@backbay/glia 0.2.0-alpha.1

package/dist/speakeasy/auth/deviceSecret.js

@@ -0,0 +1,62 @@
+/**
+ * Device secret provider
+ *
+ * Hosts can implement this using a keychain/secure enclave and inject it into
+ * SpeakeasyProvider / SpeakeasyConsentDialog.
+ */
+import { bytesToHex, hexToBytes, randomHex } from './crypto.js';
+export function createInMemoryDeviceSecretProvider() {
+    let secret = null;
+    return {
+        async getOrCreateDeviceSecret() {
+            if (!secret) {
+                secret = hexToBytes(randomHex(32));
+            }
+            return secret;
+        },
+        async clearDeviceSecret() {
+            secret = null;
+        },
+    };
+}
+export function createLocalStorageDeviceSecretProvider(options) {
+    const storageKey = options?.key ?? 'bb-ui:speakeasy:device-secret:v1';
+    return {
+        async getOrCreateDeviceSecret() {
+            if (typeof globalThis.localStorage === 'undefined') {
+                throw new Error('[Speakeasy] localStorage is not available');
+            }
+            const existing = globalThis.localStorage.getItem(storageKey);
+            if (existing) {
+                return hexToBytes(existing);
+            }
+            const created = randomHex(32);
+            globalThis.localStorage.setItem(storageKey, created);
+            return hexToBytes(created);
+        },
+        async clearDeviceSecret() {
+            try {
+                if (typeof globalThis.localStorage === 'undefined')
+                    return;
+                globalThis.localStorage.removeItem(storageKey);
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+export function createDefaultDeviceSecretProvider() {
+    try {
+        if (typeof globalThis.localStorage !== 'undefined') {
+            return createLocalStorageDeviceSecretProvider();
+        }
+    }
+    catch {
+        // ignore
+    }
+    return createInMemoryDeviceSecretProvider();
+}
+export function encodeDeviceSecretHex(secret) {
+    return bytesToHex(secret);
+}

package/dist/speakeasy/auth/storage.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Speakeasy storage abstractions.
+ *
+ * bb-ui is browser-first; hosts can inject stronger storage (keychain, enclave, etc).
+ */
+import type { Verifier } from '../types.js';
+export interface SpeakeasyStorage {
+    getVerifier: () => Promise<Verifier | null>;
+    setVerifier: (verifier: Verifier) => Promise<void>;
+    clearVerifier: () => Promise<void>;
+}
+export declare function createInMemorySpeakeasyStorage(): SpeakeasyStorage;
+export declare function createLocalStorageSpeakeasyStorage(options?: {
+    key?: string;
+}): SpeakeasyStorage;
+export declare function createIndexedDbSpeakeasyStorage(options?: {
+    dbName?: string;
+    storeName?: string;
+    key?: string;
+}): SpeakeasyStorage;
+export declare function createDefaultSpeakeasyStorage(options: {
+    deviceSecret: Uint8Array;
+}): SpeakeasyStorage;
+/**
+ * Create encrypted localStorage storage.
+ *
+ * The verifier is encrypted with AES-256-GCM using a key derived from the
+ * device secret via PBKDF2 (100k iterations).
+ *
+ * @param options.deviceSecret - The device secret to derive the encryption key from
+ * @param options.key - localStorage key for the encrypted payload
+ */
+export declare function createEncryptedLocalStorageSpeakeasyStorage(options: {
+    deviceSecret: Uint8Array;
+    key?: string;
+}): SpeakeasyStorage;
+/**
+ * Create encrypted IndexedDB storage.
+ *
+ * The verifier is encrypted with AES-256-GCM using a key derived from the
+ * device secret via PBKDF2 (100k iterations).
+ *
+ * @param options.deviceSecret - The device secret to derive the encryption key from
+ * @param options.dbName - IndexedDB database name
+ * @param options.storeName - IndexedDB store name
+ * @param options.key - Record key within the store
+ */
+export declare function createEncryptedIndexedDbSpeakeasyStorage(options: {
+    deviceSecret: Uint8Array;
+    dbName?: string;
+    storeName?: string;
+    key?: string;
+}): SpeakeasyStorage;
+/**
+ * Create encrypted storage with automatic backend selection.
