@ai-ecoverse/slicc-spectrum 1.60.1 → 1.61.0

package/dist/types/app/approvals.d.ts

@@ -7,6 +7,8 @@ import { ModelElement } from './base.js';
 export declare function countdown(ms: number): string;
 export declare function asking(approval: Approval): string;
 export declare function sudo(approval: Approval): string;
+export declare const certain: (rules: string) => boolean;
+export declare function secretRules(approval: Approval): string | null;
 export declare function waiting(model: SliccModel | null, now: number): Approval[];
 export declare class SliccApprovals extends ModelElement {
     #private;

package/dist/types/app/secrets.d.ts

@@ -0,0 +1,63 @@
+import '@adobe/spectrum-wc/components/badge/swc-badge.js';
+import '@adobe/spectrum-wc/components/button/swc-button.js';
+import '@adobe/spectrum-wc/components/status-light/swc-status-light.js';
+import '@adobe/spectrum-wc-icons/swc-icon-alert-triangle.js';
+import { nothing, type PropertyValues, type TemplateResult } from 'lit';
+import type { AuditEntry, LinkedDevice, PolicyNotice, SecretView, SliccModel, VaultPort } from '../model/types.js';
+import { ThemedElement } from './base.js';
+import { type PopupDetail } from './vault.js';
+export declare function until(at: number, now?: number): string;
+export declare function who(entry: {
+    uid: number | null;
+    tag: string | null;
+}): string;
+export declare function sourceLine(secret: SecretView, devices: readonly LinkedDevice[]): string;
+export declare function revealed(name: string, entries: readonly AuditEntry[], now?: number, more?: boolean): TemplateResult | null;
+export declare function auditLine(entry: AuditEntry, devices: readonly LinkedDevice[]): TemplateResult;
+export declare function merged(...pages: ReadonlyArray<readonly AuditEntry[]>): AuditEntry[];
+export declare function prompt(text: string): string;
+export declare class SliccSecrets extends ThemedElement {
+    #private;
+    static properties: {
+        model: {
+            attribute: boolean;
+        };
+        older: {
+            state: boolean;
+        };
+        more: {
+            state: boolean;
+        };
+        loading: {
+            state: boolean;
+        };
+        reveals: {
+            state: boolean;
+        };
+        popup: {
+            state: boolean;
+        };
+        acking: {
+            state: boolean;
+        };
+        failure: {
+            state: boolean;
+        };
+    };
+    older: readonly AuditEntry[];
+    more: boolean | null;
+    loading: boolean;
+    reveals: boolean;
+    popup: PopupDetail | null;
+    acking: ReadonlySet<string>;
+    failure: string | null;
+    constructor();
+    static styles: import("lit").CSSResult;
+    disconnectedCallback(): void;
+    protected willUpdate(changed: PropertyValues): void;
+    protected updated(): void;
+    protected subscribe(model: SliccModel): Array<() => void>;
+    showOlder(vault: VaultPort, entries: readonly AuditEntry[]): Promise<void>;
+    acknowledge(vault: VaultPort, notice: PolicyNotice): Promise<void>;
+    render(): TemplateResult | typeof nothing;
+}

package/dist/types/app/vault.d.ts

@@ -0,0 +1,36 @@
+import { LitElement, type PropertyValues } from 'lit';
+import type { ButtonConfig, ExecGrant, ExitName, LinkedDevice, PopupIntent, PopupResult, PopupState, Rule, SliccModel, VaultPort, Widening } from '../model/types.js';
+export declare function devicesOf(model: SliccModel | null): readonly LinkedDevice[];
+export declare function deviceName(id: string, devices: readonly LinkedDevice[]): string;
+export declare function exitLabel(exit: ExitName, devices: readonly LinkedDevice[]): string;
+export declare function list(items: readonly string[]): string;
+export declare function ruleLine(rule: Rule): string;
+export declare function shellWord(word: string): string;
+export declare function execLine(grant: ExecGrant): string;
+export declare function widening(change: Widening, devices: readonly LinkedDevice[]): string;
+export declare function tabbables(root: ParentNode, stop: Element, out?: Array<HTMLElement | null>): Array<HTMLElement | null>;
+export declare function sequential(order: Array<HTMLElement | null>): Array<HTMLElement | null>;
+export interface PopupDetail {
+    intent: PopupIntent;
+    state: PopupState;
+    result?: PopupResult;
+}
+export declare class SliccVaultButton extends LitElement {
+    #private;
+    static properties: {
+        vault: {
+            attribute: boolean;
+        };
+        config: {
+            attribute: boolean;
+        };
+    };
+    vault: VaultPort | null | undefined;
+    config: ButtonConfig | null;
+    static styles: import("lit").CSSResult;
+    constructor();
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    focus(): void;
+    protected updated(changed: PropertyValues): void;
+}

