSupabase;
+  // Show the sign-in form when the server runs in supabase mode, the user asked
+  // for it (?supabase=1), or Supabase has been configured (incl. just now via
+  // the inline Create-a-team form).
+  const showSignIn = !isLocalServer || forceSupabase || supabaseConfigured;
 
   async function resetToLocal() {
-    if (!recoveryToken.trim()) { setMessage('Enter the recovery token to reset.'); return; }
+    if (!recoveryToken.trim()) { setMessage('Enter the recovery token to switch.'); return; }
     setResetting(true);
     setMessage('');
     try {
@@ -69,50 +84,84 @@ export default function LoginClient({ authMode, nextPath = '/', errorCode = '',
       const data = await res.json().catch(() => ({}));
       if (res.ok && data.ok) { window.location.assign('/'); return; }
       setResetting(false);
-      setMessage(res.status === 403 ? 'Invalid recovery token.' : 'Could not reset to local mode.');
+      setMessage(res.status === 403 ? 'Invalid recovery token.' : 'Could not switch to personal mode.');
     } catch {
       setResetting(false);
-      setMessage('Could not reset to local mode.');
+      setMessage('Could not switch to personal mode.');
     }
   }
 
-  // Local mode and not forcing the form → the operator landing card, now with a
-  // real path into account sign-in (configured from Settings → Account).
-  if (!showSupabaseForm) {
-    return (
-      <main className="login-page-shell login-page-shell--local">
-        <section className="login-local-card">
-          <div className="login-wordmark">madar<span>X</span> OS</div>
-          <h1>Local operator mode is active.</h1>
-          <p>No Supabase sign-in is required in local mode. You are authenticated as the local owner and artifact sharing uses the local signed-link registry.</p>
-          <a className="login-link-button" href={safeNext}>Enter dashboard <IconArrowRight /></a>
-          <a className="login-link-button login-link-button--ghost" href="/settings/account">Set up account sign-in <IconArrowRight /></a>
-        </section>
-      </main>
-    );
+  function joinWithLink(e) {
+    e.preventDefault();
+    const raw = inviteLink.trim();
+    if (!raw) { setMessage('Paste your invite link first.'); return; }
+    // Accept a full invite link (…/join#invite=<blob>) or a bare blob. The /join
+    // page reads the #invite fragment and runs the bootstrap → sign-in → join
+    // chain, so we just hand it the blob.
+    const marker = '#invite=';
+    const idx = raw.indexOf(marker);
+    let blob = idx >= 0 ? raw.slice(idx + marker.length) : raw;
+    blob = blob.split(/[?&\s]/)[0];
+    if (!blob) { setMessage('That invite link looks incomplete.'); return; }
+    window.location.href = `/join#invite=${blob}`;
   }
 
-  // Asked for account sign-in but Supabase isn't configured → send them to the
-  // Settings form (everything is UI-driven; no env editing required).
-  if (forceSupabase && isLocalServer && cfg && !supabaseConfigured) {
-    return (
-      <main className="login-page-shell login-page-shell--local">
-        <section className="login-local-card">
-          <div className="login-wordmark">madar<span>X</span> OS</div>
-          <h1>Account sign-in is not set up yet.</h1>
-          <p>Add your Supabase project URL, anon key, and service-role key in <b>Settings → Account → Authentication</b>, then switch the mode to Supabase. No file editing required.</p>
-          <a className="login-link-button" href="/settings/account">Open authentication settings <IconArrowRight /></a>
-          <a className="login-link-button login-link-button--ghost" href={safeNext}>Back to dashboard <IconArrowRight /></a>
-        </section>
-      </main>
-    );
+  async function createTeam(e) {
+    e.preventDefault();
+    setCtBusy('save');
+    setMessage('');
+    try {
+      const res = await fetch('/api/auth/config', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          action: 'save', mode: 'supabase',
+          url: ct.url.trim(), anonKey: ct.anonKey.trim(), serviceKey: ct.serviceKey.trim(),
+        }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok || !data.ok) {
+        throw new Error(data.error === 'connection_failed'
+          ? 'Could not connect to that Supabase project. Check the URL and keys.'
+          : (data.error || 'Could not save team settings.'));
+      }
+      // Now configured + in supabase mode. Reflect it locally so the sign-in
+      // form renders, then prompt sign-in (first sign-in becomes the owner).
+      setCfg((c) => ({
+        ...(c || {}), authMode: 'supabase', supabaseConfigured: true,
+        supabaseUrl: ct.url.trim(), supabaseAnonKey: ct.anonKey.trim(),
+      }));
+      setMessage('Team created. Sign in to finish — your first sign-in makes you the owner.');
+    } catch (err) {
+      setMessage(err?.message || 'Could not create the team.');
+    } finally {
+      setCtBusy('');
+    }
+  }
+
+  async function testTeam() {
+    setCtBusy('test');
+    setMessage('');
+    try {
+      const res = await fetch('/api/auth/config', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action: 'test', url: ct.url.trim(), anonKey: ct.anonKey.trim() }),
+      });
+      const data = await res.json().catch(() => ({}));
+      setMessage(data.ok ? 'Connection OK. Create the team to continue.' : 'Connection failed. Check the URL and anon key.');
+    } catch {
+      setMessage('Connection test failed.');
+    } finally {
+      setCtBusy('');
+    }
   }
 
