chore: add FUNDING.yml — GitHub Sponsors button

- desktop: probe-then-persist server URL — scheme-less input tries https
  then http; a failed probe no longer saves a dead URL that would trap
  the next launch in a redirect to a broken address
- frontend: close the create-collection modal on successful submit
  (backdrop stayed mounted and intercepted navigation)
- frontend: reload once on service-worker controllerchange so returning
  users don't run a stale cached shell after a deploy
- frontend: gate dashboard empty states on resource loading to stop the
  "No project selected" / "Create your workspace" flash
- cli: resolve scheduled-job refs by name or id for jobs:run, jobs:runs,
  and jobs:rm, matching bucket/org resolution
- cli: correct stale pk_live_/pk_test_ help text to the real prm_ format;
  align README command spellings and demo seed prefixes
- setup: rewrite all public URL vars (auth, vite, backend) and cookie
  domain for the entered host — https for domains, http for IPs — with
  anchored full-line substitutions so stale ports/paths can't survive
- docs: VITE_* vars never reach the frontend image build; the app
  resolves API/auth URLs same-origin at runtime, so host changes need no
  rebuild — noted HTTPS requirement for PWA/secure-context features

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -77,9 +77,13 @@ BACKEND_STORAGE_DRIVER=local
 
 # Mail defaults — each is overridable in-app (Settings → Instance). In-app
 # values win over these env vars; deleting the in-app value reverts here.
+# With no transport configured (no Resend key and no SMTP_HOST) accounts are
+# verified automatically and no verification mail is attempted.
+# The dev overlay (docker compose -f docker-compose.yml -f docker-compose.dev.yml)
+# runs Mailpit — then SMTP_HOST=mailpit catches all outgoing mail at :8025.
 RESEND_API_KEY=
 MAIL_FROM=Primora <[email protected]>
-SMTP_HOST=mailpit
+SMTP_HOST=
 SMTP_PORT=1025
 SMTP_USER=
 SMTP_PASSWORD=

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: Dvorinka

.github/workflows/release.yml

@@ -327,6 +327,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: read
+      # contents: write — the job uploads SBOM assets onto the release.
+      contents: write
     env:
       VERSION: ${{ needs.verify.outputs.version }}
     steps:
@@ -339,6 +341,8 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      # anchore/sbom-action does not create the output directory.
+      - run: mkdir -p dist-release
       - uses: anchore/sbom-action@v0
         with:
           image: ghcr.io/${{ env.GHCR_OWNER }}/primora-backend:${{ needs.verify.outputs.version }}

CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to Primora. Format follows [Keep a Changelog](https://keepac
 
 ## [Unreleased]
 
+## [0.8.5] - 2026-09-28
+
+### Fixed
+
+- **Content column centers on wide screens** — `.page` was capped at 72rem but left-aligned, so above ~1200px the dashboard hugged the left with a growing dead zone on the right. It now centers (`margin-inline: auto`) while staying full-width below the cap.
+
+## [0.8.4] - 2026-09-28
+
+### Added
+
+- **Slugs auto-derive from names** — typing an organization, project, bucket, or collection name now fills its slug (`TDvorak` → `tdvorak`); hand-editing the slug stops the derivation, and manual edits are sanitized as you type. Edit forms stay manual.
+
+### Fixed
+
+- **Installer URL prompt was invisible under `curl | bash`** — `exec 9</dev/tty 2>/dev/null` sent the whole shell's stderr to `/dev/null` permanently, so the `read` prompt rendered nowhere while the script blocked on input. The prompt now reads `/dev/tty` directly with a quiet probe; no-tty runs default silently.
+- **Installer fetches fail fast** — the compose-file and source-tarball `curl` calls now carry connect/max-time timeouts plus retries, so a stalled GitHub connection errors within seconds naming the file instead of hanging forever.
+
+## [0.8.3] - 2026-09-28
+
+### Added
+
+- **Install script asks for the public URL** — `install.sh` now prompts for where you'll open the app and accepts a full URL: `https://primora.example.com` (TLS at your proxy, hints printed at the end), `primora.example.com`, or `192.168.1.50:8085` (the port becomes `NGINX_PORT`). The answer rewrites every public URL var in `.env` and `COOKIE_DOMAIN` for real DNS names. The prompt reads the controlling terminal so it appears under `curl | bash`; no tty (CI, cron) falls back to `localhost`. Non-interactive via `PUBLIC_URL=`; legacy `DOMAIN`/`NGINX_PORT` envs still work; reruns over an existing `.env` skip the question.
+
+### Fixed
+
+- **Auth origins behind external TLS terminators** — trusted origins now accept both URL schemes on the serving host. Verified live over a Cloudflare quick tunnel: a real browser session cookie + `https://*.trycloudflare.com` origin was 403'd on v0.8.2 (nginx reports `X-Forwarded-Proto: http` inbound); the same request now signs in cleanly while cross-site origins still 403.
+
+## [0.8.2] - 2026-09-28
+
+### Fixed
+
+- **Self-hosted sign-up works on any origin** — trusted origins are now derived from the request's public host (forwarded by nginx), so browsing the instance via a LAN IP, hostname, or custom port no longer fails every auth POST with a 403. Static `VITE_APP_URL`/`AUTH_BASE_URL` origins and `BETTER_AUTH_TRUSTED_ORIGINS` still apply.
+- **Sign-up/sign-in failures are surfaced, not swallowed** — better-auth resolves `{ data, error }` instead of throwing, so a failed request previously showed "Account created — signing you in" and bounced back to the bootstrap screen. The real server error (invalid origin, rate limit, disabled sign-up) is now displayed.
+- **Mail probe can no longer break auth** — `hasMailTransport` degrades to "no transport" instead of throwing when `core.settings` is unreadable, and the no-transport startup backfill is best-effort. Previously, auth could crash-loop while the backend was still migrating on a fresh volume — every sign-up 502'd during the window.
+
+## [0.8.1] - 2026-09-28
+
+### Fixed
+
+- **SMTP-less instances no longer involve email at all** — when no mail transport is configured (no Resend key, no `SMTP_HOST`), new accounts are created `emailVerified=true`, the verification send is skipped entirely, and existing unverified users are marked verified on startup. `.env.example` no longer defaults `SMTP_HOST` to the dev-only `mailpit` service, which left production deploys pointing at a transport that does not exist.
+
 ## [0.8.0] - 2026-09-28
 