package/dist/types/dummy/approvals.d.ts

@@ -1,7 +1,7 @@
 import { Emitter } from '../model/emitter.js';
 import type { Approval, ApprovalDecision, ApprovalEnd, ApprovalsEvents, ApprovalsPort } from '../model/types.js';
 import type { Clock } from './clock.js';
-export type ApprovalScenario = 'agent' | 'user' | 'many' | 'follower' | 'fail' | 'soon' | 'elsewhere' | 'withdrawn';
+export type ApprovalScenario = 'agent' | 'user' | 'many' | 'follower' | 'fail' | 'soon' | 'elsewhere' | 'withdrawn' | 'secrets';
 export declare function approvalFixtures(scenario: ApprovalScenario, now?: number): Approval[];
 export declare class DummyApprovals extends Emitter<ApprovalsEvents> implements ApprovalsPort {
     #private;

package/dist/types/dummy/index.d.ts

@@ -8,6 +8,7 @@ import { DummyNetwork, type LinksScenario, type NetworkScenario, type TailnetSce
 import { DummyNotices, type NoticeScenario } from './notices.js';
 import { DummyTabs, type TabsScenario } from './tabs.js';
 import { DummyUpdates, type PackageConfirm, type PackageScenario, type UpdateScenario } from './updates.js';
+import { DummyVault, type VaultScenario } from './vault.js';
 export interface DummyOptions {
     delay?: number;
     storage?: Storage | null;
@@ -23,6 +24,7 @@ export interface DummyOptions {
     tabs?: TabsScenario | 'off';
     approvals?: ApprovalScenario | 'off';
     follow?: FollowScenario | 'off';
+    vault?: VaultScenario | 'off';
     browser?: BrowserScenario;
     sprinkles?: 'builtin' | 'cones';
     monitor?: 'dummy' | 'agent';
@@ -35,5 +37,6 @@ export interface DummyModel extends SliccModel {
     tabs?: DummyTabs;
     approvals?: DummyApprovals;
     follow?: DummyFollow;
+    vault?: DummyVault;
 }
-export declare function createDummyModel({ delay, storage, updates, packages, confirm, mounts, network, tailnet, links, changes, notices, tabs, approvals, follow, browser: scenario, sprinkles, monitor, }?: DummyOptions): DummyModel;
+export declare function createDummyModel({ delay, storage, updates, packages, confirm, mounts, network, tailnet, links, changes, notices, tabs, approvals, follow, vault, browser: scenario, sprinkles, monitor, }?: DummyOptions): DummyModel;

