@akasecurity/cli 0.9.7 → 0.9.8

package/web-ui/web-ui/.next/server/chunks/523.js

@@ -1 +1 @@
-"use strict";exports.id=523,exports.ids=[523],exports.modules={32389:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(32713);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}},40139:(a,b,c)=>{c.d(b,{Zs:()=>t,cm:()=>s,h2:()=>u,h6:()=>w,oP:()=>v});var d=c(91873);c(429);var e=c(48161),f=c(76258),g=c(5477),h=c(74504),i=c(23326),j=c(52522),k=c(20021);let l="Could not read the local store (~/.aka/data/aka.db).";function m(a){return null===a.field?"The request did not arrive in the expected shape — reload the page and try again.":a.wrongType?`The '${a.field}' field did not arrive as text — reload the page and try again.`:`The '${a.field}' field was not in the expected form — reload the page and try again.`}let n=`${l} The fingerprint key cannot be minted until it is readable, because a key that reused a stored version would produce grants that never match.`;function o(a){let b=a?.code;return"floor-unreadable"===b?n:"string"==typeof b?"Could not access the exception key file — check the permissions on ~/.aka/data. Do not delete exception.key to work around this; that invalidates every existing grant.":"The exception key file is corrupt. Delete ~/.aka/data/exception.key to mint a new key (this invalidates existing grants)."}function p(){try{return(0,e.userInfo)().username}catch{return"unknown"}}function q(a){try{return(0,h.N6N)(a)}catch(a){return{error:a instanceof Error?a.message:"invalid scope"}}}function r(a){return(0,j.db)().exceptions.create(a).then(()=>((0,i.revalidatePath)("/exceptions"),{ok:!0})).catch(a=>a instanceof g.qA?{ok:!1,error:"An active exception for this value already exists — revoke it first."}:{ok:!1,error:"Could not create the exception."})}async function s(a){let b,c,d=(0,h.K7s)(h.QcD,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();if(""===f)return{ok:!1,error:"A reason is required — it is the audit trail."};let i=q(e.scope);if("error"in i)return{ok:!1,error:i.error};try{b=(await (0,j.db)().exceptions.recentBlocked(g.WR)).find(a=>a.reference===e.reference)}catch{return{ok:!1,error:l}}if(!b)return{ok:!1,error:"That blocked detection has expired from the ledger — trigger it again."};try{c=(0,g.y9)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}return(0,g.Dg)(c,b.keyVersion)?"permanent"===i.scope&&e.confirmation!==b.maskedValue?{ok:!1,error:"Permanent grants require retyping the masked value exactly as shown."}:r({ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,...i,justification:f,conditions:null,createdBy:p(),createdVia:"web-approve"}):{ok:!1,error:null===c?"The exception key file is missing, so the fingerprint recorded for this detection can no longer be matched. Trigger the detection again.":`That detection was blocked under fingerprint key v${String(b.keyVersion)}; the key is now v${String(c.version)}, so a grant from it could never match. Trigger the detection again.`}}async function t(a){let b,c,d=(0,h.K7s)(h.Nh0,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,i=e.reason.trim();if(""===i)return{ok:!1,error:"A reason is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};if(""===e.value)return{ok:!1,error:"No value supplied — nothing to except."};if("permanent"===k.scope&&e.confirmation!==e.value)return{ok:!1,error:"Permanent grants require retyping the value exactly."};try{({rules:b}=(0,j.db)().installedPacks.installedRuleset())}catch{return{ok:!1,error:l}}let n=b.find(a=>a.id===e.ruleId);if(!n)return{ok:!1,error:`Unknown or disabled rule '${e.ruleId}'.`};let s=(0,f.SQ)(e.value,b).filter(a=>a.ruleId===e.ruleId);if(0===s.length)return{ok:!1,error:`The value does not match rule ${e.ruleId} — a grant for it would never apply.`};let t=[...new Set(s.map(a=>a.rawMatch))],u=t[0];if(t.length>1||void 0===u)return{ok:!1,error:`The input contains ${String(t.length)} distinct values matching ${e.ruleId} — supply exactly one.`};try{c=(0,g.Rd)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}let v={valueFingerprint:(0,g._2)(c,u),keyVersion:c.version,maskedValue:(0,f.sE)(u)};return r({ruleId:n.id,category:n.category,...v,...k,justification:i,conditions:null,createdBy:p(),createdVia:"web-add"})}async function u(a){let b,c,d=(0,h.K7s)(h.agn,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.justification.trim();if(""===f)return{ok:!1,error:"A justification is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};let l=h.jUf.safeParse(e.pointer.trim());if(!l.success)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});b=await a.resolvePointerIdentity(l.data),c=null===b?null:await a.describePointer(l.data)}catch{b=null,c=null}if(null===b)return{ok:!1,error:"The pointer could not be resolved — it is not one this machine issued, or its entry was purged."