 ### Added

DEPLOYMENT_GUIDE.md

@@ -40,7 +40,7 @@ docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
 | `PRIMORA_ENCRYPTION_KEY` | AES-256 key (64 hex chars) for project secrets (Vault page, `secret://` job refs), integration credentials + webhook secrets at rest | production |
 | `AUTH_BASE_URL` / `BETTER_AUTH_URL` | public auth URL (`https://host/auth`) | yes |
 | `AUTH_INTERNAL_BASE_URL` | backend → auth internal URL (`http://auth:3001`) | yes |
-| `VITE_APP_URL` / `VITE_AUTH_BASE_URL` / `VITE_API_BASE_URL` | frontend public URLs — **baked into the frontend image at build time** | yes |
+| `VITE_APP_URL` / `VITE_AUTH_BASE_URL` / `VITE_API_BASE_URL` | frontend public URLs — informational only; the shipped image resolves API/auth URLs same-origin at runtime, so no rebuild is needed when the host changes | yes |
 | `BACKEND_STORAGE_ROOT` | object storage directory inside the backend container (local driver) | yes |
 | `BACKEND_STORAGE_DRIVER` | `local` (default) or `s3` — S3-compatible object storage | no |
 | `S3_ENDPOINT` / `S3_REGION` / `S3_BUCKET` | S3 API endpoint (empty endpoint → AWS `s3.<region>.amazonaws.com`), region, bucket | with `s3` |
@@ -81,8 +81,12 @@ labels:
 ```
 
 Once TLS is live, update `VITE_APP_URL`, `VITE_AUTH_BASE_URL`,
-`AUTH_BASE_URL`, `BETTER_AUTH_URL`, and `COOKIE_DOMAIN` to the https origin
+`AUTH_BASE_URL`, `BETTER_AUTH_URL`, `BACKEND_PUBLIC_URL`, and
-and rebuild the frontend image (`docker compose build frontend`).
+`COOKIE_DOMAIN` to the https origin and restart the stack
+(`docker compose up -d`). The frontend resolves API/auth URLs
+same-origin, so no image rebuild is needed — HTTPS is still required for
+PWA install, service workers, and other secure-context features on
+non-localhost origins.
 
 ## SMTP / email
 

README.md

@@ -77,7 +77,9 @@ Prerequisites: Docker with the Compose plugin.
 curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
 ```
 