package/dist/types/dummy/vault.d.ts

@@ -0,0 +1,42 @@
+import { Emitter } from '../model/emitter.js';
+import type { AuditEntry, AuditPage, ButtonConfig, ButtonEvent, ButtonMessage, PolicyNotice, SecretView, VaultButton, VaultEvents, VaultList, VaultPort, VaultStatus } from '../model/types.js';
+import type { Clock } from './clock.js';
+export type VaultScenario = 'empty' | 'secrets' | 'notice' | 'locked';
+export declare function vaultSecrets(now?: number): SecretView[];
+export declare function vaultAudit(now?: number): AuditEntry[];
+export declare function vaultOlder(now?: number): AuditEntry[];
+export declare function vaultNotice(now?: number): PolicyNotice;
+export declare function vaultFixtures(scenario: VaultScenario, now?: number): {
+    status: VaultStatus;
+    list: VaultList;
+};
+export declare class DummyVaultButton implements VaultButton {
+    #private;
+    element: HTMLElement;
+    config: ButtonConfig | null;
+    constructor(vault: DummyVault, time: Clock);
+    post(message: ButtonMessage): void;
+    listen(listener: (event: ButtonEvent) => void): () => void;
+}
+export declare class DummyVault extends Emitter<VaultEvents> implements VaultPort {
+    #private;
+    buttons: DummyVaultButton[];
+    acknowledged: string[];
+    constructor(scenario: VaultScenario, time: Clock);
+    status(): VaultStatus;
+    list(): VaultList;
+    audit(before?: number, limit?: number): Promise<AuditPage>;
+    acknowledge(notice: string): Promise<void>;
+    button(): DummyVaultButton;
+    autoLabel(): string;
+    autoIntent(): {
+        kind: 'unlock';
+    } | {
+        kind: 'manage';
+    };
+    answer(intent: Exclude<ButtonConfig['intent'], 'auto'>): Promise<{
+        name: string;
+        placeholder: string;
+        state: 'active';
+    } | null>;
+}

package/dist/types/dummy.d.ts

@@ -17,3 +17,5 @@ export type { TabsScenario } from './dummy/tabs.js';
 export { DummyTabs, tabsFixtures } from './dummy/tabs.js';
 export type { DummyUpdatesOptions, PackageConfirm, PackageScenario, UpdateScenario, } from './dummy/updates.js';
 export { DummyUpdates, packageFixtures, updateFixtures } from './dummy/updates.js';
+export type { VaultScenario } from './dummy/vault.js';
+export { DummyVault, DummyVaultButton, vaultAudit, vaultFixtures, vaultNotice, vaultOlder, vaultSecrets, } from './dummy/vault.js';

