@jini-ai/admin 0.3.10 → 0.4.1

package/dist/react/shell/use-admin-shell-session.js

@@ -0,0 +1,81 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+/**
+ * Own session reads and invalidation without any host API imports.
+ * @param args Stable context and session port. Changing either starts a new session check.
+ * @returns Gate state plus refresh/logout actions; adapter failures become an error state.
+ */
+export function useAdminShellSession(args) {
+    const { context, port } = args;
+    const active = useRef(null);
+    const loggingOut = useRef(null);
+    const generation = useRef(0);
+    const [owned, setOwned] = useState({ context, port, state: { status: 'checking' } });
+    const run = useCallback(async (operation) => {
+        const owner = active.current;
+        if (!owner || owner.context !== context || owner.port !== port)
+            return;
+        // A refresh must not race a pending logout and restore a soon-to-be-revoked principal.
+        if (loggingOut.current === owner)
+            return;
+        if (operation === 'logout')
+            loggingOut.current = owner;
+        const request = ++generation.current;
+        const isCurrent = () => active.current === owner && generation.current === request;
+        setOwned({ context, port, state: { status: 'checking' } });
+        try {
+            if (operation === 'logout') {
+                await port.logout(context);
+                if (isCurrent())
+                    setOwned({ context, port, state: { status: 'anonymous' } });
+                return;
+            }
+            const session = await port.read(context);
+            if (!isCurrent())
+                return;
+            const state = session === null
+                ? { status: 'anonymous' }
+                : { status: 'authenticated', session };
+            setOwned({ context, port, state });
+        }
+        catch (error) {
+            // Local sign-out must complete even when the server cannot revoke its cookie. A read
+            // retry here would quietly restore that still-valid session instead of showing login.
+            if (isCurrent())
+                setOwned({ context, port, state: operation === 'logout'
+                        ? { status: 'anonymous' }
+                        : { status: 'error', error } });
+        }
+        finally {
+            if (operation === 'logout' && loggingOut.current === owner)
+                loggingOut.current = null;
+        }
+    }, [context, port]);
+    const refresh = useCallback(() => run('read'), [run]);
+    const logout = useCallback(() => run('logout'), [run]);
+    useEffect(() => {
+        const owner = { context, port };
+        active.current = owner;
+        const unsubscribe = port.onUnauthenticated({
+            ...context,
+            onUnauthenticated: () => {
+                if (active.current !== owner)
+                    return;
+                // Retire all older reads before clearing the gate; none may restore the principal.
+                generation.current += 1;
+                setOwned({ context, port, state: { status: 'anonymous' } });
+            },
+        });
+        void refresh();
+        return () => {
+            active.current = null;
+            generation.current += 1;
+            unsubscribe();
+        };
+    }, [context, port, refresh]);
+    // Mask the old workspace synchronously, before effect cleanup/initialization executes.
+    const state = owned.context === context && owned.port === port
+        ? owned.state
+        : { status: 'checking' };
+    return { state, refresh, logout };
+}
+//# sourceMappingURL=use-admin-shell-session.js.map

package/dist/react/shell/use-admin-theme.d.ts

@@ -0,0 +1,16 @@
+import { type AdminTheme, type ColorSchemePreference } from '@jini-ai/ui/theme';
+import type { AdminShellAppearance, AdminThemeEnvironment, AdminThemePreferenceStorePort } from './theme-ports.js';
+/** Keep effects inside the host's scope; storage reads/writes never use ambient browser state. */
+export declare function useAdminTheme({ userId, workspace }: {
+    readonly userId: string | null;
+    readonly workspace: Readonly<Record<string, string>>;
+}, { theme, colorScheme, environment, preferenceStore, onColorSchemeChange }?: {
+    readonly theme?: AdminTheme;
+    readonly colorScheme?: ColorSchemePreference;
+    readonly environment?: AdminThemeEnvironment;
+    readonly preferenceStore?: AdminThemePreferenceStorePort;
+    readonly onColorSchemeChange?: (args: {
+        readonly preference: ColorSchemePreference;
+    }) => void;
+}): AdminShellAppearance | undefined;
+//# sourceMappingURL=use-admin-theme.d.ts.map