-Installs into `./primora`, generates secrets, and starts the stack on port 80.
+Installs into `./primora`, asks one question — the URL you'll open the app on
+(domain, IP, optional port) — generates secrets, and starts the stack.
+Non-interactive: `PUBLIC_URL=https://primora.example.com bash install.sh`.
 Or from a clone:
 
 ```bash

apps/auth/src/index.ts

@@ -5,7 +5,7 @@ import { requestId } from "hono/request-id";
 import { HTTPException } from "hono/http-exception";
 import { createClient } from "redis";
 
-import { auth, promoteAdminEmails, runAuthMigrations } from "./lib/auth.js";
+import { auth, promoteAdminEmails, runAuthMigrations, verifyUsersWithoutMailTransport } from "./lib/auth.js";
 import { authPool } from "./lib/db.js";
 import { env } from "./lib/env.js";
 
@@ -20,6 +20,7 @@ try {
 }
 
 await retry("auth_migrations", runAuthMigrations);
+await verifyUsersWithoutMailTransport();
 await promoteAdminEmails();
 
 const app = new Hono();

apps/auth/src/lib/auth.ts

@@ -4,7 +4,7 @@ import { admin, jwt } from "better-auth/plugins";
 import { getMigrations } from "better-auth/db/migration";
 
 import { authPool } from "./db.js";
-import { sendTransactionalEmail } from "./mail.js";
+import { hasMailTransport, sendTransactionalEmail } from "./mail.js";
 import { getBoolSetting } from "./settings.js";
 import { env } from "./env.js";
 
@@ -53,7 +53,22 @@ export const auth = betterAuth({
   appName: "Primora",
   secret: env.BETTER_AUTH_SECRET,
   baseURL: env.BETTER_AUTH_URL,
-  trustedOrigins: [env.VITE_APP_URL, env.AUTH_BASE_URL],
+  // Self-host: the browser reaches /auth through the same nginx origin as the
+  // app, so whatever host actually served this request is trusted — static
+  // localhost defaults alone 403 every sign-up on LAN IPs or custom ports.
+  // An attacker's cross-site Origin still won't match the server host.
+  trustedOrigins: (request) => {
+    const origins = [env.VITE_APP_URL, env.AUTH_BASE_URL];
+    const host = request?.headers.get("x-forwarded-host") ?? request?.headers.get("host");
+    if (host) {
+      const proto = request?.headers.get("x-forwarded-proto") ?? "http";
+      origins.push(`${proto}://${host}`);
+      // TLS often terminates at an external proxy — nginx then reports http.
+      // Both schemes on the serving host are legitimately this instance.
+      origins.push(proto === "https" ? `http://${host}` : `https://${host}`);
+    }
+    return origins;
+  },
   database: authPool,
   emailAndPassword: {
     enabled: true,
@@ -72,20 +87,29 @@ export const auth = betterAuth({
         // Gates only the public sign-up endpoint. Users created through the
         // admin plugin or OAuth callbacks take different paths and pass.
         async before(user, ctx) {
-          if (ctx?.path !== "/sign-up/email") return;
+          const data = { ...user };
-          const { rows } = await authPool.query<{ n: number }>(
+          // Without a mail transport the verification mail can never arrive —
-            `select count(*)::int as n from "user"`,
+          // mark every created account verified so nothing downstream nags
-          );
+          // "unverified" on users nobody can verify.
-          if (rows[0].n === 0) {
+          if (!(await hasMailTransport())) {
-            // Bootstrap: the first public signup becomes the instance admin.
+            data.emailVerified = true;
-            return { data: { ...user, role: "admin" } };
           }
-          const enabled = await getBoolSetting("auth.signup_enabled", env.SIGNUP_ENABLED);
+          if (ctx?.path === "/sign-up/email") {
-          if (!enabled) {
+            const { rows } = await authPool.query<{ n: number }>(
-            throw new APIError("FORBIDDEN", {
+              `select count(*)::int as n from "user"`,
-              message: "Sign-up is disabled on this instance.",
+            );
-            });
+            if (rows[0].n === 0) {
+              // Bootstrap: the first public signup becomes the instance admin.
+              return { data: { ...data, role: "admin" } };
+            }
+            const enabled = await getBoolSetting("auth.signup_enabled", env.SIGNUP_ENABLED);
+            if (!enabled) {
+              throw new APIError("FORBIDDEN", {
+                message: "Sign-up is disabled on this instance.",
+              });
+            }
           }
+          return data.emailVerified === user.emailVerified ? undefined : { data };
         },
       },
     },
@@ -94,6 +118,9 @@ export const auth = betterAuth({
     sendOnSignUp: true,
     autoSignInAfterVerification: true,
     async sendVerificationEmail({ user, url }) {
+      // No transport at all → the mail can never arrive; the user was already
+      // marked verified at creation.
+      if (!(await hasMailTransport())) return;
       // Verification is optional — a misconfigured transport must not fail
       // sign-up or sign-in.
       try {
@@ -143,6 +170,17 @@ export async function runAuthMigrations() {
   await migrations.runMigrations();
 }
 
+/** No transport → existing unverified users can never resolve that state.
+ *  Best-effort: a startup failure here must never take the service down. */
+export async function verifyUsersWithoutMailTransport() {
+  try {
+    if (await hasMailTransport()) return;
+    await authPool.query(`update "user" set "emailVerified" = true where "emailVerified" = false`);
+  } catch (error) {
+    console.warn(JSON.stringify({ level: "warn", msg: "verify_without_transport_failed", error }));
+  }
+}
+
 /** Bootstrap admins by email — run after migrations so the role column exists. */
 export async function promoteAdminEmails() {
   const emails = (env.AUTH_ADMIN_EMAILS ?? "")

apps/auth/src/lib/mail.ts

@@ -30,6 +30,21 @@ async function resolveMailConfig() {
   } as const;
 }
 
+// True when a mail transport exists (Resend key or SMTP host). Verification
+// and reset mails only make sense when mail can actually leave the box.
+// Mail is optional — a failed settings read must degrade to "no transport",
+// never break sign-up.
+export async function hasMailTransport(): Promise<boolean> {
+  try {
+    const cfg = await resolveMailConfig();
+    if ("resendApiKey" in cfg && cfg.resendApiKey) return true;
+    return "smtp" in cfg && Boolean(cfg.smtp);
+  } catch (error) {
+    console.warn(JSON.stringify({ level: "warn", msg: "mail_transport_probe_failed", error }));
+    return false;
+  }
+}
+
 export async function sendTransactionalEmail(input: {
   to: string;
   subject: string;

apps/cli/README.md

@@ -21,7 +21,7 @@ project interactively.
 ## Commands
 
 `orgs`, `projects`, `buckets`, `objects` (list/upload/download/rm), `keys`,
-`jobs`, `events:send`, `audit list --follow`. Every command accepts `--json`.
+`jobs`, `events:send`, `audit:list --follow`. Every command accepts `--json`.
 
 ```sh
 primora events:send custom.deploy.done --data '{"sha":"abc123"}'
@@ -31,7 +31,7 @@ primora events:send custom.deploy.done --data '{"sha":"abc123"}'
 webhooks, and `event_pattern` functions all fire.
 
 ```sh
-primora documents list --collection users \
+primora documents:list --collection users \
   --filter "status.eq.active,age.gt.18" --order "age.desc"
 ```
 

apps/cli/src/cli.ts

@@ -51,7 +51,7 @@ cli
   .option("--url <url>", "Primora base URL (default http://localhost)")
   .option("--email <email>", "Account email")
   .option("--password <password>", "Account password")
-  .option("--api-key <key>", "Store a pk_live_/pk_test_ API key instead of a session")
+  .option("--api-key <key>", "Store a prm_ API key instead of a session")
   .option("--json", "Machine-readable output")
   .action(cmdLogin);
 

apps/cli/src/commands/jobs.ts

@@ -2,7 +2,7 @@ import type { ScheduledJob, ScheduledJobRun } from "@primora/api-client";
 import { AutomationService } from "@primora/api-client";
 
 import { loadConfig } from "../config.js";
-import { configureClient, requireAuth, requireProject } from "../http.js";
+import { configureClient, requireAuth, requireProject, resolveJobId } from "../http.js";
 import { formatDate, isJson, printJson, printTable, success } from "../out.js";
 
 interface JobOptions {
@@ -88,12 +88,13 @@ export async function cmdJobsCreate(
   }
 }
 