+ *
+ * Prefers IndexedDB, falls back to localStorage, then in-memory.
+ *
+ * @param deviceSecret - The device secret to derive the encryption key from
+ */
+export declare function createEncryptedSpeakeasyStorage(deviceSecret: Uint8Array): SpeakeasyStorage;
+//# sourceMappingURL=storage.d.ts.map

package/dist/speakeasy/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/speakeasy/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5C,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,wBAAgB,8BAA8B,IAAI,gBAAgB,CAajE;AAED,wBAAgB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,gBAAgB,CA6BnB;AAED,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,gBAAgB,CA+DnB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,YAAY,EAAE,UAAU,CAAC;CAC1B,GAAG,gBAAgB,CAgBnB;AA8GD;;;;;;;;GAQG;AACH,wBAAgB,2CAA2C,CAAC,OAAO,EAAE;IACnE,YAAY,EAAE,UAAU,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,gBAAgB,CAqCnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,OAAO,EAAE;IAChE,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,gBAAgB,CAwEnB;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,UAAU,GACvB,gBAAgB,CAalB"}

package/dist/speakeasy/auth/storage.js

@@ -0,0 +1,344 @@
+/**
+ * Speakeasy storage abstractions.
+ *
+ * bb-ui is browser-first; hosts can inject stronger storage (keychain, enclave, etc).
+ */
+import { bytesToHex, hexToBytes, utf8ToBytes } from './crypto.js';
+export function createInMemorySpeakeasyStorage() {
+    let verifier = null;
+    return {
+        async getVerifier() {
+            return verifier;
+        },
+        async setVerifier(next) {
+            verifier = next;
+        },
+        async clearVerifier() {
+            verifier = null;
+        },
+    };
+}
+export function createLocalStorageSpeakeasyStorage(options) {
+    const storageKey = options?.key ?? 'bb-ui:speakeasy:verifier:v1';
+    return {
+        async getVerifier() {
+            try {
+                if (typeof globalThis.localStorage === 'undefined')
+                    return null;
+                const raw = globalThis.localStorage.getItem(storageKey);
+                if (!raw)
+                    return null;
+                return JSON.parse(raw);
+            }
+            catch {
+                return null;
+            }
+        },
+        async setVerifier(verifier) {
+            if (typeof globalThis.localStorage === 'undefined') {
+                throw new Error('[Speakeasy] localStorage is not available');
+            }
+            globalThis.localStorage.setItem(storageKey, JSON.stringify(verifier));
+        },
+        async clearVerifier() {
+            try {
+                if (typeof globalThis.localStorage === 'undefined')
+                    return;
+                globalThis.localStorage.removeItem(storageKey);
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+export function createIndexedDbSpeakeasyStorage(options) {
+    const dbName = options?.dbName ?? 'bb-ui-speakeasy';
+    const storeName = options?.storeName ?? 'speakeasy';
+    const recordKey = options?.key ?? 'verifier';
+    async function openDb() {
+        if (typeof globalThis.indexedDB === 'undefined') {
+            throw new Error('[Speakeasy] indexedDB is not available');
+        }
+        return new Promise((resolve, reject) => {
+            const request = globalThis.indexedDB.open(dbName, 1);
+            request.onerror = () => reject(request.error);
+            request.onsuccess = () => resolve(request.result);
+            request.onupgradeneeded = () => {
+                const db = request.result;
+                if (!db.objectStoreNames.contains(storeName)) {
+                    db.createObjectStore(storeName);
+                }
+            };
+        });
+    }
+    return {
+        async getVerifier() {
+            try {
+                const db = await openDb();
+                return await new Promise((resolve, reject) => {
+                    const tx = db.transaction(storeName, 'readonly');
+                    const store = tx.objectStore(storeName);
+                    const req = store.get(recordKey);
+                    req.onerror = () => reject(req.error);
+                    req.onsuccess = () => resolve((req.result ?? null));
+                });
+            }
+            catch {
+                return null;
