@ai-ecoverse/slicc-spectrum 1.60.2 → 1.62.0

package/dist/slicc-dummy.js

@@ -39,6 +39,19 @@ function approvalFixtures(scenario, now2 = Date.now()) {
     expiresAt: now2 + 5 * minutes,
     always: false
   };
+  if (scenario === "secrets")
+    return [
+      {
+        id: "sudo-rules",
+        kind: "sudo",
+        requester: { kind: "agent", name: "docs-pass", agentId: "scoop-docs" },
+        command: "cp fnox.toml /etc/fnox/config.toml",
+        cwd: "/home/cone/harbor",
+        createdAt: now2,
+        expiresAt: now2 + 5 * minutes,
+        always: true
+      }
+    ];
   if (scenario === "user") return [user];
   if (scenario === "many") return [agent, user, cache];
   if (scenario === "elsewhere" || scenario === "withdrawn") return [agent, user];
@@ -100,7 +113,7 @@ function titleFor(url) {
 var second = 1e3;
 function browserHistory(scenario, now2 = Date.now()) {
   if (scenario === "off") return [];
-  const harbor = { tabId: "tab-preview", agentId: "cone-harbor" };
+  const harbor2 = { tabId: "tab-preview", agentId: "cone-harbor" };
   const otter = { tabId: "tab-pull", agentId: "scoop-otter" };
   return [
     {
@@ -112,13 +125,13 @@ function browserHistory(scenario, now2 = Date.now()) {
     { ...otter, kind: "snapshot", at: now2 - 296 * second },
     { ...otter, kind: "scroll", at: now2 - 290 * second },
     { ...otter, kind: "screenshot", at: now2 - 288 * second },
-    { ...harbor, kind: "open", value: "http://localhost:8787/", at: now2 - 120 * second },
-    { ...harbor, kind: "snapshot", at: now2 - 116 * second },
-    { ...harbor, kind: "type", target: 'textbox "City"', length: 6, at: now2 - 110 * second },
-    { ...harbor, kind: "click", target: 'button "Show forecast"', at: now2 - 106 * second },
-    { ...harbor, kind: "snapshot", at: now2 - 100 * second },
+    { ...harbor2, kind: "open", value: "http://localhost:8787/", at: now2 - 120 * second },
+    { ...harbor2, kind: "snapshot", at: now2 - 116 * second },
+    { ...harbor2, kind: "type", target: 'textbox "City"', length: 6, at: now2 - 110 * second },
+    { ...harbor2, kind: "click", target: 'button "Show forecast"', at: now2 - 106 * second },
+    { ...harbor2, kind: "snapshot", at: now2 - 100 * second },
     {
-      ...harbor,
+      ...harbor2,
       kind: "click",
       target: 'link "Tomorrow"',
       status: "failed",
@@ -132,8 +145,8 @@ function browserHistory(scenario, now2 = Date.now()) {
       value: "GET https://api.example.com/v2/tides",
       at: now2 - 80 * second
     },
-    { ...harbor, kind: "eval", at: now2 - 70 * second },
-    { ...harbor, kind: "press", value: "End", at: now2 - 64 * second }
+    { ...harbor2, kind: "eval", at: now2 - 70 * second },
+    { ...harbor2, kind: "press", value: "End", at: now2 - 64 * second }
   ];
 }
 var drive = [
@@ -591,6 +604,7 @@ var DummyAgent = class extends Emitter {
   #messages = /* @__PURE__ */ new Map();
   #queues = /* @__PURE__ */ new Map();
   #frozen = [];
+  #hold = null;
   #ice = /* @__PURE__ */ new Map();
   #suggestions = /* @__PURE__ */ new Map();
   #runs = /* @__PURE__ */ new Map();
@@ -1021,6 +1035,13 @@ var DummyAgent = class extends Emitter {