package/dist/react/shell/use-admin-theme.js

@@ -0,0 +1,57 @@
+import { useCallback, useEffect, useState } from 'react';
+import { applyAdminTheme, resolveColorScheme } from '@jini-ai/ui/theme';
+/** Keep effects inside the host's scope; storage reads/writes never use ambient browser state. */
+export function useAdminTheme({ userId, workspace }, { theme, colorScheme, environment, preferenceStore, onColorSchemeChange } = {}) {
+    const scope = JSON.stringify([userId, Object.entries(workspace).sort(([a], [b]) => a.localeCompare(b))]);
+    const [saved, setSaved] = useState(null);
+    const [mediaRevision, setMediaRevision] = useState(0);
+    const preference = colorScheme ?? (saved?.scope === scope ? saved.preference : 'system');
+    useEffect(() => {
+        if (!userId || !preferenceStore) {
+            setSaved(null);
+            return;
+        }
+        const stored = preferenceStore.read({ userId, workspace });
+        setSaved(stored === 'light' || stored === 'dark' || stored === 'system' ? { scope, preference: stored } : null);
+    }, [userId, workspace, scope, preferenceStore]);
+    useEffect(() => {
+        if (!theme)
+            return;
+        if (!environment)
+            throw new TypeError('AdminShell theme requires a themeEnvironment port');
+        return applyAdminTheme({ theme }, environment);
+    }, [theme, environment]);
+    useEffect(() => {
+        if (!environment || preference !== 'system')
+            return;
+        const media = environment.matchMedia('(prefers-color-scheme: dark)');
+        const changed = () => setMediaRevision((revision) => revision + 1);
+        media.addEventListener?.('change', changed);
+        return () => media.removeEventListener?.('change', changed);
+    }, [environment, preference]);
+    // A revision refreshes the live media snapshot; explicit choices never query the OS.
+    void mediaRevision;
+    const resolved = environment ? resolveColorScheme({ preference }, { matchMedia: environment.matchMedia }) : 'light';
+    useEffect(() => {
+        if (!environment)
+            return;
+        const previous = environment.target.getAttribute('data-color-scheme');
+        environment.target.setAttribute('data-color-scheme', resolved);
+        return () => {
+            if (previous === null)
+                environment.target.removeAttribute('data-color-scheme');
+            else
+                environment.target.setAttribute('data-color-scheme', previous);
+        };
+    }, [environment, resolved]);
+    const setPreference = useCallback(({ preference: next }) => {
+        if (next !== 'light' && next !== 'dark' && next !== 'system')
+            throw new TypeError('Invalid color scheme preference');
+        if (userId && preferenceStore)
+            preferenceStore.write({ userId, workspace, preference: next });
+        setSaved({ scope, preference: next });
+        onColorSchemeChange?.({ preference: next });
+    }, [userId, preferenceStore, workspace, scope, onColorSchemeChange]);
+    return environment ? { preference, resolved, setPreference } : undefined;
+}
+//# sourceMappingURL=use-admin-theme.js.map

package/dist/react/types.d.ts

@@ -18,11 +18,13 @@
 export type ConfirmTone = 'default' | 'warning' | 'danger';
 /** Maps a tone onto the class name the host stylesheet is expected to define. `"default"` yields
  *  `undefined` — the plain button, no class. */
-export declare function toneClassName(tone: ConfirmTone): string | undefined;
+export declare function toneClassName({ tone }: {
+    readonly tone: ConfirmTone;
+}): string | undefined;
 /** `tone` wins when both `tone` and the deprecated `destructive` are passed; `destructive: true`
  *  alone still maps to `"danger"` (its only prior meaning) for callers that haven't migrated. */
-export declare function resolveTone(source: {
-    tone?: ConfirmTone;
-    destructive?: boolean;
+export declare function resolveTone(_requiredArgs: Record<string, never>, source?: {
+    tone?: ConfirmTone | undefined;
+    destructive?: boolean | undefined;
 }): ConfirmTone;
 //# sourceMappingURL=types.d.ts.map