-export async function cmdJobsRemove(jobId: string, options: JobOptions & { yes?: boolean }): Promise<void> {
+export async function cmdJobsRemove(jobRef: string, options: JobOptions & { yes?: boolean }): Promise<void> {
   const cfg = loadConfig();
   requireAuth(cfg);
   configureClient(cfg);
 
   const projectId = requireProject(cfg, options.project);
+  const jobId = await resolveJobId(projectId, jobRef);
   await AutomationService.deleteScheduledJob({ projectId, jobId });
   if (isJson(options)) {
     printJson({ deleted: jobId });
@@ -102,12 +103,13 @@ export async function cmdJobsRemove(jobId: string, options: JobOptions & { yes?:
   }
 }
 
-export async function cmdJobsRun(jobId: string, options: JobOptions): Promise<void> {
+export async function cmdJobsRun(jobRef: string, options: JobOptions): Promise<void> {
   const cfg = loadConfig();
   requireAuth(cfg);
   configureClient(cfg);
 
   const projectId = requireProject(cfg, options.project);
+  const jobId = await resolveJobId(projectId, jobRef);
   const run = await AutomationService.runScheduledJob({ projectId, jobId });
   if (isJson(options)) {
     printJson(run);
@@ -128,7 +130,7 @@ function runRow(run: ScheduledJobRun): string[] {
 }
 
 export async function cmdJobsRuns(
-  jobId: string,
+  jobRef: string,
   options: JobOptions & { limit?: string },
 ): Promise<void> {
   const cfg = loadConfig();
@@ -136,6 +138,7 @@ export async function cmdJobsRuns(
   configureClient(cfg);
 
   const projectId = requireProject(cfg, options.project);
+  const jobId = await resolveJobId(projectId, jobRef);
   const page = await AutomationService.listScheduledJobRuns({
     projectId,
     jobId,

apps/cli/src/http.ts

@@ -1,4 +1,4 @@
-import { OpenAPI, StorageService } from "@primora/api-client";
+import { AutomationService, OpenAPI, StorageService } from "@primora/api-client";
 
 import type { CliConfig } from "./config.js";
 
@@ -110,3 +110,16 @@ export async function resolveBucketId(projectId: string, ref: string): Promise<s
   }
   return match.id;
 }
+
+/** Resolve a scheduled job reference that may be an id or a name. */
+export async function resolveJobId(projectId: string, ref: string): Promise<string> {
+  const { items } = await AutomationService.listScheduledJobs({ projectId });
+  const match = items.find((j) => j.id === ref || j.name === ref);
+  if (!match) {
+    throw new CliError(
+      `Job "${ref}" not found.`,
+      `Known jobs: ${items.map((j) => j.name).join(", ") || "(none)"}`,
+    );
+  }
+  return match.id;
+}

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primora/desktop",
-  "version": "0.8.0",
+  "version": "0.8.5",
   "private": true,
   "description": "Primora desktop shell — thin Tauri client for a self-hosted deployment",
   "scripts": {

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Primora",
-  "version": "0.8.0",
+  "version": "0.8.5",
   "identifier": "dev.tdvorak.primora",
   "build": {
     "frontendDist": "../ui"

apps/desktop/ui/index.html

@@ -101,6 +101,18 @@
         tauri?.event.emit("open-vault");
       });
 
+      const probe = async (url) => {
+        try {
+          // Opaque (no-cors) — proves the host answers, not that it is a
+          // Primora deployment. A wrong-but-alive URL is recoverable via the
+          // tray menu's "Change server".
+          await fetch(url, { mode: "no-cors", signal: AbortSignal.timeout(8000) });
+          return true;
+        } catch {
+          return false;
+        }
+      };
+
       form.addEventListener("submit", async (event) => {
         event.preventDefault();
         err.hidden = true;
@@ -108,7 +120,17 @@
         button.textContent = "Checking…";
 
         let url = input.value.trim();
-        if (!/^https?:\/\//i.test(url)) url = `https://${url}`;
+        if (!/^https?:\/\//i.test(url)) {
+          // Self-hosted deployments are often plain HTTP on a LAN — probe
+          // https first, fall back to http, and only keep the one that answers.
+          const https = `https://${url}`;
+          url = (await probe(https)) ? https : `http://${url}`;
+        }
+
+        if (!(await probe(url))) {
+          fail("Server did not respond. Check the URL and that the deployment is up.");
+          return;
+        }
 
         try {
           await tauri.core.invoke("set_server_url", { url });
@@ -117,16 +139,6 @@
           return;
         }
 
