@jini-ai/admin 0.3.10 → 0.4.1

package/dist/security/controllers/other-credentials.controller.d.ts

@@ -0,0 +1,30 @@
+import type { OtherCredentialsPort } from '../ports.js';
+import type { OtherCredentialSummary } from '../models.js';
+export declare function createOtherCredentialsController({ api, permissions }: {
+    api: OtherCredentialsPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        rows: readonly OtherCredentialSummary[];
+        drafts: Readonly<Record<string, string>>;
+        errors: Readonly<Record<string, string>>;
+        loading: boolean;
+        saving: boolean;
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    setDraft({ key, token }: {
+        key: string;
+        token: string;
+    }, _optional?: {}): void;
+    replace({ row }: {
+        row: OtherCredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    remove({ row }: {
+        row: OtherCredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=other-credentials.controller.d.ts.map

package/dist/security/controllers/other-credentials.controller.js

@@ -0,0 +1,74 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { OTHER_STORES, otherWritePermission } from '../rules.js';
+export function createOtherCredentialsController({ api, permissions = [] }, _optional = {}) {
+    const grants = new Set(permissions);
+    let generation = 0;
+    const store = createControllerStore({ initial: { rows: [], drafts: {}, errors: {}, loading: false, saving: false } });
+    async function read(id, ticket) {
+        try {
+            const rows = await api.list({ store: id }, { signal: store.signal });
+            if (ticket === generation) {
+                const errors = { ...store.getSnapshot().errors };
+                delete errors[id];
+                store.set({ patch: { rows: [...store.getSnapshot().rows.filter(r => r.store !== id), ...rows], errors } });
+            }
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { errors: { ...store.getSnapshot().errors, [id]: 'Credential store unavailable' } } });
+        }
+    }
+    async function load(_required, _optional = {}) {
+        if (store.signal.aborted || !grants.has('security.read'))
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        await Promise.all(OTHER_STORES.map(id => read(id, ticket)));
+        if (ticket === generation)
+            store.set({ patch: { loading: false } });
+    }
+    // One serial lane: whole-map media writes must read only after the previous write/refetch settled.
+    // This is tab-local; cross-session races still require a server concurrency check.
+    let lane = Promise.resolve();
+    function write(row, remove) {
+        if (store.signal.aborted || !grants.has('security.read') || !grants.has(otherWritePermission({ store: row.store })) || (!remove && !row.supportsReplace))
+            return Promise.resolve(false);
+        const token = store.getSnapshot().drafts[`${row.store}:${row.id}`]?.trim() ?? '';
+        if (!remove && !token)
+            return Promise.resolve(false);
+        const run = lane.then(async () => {
+            if (store.signal.aborted)
+                return false;
+            store.set({ patch: { saving: true } });
+            try {
+                if (remove)
+                    await api.remove({ store: row.store, id: row.id }, { signal: store.signal });
+                else
+                    await api.replace({ store: row.store, id: row.id, token }, { signal: store.signal });
+                const drafts = { ...store.getSnapshot().drafts };
+                delete drafts[`${row.store}:${row.id}`];
+                store.set({ patch: { drafts } });
+                await read(row.store, generation);
+                return !store.signal.aborted;
+            }
+            catch {
+                store.set({ patch: { errors: { ...store.getSnapshot().errors, [row.store]: 'Unable to update credential' } } });
+                return false;
+            }
+            finally {
+                store.set({ patch: { saving: false } });
+            }
+        });
+        lane = run.then(() => undefined);
+        return run;
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
+        setDraft({ key, token }, _optional = {}) { if (!store.signal.aborted && !store.getSnapshot().saving)
+            store.set({ patch: { drafts: { ...store.getSnapshot().drafts, [key]: token } } }); },
+        replace({ row }, _optional = {}) { return write(row, false); },
+        remove({ row }, _optional = {}) { return write(row, true); },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=other-credentials.controller.js.map