package/dist/react/types.js

@@ -8,7 +8,7 @@
  */
 /** Maps a tone onto the class name the host stylesheet is expected to define. `"default"` yields
  *  `undefined` — the plain button, no class. */
-export function toneClassName(tone) {
+export function toneClassName({ tone }) {
     if (tone === 'danger')
         return 'btn-danger';
     if (tone === 'warning')
@@ -17,7 +17,7 @@ export function toneClassName(tone) {
 }
 /** `tone` wins when both `tone` and the deprecated `destructive` are passed; `destructive: true`
  *  alone still maps to `"danger"` (its only prior meaning) for callers that haven't migrated. */
-export function resolveTone(source) {
+export function resolveTone(_requiredArgs, source = {}) {
     return source.tone ?? (source.destructive ? 'danger' : 'default');
 }
 //# sourceMappingURL=types.js.map

package/dist/react/use-controller.d.ts

@@ -0,0 +1,16 @@
+import type { DependencyList } from 'react';
+import type { ControllerStore } from '../core/module/controller-store.js';
+/** Factory runs after commit, never during render. Each effect attachment owns a fresh
+ * controller, so StrictMode's cleanup/replay cannot revive a disposed controller. */
+export declare function useController<C extends ControllerStore<unknown>>({ create, dependencies }: {
+    create: () => C;
+    dependencies: DependencyList;
+}, { start, }?: {
+    start?: (required: {
+        controller: C;
+    }, optional?: Record<string, never>) => void;
+}): {
+    controller: C | null;
+    snapshot: ReturnType<C["getSnapshot"]> | null;
+};
+//# sourceMappingURL=use-controller.d.ts.map

package/dist/react/use-controller.js

@@ -0,0 +1,18 @@
+import { useEffect, useState, useSyncExternalStore, useCallback } from 'react';
+/** Factory runs after commit, never during render. Each effect attachment owns a fresh
+ * controller, so StrictMode's cleanup/replay cannot revive a disposed controller. */
+export function useController({ create, dependencies }, { start, } = {}) {
+    const [controller, setController] = useState(null);
+    useEffect(() => {
+        const current = create();
+        setController(current);
+        start?.({ controller: current });
+        return () => current.dispose();
+        // Dependencies are explicitly supplied by the owning hook, like useMemo's contract.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, dependencies);
+    const subscribe = useCallback((listener) => controller?.subscribe({ listener }) ?? (() => { }), [controller]);
+    const snapshot = useSyncExternalStore(subscribe, () => (controller?.getSnapshot() ?? null), () => null);
+    return { controller, snapshot };
+}
+//# sourceMappingURL=use-controller.js.map

package/dist/security/adapters/http.d.ts

@@ -0,0 +1,16 @@
+import type { SecurityApiPort, SecurityTransportPort, OtherCredentialsPort, RootKeyPort } from '../ports.js';
+export declare function createHttpSecurityApi({ transport, workspacePath }: {
+    transport: SecurityTransportPort;
+    workspacePath: string;
+}, _optional?: {}): SecurityApiPort;
+export declare function createHttpOtherCredentials({ transport, workspacePath }: {
+    transport: SecurityTransportPort;
+    workspacePath: string;
+}, { mediaLabels }?: {
+    mediaLabels?: Readonly<Record<string, string>>;
+}): OtherCredentialsPort;
+export declare function createHttpRootKey({ transport, workspacePath }: {
+    transport: SecurityTransportPort;
+    workspacePath: string;
+}, _optional?: {}): RootKeyPort;
+//# sourceMappingURL=http.d.ts.map