-        // Reachability probe — opaque (no-cors), so it proves the host answers,
-        // not that it is a Primora deployment. A wrong-but-alive URL is recoverable
-        // via the tray menu's "Change server".
-        try {
-          await fetch(url, { mode: "no-cors", signal: AbortSignal.timeout(8000) });
-        } catch {
-          fail("Server did not respond. Check the URL and that the deployment is up.");
-          return;
-        }
-
         location.replace(url);
       });
     </script>

apps/frontend/src/App.tsx

@@ -28,6 +28,7 @@ import { Show, createEffect, createMemo, createResource, createSignal, onCleanup
 import { authClient, fetchApiToken } from "./lib/auth-client";
 import { configureApiToken, errorMessage } from "./lib/api";
 import { isDemoMode, disableDemoMode, enableDemoMode, demoSession, demoService } from "./lib/demo-mode";
+import { applySlugField } from "./lib/slug";
 import {
   AgentSetupModal,
   AppShell,
@@ -735,11 +736,22 @@ export default function App() {
     await runPending("auth-submit", async () => {
       setAuthMessage("");
       try {
+        // better-auth client resolves { data, error } instead of throwing on
+        // HTTP failures — surface res.error or the UI claims success while
+        // nothing was created.
         if (mode() === "sign-up") {
-          await authClient.signUp.email({ email: email(), password: password(), name: name() });
+          const res = await authClient.signUp.email({ email: email(), password: password(), name: name() });
+          if (res.error) {
+            setAuthMessage(res.error.message ?? "Sign-up failed");
+            return;
+          }
           setAuthMessage("Account created — signing you in.");
         } else {
-          await authClient.signIn.email({ email: email(), password: password() });
+          const res = await authClient.signIn.email({ email: email(), password: password() });
+          if (res.error) {
+            setAuthMessage(res.error.message ?? "Sign-in failed");
+            return;
+          }
         }
       } catch (error) {
         setAuthMessage(getErrorMessage(error, "Authentication failed"));
@@ -1625,7 +1637,7 @@ export default function App() {
         <PwaInstallBanner />
 
         <Show
-          when={platform() || isDemo}
+          when={platform()}
           fallback={
             <div class="page">
               <div class="skeleton" style="height:2rem;width:12rem;border-radius:8px" />
@@ -1644,6 +1656,14 @@ export default function App() {
               when={activeProject()}
               fallback={
                 <div class="page">
+                  <Show
+                    when={!organizationProjects.loading}
+                    fallback={
+                      <div class="card" style="min-height:20rem">
+                        <div class="skeleton" style="height:100%;min-height:20rem;border-radius:12px" />
+                      </div>
+                    }
+                  >
                   <Show
                     when={(platform()?.organizations ?? []).length > 0}
                     fallback={
@@ -1659,14 +1679,14 @@ export default function App() {
                             label="Organization name"
                             placeholder="Acme Corporation"
                             value={organizationInput().name}
-                            onInput={(e) => setOrganizationInput((c) => ({ ...c, name: e.currentTarget.value }))}
+                            onInput={(e) => setOrganizationInput((c) => applySlugField(c, "name", e.currentTarget.value))}
                             required
                           />
                           <Input
                             label="Slug"
                             placeholder="acme"
                             value={organizationInput().slug}
-                            onInput={(e) => setOrganizationInput((c) => ({ ...c, slug: e.currentTarget.value }))}
+                            onInput={(e) => setOrganizationInput((c) => applySlugField(c, "slug", e.currentTarget.value))}
                             required
                           />
                           <button type="submit" class="btn btn-primary w-full" disabled={workspacePending()}>
@@ -1690,6 +1710,7 @@ export default function App() {
                       </button>
                     </div>
                   </Show>
+                  </Show>
                 </div>
               }
             >
@@ -1712,7 +1733,7 @@ export default function App() {
               projectMessage={projectMessage()}
               projectPending={projectPending()}
               canUpdateProject={canUpdateProject()}
-              onProjectInputChange={(field, value) => setProjectInput((c) => ({ ...c, [field]: value }))}
+              onProjectInputChange={(field, value) => setProjectInput((c) => applySlugField(c, field, value))}
               onProjectEditInputChange={(field, value) => setProjectEditInput((c) => ({ ...c, [field]: value }))}
               onCreateProject={createProject}
               onUpdateProject={updateActiveProject}
@@ -1811,7 +1832,7 @@ export default function App() {
               previewLoading={objectPreview.loading}
               renameObjectKey={renameObjectKeyInput()}
               moveDestinationBucketID={moveDestinationBucketID()}
-              onBucketInputChange={(field, value) => setBucketInput((c) => ({ ...c, [field]: value }))}
+              onBucketInputChange={(field, value) => setBucketInput((c) => applySlugField(c, field, value))}
               onBucketEditInputChange={(field, value) => setBucketEditInput((c) => ({ ...c, [field]: value }))}
               onCreateBucket={createBucket}
               onUpdateBucket={updateSelectedBucket}
@@ -1848,7 +1869,7 @@ export default function App() {
               collectionPending={collectionPending()}
               documentPending={documentPending()}
               canUpdate={canUpdateProject()}
-              onCollectionInputChange={(field, value) => setCollectionInput((c) => ({ ...c, [field]: value }))}
+              onCollectionInputChange={(field, value) => setCollectionInput((c) => applySlugField(c, field, value))}
               onCreateCollection={createCollection}
               onDeleteCollection={deleteCollection}
               onSelectCollection={setSelectedCollectionID}

apps/frontend/src/index.css

@@ -1096,6 +1096,8 @@ code {
   /* ---------- page scaffold ---------- */
   .page {
     max-width: 72rem;
+    width: 100%;
+    margin-inline: auto;
     display: flex;
     flex-direction: column;
     gap: 1.5rem;

