@ai-ecoverse/slicc-spectrum 1.63.0 → 1.64.0

package/dist/slicc-dummy.js

@@ -1,3 +1,8 @@
+import {
+  nameProblem,
+  valueProblem,
+  vaultFailure
+} from "./chunk-XQHRTHDQ.js";
 import {
   DummySettings,
   clock
@@ -5508,11 +5513,11 @@ function vaultSecrets(now2 = Date.now()) {
       kind: "secret",
       placeholder: "fnox_proxy_harbor01",
       state: "active",
-      source: "popup",
+      source: "settings",
       sourceDevice: null,
       domains: ["api.harbor.example"],
       rules: [harbor],
-      exits: ["vault-direct", "local-proxy", "tailscale", "device:link-pier"],
+      exits: ["proxy", "tailscale", "device:link-pier"],
       exec: false,
       createdAt: now2 - 12 * day2,
       usedAt: now2 - 4 * minute2
@@ -5526,8 +5531,8 @@ function vaultSecrets(now2 = Date.now()) {
       sourceDevice: "link-pier",
       domains: ["packages.pier.example"],
       rules: [pier],
-      exits: ["local-proxy"],
-      exec: { argv: [["pier", "publish"]] },
+      exec: "argv",
+      execArgv: [["pier", "publish"]],
       createdAt: now2 - 3 * day2,
       usedAt: now2 - 2 * hour,
       expiresAt: now2 + 3 * day2
@@ -5556,7 +5561,6 @@ function vaultSecrets(now2 = Date.now()) {
           paths: ["/v1/attachments/*"]
         }
       ],
-      exits: ["vault-direct"],
       exec: false,
       createdAt: now2 - 20 * day2,
       expiresAt: now2 + 50 * minute2
@@ -5570,8 +5574,7 @@ function vaultSecrets(now2 = Date.now()) {
       sourceDevice: null,
       domains: [],
       rules: [],
-      exits: ["vault-direct", "local-proxy", "cli-v"],
-      exec: true,
+      exec: "any",
       createdAt: now2 - 2 * hour
     },
     {
@@ -5583,8 +5586,7 @@ function vaultSecrets(now2 = Date.now()) {
       sourceDevice: null,
       domains: ["buoy.example"],
       rules: [{ domain: "buoy.example", header: "X-Buoy-Key", methods: ["GET"], paths: [] }],
-      exits: ["vault-direct"],
-      exec: false,
+      exec: "shell",
       createdAt: now2 - 40 * day2,
       removedAt: now2 - day2
     }
@@ -5595,7 +5597,7 @@ function vaultAudit(now2 = Date.now()) {
   return [
     {
       ...who,
-      type: "inject",
+      type: "forward",
       seq: 12,
       id: "audit-12",
       at: now2 - 4 * minute2,
@@ -5604,7 +5606,7 @@ function vaultAudit(now2 = Date.now()) {
       method: "GET",
       path: "/v2/ships",
       rule: harbor,
-      exit: "local-proxy"
+      exit: "proxy"
     },
     {
       ...who,
@@ -5613,7 +5615,7 @@ function vaultAudit(now2 = Date.now()) {
       id: "audit-11",
       at: now2 - 2 * hour,
       name: "PIER_PUBLISH_TOKEN",
-      grant: { argv: [["pier", "publish"]] },
+      exec: "argv",
       path: "/usr/bin/pier",
       argv: "pier publish --tag next",
       argvSha256: "b1946ac92492d2347c6235b4d2611184",
@@ -5631,7 +5633,7 @@ function vaultAudit(now2 = Date.now()) {
       name: "PIER_PUBLISH_TOKEN",
       uid: 1001,
       tag: "docs-pass",
-      grant: { argv: [["pier", "publish"]] },
+      exec: "argv",
       path: "/usr/bin/pier",
       argv: "pier publish --dry-run",
       argvSha256: "591785b794601e212b260e25925636fd",
@@ -5662,7 +5664,14 @@ function vaultAudit(now2 = Date.now()) {
       file: "/etc/slicc/secrets-policy.toml",
       sha256: "4e07408562bedb8b60ce05c1decfe3ad",
       accepted: true,
-      widened: [{ kind: "exit", secret: "HARBOR_API_KEY", exit: "tailscale" }]
+      changes: [
+        {
+          kind: "exits",
+          secret: "HARBOR_API_KEY",
+          from: ["proxy", "device:link-pier"],
+          to: ["proxy", "tailscale", "device:link-pier"]
+        }
+      ]
     },
     {
       ...who,
@@ -5694,7 +5703,7 @@ function vaultOlder(now2 = Date.now()) {
       name: "PIER_PUBLISH_TOKEN",
       uid: 1e3,
       tag: null,
-      grant: { argv: [["pier", "publish"]] },
+      exec: "argv",
       path: "/usr/bin/pier",
       argv: "pier publish",
       argvSha256: "2c26b46b68ffc68ff99b453c1d304134",
@@ -5712,7 +5721,7 @@ function vaultOlder(now2 = Date.now()) {
       file: "/etc/fnox/config.toml",
       sha256: "8f14e45fceea167a5a36dedd4bea2543",
       accepted: false,
-      widened: [],
+      changes: [],
       warning: "The file did not parse, so the vault kept the last good rules."