   async function supabaseClient() {
     const { createBrowserClient } = await import('@supabase/ssr');
     const url = cfg?.supabaseUrl;
     const anonKey = cfg?.supabaseAnonKey;
-    if (!url || !anonKey) throw new Error('Supabase is not configured. Set it in Settings → Account.');
+    if (!url || !anonKey) throw new Error('Supabase is not configured. Create a team or set it in Settings → Account.');
     return createBrowserClient(url, anonKey);
   }
 
@@ -147,34 +196,65 @@ export default function LoginClient({ authMode, nextPath = '/', errorCode = '',
     }
   }
 
-  return (
-    <main className="login-page-shell">
-      <section className="login-hero-panel" aria-label="madarX OS landing">
-        <div className="login-wordmark">madar<span>X</span> OS</div>
-        <p className="login-kicker">Institutional agent control plane</p>
-        <h1>AI generates. Humans approve. Regulators can inspect.</h1>
-        <p className="login-lede">Authenticate with Supabase, operate in an organization boundary, and share generated HTML artifacts through signed, expiring access links.</p>
-        <div className="login-proof-grid">
-          <div><b>Supabase Auth</b><span>Email, magic link, Google, or Microsoft SSO sessions.</span></div>
-          <div><b>Artifact ACLs</b><span>Private, organization, team-ready, and link-scoped controls.</span></div>
-          <div><b>Audit ledger</b><span>Share creation, access, and revocation are recorded.</span></div>
-        </div>
-      </section>
-      <section className="login-card" aria-label="Sign in">
-        <div className="login-card-head">
-          <p>Secure access</p>
-          <h2>Sign in to continue</h2>
+  // ── View renderers ──────────────────────────────────────────────────────────
+
+  function renderPersonal() {
+    // Fresh / local server → the operator landing.
+    if (isLocalServer && !supabaseConfigured) {
+      return (
+        <>
+          <div className="login-card-head"><p>This device</p><h2>Personal mode</h2></div>
+          <p className="login-footnote" style={{ marginTop: 0 }}>
+            You're the local owner — no account needed. Work stays on this machine and sharing uses the local signed-link registry.
+          </p>
+          {message ? <div className="login-message">{message}</div> : null}
+          <a className="login-link-button" href={safeNext} style={{ margin: '20px 0 0' }}>Enter dashboard <IconArrowRight /></a>
+          <button type="button" className="login-link-button login-link-button--ghost" style={{ margin: '12px 0 0', cursor: 'pointer' }} onClick={() => { setMessage(''); setView('team'); }}>
+            Create or join a team <IconArrowRight />
+          </button>
+          <p className="login-footnote" style={{ textAlign: 'center' }}>Collaborate with others through a shared Supabase organization.</p>
+        </>
+      );
+    }
+    // Server is in team mode → switching to personal is gated by the recovery token.
+    return (
+      <>
+        <div className="login-card-head"><p>This device</p><h2>Use it personally</h2></div>
+        <div className="login-message login-message--warn">
+          This server runs in <b>team mode</b>. Switching to personal (local) mode turns off organization sign-in for everyone on this server, so it needs the on-disk recovery token.
         </div>
+        {message ? <div className="login-message">{message}</div> : null}
+        {resetOpen ? (
+          <div className="login-form">
+            <label>Recovery token
+              <input style={inputStyle} type="text" value={recoveryToken} onChange={(e) => setRecoveryToken(e.target.value)} placeholder="paste recovery token" autoComplete="off" />
+            </label>
+            <span className="login-footnote" style={{ marginTop: 0 }}>Found in <code>data/.auth-recovery-token</code> on the server machine.</span>