apps/frontend/src/lib/__tests__/slug.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+
+import { applySlugField, slugify } from "../slug";
+
+describe("slugify", () => {
+  it("derives lowercase hyphenated slugs", () => {
+    expect(slugify("TDvorak")).toBe("tdvorak");
+    expect(slugify("Acme Corporation")).toBe("acme-corporation");
+    expect(slugify("  My_App!! v2  ")).toBe("my-app-v2");
+  });
+
+  it("strips accents and non-ascii characters", () => {
+    expect(slugify("Zürich — Héllo")).toBe("zurich-hello");
+    expect(slugify("日本語")).toBe("");
+  });
+});
+
+describe("applySlugField", () => {
+  const form = { name: "", slug: "", description: "" };
+
+  it("fills the slug while it is untouched", () => {
+    const next = applySlugField(form, "name", "My Org");
+    expect(next.slug).toBe("my-org");
+    // keeps following name edits
+    expect(applySlugField(next, "name", "Renamed Org").slug).toBe("renamed-org");
+  });
+
+  it("stops deriving once the slug was hand-edited", () => {
+    const custom = applySlugField(applySlugField(form, "name", "My Org"), "slug", "custom-slug");
+    expect(applySlugField(custom, "name", "New Name").slug).toBe("custom-slug");
+  });
+
+  it("resumes deriving if the slug is cleared", () => {
+    const cleared = applySlugField(applySlugField(form, "name", "My Org"), "slug", "");
+    expect(applySlugField(cleared, "name", "Other").slug).toBe("other");
+  });
+
+  it("sanitizes manual slug edits", () => {
+    expect(applySlugField(form, "slug", "Not A Slug!").slug).toBe("not-a-slug");
+  });
+
+  it("passes through unrelated fields", () => {
+    expect(applySlugField(form, "description", "hi").description).toBe("hi");
+  });
+});

apps/frontend/src/lib/__tests__/slugdom.test.tsx

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { render } from 'solid-js/web';
+import { createSignal } from 'solid-js';
+import { applySlugField } from '../slug';
+import { Input } from '../../components/Input';
+
+describe('slug auto-derive in DOM', () => {
+  it('typing name fills the slug input', async () => {
+    const host = document.createElement('div');
+    document.body.appendChild(host);
+    const [input, setInput] = createSignal({ name: '', slug: '' });
+    const dispose = render(() => (
+      <form>
+        <Input label="Name" value={input().name}
+          onInput={(e) => setInput((c) => applySlugField(c, 'name', e.currentTarget.value))} />
+        <Input label="Slug" value={input().slug}
+          onInput={(e) => setInput((c) => applySlugField(c, 'slug', e.currentTarget.value))} />
+      </form>
+    ), host);
+    const [name, slug] = Array.from(host.querySelectorAll('input'));
+    name.value = 'Acme Corp';
+    name.dispatchEvent(new Event('input', { bubbles: true }));
+    await new Promise((r) => setTimeout(r, 0));
+    expect(slug.value).toBe('acme-corp');
+    dispose();
+    host.remove();
+  });
+});

apps/frontend/src/lib/demo-mode.ts

@@ -216,7 +216,7 @@ let apiKeys: ApiKey[] = [
     id: "key-1",
     project_id: "proj-1",
     name: "Production key",
-    prefix: "pk_live_7f2a",
+    prefix: "prm_7f2a9c",
     last_used_at: ago(0.2),
     revoked_at: null,
   },
@@ -224,7 +224,7 @@ let apiKeys: ApiKey[] = [
     id: "key-2",
     project_id: "proj-1",
     name: "CI deploy",
-    prefix: "pk_test_9c41",
+    prefix: "prm_9c41de",
     last_used_at: ago(2),
     revoked_at: null,
   },

apps/frontend/src/lib/slug.ts

@@ -0,0 +1,27 @@
+export function slugify(value: string): string {
+  return value
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 63);
+}
+
+/**
+ * Applies a field edit to a {name, slug, ...} form. While the slug is
+ * untouched — empty or still equal to the derived value — renaming the
+ * entity re-derives its slug. Explicit slug edits are sanitized in place.
+ */
+export function applySlugField<T extends { name: string; slug: string }>(
+  current: T,
+  field: string,
+  value: string,
+): T {
+  if (field === "slug") return { ...current, slug: slugify(value) };
+  if (field === "name" && (current.slug === "" || current.slug === slugify(current.name))) {
+    return { ...current, name: value, slug: slugify(value) };
+  }
+  return { ...current, [field]: value };
+}

apps/frontend/src/main.tsx

@@ -3,4 +3,17 @@ import { render } from "solid-js/web";
 import App from "./App";
 import "./index.css";
 
+// Reload once when an updated service worker takes control. Without this the
+// precached shell keeps serving the previous release until a manual refresh.
+// Skipped when the page has no controller yet (first SW install) so first-time
+// visitors don't get an extra reload.
+if ("serviceWorker" in navigator && navigator.serviceWorker.controller) {
+  let refreshing = false;
+  navigator.serviceWorker.addEventListener("controllerchange", () => {
+    if (refreshing) return;
+    refreshing = true;
+    window.location.reload();
+  });
+}
+
 render(() => <App />, document.getElementById("root")!);

apps/frontend/src/pages/CollectionsPage.tsx

@@ -253,7 +253,13 @@ export function CollectionsPage(props: CollectionsPageProps) {
         title="Create collection"
         description="Collections store JSON documents scoped to a project."
       >
-        <form onSubmit={props.onCreateCollection} class="space-y-4">
+        <form
+          onSubmit={(e) => {
+            props.onCreateCollection(e);
+            setCreateOpen(false);
+          }}
+          class="space-y-4"
+        >
           <Input
             label="Collection name"
             placeholder="Posts"