package/dist/types/model/types.d.ts

@@ -806,6 +806,246 @@ export interface FollowPort extends Subscribable<{
     leave(): Promise<void>;
     retry?(): Promise<void>;
 }
+export type DeviceId = string;
+export type RecordKind = 'secret' | 'grant' | 'model' | 'mcp';
+export type RecordState = 'active' | 'inert' | 'removed';
+export type RecordSource = 'popup' | 'process' | `jerk:${string}@${DeviceId}` | `oauth:${string}` | `import:${string}`;
+export type LockMode = 'auto' | 'passkey' | 'passphrase';
+export type RequestKind = 'value' | 'oauth' | 'jerk-seal';
+export type ExitName = 'vault-direct' | 'local-proxy' | 'cli-v' | 'tailscale' | 'local-link' | `device:${DeviceId}`;
+export type ExecGrant = boolean | {
+    argv: string[][];
+};
+export interface Rule {
+    domain: string;
+    header: string;
+    methods: string[];
+    paths: string[];
+}
+export interface SecretView {
+    name: string;
+    kind: RecordKind;
+    placeholder: string;
+    state: RecordState;
+    source: RecordSource;
+    sourceDevice: DeviceId | null;
+    provider?: string;
+    account?: string;
+    domains: string[];
+    rules: Rule[];
+    exits: ExitName[];
+    exec: ExecGrant;
+    createdAt: number;
+    usedAt?: number;
+    expiresAt?: number;
+    removedAt?: number;
+}
+export interface PendingRequest {
+    id: string;
+    kind: RequestKind;
+    name?: string;
+    provider?: string;
+    prompt?: string;
+    uid: number;
+    tag: string | null;
+    createdAt: number;
+    expiresAt: number;
+}
+export interface VaultStatus {
+    version: string;
+    protocol: 1;
+    origin: string;
+    locked: boolean;
+    lock: LockMode;
+    waiting: PendingRequest[];
+    notices: number;
+}
+export type Widening = {
+    kind: 'rule';
+    secret: string;
+    rule: Rule;
+} | {
+    kind: 'methods';
+    secret: string;
+    domain: string;
+    methods: string[];
+} | {
+    kind: 'paths';
+    secret: string;
+    domain: string;
+    paths: string[];
+} | {
+    kind: 'exec';
+    secret: string;
+    grant: ExecGrant;
+} | {
+    kind: 'exit';
+    secret: string;
+    exit: ExitName;
+} | {
+    kind: 'limits';
+    field: string;
+    from: number;
+    to: number;
+};
+export type PolicyFile = '/etc/fnox/config.toml' | '/etc/slicc/secrets-policy.toml';
+export interface PolicyNotice {
+    id: string;
+    at: number;
+    file: PolicyFile;
+    sha256: string;
+    widened: Widening[];
+    acknowledged: boolean;
+}
+interface AuditBase {
+    seq: number;
+    id: string;
+    at: number;
+    name: string;
+    uid: number | null;
+    tag: string | null;
+}
+export interface InjectionEntry extends AuditBase {
+    type: 'inject' | 'forward';
+    domain: string;
+    method: string;
+    path: string;
+    rule: Rule;
+    exit: ExitName;
+}
+export interface RevealEntry extends AuditBase {
+    type: 'materialize';
+    grant: ExecGrant;
+    path: string;
+    argv: string;
+    argvSha256: string;
+    cwd: string;
+    pid: number;
+    ppid: number;
+    ticket: string;
+    consumed: boolean;
+}
+export interface SealEntry extends AuditBase {
+    type: 'seal';
+    source: RecordSource;
+    rotated: boolean;
+}
+export interface RemoveEntry extends AuditBase {
+    type: 'remove' | 'restore';
+}
+export interface PolicyEntry {
+    type: 'policy';
+    seq: number;
+    id: string;
+    at: number;
+    file: PolicyFile;
+    sha256: string;
+    accepted: boolean;
+    widened: Widening[];
+    warning?: string;
+}
+export type AuditEntry = InjectionEntry | RevealEntry | SealEntry | RemoveEntry | PolicyEntry;
+export interface AuditPage {
+    audit: AuditEntry[];
+    more: boolean;
+    next?: number;
+}
+export interface VaultList {
+    secrets: SecretView[];
+    notices: PolicyNotice[];
+    audit: AuditEntry[];
+    auditMore: boolean;
+}
+export type PopupIntent = {
+    kind: 'unlock';
+} | {
+    kind: 'enter';
+    name: string;
+    request?: string;
+} | {
+    kind: 'request';
+    request: string;
+} | {
+    kind: 'import';
+    format?: 'bundle' | 'keepass' | 'six';
+} | {
+    kind: 'export';
+} | {
+    kind: 'signin';
+    provider: string;
+    request?: string;
+} | {
+    kind: 'manage';
+    name?: string;
+};
+export type PopupState = 'opened' | 'done' | 'cancelled' | 'closed' | 'blocked';
+export interface PopupResult {
+    name: string;
+    placeholder: string;
+    state: RecordState;
+}
+export interface ButtonConfig {
+    intent: PopupIntent | 'auto';
+    label?: string;
+    size?: 's' | 'm' | 'l';
+    variant?: 'accent' | 'primary' | 'secondary';
+    treatment?: 'fill' | 'outline';
+    quiet?: boolean;
+    scale?: 'medium' | 'large';
+    theme?: 'light' | 'dark';
+    dir?: 'ltr' | 'rtl';
+    lang?: string;
+    disabled?: boolean;
+}
+export type ButtonMessage = {
+    type: 'slicc-vault';
+    v: 1;
+    op: 'button';
+    button: ButtonConfig;
+} | {
+    type: 'slicc-vault';
+    v: 1;
+    op: 'focus';
+};
+export type ButtonEvent = {
+    type: 'slicc-vault';
+    v: 1;
+} & ({
+    event: 'ready';
+} | {
+    event: 'size';
+    width: number;
+    height: number;
+    inset: number;
+} | {
+    event: 'label';
+    label: string;
+} | {
+    event: 'focus';
+    direction: 'next' | 'previous';
+} | {
+    event: 'popup';
+    intent: PopupIntent;
+    state: PopupState;
+    result?: PopupResult;
+});
+export interface VaultButton {
+    element: HTMLElement;
+    post(message: ButtonMessage): void;
+    listen(listener: (event: ButtonEvent) => void): () => void;
+}
+export interface VaultEvents {
+    status: VaultStatus;
+    list: VaultList;
+    notice: PolicyNotice;
+}
+export interface VaultPort extends Subscribable<VaultEvents> {
+    status(): VaultStatus | null;
+    list(): VaultList | null;
+    audit(before?: number, limit?: number): Promise<AuditPage>;
+    acknowledge(notice: string): Promise<void>;
+    button(): VaultButton;
+}
 export interface SliccModel {
     agent: AgentPort;
     files: FilePort;
@@ -823,4 +1063,6 @@ export interface SliccModel {
     tabs?: TabsPort;
     approvals?: ApprovalsPort;
     follow?: FollowPort;
+    vault?: VaultPort;
 }
+export {};

