@hanzo/build 0.2.50 → 0.2.51

package/README.md

@@ -214,7 +214,7 @@ picker and open-in-tab; Share and Publish; the console dock under it.
 | `PATCH /v1/agent/sessions/{id}` `{title}` · `{published}` | rename a run, share its story at `GET /v1/agent/builds/{org}/{project}` |
 | `GET /v1/agent/sessions?kind=coding&status=&after=` | Find, by status, paged |
 | `GET`/`POST /v1/agent/targets` · `PATCH`/`DELETE …/{id}` · `POST …/{id}/key` | the org's machines, and a machine's claim key |
-| `GET`/`POST`/`DELETE /v1/account/keys` | your API keys |
+| `GET`/`POST /v1/account/keys` · `DELETE …/{id}` | your API keys, as many as you need; one revoked at a time |
 | `GET /v1/auto/flows` · `POST /v1/auto/flows` · `POST /v1/auto/flows/{id}/enable` | automations |
 | `GET /v1/environment` · `GET`/`PUT`/`DELETE /v1/environment/{repo}` · `PUT`/`DELETE …/secrets/{name}` | a codebase's environment |
 | `GET /v1/agent/coding/{session}/changes` · `/tree` · `/blob` | what a run pushed, and its branch's files, from the forge |

package/lib/api/keys.d.ts

@@ -1,31 +1,38 @@
 /**
- * A person's own API keys: one secret key (sk-, it belongs on a server) and one
- * publishable key (pk-, safe in a page's source), at most one of each.
+ * A person's API keys, each its own credential: as many as they like, of either
+ * type — secret (sk-, it belongs on a server) or publishable (pk-, safe in a
+ * page's source).
  *
- *   GET    /v1/account/keys             {keys: [{type, prefix, key?, limit?, createdAt}]}
- *   POST   /v1/account/keys             {type, limit?} → {key, type, limit}, answered once
- *   DELETE /v1/account/keys?type=…      revoke that one
+ *   GET    /v1/account/keys        {keys: [{id, name, type, prefix, key?, status, limit?, created, …}]}
+ *   POST   /v1/account/keys        {name, type, limit?} → the key, its secret answered once
+ *   DELETE /v1/account/keys/{id}   revoke exactly that one; it stays listed as revoked
  *
- * Creating is rotating: a new key of a type ends the one before it. A secret key
- * is answered once and by its prefix after; a publishable key is public by
- * construction and always comes back whole. A limit only narrows what a key may
- * reach — `model:zen5`, `project:acme`, `product:commerce`, `model:*`.
+ * Creating a key never touches another. A secret key is answered once and by its
+ * prefix after; a publishable key is public by construction and always comes back
+ * whole. A limit only narrows what a key may reach — `model:zen5`,
+ * `project:acme`, `product:train`, `read:*`.
  */
 import { type Target } from './call.ts';
 export declare const KINDS: readonly ['secret', 'publishable'];
 export type Kind = (typeof KINDS)[number];
 export interface Key {
+    id: string;
+    name: string;
     type: Kind;
     /** The recognizable head, never enough to use the key. */
     prefix: string;
     /** The whole key: a publishable key's only. */
     key: string;
+    /** active, expired, revoked or disabled. */
+    status: string;
     /** `kind:name` entries; none reaches whatever its holder does. */
     limit: string[];
-    /** When it last changed, as IAM records it. */
+    /** When it was made, as IAM records it. */
     created: string;
 }
 export interface Minted {
+    id: string;
+    name: string;
     type: Kind;
     /** The key itself. A secret one is never readable again. */
     key: string;
@@ -36,6 +43,7 @@ export declare function keys(t: Target): Promise<Key[]>;
 export declare const LIMIT: RegExp;
 /** The limits a person typed, split on commas and spaces; throws on the first that is not one. */
 export declare function limits(raw: string): string[];
-/** Create a key of this type, ending the one before it. The answer is the only time a secret key is shown. */
-export declare function mint(t: Target, type: Kind, limit?: string[]): Promise<Minted>;
-export declare function revoke(t: Target, type: Kind): Promise<void>;
+/** Create a new key beside the ones held. The answer is the only time a secret key is shown. */
+export declare function mint(t: Target, type: Kind, name?: string, limit?: string[]): Promise<Minted>;
+/** Revoke exactly one key, by id. Every other key keeps working. */
+export declare function revoke(t: Target, id: string): Promise<void>;

package/lib/api/keys.js

@@ -1,17 +1,18 @@
 /**
- * A person's own API keys: one secret key (sk-, it belongs on a server) and one
- * publishable key (pk-, safe in a page's source), at most one of each.