};let n=c?.category??function(a){let b=a.slice(6).split(":")[0]??"",c=h.gbA.safeParse(b);return c.success?c.data:null}(l.data);if(null===n)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};if("permanent"===k.scope){if(null===c)return{ok:!1,error:"A permanent reveal needs the value preview to confirm against — use a time-limited scope."};if(e.confirmation!==c.maskedMatch)return{ok:!1,error:`A permanent reveal must be confirmed by retyping the masked value (${c.maskedMatch}).`}}try{let a=await (0,j.db)().exceptions.create({ruleId:b.ruleId,category:n,valueFingerprint:b.valueFingerprint,keyVersion:b.fingerprintKeyVersion,maskedValue:c?.maskedMatch??"\xb7\xb7\xb7",capability:"reveal_to_model",...k,justification:f,conditions:null,createdBy:"dashboard",createdVia:"web-approve"});return(0,i.revalidatePath)("/exceptions"),{ok:!0,grantIdPrefix:a.id.slice(0,8)}}catch(a){if(a instanceof g.qA)return{ok:!1,error:"An active exception for this value already exists — revoke it first."};return{ok:!1,error:"Could not create the reveal grant."}}}async function v(a,b){let c,d=(0,h.K7s)(h.eYL,{id:a,reason:b});if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();try{c=await (0,j.db)().exceptions.revoke(e.id,p(),""===f?void 0:f)}catch{return{ok:!1,error:l}}return c?((0,i.revalidatePath)("/exceptions"),(0,i.revalidatePath)(`/exceptions/${e.id}`),{ok:!0}):{ok:!1,error:"No active exception with that id."}}async function w(a){let b,c=(0,h.K7s)(h.JJC,{confirmation:a});if(!c.ok)return{ok:!1,error:m(c)};if("rotate"!==c.data.confirmation)return{ok:!1,error:'Type "rotate" to confirm.'};try{b=(0,g.v5)((0,g.KS)())}catch(a){return{ok:!1,error:`Could not rotate the fingerprint key. ${o(a)}`}}try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});await a.refreshFingerprints(b)}catch{}return(0,i.revalidatePath)("/exceptions"),{ok:!0}}(0,k.D)([s,t,u,v,w]),(0,d.A)(s,"406a65b910ab98e84986e1786ce892777e0e44d186",null),(0,d.A)(t,"40fe99c0c9b0136bb46acbe784f17a30450a1db8bd",null),(0,d.A)(u,"40762771ed3b208bc2e1ae4b2da80ba1a7da8d5a5a",null),(0,d.A)(v,"60da2232f294a0d2356b135de28a3ac31a89becaa9",null),(0,d.A)(w,"40ebe5047afa9b49f33a884b4e0cb2d0db381fdca9",null)},52522:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(5477);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}}};
+"use strict";exports.id=523,exports.ids=[523],exports.modules={32389:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(57412);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}},40139:(a,b,c)=>{c.d(b,{Zs:()=>t,cm:()=>s,h2:()=>u,h6:()=>w,oP:()=>v});var d=c(91873);c(429);var e=c(48161),f=c(76258),g=c(48844),h=c(85002),i=c(23326),j=c(52522),k=c(20021);let l="Could not read the local store (~/.aka/data/aka.db).";function m(a){return null===a.field?"The request did not arrive in the expected shape — reload the page and try again.":a.wrongType?`The '${a.field}' field did not arrive as text — reload the page and try again.`:`The '${a.field}' field was not in the expected form — reload the page and try again.`}let n=`${l} The fingerprint key cannot be minted until it is readable, because a key that reused a stored version would produce grants that never match.`;function o(a){let b=a?.code;return"floor-unreadable"===b?n:"string"==typeof b?"Could not access the exception key file — check the permissions on ~/.aka/data. Do not delete exception.key to work around this; that invalidates every existing grant.":"The exception key file is corrupt. Delete ~/.aka/data/exception.key to mint a new key (this invalidates existing grants)."}function p(){try{return(0,e.userInfo)().username}catch{return"unknown"}}function q(a){try{return(0,h.N6N)(a)}catch(a){return{error:a instanceof Error?a.message:"invalid scope"}}}function r(a){return(0,j.db)().exceptions.create(a).then(()=>((0,i.revalidatePath)("/exceptions"),{ok:!0})).catch(a=>a instanceof g.qA?{ok:!1,error:"An active exception for this value already exists — revoke it first."}:{ok:!1,error:"Could not create the exception."})}async function s(a){let b,c,d=(0,h.K7s)(h.QcD,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();if(""===f)return{ok:!1,error:"A reason is required — it is the audit trail."};let i=q(e.scope);if("error"in i)return{ok:!1,error:i.error};try{b=(await (0,j.db)().exceptions.recentBlocked(g.WR)).find(a=>a.reference===e.reference)}catch{return{ok:!1,error:l}}if(!b)return{ok:!1,error:"That blocked detection has expired from the ledger — trigger it again."};try{c=(0,g.y9)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}return(0,g.Dg)(c,b.keyVersion)?"permanent"===i.scope&&e.confirmation!