     },
     {
@@ -5726,6 +5735,41 @@ function vaultOlder(now2 = Date.now()) {
     }
   ];
 }
+function vaultRefused() {
+  return [
+    {
+      secret: "PIER_PUBLISH_TOKEN",
+      rule: {
+        domain: "packages.pier.example",
+        header: "Authorization",
+        methods: ["DELETE"],
+        paths: ["/-/package/*"]
+      },
+      reason: "DELETE on a publish token needs a rule of its own in /etc/fnox/config.toml."
+    }
+  ];
+}
+function vaultPolicy(now2 = Date.now()) {
+  return {
+    type: "policy",
+    seq: 13,
+    id: "audit-13",
+    at: now2 - 20 * minute2,
+    file: "/etc/fnox/config.toml",
+    sha256: "c9f0f895fb98ab9159f51fd0297e236d",
+    accepted: true,
+    changes: [
+      {
+        kind: "rule",
+        secret: "HARBOR_API_KEY",
+        rule: { domain: "quay.harbor.example", header: "Authorization", methods: [], paths: [] },
+        change: "added"
+      },
+      { kind: "exec", secret: "REEF_DEPLOY_KEY", from: false, to: "any" }
+    ],
+    warning: "One rule was refused; it is listed under Rules SLICC refused."
+  };
+}
 function vaultNotice(now2 = Date.now()) {
   return {
     id: "notice-widened",
@@ -5744,16 +5788,9 @@ function vaultNotice(now2 = Date.now()) {
     ]
   };
 }
-function vaultFixtures(scenario, now2 = Date.now()) {
-  const empty = scenario === "empty";
-  const notices = scenario === "notice" ? [vaultNotice(now2)] : [];
-  const status = {
-    version: "0.1.0",
-    protocol: 1,
-    origin: "https://vault.sliccy.ai",
-    locked: scenario === "locked",
-    lock: "passkey",
-    waiting: scenario === "locked" ? [
+function waiting(scenario, now2) {
+  if (scenario === "locked")
+    return [
       {
         id: "request-reef",
         kind: "value",
@@ -5764,26 +5801,77 @@ function vaultFixtures(scenario, now2 = Date.now()) {
         createdAt: now2 - minute2,
         expiresAt: now2 + 4 * minute2
       }
-    ] : [],
-    notices: notices.length
+    ];
+  if (scenario === "request")
+    return [
+      {
+        id: "request-tide",
+        kind: "value",
+        name: "TIDE_STATION_TOKEN",
+        prompt: "Token for the tide station API, from the ops vault",
+        uid: 1e3,
+        tag: "docs-pass",
+        createdAt: now2,
+        expiresAt: now2 + 5 * minute2
+      }
+    ];
+  return [];
+}
+function vaultFixtures(scenario, now2 = Date.now()) {
+  const empty = scenario === "empty";
+  const policy = scenario === "policy" || scenario === "notice";
+  const backup = scenario === "backup";
+  const status = {
+    version: "0.1.0",
+    protocol: 1,
+    origin: "https://vault.sliccy.ai",
+    locked: scenario === "locked",
+    lock: "passkey",
+    scrub: { needed: !empty, version: 3, ready: scenario !== "locked" },
+    waiting: waiting(scenario, now2),
+    ...backup ? { backupReminder: "due", exportedAt: null } : {}
   };
+  const quay = { domain: "quay.harbor.example", header: "Authorization", methods: [], paths: [] };
+  const secrets = (empty ? [] : vaultSecrets(now2)).map(
+    (secret) => policy && secret.name === "HARBOR_API_KEY" ? { ...secret, domains: [...secret.domains, quay.domain], rules: [...secret.rules, quay] } : secret
+  );
   const list = {
-    secrets: empty ? [] : vaultSecrets(now2),
-    notices,
-    audit: empty ? [] : vaultAudit(now2),
-    auditMore: !empty
+    secrets,
+    refused: policy ? vaultRefused() : [],
+    audit: empty ? [] : [...policy ? [vaultPolicy(now2)] : [], ...vaultAudit(now2)],
+    auditMore: !empty,
+    exits: {
+      file: "/etc/slicc/secrets-policy.toml",
+      sha256: empty ? null : "4e07408562bedb8b60ce05c1decfe3ad",