+ * A person's API keys, each its own credential: as many as they like, of either
+ * type — secret (sk-, it belongs on a server) or publishable (pk-, safe in a
+ * page's source).
  *
- *   GET    /v1/account/keys             {keys: [{type, prefix, key?, limit?, createdAt}]}
- *   POST   /v1/account/keys             {type, limit?} → {key, type, limit}, answered once
- *   DELETE /v1/account/keys?type=…      revoke that one
+ *   GET    /v1/account/keys        {keys: [{id, name, type, prefix, key?, status, limit?, created, …}]}
+ *   POST   /v1/account/keys        {name, type, limit?} → the key, its secret answered once
+ *   DELETE /v1/account/keys/{id}   revoke exactly that one; it stays listed as revoked
  *
- * Creating is rotating: a new key of a type ends the one before it. A secret key
- * is answered once and by its prefix after; a publishable key is public by
- * construction and always comes back whole. A limit only narrows what a key may
- * reach — `model:zen5`, `project:acme`, `product:commerce`, `model:*`.
+ * Creating a key never touches another. A secret key is answered once and by its
+ * prefix after; a publishable key is public by construction and always comes back
+ * whole. A limit only narrows what a key may reach — `model:zen5`,
+ * `project:acme`, `product:train`, `read:*`.
  */
-import { call, query } from './call.js';
+import { call } from './call.js';
 export const KINDS = ['secret', 'publishable'];
 const str = (v) => (typeof v === 'string' ? v : '');
 const list = (v) => (Array.isArray(v) ? v.filter((s) => typeof s === 'string' && s !== '') : []);
@@ -23,9 +24,18 @@ export async function keys(t) {
     for (const raw of rows) {
         const o = (raw && typeof raw === 'object' ? raw : {});
         const type = kind(o.type);
-        if (!type)
+        if (!type || !str(o.id))
             continue;
-        out.push({ type, prefix: str(o.prefix), key: str(o.key), limit: list(o.limit), created: str(o.createdAt) });
+        out.push({
+            id: str(o.id),
+            name: str(o.name),
+            type,
+            prefix: str(o.prefix),
+            key: str(o.key),
+            status: str(o.status) || 'active',
+            limit: list(o.limit),
+            created: str(o.created),
+        });
     }
     return out;
 }
@@ -42,14 +52,20 @@ export function limits(raw) {
         throw new Error(`${bad} is not a limit — write it as kind:name, like model:zen5`);
     return out;
 }
-/** Create a key of this type, ending the one before it. The answer is the only time a secret key is shown. */
-export async function mint(t, type, limit = []) {
-    const r = await call(t, 'POST', '/v1/account/keys', limit.length ? { type, limit } : { type });
-    const key = str(r?.key) || str(r?.accessKey);
+/** Create a new key beside the ones held. The answer is the only time a secret key is shown. */
+export async function mint(t, type, name = '', limit = []) {
+    const body = { type };
+    if (name.trim())
+        body.name = name.trim();
+    if (limit.length)
+        body.limit = limit;
+    const r = await call(t, 'POST', '/v1/account/keys', body);
+    const key = str(r?.key);
     if (!key)
         throw new Error('The platform answered no key');
-    return { type: kind(r?.type) ?? type, key, limit: list(r?.limit) };
+    return { id: str(r?.id), name: str(r?.name), type: kind(r?.type) ?? type, key, limit: list(r?.limit) };
 }
-export async function revoke(t, type) {
-    await call(t, 'DELETE', `/v1/account/keys${query({ type })}`);
+/** Revoke exactly one key, by id. Every other key keeps working. */
+export async function revoke(t, id) {
+    await call(t, 'DELETE', `/v1/account/keys/${encodeURIComponent(id)}`);
 }

package/lib/settings/keys.js

@@ -1,9 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /**
- * API keys: your own keys for calling the Hanzo API from code — one secret key
- * for a server, one publishable key for a page's source. Creating one ends the
- * one before it, and a secret key is shown once, when it is made. A limit
- * narrows what a key reaches; it never reaches further than you do.