install.sh

@@ -3,8 +3,14 @@
 #
 #   curl -fsSL https://raw.githubusercontent.com/Dvorinka/Primora/master/install.sh | bash
 #
-# Installs into ./primora (override with PRIMORA_DIR). Non-interactive:
+# Installs into ./primora (override with PRIMORA_DIR). On a fresh install,
-#   DOMAIN=example.com NGINX_PORT=8080 bash install.sh
+# interactive shells get one question — the URL the app will be opened on
+# (domain or IP, optional port). Non-interactive:
+#   PUBLIC_URL=https://primora.example.com bash install.sh
+#   DOMAIN=192.168.1.50 NGINX_PORT=8085 bash install.sh   (legacy form)
+#
+# https URLs mean TLS terminates at your own proxy in front of Primora's
+# bundled nginx (which always speaks http on NGINX_PORT).
 #
 # Pulls prebuilt GHCR images when available; otherwise downloads the source
 # tarball and builds locally. Either way the result is the same compose stack.
@@ -14,8 +20,8 @@ set -euo pipefail
 REPO="Dvorinka/Primora"
 REF="${PRIMORA_REF:-master}"
 DIR="${PRIMORA_DIR:-primora}"
-DOMAIN="${DOMAIN:-localhost}"
 NGINX_PORT="${NGINX_PORT:-80}"
+PUBLIC_URL="${PUBLIC_URL:-}"
 
 info() { echo "==> $*"; }
 die()  { echo "ERROR: $*" >&2; exit 1; }
@@ -32,12 +38,62 @@ mkdir -p "$DIR/infra/nginx"
 cd "$DIR"
 
 # The compose stack needs exactly these three files from the repo.
+# Timeouts + retries: a stalled connection must fail loudly, not hang.
 info "Fetching compose files ($REF)"
 for f in docker-compose.yml .env.example infra/nginx/default.conf; do
-  curl -fsSL "https://raw.githubusercontent.com/$REPO/$REF/$f" -o "$f"
+  curl -fsSL --connect-timeout 10 --max-time 60 --retry 3 --retry-delay 1 --retry-all-errors \
+    "https://raw.githubusercontent.com/$REPO/$REF/$f" -o "$f" \
+    || die "could not fetch $f — check connectivity to raw.githubusercontent.com"
 done
 
-if [ ! -f .env ]; then
+if [ -f .env ]; then
+  info "Existing .env kept"
+  # Display URL comes from the file — answers here would change nothing.
+  PUBLIC_URL="$(grep -E '^VITE_APP_URL=' .env | tail -1 | cut -d= -f2- || true)"
+  [ -z "$PUBLIC_URL" ] && PUBLIC_URL="http://localhost"
+else
+  # Public URL — the single question. Env wins, then prompt, then default.
+  if [ -z "$PUBLIC_URL" ] && [ -n "${DOMAIN:-}" ]; then
+    PUBLIC_URL="http://${DOMAIN}"
+    [ "$NGINX_PORT" != "80" ] && PUBLIC_URL="$PUBLIC_URL:$NGINX_PORT"
+  fi
+  if [ -z "$PUBLIC_URL" ]; then
+    DEFAULT_URL="http://localhost"
+    [ "$NGINX_PORT" != "80" ] && DEFAULT_URL="http://localhost:$NGINX_PORT"
+    # Under `curl | bash` stdin is the script pipe — ask on the controlling
+    # terminal instead. `true </dev/tty` probes the open quietly; read's own
+    # redirect fails non-fatally (default applies) where there is no tty.
+    # Never `exec ... 2>/dev/null` here — exec redirections persist and would
+    # silence stderr, including the read prompt below, for the whole script.
+    if true 2>/dev/null </dev/tty; then
+      read -rp "URL where you'll open Primora (domain or IP, e.g. https://primora.example.com) [$DEFAULT_URL]: " PUBLIC_URL </dev/tty || true
+    fi
+    PUBLIC_URL="${PUBLIC_URL:-$DEFAULT_URL}"
+  fi
+
+  # Normalize: default scheme http, strip trailing slash.
+  case "$PUBLIC_URL" in
+    http://*|https://*) ;;
+    *) PUBLIC_URL="http://$PUBLIC_URL" ;;
+  esac
+  PUBLIC_URL="${PUBLIC_URL%/}"
+
+  # Split host[:port]; URL paths aren't supported — nginx mounts auth at /auth.
+  REST="${PUBLIC_URL#*://}"
+  HOSTPORT="${REST%%/*}"
+  [ "$REST" != "$HOSTPORT" ] && die "URL paths are not supported — use a domain or port instead: $PUBLIC_URL"
+  if [[ "$HOSTPORT" == *:* ]]; then
+    HOST="${HOSTPORT%%:*}"
+    PORT="${HOSTPORT##*:}"
+  else
+    HOST="$HOSTPORT"; PORT=""
+  fi
+  [ -z "$HOST" ] && die "could not parse a host from: $PUBLIC_URL"
+  if [ -n "$PORT" ]; then
+    [[ "$PORT" =~ ^[0-9]+$ ]] || die "invalid port in: $PUBLIC_URL"
+    NGINX_PORT="$PORT"
+  fi
+
   info "Generating .env with random secrets"
   cp .env.example .env
 
@@ -53,12 +109,15 @@ if [ ! -f .env ]; then
   "${SED[@]}" "s|^PRIMORA_ENCRYPTION_KEY=.*|PRIMORA_ENCRYPTION_KEY=$ENCRYPTION_KEY|" .env
   "${SED[@]}" "s|^NGINX_PORT=.*|NGINX_PORT=$NGINX_PORT|" .env
 