package/dist/types/ui.d.ts

@@ -11,7 +11,9 @@ import { SliccFiles, SliccFileView } from './app/files.js';
 import { SliccFollow } from './app/follow.js';
 import { SliccNetwork } from './app/network.js';
 import { SliccNotices } from './app/notices.js';
+import { SliccSecrets } from './app/secrets.js';
 import { SliccUpdates } from './app/updates.js';
+import { SliccVaultButton } from './app/vault.js';
 import { SliccCodeView, SliccDiffView } from './components/code-view.js';
 import { SliccDock } from './components/dock.js';
 import { SliccFileTree } from './components/file-tree.js';
@@ -31,5 +33,5 @@ export type { GitStatusEntry } from './components/file-tree.js';
 export type { Listener, Subscribable } from './model/emitter.js';
 export { Emitter } from './model/emitter.js';
 export type * from './model/types.js';
-export { SliccAgents, SliccApp, SliccApprovals, SliccBrowser, SliccChanges, SliccChat, SliccCodeView, SliccComposer, SliccConfirm, SliccDiffPanel, SliccDiffView, SliccDock, SliccFiles, SliccFileTree, SliccFileView, SliccFollow, SliccNetwork, SliccNotices, SliccPrompt, SliccUpdates, };
+export { SliccAgents, SliccApp, SliccApprovals, SliccBrowser, SliccChanges, SliccChat, SliccCodeView, SliccComposer, SliccConfirm, SliccDiffPanel, SliccDiffView, SliccDock, SliccFiles, SliccFileTree, SliccFileView, SliccFollow, SliccNetwork, SliccNotices, SliccPrompt, SliccSecrets, SliccUpdates, SliccVaultButton, };
 export declare function define(): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-spectrum",
-  "version": "1.60.1",
+  "version": "1.61.0",
   "description": "Web components for SLICC on Spectrum Web Components: the terminal, the app shell and its surfaces",
   "type": "module",
   "license": "Apache-2.0",
@@ -72,14 +72,14 @@
   "devDependencies": {
     "@adobe/spectrum-wc": "2.0.0-beta.4",
     "@adobe/spectrum-wc-icons": "2.0.0-beta.4",
-    "@ai-ecoverse/slicc-kernel": "1.64.0",
+    "@ai-ecoverse/slicc-kernel": "1.65.0",
     "@ai-ecoverse/slicc-shared-web": "1.13.0",
     "@ai-ecoverse/wasm-bash": "5.3.0-17",
     "@ai-ecoverse/wasm-coreutils": "9.7.0-3",
     "@biomejs/biome": "2.5.15",
     "@fontsource/source-code-pro": "5.3.0",
     "@happy-dom/global-registrator": "20.14.5",
-    "@pierre/diffs": "1.5.1",
+    "@pierre/diffs": "1.5.2",
     "@pierre/trees": "1.0.0-beta.6",
     "@spectrum-web-components/action-button": "1.12.4",
     "@spectrum-web-components/action-group": "1.12.4",