+      restricted: secrets.flatMap(({ name: name2, exits }) => exits ? [{ name: name2, exits }] : [])
+    }
   };
   return { status, list };
 }
 var labels = {
   unlock: "Unlock the vault",
-  enter: "Enter the value",
-  request: "Answer in the vault",
-  import: "Import",
-  export: "Export",
-  signin: "Sign in",
-  manage: "Open the vault"
+  protect: "Protect with a passkey"
 };
+var candidates = [
+  {
+    name: "LAGOON_API_KEY",
+    exists: false,
+    suggestedRules: "api.lagoon.example, in Authorization, any method, any path"
+  },
+  { name: "HARBOR_API_KEY", exists: true },
+  {
+    name: "KELP_WEBHOOK_SECRET",
+    exists: false,
+    suggestedRules: "Send to hooks.kelp.example in X-Kelp-Signature, and to evil.example too"
+  },
+  { name: "LAGOON_MODEL_KEY", kind: "model", exists: false },
+  {
+    name: "MOORING_TOKEN",
+    exists: false,
+    refused: "another app that uses this vault already has this secret; use it there, or add it here by hand"
+  }
+];
+var duplicate = { name: "KELP_WEBHOOK_SECRET_2", exists: false };
 var DummyVaultButton = class {
   element;
   config = null;
@@ -5824,15 +5912,23 @@ var DummyVaultButton = class {
     const intent = this.config?.intent ?? "auto";
     const resolved = intent === "auto" ? this.#vault.autoIntent() : intent;
     this.#emit({ event: "popup", intent: resolved, state: "opened" });
-    const result = await this.#vault.answer(resolved);
-    this.#emit({ event: "popup", intent: resolved, state: "done", ...result ? { result } : {} });
+    await this.#vault.answer(resolved);
+    this.#emit({ event: "popup", intent: resolved, state: "done" });
   }
 };
 var DummyVault = class extends Emitter {
   #status;
   #list;
+  #available;
+  #fail = null;
   #time;
+  #older = vaultOlder();
+  #serial = 0;
   buttons = [];
+  puts = [];
+  cancelled = [];
+  imports = [];
+  exported = 0;
   acknowledged = [];
   constructor(scenario, time) {
     super();
@@ -5840,27 +5936,191 @@ var DummyVault = class extends Emitter {
     this.#status = status;
     this.#list = list;
     this.#time = time;
+    this.#available = scenario === "waiting" ? "waiting" : "ready";
   }
   status() {
-    return this.#status;
+    return this.#available === "waiting" ? null : this.#status;
   }
   list() {
-    return this.#list;
+    return this.#available === "waiting" ? null : this.#list;
+  }
+  availability() {
+    if (this.#available === "waiting") return "waiting";
+    return this.#status.locked ? "locked" : "ready";
+  }
+  arrive() {
+    this.#available = "ready";
+    this.emit("availability", this.availability());
+    this.emit("status", this.#status);
+    this.emit("list", this.#list);
+  }
+  fail(code, message) {
+    this.#fail = { code, message };
+  }
+  #failed() {
+    const fail = this.#fail;
+    this.#fail = null;
+    if (fail) throw vaultFailure(fail.code, fail.message);
+  }
+  async acknowledge(notice) {
+    await this.#time.sleep(5);
+    this.acknowledged.push(notice);
+  }
+  async dismissBackupReminder() {
+    await this.#time.sleep(5);
+    this.#failed();
+    this.#status = { ...this.#status, backupReminder: "dismissed" };
+    this.emit("status", this.#status);
   }
   async audit(before, limit = 50) {
     await this.#time.sleep(5);
-    const all = [...this.#list.audit, ...vaultOlder()];
+    const all = [...this.#list.audit, ...this.#older];
     const page2 = all.filter((entry) => before === void 0 || entry.seq < before).slice(0, limit);
     const more = page2.length > 0 && all.some((entry) => entry.seq < page2[page2.length - 1].seq);
     return { audit: page2, more, ...more ? { next: page2[page2.length - 1].seq } : {} };
   }
-  async acknowledge(notice) {