       ...body ? { body } : {}
     });
   }
+  hold() {
+    return this.#hold && { ...this.#hold };
+  }
+  setHold(hold) {
+    this.#hold = hold && { ...hold };
+    this.emit("hold", this.hold());
+  }
   frozen() {
     const live = this.#agents.filter((agent) => !agent.frozen).map((agent) => {
       const messages = this.#messages.get(agent.id);
@@ -5441,6 +5462,411 @@ Done in 3.8s`
   }
 };
 
+// src/dummy/vault.ts
+var minute2 = 6e4;
+var hour = 60 * minute2;
+var day2 = 24 * hour;
+var harbor = { domain: "api.harbor.example", header: "Authorization", methods: [], paths: [] };
+var pier = {
+  domain: "packages.pier.example",
+  header: "Authorization",
+  methods: ["PUT"],
+  paths: ["/-/package/*"]
+};
+function vaultSecrets(now2 = Date.now()) {
+  return [
+    {
+      name: "HARBOR_API_KEY",
+      kind: "secret",
+      placeholder: "fnox_proxy_harbor01",
+      state: "active",
+      source: "popup",
+      sourceDevice: null,
+      domains: ["api.harbor.example"],
+      rules: [harbor],
+      exits: ["vault-direct", "local-proxy", "tailscale", "device:link-pier"],
+      exec: false,
+      createdAt: now2 - 12 * day2,
+      usedAt: now2 - 4 * minute2
+    },
+    {
+      name: "PIER_PUBLISH_TOKEN",
+      kind: "secret",
+      placeholder: "fnox_proxy_pier0002",
+      state: "active",
+      source: "jerk:cone@link-pier",
+      sourceDevice: "link-pier",
+      domains: ["packages.pier.example"],
+      rules: [pier],
+      exits: ["local-proxy"],
+      exec: { argv: [["pier", "publish"]] },
+      createdAt: now2 - 3 * day2,
+      usedAt: now2 - 2 * hour,
+      expiresAt: now2 + 3 * day2
+    },
+    {
+      name: "TIDE_MAIL",
+      kind: "grant",
+      placeholder: "fnox_proxy_tide0003",
+      state: "active",
+      source: "oauth:tide-mail",
+      sourceDevice: null,
+      provider: "Tide Mail",
+      account: "cone@tide.example",
+      domains: ["mail.tide.example"],
+      rules: [
+        {
+          domain: "mail.tide.example",
+          header: "Authorization",
+          methods: ["GET", "POST"],
+          paths: ["/v1/messages/*"]
+        },
+        {
+          domain: "files.tide.example",
+          header: "Authorization",
+          methods: ["GET"],
+          paths: ["/v1/attachments/*"]
+        }
+      ],
+      exits: ["vault-direct"],
+      exec: false,
+      createdAt: now2 - 20 * day2,
+      expiresAt: now2 + 50 * minute2
+    },
+    {
+      name: "REEF_DEPLOY_KEY",
+      kind: "secret",
+      placeholder: "fnox_proxy_reef0004",
+      state: "inert",
+      source: "process",
+      sourceDevice: null,
+      domains: [],
+      rules: [],
+      exits: ["vault-direct", "local-proxy", "cli-v"],
+      exec: true,
+      createdAt: now2 - 2 * hour
+    },
+    {
+      name: "BUOY_OLD_TOKEN",
+      kind: "secret",
+      placeholder: "fnox_proxy_buoy0005",
+      state: "removed",
+      source: "import:six",
+      sourceDevice: null,
+      domains: ["buoy.example"],
+      rules: [{ domain: "buoy.example", header: "X-Buoy-Key", methods: ["GET"], paths: [] }],
+      exits: ["vault-direct"],
+      exec: false,
+      createdAt: now2 - 40 * day2,