package/dist/security/adapters/http.js

@@ -0,0 +1,94 @@
+/** Explicit projection strips accidental server extras, including token/ciphertext/hex. */
+function summary(row, kind) {
+    return Object.freeze({ kind, id: row.id, providerId: row.providerId ?? '', label: row.label, configured: row.configured, isDefault: row.isDefault ?? false, createdAt: row.createdAt, updatedAt: row.updatedAt,
+        ...(row.accountLabel !== undefined ? { accountLabel: row.accountLabel } : {}), ...(kind === 'custom' ? { category: row.category ?? 'general', baseUrl: row.baseUrl ?? '', additionalHosts: Object.freeze([...(row.additionalHosts ?? [])]), ...(row.username ? { username: row.username } : {}) } : {}) });
+}
+export function createHttpSecurityApi({ transport, workspacePath }, _optional = {}) {
+    const base = workspacePath.replace(/\/$/, '');
+    function store(kind, suffix) {
+        const path = `${base}/system/${suffix}/credentials`;
+        async function mutate(method, target, body, options) { options.signal?.throwIfAborted(); const r = await transport.request({ method, path: target, body }, options); return summary(r.credential, kind); }
+        return {
+            async list(_r, options = {}) { options.signal?.throwIfAborted(); const r = await transport.request({ method: 'GET', path }, options); return Object.freeze(r.credentials.map(row => summary(row, kind))); },
+            create(input, options = {}) { return mutate('POST', path, input, options); },
+            update({ id, patch }, options = {}) { return mutate('PUT', `${path}/${encodeURIComponent(id)}`, patch, options); },
+            async remove({ id }, options = {}) { options.signal?.throwIfAborted(); await transport.request({ method: 'DELETE', path: `${path}/${encodeURIComponent(id)}` }, options); },
+        };
+    }
+    return {
+        async providers(_r, options = {}) {
+            options.signal?.throwIfAborted();
+            const [publish, source] = await Promise.all([
+                transport.request({ method: 'GET', path: `${base}/system/publish-targets` }, options),
+                transport.request({ method: 'GET', path: `${base}/system/source-control/providers` }, options),
+            ]);
+            const map = (kind, d) => ({ kind, id: d.id, label: d.label, vendorLabel: d.credential?.vendorLabel ?? d.label, category: kind === 'publish' ? 'hosting' : 'source-control', tokenField: d.credential?.tokenField ?? 'token', fields: d.credential?.fields ?? [], ...(d.credential?.tokenPageUrl ? { tokenPageUrl: d.credential.tokenPageUrl } : {}), ...((d.credential?.userHelp ?? d.credential?.help) ? { help: d.credential.userHelp ?? d.credential.help } : {}) });
+            return [...publish.targets.filter(d => d.credential).map(d => map('publish', d)), ...source.providers.map(d => map('source-control', d))];
+        },
+        publish: store('publish', 'publish'), sourceControl: store('source-control', 'source-control'), custom: store('custom', 'custom'),
+    };
+}
+/** Replacing the ENTIRE map requires sibling settings unchanged. Blank apiKey preserves their stored keys. */
+function rebuildMedia(current, id, token) {
+    const next = {};
+    for (const [key, entry] of Object.entries(current)) {
+        if (key === id && token === undefined)
+            continue;
+        next[key] = { ...(entry.baseUrl !== undefined ? { baseUrl: entry.baseUrl } : {}), ...(entry.model !== undefined ? { model: entry.model } : {}), ...(key === id && token !== undefined ? { apiKey: token } : {}) };
+    }
+    return next;
+}
+export function createHttpOtherCredentials({ transport, workspacePath }, { mediaLabels = {} } = {}) {
+    const base = workspacePath.replace(/\/$/, '');
+    const singles = { 'site-assistant': { path: '/assistant/site-credential', label: 'Assistant model key' }, 'admin-byok': { path: '/assistant/execution-credential', label: 'Admin model key' } };
+    async function request(path, method, options, body) { options.signal?.throwIfAborted(); return transport.request({ path: `${base}${path}`, method, ...(body !== undefined ? { body } : {}) }, options); }
+    return {