+            }
+        },
+        async setVerifier(verifier) {
+            const db = await openDb();
+            await new Promise((resolve, reject) => {
+                const tx = db.transaction(storeName, 'readwrite');
+                const store = tx.objectStore(storeName);
+                const req = store.put(verifier, recordKey);
+                req.onerror = () => reject(req.error);
+                req.onsuccess = () => resolve();
+            });
+        },
+        async clearVerifier() {
+            try {
+                const db = await openDb();
+                await new Promise((resolve, reject) => {
+                    const tx = db.transaction(storeName, 'readwrite');
+                    const store = tx.objectStore(storeName);
+                    const req = store.delete(recordKey);
+                    req.onerror = () => reject(req.error);
+                    req.onsuccess = () => resolve();
+                });
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+export function createDefaultSpeakeasyStorage(options) {
+    // deviceSecret is required for secure storage
+    if (!options?.deviceSecret?.length) {
+        throw new Error('[Speakeasy] deviceSecret is required for secure storage');
+    }
+    // Use encrypted storage with the provided deviceSecret
+    if (typeof globalThis.indexedDB !== 'undefined') {
+        return createEncryptedIndexedDbSpeakeasyStorage({ deviceSecret: options.deviceSecret });
+    }
+    if (typeof globalThis.localStorage !== 'undefined') {
+        return createEncryptedLocalStorageSpeakeasyStorage({ deviceSecret: options.deviceSecret });
+    }
+    // No persistent storage available - throw error (in-memory is not secure)
+    throw new Error('[Speakeasy] No secure persistent storage available (requires IndexedDB or localStorage)');
+}
+async function deriveEncryptionKey(deviceSecret, salt) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('[Speakeasy] crypto.subtle is required for encrypted storage');
+    }
+    // Import device secret as key material
+    // Cast to BufferSource to satisfy TypeScript with bun-types
+    const keyMaterial = await subtle.importKey('raw', deviceSecret, 'PBKDF2', false, [
+        'deriveKey',
+    ]);
+    // Derive AES-256-GCM key using PBKDF2
+    return subtle.deriveKey({
+        name: 'PBKDF2',
+        salt: salt,
+        iterations: 600_000,
+        hash: 'SHA-256',
+    }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+async function encryptVerifier(verifier, deviceSecret) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('[Speakeasy] crypto.subtle is required for encrypted storage');
+    }
+    // Generate random IV (12 bytes for AES-GCM)
+    const iv = new Uint8Array(12);
+    globalThis.crypto.getRandomValues(iv);
+    // Generate random salt (16 bytes) for PBKDF2 - v2 uses per-encryption salt
+    const salt = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(salt);
+    const key = await deriveEncryptionKey(deviceSecret, salt);
+    const plaintext = utf8ToBytes(JSON.stringify(verifier));
+    const ciphertext = await subtle.encrypt({ name: 'AES-GCM', iv: iv }, key, plaintext);
+    return {
+        v: 2,
+        iv: bytesToHex(iv),
+        ct: bytesToHex(new Uint8Array(ciphertext)),
+        salt: bytesToHex(salt),
+    };
+}
+async function decryptVerifier(payload, deviceSecret) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('[Speakeasy] crypto.subtle is required for encrypted storage');
+    }
+    if (payload.v !== 1 && payload.v !== 2) {
+        throw new Error(`[Speakeasy] Unsupported encrypted payload version: ${payload.v}`);
+    }
+    const iv = hexToBytes(payload.iv);
+    const ciphertext = hexToBytes(payload.ct);
+    // v1: legacy fixed salt, v2: random salt stored in payload
+    let salt;
+    if (payload.v === 2 && payload.salt) {
+        salt = hexToBytes(payload.salt);
+    }
+    else {
+        // Legacy v1 fallback: use fixed salt
+        salt = utf8ToBytes('bb-ui:speakeasy:encrypted-storage:v1');
+    }
+    const key = await deriveEncryptionKey(deviceSecret, salt);
+    const plaintext = await subtle.decrypt({ name: 'AES-GCM', iv: iv }, key, ciphertext);
+    const json = new TextDecoder().decode(plaintext);
+    return JSON.parse(json);
+}
+/**
+ * Create encrypted localStorage storage.