==b.maskedValue?{ok:!1,error:"Permanent grants require retyping the masked value exactly as shown."}:r({ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,...i,justification:f,conditions:null,createdBy:p(),createdVia:"web-approve"}):{ok:!1,error:null===c?"The exception key file is missing, so the fingerprint recorded for this detection can no longer be matched. Trigger the detection again.":`That detection was blocked under fingerprint key v${String(b.keyVersion)}; the key is now v${String(c.version)}, so a grant from it could never match. Trigger the detection again.`}}async function t(a){let b,c,d=(0,h.K7s)(h.Nh0,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,i=e.reason.trim();if(""===i)return{ok:!1,error:"A reason is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};if(""===e.value)return{ok:!1,error:"No value supplied — nothing to except."};if("permanent"===k.scope&&e.confirmation!==e.value)return{ok:!1,error:"Permanent grants require retyping the value exactly."};try{({rules:b}=(0,j.db)().installedPacks.installedRuleset())}catch{return{ok:!1,error:l}}let n=b.find(a=>a.id===e.ruleId);if(!n)return{ok:!1,error:`Unknown or disabled rule '${e.ruleId}'.`};let s=(0,f.SQ)(e.value,b).filter(a=>a.ruleId===e.ruleId);if(0===s.length)return{ok:!1,error:`The value does not match rule ${e.ruleId} — a grant for it would never apply.`};let t=[...new Set(s.map(a=>a.rawMatch))],u=t[0];if(t.length>1||void 0===u)return{ok:!1,error:`The input contains ${String(t.length)} distinct values matching ${e.ruleId} — supply exactly one.`};try{c=(0,g.Rd)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}let v={valueFingerprint:(0,g._2)(c,u),keyVersion:c.version,maskedValue:(0,f.sE)(u)};return r({ruleId:n.id,category:n.category,...v,...k,justification:i,conditions:null,createdBy:p(),createdVia:"web-add"})}async function u(a){let b,c,d=(0,h.K7s)(h.agn,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.justification.trim();if(""===f)return{ok:!1,error:"A justification is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};let l=h.jUf.safeParse(e.pointer.trim());if(!l.success)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});b=await a.resolvePointerIdentity(l.data),c=null===b?null:await a.describePointer(l.data)}catch{b=null,c=null}if(null===b)return{ok:!1,error:"The pointer could not be resolved — it is not one this machine issued, or its entry was purged."};let n=c?.category??function(a){let b=a.slice(6).split(":")[0]??"",c=h.gbA.safeParse(b);return c.success?c.data:null}(l.data);if(null===n)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};if("permanent"===k.scope){if(null===c)return{ok:!1,error:"A permanent reveal needs the value preview to confirm against — use a time-limited scope."};if(e.confirmation!==c.maskedMatch)return{ok:!1,error:`A permanent reveal must be confirmed by retyping the masked value (${c.maskedMatch}).`}}try{let a=await (0,j.db)().exceptions.create({ruleId:b.ruleId,category:n,valueFingerprint:b.valueFingerprint,keyVersion:b.fingerprintKeyVersion,maskedValue:c?.maskedMatch??"\xb7\xb7\xb7",capability:"reveal_to_model",...k,justification:f,conditions:null,createdBy:"dashboard",createdVia:"web-approve"});return(0,i.revalidatePath)("/exceptions"),{ok:!0,grantIdPrefix:a.id.slice(0,8)}}catch(a){if(a instanceof g.qA)return{ok:!1,error:"An active exception for this value already exists — revoke it first."};return{ok:!1,error:"Could not create the reveal grant."}}}async function v(a,b){let c,d=(0,h.K7s)(h.eYL,{id:a,reason:b});if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();try{c=await (0,j.db)().exceptions.revoke(e.id,p(),""===f?void 0:f)}catch{return{ok:!1,error:l}}return c?((0,i.revalidatePath)("/exceptions"),(0,i.revalidatePath)(`/exceptions/${e.id}`),{ok:!0}):{ok:!1,error:"No active exception with that id."}}async function w(a){let b,c=(0,h.K7s)(h.JJC,{confirmation:a});if(!c.ok)return{ok:!1,error:m(c)};if("rotate"!==c.data.confirmation)return{ok:!1,error:'Type "rotate" to confirm.'};try{b=(0,g.v5)((0,g.KS)())}catch(a){return{ok:!1,error:`Could not rotate the fingerprint key. ${o(a)}`}}try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});await a.refreshFingerprints(b)}catch{}return(0,i.revalidatePath)("/exceptions"),{ok:!0}}(0,k.D)([s,t,u,v,w]),(0,d.A)(s,"40d8c3185c852c292959c917cde30e3ef5449ce537",null),(0,d.A)(t,"401de4e8b94110b1f5ac0627954a97ae50864c81ed",null),(0,d.A)(u,"40a3b4d5843af2314b9146f65278f1279dd31f1fb1",null),(0,d.A)(v,"60b6dc932f4d627b2c4dad24faaedeb50c169ad2ea",null),(0,d.A)(w,"40ab5cbc8b1a706539046aa765996e762cdc10c4b4",null)},52522:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(48844);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}}};