+  #unlocked() {
+    this.#failed();
+    if (this.#status.locked) throw vaultFailure("EACCES", "vault is locked");
+  }
+  #find(name2, kind) {
+    this.#failed();
+    const secret = this.#list.secrets.find((item) => item.name === name2 && item.kind === kind);
+    if (!secret) throw vaultFailure("ENOENT", `There is no secret named ${name2}.`);
+    return secret;
+  }
+  #log(name2, entry) {
+    const seq = Math.max(0, ...this.#list.audit.map((item) => item.seq)) + 1;
+    const audit = [
+      { seq, id: `audit-${seq}`, at: Date.now(), name: name2, uid: null, tag: null, ...entry },
+      ...this.#list.audit
+    ];
+    this.#list = { ...this.#list, audit };
+  }
+  #save(secret, rotated) {
+    this.#list = {
+      ...this.#list,
+      secrets: [...this.#list.secrets.filter((item) => item.name !== secret.name), secret]
+    };
+    this.#log(secret.name, { type: "seal", source: secret.source, rotated });
+    this.emit("list", this.#list);
+    return { name: secret.name, placeholder: secret.placeholder, state: secret.state };
+  }
+  #seal(name2, source, kind = "secret") {
+    const old = this.#list.secrets.find((item) => item.name === name2 && item.kind === kind);
+    if (old) {
+      const state = old.state === "removed" ? old.rules.length ? "active" : "inert" : old.state;
+      const { removedAt: _, ...kept } = old;
+      return this.#save({ ...kept, state, source }, true);
+    }
+    this.#serial += 1;
+    return this.#save(
+      {
+        name: name2,
+        kind,
+        placeholder: `fnox_proxy_new${String(this.#serial).padStart(5, "0")}`,
+        state: "inert",
+        source,
+        sourceDevice: null,
+        domains: [],
+        rules: [],
+        exec: false,
+        createdAt: Date.now()
+      },
+      false
+    );
+  }
+  async put(name2, value, request) {
     await this.#time.sleep(5);
-    this.acknowledged.push(notice);
-    const notices = this.#list.notices.filter((item) => item.id !== notice);
-    this.#list = { ...this.#list, notices };
-    this.#status = { ...this.#status, notices: notices.length };
+    this.#unlocked();
+    const problem = nameProblem(name2) ?? valueProblem(value);
+    if (problem) throw vaultFailure("EINVAL", problem);
+    if (request !== void 0) this.#take(request, name2);
+    this.puts.push({ name: name2, ...request === void 0 ? {} : { request } });
+    return this.#seal(name2, "settings");
+  }
+  #take(request, name2) {
+    const found = this.#status.waiting.find((item) => item.id === request);
+    if (!found) throw vaultFailure("ENOENT", "That request is no longer waiting.");
+    if (name2 !== void 0 && found.name !== void 0 && found.name !== name2)
+      throw vaultFailure("EINVAL", `That request asks for ${found.name}.`);
+    this.#status = {
+      ...this.#status,
+      waiting: this.#status.waiting.filter((item) => item.id !== request)
+    };
+    this.emit("status", this.#status);
+  }
+  async cancel(request) {
+    await this.#time.sleep(5);
+    this.#failed();
+    this.#take(request);
+    this.cancelled.push(request);
+    return "cancelled";
+  }
+  async remove(name2, kind = "secret") {
+    await this.#time.sleep(5);
+    const secret = { ...this.#find(name2, kind), state: "removed", removedAt: Date.now() };
+    return this.#flip(secret, "remove");
+  }
+  async restore(name2, kind = "secret") {
+    await this.#time.sleep(5);
+    const { removedAt: _, ...secret } = this.#find(name2, kind);
+    return this.#flip({ ...secret, state: secret.rules.length ? "active" : "inert" }, "restore");
+  }
+  #flip(secret, type) {
+    this.#list = {
+      ...this.#list,
+      secrets: this.#list.secrets.map(