+ *
+ * The verifier is encrypted with AES-256-GCM using a key derived from the
+ * device secret via PBKDF2 (100k iterations).
+ *
+ * @param options.deviceSecret - The device secret to derive the encryption key from
+ * @param options.key - localStorage key for the encrypted payload
+ */
+export function createEncryptedLocalStorageSpeakeasyStorage(options) {
+    const storageKey = options.key ?? 'bb-ui:speakeasy:verifier:encrypted:v1';
+    const { deviceSecret } = options;
+    return {
+        async getVerifier() {
+            try {
+                if (typeof globalThis.localStorage === 'undefined')
+                    return null;
+                const raw = globalThis.localStorage.getItem(storageKey);
+                if (!raw)
+                    return null;
+                const payload = JSON.parse(raw);
+                return await decryptVerifier(payload, deviceSecret);
+            }
+            catch (err) {
+                console.warn('[Speakeasy] Failed to decrypt verifier:', err);
+                return null;
+            }
+        },
+        async setVerifier(verifier) {
+            if (typeof globalThis.localStorage === 'undefined') {
+                throw new Error('[Speakeasy] localStorage is not available');
+            }
+            const payload = await encryptVerifier(verifier, deviceSecret);
+            globalThis.localStorage.setItem(storageKey, JSON.stringify(payload));
+        },
+        async clearVerifier() {
+            try {
+                if (typeof globalThis.localStorage === 'undefined')
+                    return;
+                globalThis.localStorage.removeItem(storageKey);
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+/**
+ * Create encrypted IndexedDB storage.
+ *
+ * The verifier is encrypted with AES-256-GCM using a key derived from the
+ * device secret via PBKDF2 (100k iterations).
+ *
+ * @param options.deviceSecret - The device secret to derive the encryption key from
+ * @param options.dbName - IndexedDB database name
+ * @param options.storeName - IndexedDB store name
+ * @param options.key - Record key within the store
+ */
+export function createEncryptedIndexedDbSpeakeasyStorage(options) {
+    const dbName = options.dbName ?? 'bb-ui-speakeasy-encrypted';
+    const storeName = options.storeName ?? 'speakeasy';
+    const recordKey = options.key ?? 'verifier';
+    const { deviceSecret } = options;
+    async function openDb() {
+        if (typeof globalThis.indexedDB === 'undefined') {
+            throw new Error('[Speakeasy] indexedDB is not available');
+        }
+        return new Promise((resolve, reject) => {
+            const request = globalThis.indexedDB.open(dbName, 1);
+            request.onerror = () => reject(request.error);
+            request.onsuccess = () => resolve(request.result);
+            request.onupgradeneeded = () => {
+                const db = request.result;
+                if (!db.objectStoreNames.contains(storeName)) {
+                    db.createObjectStore(storeName);
+                }
+            };
+        });
+    }
+    return {
+        async getVerifier() {
+            try {
+                const db = await openDb();
+                const payload = await new Promise((resolve, reject) => {
+                    const tx = db.transaction(storeName, 'readonly');
+                    const store = tx.objectStore(storeName);
+                    const req = store.get(recordKey);
+                    req.onerror = () => reject(req.error);
+                    req.onsuccess = () => resolve((req.result ?? null));
+                });
+                if (!payload)
+                    return null;
+                return await decryptVerifier(payload, deviceSecret);
+            }
+            catch (err) {
+                console.warn('[Speakeasy] Failed to decrypt verifier:', err);
+                return null;
+            }
+        },
+        async setVerifier(verifier) {
+            const db = await openDb();
+            const payload = await encryptVerifier(verifier, deviceSecret);
+            await new Promise((resolve, reject) => {
+                const tx = db.transaction(storeName, 'readwrite');
+                const store = tx.objectStore(storeName);
+                const req = store.put(payload, recordKey);
+                req.onerror = () => reject(req.error);
+                req.onsuccess = () => resolve();
+            });
+        },
+        async clearVerifier() {
+            try {
+                const db = await openDb();
+                await new Promise((resolve, reject) => {
+                    const tx = db.transaction(storeName, 'readwrite');
+                    const store = tx.objectStore(storeName);
+                    const req = store.delete(recordKey);
+                    req.onerror = () => reject(req.error);
+                    req.onsuccess = () => resolve();
+                });
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+/**
+ * Create encrypted storage with automatic backend selection.