+            <button type="button" style={{ ...buttonStyle, opacity: resetting ? .65 : 1 }} disabled={resetting} onClick={resetToLocal}>
+              {resetting ? 'Switching…' : 'Switch to personal mode'}
+            </button>
+          </div>
+        ) : (
+          <button type="button" className="login-link-button login-link-button--ghost" style={{ cursor: 'pointer' }} onClick={() => setResetOpen(true)}>
+            Switch to personal mode <IconArrowRight />
+          </button>
+        )}
+      </>
+    );
+  }
+
+  function renderSignIn() {
+    return (
+      <>
         {isLocalServer ? (
           <div className="login-message login-message--warn">
-            Server is in <b>local mode</b>. You can test sign-in here, but sessions only persist after you switch the mode to Supabase in <a href="/settings/account">Settings → Account</a>.
+            Server is in <b>local mode</b>. You can sign in to test, but sessions persist only after switching to team mode in <a href="/settings/account">Settings → Account</a>.
           </div>
         ) : null}
         <div className="login-mode-toggle" role="tablist" aria-label="Sign-in method">
           <button type="button" className={mode === 'password' ? 'active' : ''} onClick={() => setMode('password')}>Password</button>
           <button type="button" className={mode === 'magic' ? 'active' : ''} onClick={() => setMode('magic')}>Magic link</button>
         </div>
-        {message ? <div className="login-message">{message}</div> : null}
         <form onSubmit={signIn} className="login-form">
           <label>Email<input style={inputStyle} type="email" value={email} onChange={(e) => setEmail(e.target.value)} placeholder="you@company.com" autoComplete="email" required /></label>
           {mode === 'password' ? <label>Password<input style={inputStyle} type="password" value={password} onChange={(e) => setPassword(e.target.value)} placeholder="Password" autoComplete="current-password" required /></label> : null}
@@ -187,35 +267,68 @@ export default function LoginClient({ authMode, nextPath = '/', errorCode = '',
             {process.env.NEXT_PUBLIC_MICROSOFT_SSO_ENABLED === 'true' ? <button type="button" onClick={() => sso('azure')} style={secondaryButtonStyle}><IconMicrosoft /> Microsoft</button> : null}
           </div>
         ) : null}
-        <p className="login-footnote">Supabase stores identity. madarX OS stores local runtime state, artifact ACLs, and share-link audit events.</p>
-        {!isLocalServer ? (
-          resetOpen ? (
-            <div className="login-footnote" style={{ display: 'grid', gap: 8 }}>
-              <span>Paste the recovery token from <code>data/.auth-recovery-token</code> on the server machine:</span>
-              <input
-                style={inputStyle}
-                type="text"
-                value={recoveryToken}
-                onChange={(e) => setRecoveryToken(e.target.value)}
-                placeholder="recovery token"
-                autoComplete="off"
-              />
-              <div>
-                <button type="button" onClick={resetToLocal} disabled={resetting} className="login-text-button">
-                  {resetting ? 'Resetting…' : 'Confirm reset to local mode'}
-                </button>
-              </div>
-            </div>
-          ) : (
-            <p className="login-footnote">
-              Locked out or misconfigured?{' '}
-              <button type="button" onClick={() => setResetOpen(true)} className="login-text-button">
-                Reset to local mode
-              </button>{' '}
-              (requires the on-disk recovery token).
-            </p>
-          )
+      </>
+    );
+  }
+
+  function renderCreateTeam() {
+    return (
+      <form className="login-form login-create-team" onSubmit={createTeam}>
+        <p className="login-footnote" style={{ marginTop: 0 }}>
+          Connect a Supabase project to host your team. Your first sign-in becomes the owner. Keys are stored encrypted on this server, never in the browser.