package/dist/security/controllers/root-key.controller.d.ts

@@ -0,0 +1,35 @@
+import type { RootKeyPort } from '../ports.js';
+import type { RootKeyStatus, RootKeyPreview } from '../models.js';
+export declare function createRootKeyController({ api, permissions }: {
+    api: RootKeyPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        status: RootKeyStatus | null;
+        preview: RootKeyPreview | null;
+        token: string;
+        confirm: string;
+        loading: boolean;
+        saving: boolean;
+        error: string | null;
+        result: string | null;
+        confirming: boolean;
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    setToken({ value }: {
+        value: string;
+    }, _optional?: {}): void;
+    setConfirm({ value }: {
+        value: string;
+    }, _optional?: {}): void;
+    generate(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    importToken(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    preview(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    startFresh(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    cancel(_required: Record<string, never>, _optional?: {}): void;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=root-key.controller.d.ts.map

package/dist/security/controllers/root-key.controller.js

@@ -0,0 +1,90 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
+    const granted = permissions.includes(ROOT_KEY_PERMISSION);
+    const store = createControllerStore({ initial: { status: null, preview: null, token: '', confirm: '', loading: false, saving: false, error: null, result: null, confirming: false } });
+    let generation = 0;
+    const allowed = () => granted && !store.signal.aborted;
+    async function load(_required, _optional = {}) {
+        if (!allowed())
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        try {
+            const status = await api.status({}, { signal: store.signal });
+            if (ticket === generation)
+                store.set({ patch: { status, error: null } });
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { error: 'Root key status unavailable' } });
+        }
+        finally {
+            if (ticket === generation)
+                store.set({ patch: { loading: false } });
+        }
+    }
+    async function execute(run, result) {
+        if (!allowed() || store.getSnapshot().saving)
+            return false;
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const response = await run();
+            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: response.affectedWebhooks?.length ? `${result} Update receivers: ${response.affectedWebhooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result } });
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Recovery refused. Check the host key configuration.' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
+        setToken({ value }, _optional = {}) { if (allowed() && !store.getSnapshot().saving)
+            store.set({ patch: { token: value } }); },
+        setConfirm({ value }, _optional = {}) { if (allowed() && !store.getSnapshot().saving)
+            store.set({ patch: { confirm: value } }); },
+        generate(_required, _optional = {}) {
+            const status = store.getSnapshot().status;
+            // No rotate/replace: replacing an active key would orphan every secret sealed under it.
+            if (!status || status.active || status.state !== 'missing')
+                return Promise.resolve(false);
+            return execute(() => api.generate({}, { signal: store.signal }), 'Root key ready');
+        },
+        importToken(_required, _optional = {}) { const token = store.getSnapshot().token.trim(); return token && isRootKeyLocked({ status: store.getSnapshot().status }) ? execute(() => api.importToken({ token }, { signal: store.signal }), 'Unlocked. Saved credentials work again.') : Promise.resolve(false); },
+        async preview(_required, _optional = {}) {
+            if (!allowed() || !isRootKeyLocked({ status: store.getSnapshot().status }) || store.getSnapshot().saving || store.getSnapshot().loading)
+                return false;
+            const ticket = ++generation;
+            store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
+            try {
+                const preview = await api.previewStartFresh({}, { signal: store.signal });
+                if (ticket !== generation || !allowed())
+                    return false;
+                store.set({ patch: { preview, confirming: true } });
+                return true;
+            }
+            catch {
+                if (ticket === generation)
+                    store.set({ patch: { error: 'Recovery preview unavailable' } });
+                return false;
+            }
+            finally {
+                if (ticket === generation)
+                    store.set({ patch: { loading: false } });
+            }
+        },
+        startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
+            return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },
+        cancel(_required, _optional = {}) { if (!store.getSnapshot().saving) {
+            generation++;
+            store.set({ patch: { confirming: false, preview: null, confirm: '', loading: false } });
+        } },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=root-key.controller.js.map

package/dist/security/index.d.ts

@@ -0,0 +1,9 @@
+export { securityModule } from './security.module.js';
+export * from './models.js';
+export * from './ports.js';
+export * from './rules.js';
+export { securityMessagesEn } from './messages.en.js';
+export { createAccessTokensController } from './controllers/access-tokens.controller.js';
+export { createOtherCredentialsController } from './controllers/other-credentials.controller.js';
+export { createRootKeyController } from './controllers/root-key.controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.js