+      removedAt: now2 - day2
+    }
+  ];
+}
+function vaultAudit(now2 = Date.now()) {
+  const who = { uid: 1e3, tag: "cone" };
+  return [
+    {
+      ...who,
+      type: "inject",
+      seq: 12,
+      id: "audit-12",
+      at: now2 - 4 * minute2,
+      name: "HARBOR_API_KEY",
+      domain: "api.harbor.example",
+      method: "GET",
+      path: "/v2/ships",
+      rule: harbor,
+      exit: "local-proxy"
+    },
+    {
+      ...who,
+      type: "materialize",
+      seq: 11,
+      id: "audit-11",
+      at: now2 - 2 * hour,
+      name: "PIER_PUBLISH_TOKEN",
+      grant: { argv: [["pier", "publish"]] },
+      path: "/usr/bin/pier",
+      argv: "pier publish --tag next",
+      argvSha256: "b1946ac92492d2347c6235b4d2611184",
+      cwd: "/home/cone/harbor",
+      pid: 4211,
+      ppid: 4100,
+      ticket: "ticket-11",
+      consumed: true
+    },
+    {
+      type: "materialize",
+      seq: 10,
+      id: "audit-10",
+      at: now2 - 3 * hour,
+      name: "PIER_PUBLISH_TOKEN",
+      uid: 1001,
+      tag: "docs-pass",
+      grant: { argv: [["pier", "publish"]] },
+      path: "/usr/bin/pier",
+      argv: "pier publish --dry-run",
+      argvSha256: "591785b794601e212b260e25925636fd",
+      cwd: "/home/cone/harbor/docs",
+      pid: 3980,
+      ppid: 3901,
+      ticket: "ticket-10",
+      consumed: true
+    },
+    {
+      ...who,
+      type: "forward",
+      seq: 9,
+      id: "audit-9",
+      at: now2 - 6 * hour,
+      name: "HARBOR_API_KEY",
+      domain: "api.harbor.example",
+      method: "POST",
+      path: "/v2/ships/quay/berths",
+      rule: harbor,
+      exit: "device:link-pier"
+    },
+    {
+      type: "policy",
+      seq: 8,
+      id: "audit-8",
+      at: now2 - day2,
+      file: "/etc/slicc/secrets-policy.toml",
+      sha256: "4e07408562bedb8b60ce05c1decfe3ad",
+      accepted: true,
+      widened: [{ kind: "exit", secret: "HARBOR_API_KEY", exit: "tailscale" }]
+    },
+    {
+      ...who,
+      type: "remove",
+      seq: 7,
+      id: "audit-7",
+      at: now2 - day2 - hour,
+      name: "BUOY_OLD_TOKEN"
+    },
+    {
+      ...who,
+      type: "seal",
+      seq: 6,
+      id: "audit-6",
+      at: now2 - 3 * day2,
+      name: "PIER_PUBLISH_TOKEN",
+      source: "jerk:cone@link-pier",
+      rotated: false
+    }
+  ];
+}
+function vaultOlder(now2 = Date.now()) {
+  return [
+    {
+      type: "materialize",
+      seq: 5,
+      id: "audit-5",
+      at: now2 - 4 * day2,
+      name: "PIER_PUBLISH_TOKEN",
+      uid: 1e3,
+      tag: null,
+      grant: { argv: [["pier", "publish"]] },
+      path: "/usr/bin/pier",
+      argv: "pier publish",
+      argvSha256: "2c26b46b68ffc68ff99b453c1d304134",
+      cwd: "/home/cone/harbor",
+      pid: 2210,
+      ppid: 2200,
+      ticket: "ticket-5",
+      consumed: true
+    },
+    {
+      type: "policy",
+      seq: 4,
+      id: "audit-4",
+      at: now2 - 5 * day2,
+      file: "/etc/fnox/config.toml",
+      sha256: "8f14e45fceea167a5a36dedd4bea2543",
+      accepted: false,
+      widened: [],
+      warning: "The file did not parse, so the vault kept the last good rules."