+ * API keys: your keys for calling the Hanzo API from code, as many as you need —
+ * a secret key for a server, a publishable key for a page's source. Each is its
+ * own credential: creating one never touches another, and revoking one stops only
+ * that one. A secret key is shown once, when it is made. A limit narrows what a
+ * key reaches; it never reaches further than you do.
  */
 import { SizableText, XStack, YStack } from '@hanzo/gui';
 import { Button, Dialog, DialogContent, DialogTitle, Input } from '@hanzo/ui';
@@ -15,19 +16,15 @@ import { useRead } from '../data.js';
 import { useHost, useTarget } from '../host.js';
 import { Card, Field, Heading, Note, Once, Row, Soft } from './ui.js';
 const NAME = { secret: 'Secret key', publishable: 'Publishable key' };
-const FOR = {
-    secret: 'For a server. It acts as you, so it never goes in a page.',
-    publishable: 'Safe in a page’s source.',
-};
-/** The line under a key: what it is for, how it starts, what it reaches, when it was made. */
-function about(type, k) {
-    if (!k)
-        return `${FOR[type]} None yet.`;
+/** The line under a key: its head, what it reaches, when it was made, and where it stands. */
+function about(k) {
     const when = k.created ? new Date(k.created) : null;
     return [
-        type === 'secret' && k.prefix ? `${k.prefix}…` : '',
+        k.type === 'secret' && k.prefix ? `${k.prefix}…` : '',
+        k.type === 'publishable' ? 'Publishable' : '',
         k.limit.length ? `Reaches ${k.limit.join(', ')}` : 'Unrestricted',
         when && !Number.isNaN(when.getTime()) ? `Created ${when.toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' })}` : '',
+        k.status !== 'active' ? k.status[0].toUpperCase() + k.status.slice(1) : '',
     ]
         .filter(Boolean)
         .join(' · ');
@@ -43,24 +40,21 @@ export function Keys() {
     if (!signed) {
         return (_jsxs(YStack, { gap: "$5", children: [_jsx(Heading, { title: "API keys" }), _jsx(Soft, { children: "Sign in to see your API keys." })] }));
     }
-    const held = (type) => list.value.find((k) => k.type === type);
-    return (_jsxs(YStack, { gap: "$5", children: [_jsx(Heading, { title: "API keys", detail: "Your own keys for calling api.hanzo.ai from code. You hold one of each; creating one ends the one before it." }), list.error ? (_jsx(Soft, { children: list.error.message })) : list.loading && list.value.length === 0 ? (_jsx(Soft, { children: "Reading your keys\u2026" })) : (_jsx(Card, { children: KINDS.map((type, i) => {
-                    const k = held(type);
-                    return (_jsxs(YStack, { borderTopWidth: i ? 1 : 0, borderColor: "$borderColor", children: [_jsx(Row, { first: true, title: NAME[type], detail: about(type, k), trailing: _jsxs(XStack, { gap: "$1.5", shrink: 0, children: [k ? (_jsx(Button, { size: "sm", variant: "ghost", "aria-label": `Revoke the ${type} key`, onPress: () => setRevoking(type), children: "Revoke" })) : null, _jsx(Button, { size: "sm", variant: "outline", "aria-label": `${k ? 'Rotate' : 'Create'} the ${type} key`, onPress: () => setMaking(type), children: k ? 'Rotate' : 'Create' })] }) }), type === 'publishable' && k?.key ? (_jsxs(XStack, { items: "center", gap: "$2", px: "$3", pb: "$2.5", children: [_jsx(SizableText, { flex: 1, minW: 0, size: "$1", color: "$soft", numberOfLines: 1, "aria-label": "Publishable key", style: { fontFamily: 'var(--f-mono, ui-monospace, monospace)' }, children: k.key }), _jsx(CopyButton, { value: k.key, label: "Copy publishable key" })] })) : null] }, type));
-                }) })), _jsx(Note, { children: note }), _jsx(Making, { type: making, rotating: making ? Boolean(held(making)) : false, onClose: () => setMaking(null), onMade: (m) => {
-                    setNote(`${NAME[m.type]} created`);