@@ -0,0 +1,9 @@
+export { securityModule } from './security.module.js';
+export * from './models.js';
+export * from './ports.js';
+export * from './rules.js';
+export { securityMessagesEn } from './messages.en.js';
+export { createAccessTokensController } from './controllers/access-tokens.controller.js';
+export { createOtherCredentialsController } from './controllers/other-credentials.controller.js';
+export { createRootKeyController } from './controllers/root-key.controller.js';
+//# sourceMappingURL=index.js.map

package/dist/security/messages.en.d.ts

@@ -0,0 +1,12 @@
+export declare const securityMessagesEn: {
+    readonly security: "Secrets";
+    readonly accessTokens: "Access tokens";
+    readonly rootKey: "Root key";
+    readonly denied: "Permission denied";
+    readonly loading: "Loading credentials…";
+    readonly remove: "Remove credential";
+    readonly replace: "Replace";
+    readonly save: "Save";
+    readonly cancel: "Cancel";
+};
+//# sourceMappingURL=messages.en.d.ts.map

package/dist/security/messages.en.js

@@ -0,0 +1,2 @@
+export const securityMessagesEn = { security: 'Secrets', accessTokens: 'Access tokens', rootKey: 'Root key', denied: 'Permission denied', loading: 'Loading credentials…', remove: 'Remove credential', replace: 'Replace', save: 'Save', cancel: 'Cancel' };
+//# sourceMappingURL=messages.en.js.map