+ *
+ * Prefers IndexedDB, falls back to localStorage, then in-memory.
+ *
+ * @param deviceSecret - The device secret to derive the encryption key from
+ */
+export function createEncryptedSpeakeasyStorage(deviceSecret) {
+    try {
+        if (typeof globalThis.indexedDB !== 'undefined') {
+            return createEncryptedIndexedDbSpeakeasyStorage({ deviceSecret });
+        }
+        if (typeof globalThis.localStorage !== 'undefined') {
+            return createEncryptedLocalStorageSpeakeasyStorage({ deviceSecret });
+        }
+    }
+    catch {
+        // ignore
+    }
+    // Fall back to in-memory (no encryption needed since it's ephemeral)
+    return createInMemorySpeakeasyStorage();
+}

package/dist/speakeasy/components/SpeakeasyConsentDialog.d.ts

@@ -0,0 +1,24 @@
+import React from 'react';
+import { type SpeakeasyAuthOptions } from '../auth/SpeakeasyAuth.js';
+import { type SpeakeasyDeviceSecretProvider } from '../auth/deviceSecret.js';
+import type { CapabilityToken } from '../types.js';
+export interface SpeakeasyConsentRequest {
+    requester: string;
+    purpose: string;
+    scopes: string[];
+}
+export interface SpeakeasyConsentDialogProps {
+    trigger?: React.ReactNode;
+    open?: boolean;
+    onOpenChange?: (open: boolean) => void;
+    request: SpeakeasyConsentRequest;
+    authOptions?: SpeakeasyAuthOptions;
+    deviceSecret?: SpeakeasyAuthOptions['deviceSecret'];
+    deviceSecretProvider?: SpeakeasyDeviceSecretProvider;
+    issuer?: string;
+    ttlMs?: number;
+    onGranted: (token: CapabilityToken) => void;
+}
+export declare function SpeakeasyConsentDialog({ trigger, open: openProp, onOpenChange, request, authOptions, deviceSecret, deviceSecretProvider, issuer, ttlMs, onGranted, }: SpeakeasyConsentDialogProps): import("react/jsx-runtime").JSX.Element;
+export default SpeakeasyConsentDialog;
+//# sourceMappingURL=SpeakeasyConsentDialog.d.ts.map

package/dist/speakeasy/components/SpeakeasyConsentDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpeakeasyConsentDialog.d.ts","sourceRoot":"","sources":["../../../src/speakeasy/components/SpeakeasyConsentDialog.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAazE,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIpF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,aAAa,CAAC;AAG/E,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,YAAY,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACpD,oBAAoB,CAAC,EAAE,6BAA6B,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAC7C;AAWD,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACP,IAAI,EAAE,QAAQ,EACd,YAAY,EACZ,OAAO,EACP,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,MAAkC,EAClC,KAAe,EACf,SAAS,GACV,EAAE,2BAA2B,2CAsP7B;AAED,eAAe,sBAAsB,CAAC"}

package/dist/speakeasy/components/SpeakeasyConsentDialog.js

@@ -0,0 +1,181 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, DialogTrigger, } from '../../primitives/ui/dialog';
+import { Button } from '../../primitives/ui/button';
+import { SpeakeasyAuth } from '../auth/SpeakeasyAuth.js';
+import { createCapabilityToken } from '../auth/CapabilityIssuer.js';
+import { randomHex } from '../auth/crypto.js';
+import { createDefaultDeviceSecretProvider, } from '../auth/deviceSecret.js';
+import { isPanicGesture } from '../doorman/panic.js';
+import { SpeakeasyRitualPad } from './SpeakeasyRitualPad.js';
+const DEFAULTS = {
+    challengeWindowMs: 30_000,
+    maxFailures: 3,
+    cooldownBaseMs: 1_000,
+    lockDurationMs: 300_000,
+};
+export function SpeakeasyConsentDialog({ trigger, open: openProp, onOpenChange, request, authOptions, deviceSecret, deviceSecretProvider, issuer = 'bb-ui:speakeasy:consent', ttlMs = 300_000, onGranted, }) {
+    const [openInternal, setOpenInternal] = useState(false);