+    return (_jsxs(YStack, { gap: "$5", children: [_jsx(Heading, { title: "API keys", detail: "Your keys for calling api.hanzo.ai from code. Make one for each app; revoking one stops only that one." }), _jsx(XStack, { gap: "$2", children: KINDS.map((type) => (_jsx(Button, { size: "sm", variant: "outline", "aria-label": `Create a ${type} key`, onPress: () => setMaking(type), children: `Create ${NAME[type].toLowerCase()}` }, type))) }), list.error ? (_jsx(Soft, { children: list.error.message })) : list.loading && list.value.length === 0 ? (_jsx(Soft, { children: "Reading your keys\u2026" })) : list.value.length === 0 ? (_jsx(Soft, { children: "No keys yet." })) : (_jsx(Card, { children: list.value.map((k, i) => (_jsxs(YStack, { borderTopWidth: i ? 1 : 0, borderColor: "$borderColor", opacity: k.status === 'active' ? 1 : 0.55, children: [_jsx(Row, { first: true, title: k.name || NAME[k.type], detail: about(k), trailing: k.status === 'revoked' ? null : (_jsx(Button, { size: "sm", variant: "ghost", "aria-label": `Revoke ${k.name || k.id}`, onPress: () => setRevoking(k), children: "Revoke" })) }), k.type === 'publishable' && k.key ? (_jsxs(XStack, { items: "center", gap: "$2", px: "$3", pb: "$2.5", children: [_jsx(SizableText, { flex: 1, minW: 0, size: "$1", color: "$soft", numberOfLines: 1, "aria-label": "Publishable key", style: { fontFamily: 'var(--f-mono, ui-monospace, monospace)' }, children: k.key }), _jsx(CopyButton, { value: k.key, label: "Copy publishable key" })] })) : null] }, k.id))) })), _jsx(Note, { children: note }), _jsx(Making, { type: making, onClose: () => setMaking(null), onMade: (m) => {
+                    setNote(`${m.name || NAME[m.type]} created`);
                     list.reload();
-                } }), _jsx(Confirm, { open: revoking !== null, onOpenChange: (o) => !o && setRevoking(null), title: `Revoke your ${revoking ?? 'secret'} key?`, says: "It stops working within a minute, and anything using it is refused until it has a new one.", act: "Revoke", 
-                // It acts only while it is open, which is while a type is chosen.
+                } }), _jsx(Confirm, { open: revoking !== null, onOpenChange: (o) => !o && setRevoking(null), title: `Revoke ${revoking?.name || 'this key'}?`, says: "It stops working within a minute, and anything using it is refused. Your other keys keep working.", act: "Revoke", 
+                // It acts only while it is open, which is while a key is chosen.
                 run: async () => {
-                    await revoke(t, revoking);
-                    setNote(`${NAME[revoking]} revoked`);
+                    await revoke(t, revoking.id);
+                    setNote(`${revoking.name || NAME[revoking.type]} revoked`);
                     list.reload();
                 } })] }));
 }
-/** Creating or rotating one key: an optional limit, then the key itself, once. */
-function Making({ type, rotating, onClose, onMade }) {
+/** Creating one key: a name and an optional limit, then the key itself, once. */
+function Making({ type, onClose, onMade }) {
     const t = useTarget();
+    const [name, setName] = useState('');
     const [limit, setLimit] = useState('');
     const [made, setMade] = useState(null);
     const [working, setWorking] = useState(false);
@@ -68,6 +62,7 @@ function Making({ type, rotating, onClose, onMade }) {
     const close = () => {
         if (working)
             return;
+        setName('');
         setLimit('');
         setMade(null);
         setNote('');
@@ -86,7 +81,7 @@ function Making({ type, rotating, onClose, onMade }) {
         }
         setWorking(true);
         try {
-            const m = await mint(t, type, list);
+            const m = await mint(t, type, name, list);
             setMade(m);
             onMade(m);
         }
@@ -97,5 +92,5 @@ function Making({ type, rotating, onClose, onMade }) {
             setWorking(false);
         }
     };