+        async list({ store }, options = {}) {
+            if (store === 'site-assistant' || store === 'admin-byok') {
+                const r = await request(singles[store].path, 'GET', options);
+                return r.data.isSet ? [{ store, id: store, label: singles[store].label, category: 'ai', configured: true, supportsReplace: true, updatedAt: r.data.updatedAt }] : [];
+            }
+            if (store === 'media-provider') {
+                const map = await request('/media/providers', 'GET', options);
+                return Object.entries(map).filter(([, entry]) => entry.apiKeyConfigured).map(([id]) => ({ store, id, label: mediaLabels[id] ?? id, category: 'media', configured: true, supportsReplace: true }));
+            }
+            const { servers } = await request('/mcp-servers', 'GET', options);
+            return servers.map(s => ({ store, id: s.serverId, label: s.label, category: 'ai', configured: true, supportsReplace: false, envNames: Object.freeze([...s.envNames]) }));
+        },
+        async replace({ store, id, token }, options = {}) {
+            if (!token.trim())
+                throw new Error('Enter a credential');
+            if (store === 'external-mcp')
+                throw new Error('Edit the full server configuration on its own screen');
+            if (store === 'media-provider') {
+                const current = await request('/media/providers', 'GET', options);
+                await request('/media/providers', 'PUT', options, rebuildMedia(current, id, token));
+            }
+            else
+                await request(singles[store].path, 'PUT', options, { apiKey: token });
+        },
+        async remove({ store, id }, options = {}) {
+            if (store === 'media-provider') {
+                const current = await request('/media/providers', 'GET', options);
+                await request('/media/providers', 'PUT', options, rebuildMedia(current, id));
+            }
+            else if (store === 'external-mcp')
+                await request(`/mcp-servers/${encodeURIComponent(id)}`, 'DELETE', options);
+            else
+                await request(singles[store].path, 'DELETE', options);
+        },
+    };
+}
+export function createHttpRootKey({ transport, workspacePath }, _optional = {}) {
+    const path = `${workspacePath.replace(/\/$/, '')}/system/site-token`;
+    async function request(suffix, method, options, body) { options.signal?.throwIfAborted(); return transport.request({ path: `${path}${suffix}`, method, ...(body !== undefined ? { body } : {}) }, options); }
+    function result(r) { return { outcome: r.outcome, fingerprint: r.fingerprint, keyFilePath: r.keyFilePath, runtimeMode: r.runtimeMode, ...(r.resealed !== undefined ? { resealed: r.resealed } : {}), ...(r.discarded !== undefined ? { discarded: r.discarded } : {}), ...(r.kept !== undefined ? { kept: r.kept } : {}), ...(r.restorePointId ? { restorePointId: r.restorePointId } : {}), ...(r.affectedWebhooks ? { affectedWebhooks: r.affectedWebhooks.map(w => ({ label: w.label, targetUrl: w.targetUrl })) } : {}) }; }
+    return {
+        async status(_r, o = {}) { const r = await request('', 'GET', o); return { active: r.active, source: r.source, state: r.state, keyFilePath: r.keyFilePath, runtimeMode: r.runtimeMode, ...(r.fingerprint ? { fingerprint: r.fingerprint } : {}), ...(r.invalid !== undefined ? { invalid: r.invalid } : {}) }; },
+        async generate(_r, o = {}) { return result(await request('/generate', 'POST', o)); },
+        async importToken({ token }, o = {}) { return result(await request('/import', 'POST', o, { token })); },
+        async previewStartFresh(_r, o = {}) { const r = await request('/start-fresh', 'GET', o); return { removes: r.removes, detail: r.detail, runtimeMode: r.runtimeMode, affectedWebhooks: r.affectedWebhooks.map(w => ({ label: w.label, targetUrl: w.targetUrl })) }; },
+        async startFresh({ confirm }, o = {}) { return result(await request('/start-fresh', 'POST', o, { confirm })); },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/security/adapters/memory.d.ts