+    const open = openProp ?? openInternal;
+    const setOpen = onOpenChange ?? setOpenInternal;
+    const [resolvedDeviceSecret, setResolvedDeviceSecret] = useState(deviceSecret);
+    useEffect(() => {
+        let cancelled = false;
+        if (deviceSecret !== undefined) {
+            setResolvedDeviceSecret(deviceSecret);
+            return;
+        }
+        const provider = deviceSecretProvider ?? createDefaultDeviceSecretProvider();
+        provider.getOrCreateDeviceSecret().then((secret) => {
+            if (!cancelled)
+                setResolvedDeviceSecret(secret);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [deviceSecret, deviceSecretProvider]);
+    // Auth is only created once deviceSecret is resolved (prevents race condition)
+    const auth = useMemo(() => {
+        if (resolvedDeviceSecret === undefined) {
+            return null; // Not ready yet
+        }
+        return new SpeakeasyAuth({
+            ...authOptions,
+            deviceSecret: resolvedDeviceSecret,
+        });
+    }, [authOptions, resolvedDeviceSecret]);
+    const [phase, setPhase] = useState('idle');
+    const [challenge, setChallenge] = useState(null);
+    const [error, setError] = useState(null);
+    const [failures, setFailures] = useState(0);
+    const [cooldownUntil, setCooldownUntil] = useState(null);
+    const [lockUntil, setLockUntil] = useState(null);
+    useEffect(() => {
+        if (!open) {
+            setPhase('idle');
+            setChallenge(null);
+            setError(null);
+            setFailures(0);
+            setCooldownUntil(null);
+            setLockUntil(null);
+        }
+    }, [open]);
+    useEffect(() => {
+        if (!cooldownUntil)
+            return;
+        const remaining = cooldownUntil - Date.now();
+        if (remaining <= 0) {
+            setCooldownUntil(null);
+            return;
+        }
+        const id = setTimeout(() => setCooldownUntil(null), remaining);
+        return () => clearTimeout(id);
+    }, [cooldownUntil]);
+    useEffect(() => {
+        if (!lockUntil)
+            return;
+        const remaining = lockUntil - Date.now();
+        if (remaining <= 0) {
+            setLockUntil(null);
+            setPhase('idle');
+            return;
+        }
+        const id = setTimeout(() => {
+            setLockUntil(null);
+            setPhase('idle');
+        }, remaining);
+        return () => clearTimeout(id);
+    }, [lockUntil]);
+    const begin = useCallback(async () => {
+        setError(null);
+        if (!auth) {
+            // User-friendly message for UI (matches SpeakeasyNotReadyError semantics)
+            setError('Initializing secure storage. Please wait a moment.');
+            return;
+        }
+        if (!(await auth.isRegistered())) {
+            setError('No ritual is registered on this device yet.');
+            return;
+        }
+        if (lockUntil && Date.now() < lockUntil) {
+            setPhase('locked');
+            return;
+        }
+        const now = Date.now();
+        const next = {
+            nonce: randomHex(32),
+            salt: randomHex(16),
+            issuedAt: now,
+            expiresAt: now + DEFAULTS.challengeWindowMs,
+        };
+        setChallenge(next);
+        setPhase('challenged');
+    }, [auth, lockUntil]);
+    const onRitualComplete = useCallback(async (sequence) => {
+        if (!challenge || !auth)
+            return;
+        if (Date.now() > challenge.expiresAt) {
+            setError('Challenge expired. Try again.');
+            setPhase('idle');
+            setChallenge(null);
+            return;
+        }
+        // Panic ritual always locks in consent flows.