+        </p>
+        <label>Supabase URL<input style={inputStyle} type="url" value={ct.url} onChange={(e) => setCt((s) => ({ ...s, url: e.target.value }))} placeholder="https://xxxx.supabase.co" autoComplete="off" required /></label>
+        <label>Anon key<input style={inputStyle} type="text" value={ct.anonKey} onChange={(e) => setCt((s) => ({ ...s, anonKey: e.target.value }))} placeholder="eyJ…" autoComplete="off" required /></label>
+        <label>Service-role key<input style={inputStyle} type="password" value={ct.serviceKey} onChange={(e) => setCt((s) => ({ ...s, serviceKey: e.target.value }))} placeholder="eyJ… (kept server-side)" autoComplete="off" required /></label>
+        <div className="login-create-actions">
+          <button type="button" style={{ ...secondaryButtonStyle, width: 'auto', flex: '0 0 auto', padding: '0 16px' }} disabled={Boolean(ctBusy)} onClick={testTeam}>{ctBusy === 'test' ? 'Testing…' : 'Test'}</button>
+          <button type="submit" style={{ ...buttonStyle, opacity: ctBusy ? .65 : 1 }} disabled={Boolean(ctBusy)}>{ctBusy === 'save' ? 'Creating…' : 'Create team'} {!ctBusy ? <IconArrowRight /> : null}</button>
+        </div>
+      </form>
+    );
+  }
+
+  function renderTeam() {
+    return (
+      <>
+        <div className="login-card-head"><p>Secure access</p><h2>{showSignIn ? 'Sign in to your team' : 'Set up your team'}</h2></div>
+        {message ? <div className="login-message">{message}</div> : null}
+        {showSignIn ? renderSignIn() : renderCreateTeam()}
+
+        <div className="login-join">
+          <span className="login-join-label">Have an invite link?</span>
+          <form className="login-join-row" onSubmit={joinWithLink}>
+            <input style={inputStyle} type="text" value={inviteLink} onChange={(e) => setInviteLink(e.target.value)} placeholder="paste invite link" autoComplete="off" />
+            <button type="submit" style={{ ...secondaryButtonStyle, width: 'auto', flex: '0 0 auto', padding: '0 18px', whiteSpace: 'nowrap' }}>Join</button>
+          </form>
+        </div>
+
+        {showSignIn ? (
+          <p className="login-footnote">Supabase stores identity. madarX OS stores local runtime state, artifact ACLs, and share-link audit events.</p>
         ) : null}
+      </>
+    );
+  }
+
+  return (
+    <main className="login-page-shell">
+      <section className="login-hero-panel" aria-label="madarX OS landing">
+        <div className="login-wordmark">madar<span>X</span> OS</div>
+        <p className="login-kicker">Institutional agent control plane</p>
+        <h1>AI generates. Humans approve. Regulators can inspect.</h1>
+        <p className="login-lede">Run it personally on your machine, or set up an organization boundary with Supabase and share generated HTML artifacts through signed, expiring access links.</p>
+        <div className="login-proof-grid">
+          <div><b>Personal or team</b><span>Local-first by default. Add Supabase when you want an org.</span></div>
+          <div><b>Artifact ACLs</b><span>Private, organization, team-ready, and link-scoped controls.</span></div>
+          <div><b>Audit ledger</b><span>Share creation, access, and revocation are recorded.</span></div>
+        </div>
+      </section>
+      <section className="login-card" aria-label="Sign in">
+        <div className="login-seg" role="tablist" aria-label="Account type">
+          <button type="button" role="tab" aria-selected={view === 'personal'} className={view === 'personal' ? 'active' : ''} onClick={() => setView('personal')}>Personal</button>
+          <button type="button" role="tab" aria-selected={view === 'team'} className={view === 'team' ? 'active' : ''} onClick={() => setView('team')}>Team</button>
+        </div>
+        {view === 'personal' ? renderPersonal() : renderTeam()}
       </section>
     </main>
   );