@@ -0,0 +1,15 @@
+import type { SecurityApiPort, OtherCredentialsPort, RootKeyPort } from '../ports.js';
+import type { CredentialSummary, CredentialProvider, OtherCredentialSummary, RootKeyStatus, RootKeyPreview } from '../models.js';
+/** Fake backend: retains only read models, never credential material. */
+export declare function createMemorySecurityApi({ providers, rows }: {
+    providers?: readonly CredentialProvider[];
+    rows?: readonly CredentialSummary[];
+}, _optional?: {}): SecurityApiPort;
+export declare function createMemoryOtherCredentials({ rows }: {
+    rows?: readonly OtherCredentialSummary[];
+}, _optional?: {}): OtherCredentialsPort;
+export declare function createMemoryRootKey({ status, preview }: {
+    status?: RootKeyStatus;
+    preview?: RootKeyPreview;
+}, _optional?: {}): RootKeyPort;
+//# sourceMappingURL=memory.d.ts.map

package/dist/security/adapters/memory.js

@@ -0,0 +1,60 @@
+import { START_FRESH_CONFIRMATION } from '../rules.js';
+/** Fake backend: retains only read models, never credential material. */
+export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
+    let items = rows.map(r => Object.freeze({ ...r }));
+    let sequence = 0;
+    function store(kind) {
+        function project(id, patch, providerId, initial) {
+            const now = new Date().toISOString();
+            return Object.freeze({ kind, id, providerId, label: patch.label ?? initial?.label ?? '', configured: true, isDefault: kind === 'custom' ? false : patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId), createdAt: initial?.createdAt ?? now, updatedAt: now,
+                ...(kind === 'custom' ? { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]), ...((patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) ? { username: (patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) } : {}) } : {}),
+            });
+        }
+        function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
+            throw new Error('Duplicate label'); }
+        function insert(row) {
+            if (row.isDefault)
+                items = items.map(r => r.kind === kind && r.providerId === row.providerId ? Object.freeze({ ...r, isDefault: false }) : r);
+            items = [...items.filter(r => !(r.kind === kind && r.id === row.id)), row];
+            return row;
+        }
+        return {
+            async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
+            async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
+                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project(`credential-${++sequence}`, input, providerId)); },
+            async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
+                throw new Error('Credential not found'); check(patch.label ?? old.label, old.providerId, id); return insert(project(id, patch, old.providerId, old)); },
+            async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
+                const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
+                if (next)
+                    insert(Object.freeze({ ...next, isDefault: true }));
+            } },
+        };
+    }
+    return { async providers(_r, o = {}) { o.signal?.throwIfAborted(); return providers; }, publish: store('publish'), sourceControl: store('source-control'), custom: store('custom') };
+}
+export function createMemoryOtherCredentials({ rows = [] }, _optional = {}) {
+    let items = rows.map(row => Object.freeze({ ...row }));
+    return {
+        async list({ store }, o = {}) { o.signal?.throwIfAborted(); return items.filter(r => r.store === store); },
+        async replace({ store, id, token }, o = {}) { o.signal?.throwIfAborted(); const row = items.find(r => r.store === store && r.id === id); if (!row?.supportsReplace || !token.trim())
+            throw new Error('Replacement unavailable'); items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r); },
+        async remove({ store, id }, o = {}) { o.signal?.throwIfAborted(); items = items.filter(r => r.store !== store || r.id !== id); },
+    };
+}
+export function createMemoryRootKey({ status = { active: false, source: 'none', state: 'missing', keyFilePath: '/memory/key', runtimeMode: 'local' }, preview = { removes: 0, affectedWebhooks: [], detail: 'Remove saved credentials and create a new root key.', runtimeMode: 'local' } }, _optional = {}) {
+    let current = Object.freeze({ ...status });
+    function activate(outcome) { current = Object.freeze({ ...current, active: true, state: 'active', source: 'file', fingerprint: 'memory-fingerprint' }); return { outcome, fingerprint: 'memory-fingerprint', keyFilePath: current.keyFilePath, runtimeMode: current.runtimeMode }; }
+    return {
+        async status(_r, o = {}) { o.signal?.throwIfAborted(); return current; },
+        async generate(_r, o = {}) { o.signal?.throwIfAborted(); if (current.active)
+            return { ...activate('already-active') }; if (current.state !== 'missing')
+            throw new Error('Key dependent data'); return activate('created'); },
+        async importToken({ token }, o = {}) { o.signal?.throwIfAborted(); if (!/^[0-9a-f]{64}$/i.test(token))
+            throw new Error('Invalid token'); return { ...activate('unlocked'), resealed: 0 }; },
+        async previewStartFresh(_r, o = {}) { o.signal?.throwIfAborted(); return preview; },
+        async startFresh({ confirm }, o = {}) { o.signal?.throwIfAborted(); if (confirm !== START_FRESH_CONFIRMATION)
+            throw new Error('Confirmation required'); return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' }; },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/dist/security/conformance/security-api.conformance.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityApiPort } from '../ports.js';
+import type { CredentialProvider } from '../models.js';
+/** Use a disposable backend: this contract creates, updates and removes credentials. */
+export declare function runSecurityApiConformance({ createApi, provider }: {
+    createApi: (required: Record<string, never>, optional?: Record<string, never>) => SecurityApiPort | Promise<SecurityApiPort>;
+    provider: CredentialProvider;
+}, _optional?: {}): Promise<{
+    passed: number;
+}>;
+//# sourceMappingURL=security-api.conformance.d.ts.map