-    return (_jsx(Dialog, { open: type !== null, onOpenChange: (o) => !o && close(), children: _jsxs(DialogContent, { maxW: 480, showCloseButton: false, children: [_jsx(DialogTitle, { children: made ? `Your new ${made.type} key` : `${rotating ? 'Rotate' : 'Create'} your ${type ?? ''} key` }), made ? (_jsxs(YStack, { gap: "$3", children: [made.type === 'secret' ? (_jsx(Once, { value: made.key, label: "Secret key" })) : (_jsxs(XStack, { items: "center", gap: "$2", px: "$3", py: "$3", rounded: "$3", borderWidth: 1, borderColor: "$borderColor", bg: "$raised", children: [_jsx(SizableText, { flex: 1, minW: 0, size: "$2", color: "$ink", style: { fontFamily: 'var(--f-mono, ui-monospace, monospace)', wordBreak: 'break-all' }, children: made.key }), _jsx(CopyButton, { value: made.key, label: "Copy publishable key" })] })), made.limit.length ? (_jsxs(SizableText, { size: "$1", color: "$soft", children: ["It reaches ", made.limit.join(', '), " and nothing else."] })) : null, _jsx(XStack, { justify: "flex-end", children: _jsx(Button, { size: "sm", onPress: close, children: "Done" }) })] })) : (_jsxs(YStack, { gap: "$3", children: [rotating ? (_jsxs(SizableText, { size: "$2", color: "$soft", children: ["The ", type, " key you have now stops working."] })) : null, _jsx(Field, { label: "Limit", hint: "Optional. What it may reach, as kind:name \u2014 model:zen5, project:acme, product:commerce. Empty reaches whatever you do.", children: _jsx(Input, { value: limit, onChangeText: setLimit, placeholder: "model:zen5, project:acme", "aria-label": "Limit", autoCapitalize: "none" }) }), note ? (_jsx(SizableText, { size: "$1", color: "$soft", role: "status", children: note })) : null, _jsxs(XStack, { gap: "$2", justify: "flex-end", children: [_jsx(Button, { size: "sm", variant: "ghost", disabled: working, onPress: close, children: "Cancel" }), _jsx(Button, { size: "sm", disabled: working, onPress: () => void go(type), children: rotating ? 'Rotate' : 'Create' })] })] }))] }) }));
+    return (_jsx(Dialog, { open: type !== null, onOpenChange: (o) => !o && close(), children: _jsxs(DialogContent, { maxW: 480, showCloseButton: false, children: [_jsx(DialogTitle, { children: made ? `Your new ${made.type} key` : `Create a ${type ?? ''} key` }), made ? (_jsxs(YStack, { gap: "$3", children: [made.type === 'secret' ? (_jsx(Once, { value: made.key, label: "Secret key" })) : (_jsxs(XStack, { items: "center", gap: "$2", px: "$3", py: "$3", rounded: "$3", borderWidth: 1, borderColor: "$borderColor", bg: "$raised", children: [_jsx(SizableText, { flex: 1, minW: 0, size: "$2", color: "$ink", style: { fontFamily: 'var(--f-mono, ui-monospace, monospace)', wordBreak: 'break-all' }, children: made.key }), _jsx(CopyButton, { value: made.key, label: "Copy publishable key" })] })), made.limit.length ? (_jsxs(SizableText, { size: "$1", color: "$soft", children: ["It reaches ", made.limit.join(', '), " and nothing else."] })) : null, _jsx(XStack, { justify: "flex-end", children: _jsx(Button, { size: "sm", onPress: close, children: "Done" }) })] })) : (_jsxs(YStack, { gap: "$3", children: [_jsx(Field, { label: "Name", hint: "What it is for, so you can tell it from your other keys.", children: _jsx(Input, { value: name, onChangeText: setName, placeholder: "production", "aria-label": "Name" }) }), _jsx(Field, { label: "Limit", hint: "Optional. What it may reach, as kind:name \u2014 model:zen5, project:acme, product:train, read:* for read-only. Empty reaches whatever you do.", children: _jsx(Input, { value: limit, onChangeText: setLimit, placeholder: "model:zen5, project:acme", "aria-label": "Limit", autoCapitalize: "none" }) }), note ? (_jsx(SizableText, { size: "$1", color: "$soft", role: "status", children: note })) : null, _jsxs(XStack, { gap: "$2", justify: "flex-end", children: [_jsx(Button, { size: "sm", variant: "ghost", disabled: working, onPress: close, children: "Cancel" }), _jsx(Button, { size: "sm", disabled: working, onPress: () => void go(type), children: "Create" })] })] }))] }) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/build",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "type": "module",
   "license": "Apache-2.0 OR MIT",
   "description": "Hanzo Build — say what you want, watch it built, deployed and running. The builder as a component, mounted by the Hanzo app at hanzo.ai.",