-  if [ "$DOMAIN" != "localhost" ]; then
+  # Every public URL var (VITE_APP_URL, BETTER_AUTH_URL, AUTH_BASE_URL,
-    "${SED[@]}" "s|http://localhost|http://$DOMAIN|g" .env
+  # VITE_AUTH_BASE_URL, VITE_API_BASE_URL, BACKEND_PUBLIC_URL) is built on the
-    "${SED[@]}" "s|^COOKIE_DOMAIN=.*|COOKIE_DOMAIN=$DOMAIN|" .env
+  # http://localhost prefix in .env.example — one rewrite covers them all.
+  "${SED[@]}" "s|http://localhost|$PUBLIC_URL|g" .env
+
+  # Cookie domains only apply to real DNS names — never IPs or localhost.
+  if [ "$HOST" != "localhost" ] && ! [[ "$HOST" =~ ^[0-9.]+$ ]]; then
+    "${SED[@]}" "s|^COOKIE_DOMAIN=.*|COOKIE_DOMAIN=$HOST|" .env
   fi
-else
-  info "Existing .env kept"
 fi
 
 # Compose v5 skips `pull` for services that declare build:, so fetch the
@@ -75,15 +134,17 @@ if docker pull "ghcr.io/$GHCR_OWNER/primora-backend:latest" \
 else
   # GHCR packages are private until first published release — build from source.
   info "Prebuilt images unavailable; building from source"
-  curl -fsSL "https://codeload.github.com/$REPO/tar.gz/refs/heads/$REF" | tar xz --strip-components=1
+  curl -fsSL --connect-timeout 10 --max-time 120 --retry 3 --retry-delay 1 --retry-all-errors \
+    "https://codeload.github.com/$REPO/tar.gz/refs/heads/$REF" | tar xz --strip-components=1
   docker compose up -d --build
 fi
 
-DISPLAY_URL="http://$DOMAIN"
-[ "$NGINX_PORT" != "80" ] && DISPLAY_URL="$DISPLAY_URL:$NGINX_PORT"
-
 info "Primora is starting"
-echo "  Dashboard:  $DISPLAY_URL"
+echo "  Dashboard:  $PUBLIC_URL"
-echo "  Health:     $DISPLAY_URL/api/v1/health/liveness"
+echo "  Health:     $PUBLIC_URL/api/v1/health/liveness"
 echo "  Logs:       cd $DIR && docker compose logs -f"
 echo "  Stop:       cd $DIR && docker compose down"
+if [[ "$PUBLIC_URL" == https://* ]]; then
+  echo
+  echo "  Primora listens on http port $NGINX_PORT — point your TLS proxy there."
+fi

package.json

@@ -1,6 +1,6 @@
 {
   "name": "primora",
-  "version": "0.8.0",
+  "version": "0.8.5",
   "private": true,
   "packageManager": "[email protected]",
   "workspaces": [

scripts/setup.sh

@@ -48,15 +48,32 @@ fi
 read -p "🌐 Enter your domain or IP (default: localhost): " DOMAIN
 DOMAIN=${DOMAIN:-localhost}
 
-if [[ "$OSTYPE" == "darwin"* ]]; then
+# Plain HTTP for localhost/IPs; domains are presumed to sit behind a TLS
-    sed -i '' "s/COOKIE_DOMAIN=localhost/COOKIE_DOMAIN=$DOMAIN/g" .env
+# proxy (see DEPLOYMENT_GUIDE.md — Primora never terminates TLS itself).
-    sed -i '' "s/BETTER_AUTH_URL=http:\/\/localhost/BETTER_AUTH_URL=http:\/\/$DOMAIN/g" .env
+if [[ "$DOMAIN" == "localhost" || "$DOMAIN" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    sed -i '' "s/VITE_APP_URL=http:\/\/localhost/VITE_APP_URL=http:\/\/$DOMAIN/g" .env
+    SCHEME="http"
 else
-    sed -i "s/COOKIE_DOMAIN=localhost/COOKIE_DOMAIN=$DOMAIN/g" .env
+    SCHEME="https"
-    sed -i "s/BETTER_AUTH_URL=http:\/\/localhost/BETTER_AUTH_URL=http:\/\/$DOMAIN/g" .env
-    sed -i "s/VITE_APP_URL=http:\/\/localhost/VITE_APP_URL=http:\/\/$DOMAIN/g" .env
 fi
+BASE_URL="$SCHEME://$DOMAIN"
+
+rewrite_env() {
+    # $1 = var name, $2 = new value — anchor to the full line so prior values
+    # (ports, stale paths) are replaced regardless of what .env.example held.
+    if [[ "$OSTYPE" == "darwin"* ]]; then
+        sed -i '' "s|^$1=.*|$1=$2|" .env
+    else
+        sed -i "s|^$1=.*|$1=$2|" .env
+    fi
+}
+
+rewrite_env AUTH_BASE_URL "$BASE_URL/auth"
+rewrite_env BETTER_AUTH_URL "$BASE_URL/auth"
+rewrite_env VITE_APP_URL "$BASE_URL"
+rewrite_env VITE_AUTH_BASE_URL "$BASE_URL/auth"
+rewrite_env VITE_API_BASE_URL "$BASE_URL/api/v1"
+rewrite_env BACKEND_PUBLIC_URL "$BASE_URL/api/v1"
+rewrite_env COOKIE_DOMAIN "$DOMAIN"
 
 # Start services — the dev overlay adds mailpit for local email capture.
 # Production deploys use the base file alone: docker compose up -d