package/dist/security/conformance/security-api.conformance.js

@@ -0,0 +1,48 @@
+import { credentialStore } from '../rules.js';
+/** Use a disposable backend: this contract creates, updates and removes credentials. */
+export async function runSecurityApiConformance({ createApi, provider }, _optional = {}) {
+    const api = await createApi({}), target = credentialStore({ api, kind: provider.kind });
+    let passed = 0;
+    function check(value, message) { if (!value)
+        throw new Error(`Security contract: ${message}`); passed++; }
+    const suffix = `${Date.now()}-${Math.random()}`;
+    const secret = `contract-secret-${suffix}`;
+    const connection = { providerId: provider.id, [provider.tokenField]: secret, ...Object.fromEntries(provider.fields.filter(f => f.name !== provider.tokenField).map(f => [f.name, 'test-value'])) };
+    const ids = [];
+    try {
+        const a = await target.create({ label: `First ${suffix}`, connection }, {});
+        ids.push(a.id);
+        check(a.configured, 'create produces configured summary');
+        check(!JSON.stringify(a).includes(secret), 'create cannot return secret');
+        const b = await target.create({ label: `Second ${suffix}`, connection }, {});
+        ids.push(b.id);
+        const renamed = await target.update({ id: a.id, patch: { label: `Renamed ${suffix}` } }, {});
+        check(renamed.id === a.id && renamed.label === `Renamed ${suffix}`, 'metadata update preserves identity');
+        const replaced = await target.update({ id: a.id, patch: { connection } }, {});
+        check(!JSON.stringify(replaced).includes(secret), 'replacement cannot return secret');
+        await target.update({ id: b.id, patch: { isDefault: true } }, {});
+        const listed = await target.list({}, {});
+        check(listed.filter(r => r.providerId === provider.id && r.isDefault).length === 1 && listed.find(r => r.id === b.id)?.isDefault === true, 'one server-owned default');
+        await target.remove({ id: b.id }, {});
+        const remaining = await target.list({}, {});
+        check(!remaining.some(r => r.id === b.id) && remaining.some(r => r.providerId === provider.id && r.isDefault), 'remove promotes remaining connection');
+        await target.remove({ id: b.id }, {});
+        check(true, 'remove is idempotent');
+        const abort = new AbortController();
+        abort.abort();
+        let refused = false;
+        try {
+            await target.create({ label: `Aborted ${suffix}`, connection }, { signal: abort.signal });
+        }
+        catch {
+            refused = true;
+        }
+        check(refused && !(await target.list({}, {})).some(r => r.label === `Aborted ${suffix}`), 'aborted mutation writes nothing');
+    }
+    finally {
+        for (const id of ids)
+            await target.remove({ id }, {});
+    }
+    return { passed };
+}
+//# sourceMappingURL=security-api.conformance.js.map

package/dist/security/controllers/access-tokens.controller.d.ts

@@ -0,0 +1,44 @@
+import type { SecurityApiPort } from '../ports.js';
+import type { CredentialSummary, CredentialProvider, CredentialDraft, CredentialKind, CredentialCategory } from '../models.js';
+export declare function createAccessTokensController({ api, permissions }: {
+    api: SecurityApiPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        rows: readonly CredentialSummary[];
+        providers: readonly CredentialProvider[];
+        draft: CredentialDraft | null;
+        loading: boolean;
+        saving: boolean;
+        error: string | null;
+        errors: Readonly<Record<string, string>>;
+        query: string;
+        category: CredentialCategory | "all";
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    begin: ({ row, kind, providerId }: {
+        row?: CredentialSummary;
+        kind?: CredentialKind;
+        providerId?: string;
+    }, _optional?: {}) => void;
+    save: (_required: Record<string, never>, _optional?: {}) => Promise<boolean>;
+    setDraft({ patch }: {
+        patch: Partial<Omit<CredentialDraft, "kind" | "id" | "providerId">>;
+    }, _optional?: {}): void;
+    cancel(_required: Record<string, never>, _optional?: {}): void;
+    filter({ query, category }: {
+        query?: string;
+        category?: CredentialCategory | "all";
+    }, _optional?: {}): void;
+    remove({ row }: {
+        row: CredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    makeDefault({ row }: {
+        row: CredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=access-tokens.controller.d.ts.map