+    },
+    {
+      type: "restore",
+      seq: 3,
+      id: "audit-3",
+      at: now2 - 6 * day2,
+      name: "TIDE_MAIL",
+      uid: 0,
+      tag: null
+    }
+  ];
+}
+function vaultNotice(now2 = Date.now()) {
+  return {
+    id: "notice-widened",
+    at: now2 - 20 * minute2,
+    file: "/etc/slicc/secrets-policy.toml",
+    sha256: "c9f0f895fb98ab9159f51fd0297e236d",
+    acknowledged: false,
+    widened: [
+      { kind: "exit", secret: "HARBOR_API_KEY", exit: "device:link-quay" },
+      {
+        kind: "methods",
+        secret: "PIER_PUBLISH_TOKEN",
+        domain: "packages.pier.example",
+        methods: ["PUT", "DELETE"]
+      }
+    ]
+  };
+}
+function vaultFixtures(scenario, now2 = Date.now()) {
+  const empty = scenario === "empty";
+  const notices = scenario === "notice" ? [vaultNotice(now2)] : [];
+  const status = {
+    version: "0.1.0",
+    protocol: 1,
+    origin: "https://vault.sliccy.ai",
+    locked: scenario === "locked",
+    lock: "passkey",
+    waiting: scenario === "locked" ? [
+      {
+        id: "request-reef",
+        kind: "value",
+        name: "REEF_DEPLOY_KEY",
+        prompt: "Needed to deploy the reef preview. It is the deploy key from the reef dashboard, under Settings > Keys.",
+        uid: 1001,
+        tag: "docs-pass",
+        createdAt: now2 - minute2,
+        expiresAt: now2 + 4 * minute2
+      }
+    ] : [],
+    notices: notices.length
+  };
+  const list = {
+    secrets: empty ? [] : vaultSecrets(now2),
+    notices,
+    audit: empty ? [] : vaultAudit(now2),
+    auditMore: !empty
+  };
+  return { status, list };
+}
+var labels = {
+  unlock: "Unlock the vault",
+  enter: "Enter the value",
+  request: "Answer in the vault",
+  import: "Import",
+  export: "Export",
+  signin: "Sign in",
+  manage: "Open the vault"
+};
+var DummyVaultButton = class {
+  element;
+  config = null;
+  #listeners = /* @__PURE__ */ new Set();
+  #vault;
+  #button;
+  constructor(vault, time) {
+    this.#vault = vault;
+    this.element = document.createElement("span");
+    this.element.dataset.vaultButton = "";
+    this.#button = document.createElement("swc-button");
+    this.element.append(this.#button);
+    this.#button.addEventListener("click", () => void this.#click());
+    void time.sleep(0).then(() => this.#emit({ event: "ready" }));
+  }
+  post(message) {
+    if (message.op === "focus") {
+      this.#button.focus();
+      return;
+    }
+    this.config = message.button;
+    const { intent, label, size = "m", variant = "secondary", treatment = "fill" } = message.button;
+    this.#button.textContent = label ?? (intent === "auto" ? this.#vault.autoLabel() : labels[intent.kind]);
+    this.#button.setAttribute("size", size);
+    this.#button.setAttribute("variant", variant);
+    this.#button.setAttribute("fill-style", treatment);
+    this.#button.toggleAttribute("disabled", !!message.button.disabled);
+  }
+  listen(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  #emit(event) {
+    const message = { type: "slicc-vault", v: 1, ...event };
+    for (const listener of [...this.#listeners]) listener(message);
+  }
+  async #click() {
+    const intent = this.config?.intent ?? "auto";
+    const resolved = intent === "auto" ? this.#vault.autoIntent() : intent;
+    this.#emit({ event: "popup", intent: resolved, state: "opened" });
+    const result = await this.#vault.answer(resolved);
+    this.#emit({ event: "popup", intent: resolved, state: "done", ...result ? { result } : {} });
+  }
+};
+var DummyVault = class extends Emitter {
+  #status;
+  #list;
+  #time;
+  buttons = [];
+  acknowledged = [];
+  constructor(scenario, time) {
+    super();
+    const { status, list } = vaultFixtures(scenario);
+    this.#status = status;