package/app/login/page.js

@@ -16,6 +16,7 @@ export default async function LoginPage({ searchParams }) {
       nextPath={params.next || '/'}
       errorCode={params.error || ''}
       forceSupabase={params.supabase === '1'}
+      initialView={params.view === 'personal' || params.view === 'team' ? params.view : ''}
     />
   );
 }

package/lib/artifact-format.js

@@ -36,6 +36,18 @@ function cssString(s) {
   return String(s || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
+// True when the brand carries an OWNER-UPLOADED logo (stored under workspace/
+// brand/) rather than the bundled madarX default (brand-assets/). Drives whether
+// branded artifacts render the uploaded logo as an <img> or fall back to the
+// inline, currentColor-aware madarX lockup. A logo_data_url is required so the
+// artifact stays self-contained inside its sandboxed iframe.
+function isCustomBrandLogo(brand) {
+  if (!brand?.logo_data_url) return false;
+  const p = String(brand.logo_path || '');
+  if (!p) return false;
+  return !/brand-assets[/\\]madarx-logo-primary\.svg$/i.test(p);
+}
+
 function parseHex(hex) {
   if (!hex || typeof hex !== 'string') return null;
   const m = hex.trim().match(/^#?([0-9a-f]{6})$/i);
@@ -448,6 +460,7 @@ body {
 .cl-doc { width: 100%; max-width: 680px; margin: 0 auto; }
 .cl-mark { display: flex; align-items: center; margin-bottom: clamp(30px, 6vw, 56px); color: var(--cl-fg); }
 .cl-logo { display: block; flex: none; height: 30px; width: auto; }
+.cl-logo-img { max-width: 220px; object-fit: contain; }
 .cl-eyebrow {
   font-family: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
   font-size: 11px; letter-spacing: 0.22em; text-transform: uppercase;
@@ -568,11 +581,16 @@ export function renderChangelogHtml({ version, date, markdown, title } = {}) {
   const muted = colors[3] || '#8A8278';
   const bone = colors[2] || '#DCDCD8';
   const mars = '#C2452A';
-  // The actual brand logo — primary horizontal lockup (brand-assets/
+  // The brand logo. When the owner has uploaded a custom logo (it lives under
+  // workspace/brand/ rather than the bundled brand-assets/ default), render it
+  // as an <img> so the release notes carry *their* identity, not madarX's. For
+  // the default brand we keep the inline madarX lockup (brand-assets/
   // madarx-logo-primary.svg): orbit mark + "madarX" wordmark in IBM Plex Mono,
-  // X in Mars. Inlined (not <img>) so its `currentColor` ring + wordmark resolve
-  // to Platinum on Onyx; an iframe <img> would render currentColor black.
-  const logo = `<svg class="cl-logo" viewBox="0 0 360 100" height="30" role="img" aria-label="${escapeHtml(company)}">
+  // X in Mars. It is inlined (not <img>) so its `currentColor` ring + wordmark
+  // resolve to Platinum on Onyx; an iframe <img> would render currentColor black.
+  const logo = isCustomBrandLogo(brand)
+    ? `<img class="cl-logo cl-logo-img" src="${escapeHtml(brand.logo_data_url)}" alt="${escapeHtml(company)}">`
+    : `<svg class="cl-logo" viewBox="0 0 360 100" height="30" role="img" aria-label="${escapeHtml(company)}">
     <g transform="translate(50,50)">
       <path d="M 35.32 -18.78 A 40 40 0 1 1 28.78 -27.80" stroke="currentColor" stroke-width="3" fill="none"/>
       <line x1="-28.28" y1="-28.28" x2="28.28" y2="28.28" stroke="currentColor" stroke-width="3" stroke-linecap="round"/>

package/lib/schema.js

@@ -922,6 +922,32 @@ CREATE TABLE IF NOT EXISTS shared_space_publications (
 CREATE INDEX IF NOT EXISTS idx_shared_space_pub_status ON shared_space_publications(status);
 CREATE INDEX IF NOT EXISTS idx_shared_space_pub_org ON shared_space_publications(org_id);
 
+-- ── Shared brand-profile publication ledger (local-only) ───────────────────────
+-- Sibling of shared_publications, but for the org BRAND. The brand profile is a
+-- singleton per install (config.brand_profile). This ledger records whether the
+-- local brand has been *published* to the org (status='published'), *adopted*
+-- from the org (source='org'), or stopped sharing (status='unpublished'). Like
+-- its siblings it performs no network writes itself — lib/shared-cloud.js owns
+-- the cloud writes on an explicit publish/adopt/unpublish action. A row is keyed
+-- by org_id (one brand per org). No row (the default) means the brand is purely
+-- local and has never left the machine.
+CREATE TABLE IF NOT EXISTS brand_publications (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  source TEXT NOT NULL DEFAULT 'local',
+  content_hash TEXT,
+  status TEXT NOT NULL DEFAULT 'published',
+  last_error TEXT,
+  published_by TEXT,
+  published_at TEXT,
+  adopted_at TEXT,
+  last_synced_at TEXT,
+  unpublished_at TEXT,
+  UNIQUE(org_id)
+);
+CREATE INDEX IF NOT EXISTS idx_brand_pub_status ON brand_publications(status);
+CREATE INDEX IF NOT EXISTS idx_brand_pub_org ON brand_publications(org_id);
+
 -- ── Dashboard spaces ─────────────────────────────────────────────────────────
 -- Server-side persistence for the dashboard's space sidebar. Replaces the prior
 -- localStorage-only store (use-spaces.js) which lost user state across browser