package/dist/security/controllers/access-tokens.controller.js

@@ -0,0 +1,112 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { blankCredentialDraft, buildCredentialPatch, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+export function createAccessTokensController({ api, permissions = [] }, _optional = {}) {
+    const grants = new Set(permissions);
+    const store = createControllerStore({ initial: { rows: [], providers: [], draft: null, loading: false, saving: false, error: null, errors: {}, query: '', category: 'all' } });
+    let generation = 0;
+    const allowed = (kind) => !store.signal.aborted && grants.has('security.read') && grants.has(writePermission({ kind }));
+    async function load(_required, _optional = {}) {
+        if (store.signal.aborted || !grants.has('security.read'))
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        // Independent stores retain their own successful results; one unavailable store cannot hide the rest.
+        const kinds = ['publish', 'source-control', 'custom'];
+        const tasks = kinds.map(async (kind) => {
+            try {
+                const rows = await credentialStore({ api, kind }).list({}, { signal: store.signal });
+                if (ticket === generation) {
+                    const errors = { ...store.getSnapshot().errors };
+                    delete errors[kind];
+                    store.set({ patch: { rows: Object.freeze([...store.getSnapshot().rows.filter(r => r.kind !== kind), ...rows]), errors } });
+                }
+            }
+            catch {
+                if (ticket === generation)
+                    store.set({ patch: { errors: { ...store.getSnapshot().errors, [kind]: 'Credential store unavailable' } } });
+            }
+        });
+        tasks.push((async () => { try {
+            const providers = await api.providers({}, { signal: store.signal });
+            if (ticket === generation)
+                store.set({ patch: { providers, error: null } });
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { error: 'Provider catalog unavailable' } });
+        } })());
+        await Promise.all(tasks);
+        if (ticket === generation)
+            store.set({ patch: { loading: false } });
+    }
+    function begin({ row, kind, providerId }, _optional = {}) {
+        const k = row?.kind ?? kind ?? 'custom';
+        if (!allowed(k) || store.getSnapshot().saving)
+            return;
+        const draft = row ? { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers: store.getSnapshot().providers }), category: row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' } : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
+        store.set({ patch: { draft, error: null } });
+    }
+    async function save(_required, _optional = {}) {
+        const state = store.getSnapshot(), draft = state.draft;
+        if (!draft || !allowed(draft.kind) || state.saving)
+            return false;
+        const error = validateCredentialDraft({ draft, rows: state.rows, providers: state.providers });
+        if (error) {
+            store.set({ patch: { error } });
+            return false;
+        }
+        const patch = buildCredentialPatch({ draft, providers: state.providers });
+        const target = credentialStore({ api, kind: draft.kind });
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
+            // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
+            store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
+            // First-create default assignment can change siblings; the server owns that invariant.
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Unable to save credential' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    async function write({ row, remove }) {
+        if (!allowed(row.kind) || store.getSnapshot().saving)
+            return false;
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const target = credentialStore({ api, kind: row.kind });
+            if (remove)
+                await target.remove({ id: row.id }, { signal: store.signal });
+            else
+                await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            // Remove/default can promote another row. Refetch rather than duplicating server promotion rules.
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Unable to update credential' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load, begin, save,
+        setDraft({ patch }, _optional = {}) { const draft = store.getSnapshot().draft; if (draft && allowed(draft.kind) && !store.getSnapshot().saving)
+            store.set({ patch: { draft: { ...draft, ...patch } } }); },
+        cancel(_required, _optional = {}) { if (!store.getSnapshot().saving)
+            store.set({ patch: { draft: null, error: null } }); },
+        filter({ query, category }, _optional = {}) { store.set({ patch: { ...(query !== undefined ? { query } : {}), ...(category ? { category } : {}) } }); },
+        remove({ row }, _optional = {}) { return write({ row, remove: true }); },
+        makeDefault({ row }, _optional = {}) { if (row.kind === 'custom')
+            return Promise.resolve(false); return write({ row, remove: false }); },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=access-tokens.controller.js.map