+    this.#list = list;
+    this.#time = time;
+  }
+  status() {
+    return this.#status;
+  }
+  list() {
+    return this.#list;
+  }
+  async audit(before, limit = 50) {
+    await this.#time.sleep(5);
+    const all = [...this.#list.audit, ...vaultOlder()];
+    const page2 = all.filter((entry) => before === void 0 || entry.seq < before).slice(0, limit);
+    const more = page2.length > 0 && all.some((entry) => entry.seq < page2[page2.length - 1].seq);
+    return { audit: page2, more, ...more ? { next: page2[page2.length - 1].seq } : {} };
+  }
+  async acknowledge(notice) {
+    await this.#time.sleep(5);
+    this.acknowledged.push(notice);
+    const notices = this.#list.notices.filter((item) => item.id !== notice);
+    this.#list = { ...this.#list, notices };
+    this.#status = { ...this.#status, notices: notices.length };
+    this.emit("list", this.#list);
+    this.emit("status", this.#status);
+  }
+  button() {
+    const button = new DummyVaultButton(this, this.#time);
+    this.buttons.push(button);
+    return button;
+  }
+  autoLabel() {
+    return this.#status.locked ? "Vault locked" : "Vault unlocked";
+  }
+  autoIntent() {
+    return this.#status.locked ? { kind: "unlock" } : { kind: "manage" };
+  }
+  async answer(intent) {
+    await this.#time.sleep(10);
+    if (intent.kind === "unlock") {
+      this.#status = { ...this.#status, locked: false };
+      this.emit("status", this.#status);
+      return null;
+    }
+    if (intent.kind !== "request" && intent.kind !== "enter") return null;
+    const request = this.#status.waiting.find((item) => item.id === intent.request);
+    const name2 = intent.kind === "enter" ? intent.name : request?.name ?? "NEW_SECRET";
+    this.#status = {
+      ...this.#status,
+      locked: false,
+      waiting: this.#status.waiting.filter((item) => item !== request)
+    };
+    this.emit("status", this.#status);
+    const record = this.#list.secrets.find((secret) => secret.name === name2);
+    return { name: name2, placeholder: record?.placeholder ?? "fnox_proxy_new00001", state: "active" };
+  }
+};
+
 // src/dummy/index.ts
 function createDummyModel({
   delay = 30,
@@ -5457,6 +5883,8 @@ function createDummyModel({
   tabs: tabs2 = "off",
   approvals = "off",
   follow = "off",
+  vault = "off",
+  hold = "off",
   browser: scenario = "idle",
   sprinkles: sprinkles2 = "builtin",
   monitor = "dummy"
@@ -5482,6 +5910,7 @@ function createDummyModel({
     stop(agentId);
     browser.release(agentId);
   };
+  if (hold !== "off") agent.setHold({ reason: hold, held: 2 });
   if (scenario === "driving") void browser.run(drive);
   const base = {
     agent,
@@ -5515,8 +5944,12 @@ function createDummyModel({
     ...notices === "off" ? {} : { notices: new DummyNotices(notices, time) },
     ...tabs2 === "off" ? {} : { tabs: new DummyTabs(tabs2, time) },
     ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time) },
-    ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) }
+    ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) },
+    ...vault === "off" ? {} : { vault: new DummyVault(vault, time) }
   };
+  base.vault?.on("status", (status) => {
+    if (!status.locked && agent.hold()?.reason === "locked") agent.setHold(null);
+  });
   return {
     ...base,
     monitor: new DummyMonitor(base, monitor === "agent" ? agentSections : void 0)
@@ -5531,6 +5964,8 @@ export {
   DummyNotices,
   DummyTabs,
   DummyUpdates,
+  DummyVault,
+  DummyVaultButton,
   approvalFixtures,
   browserHistory,
   createDummyModel,
@@ -5543,6 +5978,11 @@ export {
   page,
   tabsFixtures,
   tailnetFixtures,
-  updateFixtures
+  updateFixtures,
+  vaultAudit,
+  vaultFixtures,
+  vaultNotice,
+  vaultOlder,
+  vaultSecrets
 };
 //# sourceMappingURL=slicc-dummy.js.map