+        (item) => item.name === secret.name && item.kind === secret.kind ? secret : item
+      )
+    };
+    this.#log(secret.name, { type });
     this.emit("list", this.#list);
+    return { name: secret.name, placeholder: secret.placeholder, state: secret.state };
+  }
+  async import(kind, bytes, options = {}) {
+    await this.#time.sleep(5);
+    this.#unlocked();
+    if (kind === "six") throw vaultFailure("ENOTSUP", "six imports are not supported yet.");
+    if (!bytes.length) throw vaultFailure("EINVAL", "The file is empty.");
+    const { pick } = options;
+    this.imports.push({
+      kind,
+      size: bytes.length,
+      password: !!options.password,
+      ...pick ? { pick: [...pick] } : {}
+    });
+    const offered = kind === "keepass" ? [...candidates, duplicate] : candidates;
+    if (!pick) return { stage: "pick", candidates: offered.map((item) => ({ ...item })) };
+    const chosen = new Map(
+      pick.map(
+        (item) => typeof item === "string" ? [item, "secret"] : [item.name, item.kind]
+      )
+    );
+    const taken = offered.filter((item) => chosen.has(item.name) && !item.refused);
+    return {
+      stage: "done",
+      imported: taken.map((item) => this.#seal(item.name, `import:${kind}`, chosen.get(item.name))),
+      skipped: offered.filter((item) => !taken.includes(item)).map((item) => item.name),
+      reasons: Object.fromEntries(
+        offered.flatMap((item) => item.refused ? [[item.name, item.refused]] : [])
+      )
+    };
+  }
+  async export(passphrase) {
+    await this.#time.sleep(5);
+    this.#unlocked();
+    if (new TextEncoder().encode(passphrase).length < 8)
+      throw vaultFailure("EINVAL", "Passphrases need at least 8 bytes.");
+    this.exported += 1;
+    this.#status = { ...this.#status, exportedAt: Date.now(), backupReminder: null };
+    this.emit("status", this.#status);
+    return new TextEncoder().encode("slicc-vault invented bundle");
+  }
+  async lock() {
+    await this.#time.sleep(5);
+    this.#failed();
+    this.#status = { ...this.#status, locked: true };
     this.emit("status", this.#status);
   }
   button() {
@@ -5872,26 +6132,16 @@ var DummyVault = class extends Emitter {
     return this.#status.locked ? "Vault locked" : "Vault unlocked";
   }
   autoIntent() {
-    return this.#status.locked ? { kind: "unlock" } : { kind: "manage" };
+    return this.#status.locked ? { kind: "unlock" } : { kind: "protect" };
   }
   async answer(intent) {
     await this.#time.sleep(10);
-    if (intent.kind === "unlock") {
-      this.#status = { ...this.#status, locked: false };
-      this.emit("status", this.#status);
-      return null;
-    }
-    if (intent.kind !== "request" && intent.kind !== "enter") return null;
-    const request = this.#status.waiting.find((item) => item.id === intent.request);
-    const name2 = intent.kind === "enter" ? intent.name : request?.name ?? "NEW_SECRET";
-    this.#status = {
+    this.#status = intent.kind === "unlock" ? {
       ...this.#status,
       locked: false,
-      waiting: this.#status.waiting.filter((item) => item !== request)
-    };
+      scrub: { needed: false, version: 0, ...this.#status.scrub, ready: true }
+    } : { ...this.#status, lock: "passkey" };
     this.emit("status", this.#status);
-    const record = this.#list.secrets.find((secret) => secret.name === name2);
-    return { name: name2, placeholder: record?.placeholder ?? "fnox_proxy_new00001", state: "active" };
   }
 };
 
@@ -6011,6 +6261,8 @@ export {
   vaultFixtures,
   vaultNotice,
   vaultOlder,
+  vaultPolicy,
+  vaultRefused,
   vaultSecrets
 };
 //# sourceMappingURL=slicc-dummy.js.map