+        if (isPanicGesture(sequence)) {
+            const now = Date.now();
+            setLockUntil(now + DEFAULTS.lockDurationMs);
+            setPhase('locked');
+            setChallenge(null);
+            setError('Locked (panic).');
+            return;
+        }
+        const result = await auth.verifyGesture(sequence, challenge);
+        if (!result.ok) {
+            const nextFailures = failures + 1;
+            setFailures(nextFailures);
+            if (nextFailures >= DEFAULTS.maxFailures) {
+                const now = Date.now();
+                setLockUntil(now + DEFAULTS.lockDurationMs);
+                setPhase('locked');
+                setChallenge(null);
+                setError('Too many attempts. Locked.');
+                return;
+            }
+            const cooldownMs = DEFAULTS.cooldownBaseMs * Math.pow(2, nextFailures - 1);
+            setCooldownUntil(Date.now() + cooldownMs);
+            setError('Incorrect ritual.');
+            setPhase('idle');
+            setChallenge(null);
+            return;
+        }
+        const verifier = await auth.getVerifier();
+        if (!verifier) {
+            setError('No ritual is registered on this device yet.');
+            setPhase('idle');
+            setChallenge(null);
+            return;
+        }
+        const token = await createCapabilityToken({
+            verifierKeyHex: verifier.hash,
+            issuer,
+            scopes: request.scopes,
+            ttlMs,
+            constraints: { maxUses: 1, allowedOrigins: [verifier.domain] },
+        });
+        onGranted(token);
+        setOpen(false);
+    }, [auth, challenge, failures, issuer, request.scopes, ttlMs, onGranted, setOpen]);
+    const remainingLockSeconds = lockUntil ? Math.max(0, Math.ceil((lockUntil - Date.now()) / 1000)) : 0;
+    const remainingCooldownMs = cooldownUntil ? Math.max(0, cooldownUntil - Date.now()) : 0;
+    return (_jsxs(Dialog, { open: open, onOpenChange: setOpen, children: [trigger ? _jsx(DialogTrigger, { asChild: true, children: trigger }) : null, _jsxs(DialogContent, { children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: "Consent gate" }), _jsxs(DialogDescription, { children: [request.requester, " requests speakeasy access for: ", request.purpose] })] }), _jsxs("div", { style: { display: 'grid', gap: 12 }, children: [error ? (_jsx("div", { style: {
+                                    padding: '10px 12px',
+                                    borderRadius: 10,
+                                    border: '1px solid rgba(239,68,68,0.35)',
+                                    background: 'rgba(239,68,68,0.10)',
+                                    color: 'rgba(255,255,255,0.92)',
+                                    fontSize: 13,
+                                }, children: error })) : null, phase === 'locked' ? (_jsxs("div", { style: { fontSize: 13, opacity: 0.85 }, children: ["Locked. Try again in ", remainingLockSeconds, "s."] })) : null, phase === 'challenged' ? (_jsxs("div", { style: { display: 'grid', gap: 12, justifyItems: 'center' }, children: [_jsx("div", { style: { fontWeight: 600 }, children: "Perform ritual" }), _jsx(SpeakeasyRitualPad, { onComplete: onRitualComplete })] })) : null, phase === 'idle' ? (_jsxs("div", { style: { display: 'grid', gap: 10 }, children: [_jsxs("div", { style: { fontSize: 13, opacity: 0.85 }, children: ["Scopes: ", _jsx("code", { children: request.scopes.join(', ') })] }), _jsxs("div", { style: { display: 'flex', justifyContent: 'flex-end', gap: 8 }, children: [_jsx(Button, { variant: "outline", onClick: () => setOpen(false), children: "Deny" }), _jsx(Button, { onClick: begin, disabled: remainingCooldownMs > 0, children: remainingCooldownMs > 0
+                                                    ? `Cooldown (${Math.ceil(remainingCooldownMs / 1000)}s)`
+                                                    : 'Perform ritual' })] })] })) : null] }), _jsx(DialogFooter, { children: _jsx(Button, { variant: "outline", onClick: () => setOpen(false), children: "Close" }) })] })] }));
+}
+export default SpeakeasyConsentDialog;