package/dist/security/models.d.ts

@@ -0,0 +1,112 @@
+export type CredentialKind = 'publish' | 'source-control' | 'custom';
+export type CredentialCategory = 'source-control' | 'hosting' | 'media' | 'ai' | 'ops' | 'general';
+export interface RequestOptions {
+    readonly signal?: AbortSignal;
+}
+export interface CredentialField {
+    readonly name: string;
+    readonly label: string;
+    readonly required?: boolean;
+    readonly secret?: boolean;
+    readonly type?: string;
+    readonly help?: string;
+}
+export interface CredentialProvider {
+    readonly kind: Exclude<CredentialKind, 'custom'>;
+    readonly id: string;
+    readonly label: string;
+    readonly vendorLabel: string;
+    readonly category: CredentialCategory;
+    readonly tokenField: string;
+    readonly fields: readonly CredentialField[];
+    readonly tokenPageUrl?: string;
+    readonly help?: string;
+}
+/** A saved token is never read back: label and updatedAt identify a connection without a last-4 hint. */
+export interface CredentialSummary {
+    readonly kind: CredentialKind;
+    readonly id: string;
+    readonly providerId: string;
+    readonly label: string;
+    readonly configured: boolean;
+    readonly isDefault: boolean;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly accountLabel?: string | null;
+    readonly category?: CredentialCategory;
+    readonly baseUrl?: string;
+    readonly additionalHosts?: readonly string[];
+    readonly username?: string;
+}
+export interface CredentialInput {
+    readonly label: string;
+    readonly connection: Readonly<Record<string, string>>;
+    readonly isDefault?: boolean;
+    readonly category?: CredentialCategory;
+    readonly baseUrl?: string;
+    readonly additionalHosts?: readonly string[];
+}
+export interface CredentialPatch {
+    readonly label?: string;
+    readonly connection?: Readonly<Record<string, string>>;
+    readonly isDefault?: boolean;
+    readonly category?: CredentialCategory;
+    readonly baseUrl?: string;
+    readonly additionalHosts?: readonly string[];
+    /** Omit preserves, null clears, string replaces independently of secret replacement. */
+    readonly username?: string | null;
+}
+export interface CredentialDraft {
+    readonly kind: CredentialKind;
+    readonly id?: string;
+    readonly providerId: string;
+    readonly label: string;
+    readonly token: string;
+    readonly values: Readonly<Record<string, string>>;
+    readonly category: CredentialCategory;
+    readonly baseUrl: string;
+    readonly additionalHosts: string;
+    readonly username: string;
+}
+export type OtherStoreId = 'site-assistant' | 'admin-byok' | 'media-provider' | 'external-mcp';
+export interface OtherCredentialSummary {
+    readonly store: OtherStoreId;
+    readonly id: string;
+    readonly label: string;
+    readonly category: CredentialCategory;
+    readonly configured: boolean;
+    readonly supportsReplace: boolean;
+    readonly envNames?: readonly string[];
+    readonly updatedAt?: string | null;
+}
+export type RootKeyState = 'active' | 'missing' | 'missing-with-data' | 'mismatch' | 'invalid';
+export interface RootKeyStatus {
+    readonly active: boolean;
+    readonly source: 'env' | 'file' | 'none';
+    readonly state: RootKeyState;
+    readonly fingerprint?: string;
+    readonly invalid?: boolean;
+    readonly keyFilePath: string;
+    readonly runtimeMode: 'production' | 'local';
+}
+export interface RootKeyPreview {
+    readonly removes: number;
+    readonly affectedWebhooks: readonly {
+        readonly label: string;
+        readonly targetUrl: string;
+    }[];
+    readonly detail: string;
+    readonly runtimeMode: 'production' | 'local';
+}
+export interface RootKeyResult {
+    readonly outcome: string;
+    readonly fingerprint: string;
+    readonly keyFilePath: string;
+    readonly runtimeMode: 'production' | 'local';
+    readonly resealed?: number;
+    readonly discarded?: number;
+    readonly kept?: number;
+    readonly affectedWebhooks?: RootKeyPreview['affectedWebhooks'];
+    readonly restorePointId?: string;
+}
+//# sourceMappingURL=models.d.ts.map

package/dist/security/models.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=models.js.map

package/dist/security/ports.d.ts

@@ -0,0 +1,58 @@
+import type { CredentialSummary, CredentialProvider, CredentialInput, CredentialPatch, RequestOptions, OtherStoreId, OtherCredentialSummary, RootKeyStatus, RootKeyPreview, RootKeyResult } from './models.js';
+/** Separate method groups: connection shapes differ, and deployment and source identities must never merge. */
+export interface CredentialStorePort {
+    list(required: Record<string, never>, optional?: RequestOptions): Promise<readonly CredentialSummary[]>;
+    create(required: CredentialInput, optional?: RequestOptions): Promise<CredentialSummary>;
+    update(required: {
+        id: string;
+        patch: CredentialPatch;
+    }, optional?: RequestOptions): Promise<CredentialSummary>;
+    /** Idempotent, including stale lists and double clicks. */
+    remove(required: {
+        id: string;
+    }, optional?: RequestOptions): Promise<void>;
+}
+export interface SecurityApiPort {
+    providers(required: Record<string, never>, optional?: RequestOptions): Promise<readonly CredentialProvider[]>;
+    readonly publish: CredentialStorePort;
+    readonly sourceControl: CredentialStorePort;
+    readonly custom: CredentialStorePort;
+}
+/** Other stores keep their own endpoint shapes inside the adapter. No saved material leaves it. */
+export interface OtherCredentialsPort {
+    list(required: {
+        store: OtherStoreId;
+    }, optional?: RequestOptions): Promise<readonly OtherCredentialSummary[]>;
+    replace(required: {
+        store: OtherStoreId;
+        id: string;
+        token: string;
+    }, optional?: RequestOptions): Promise<void>;
+    remove(required: {
+        store: OtherStoreId;
+        id: string;
+    }, optional?: RequestOptions): Promise<void>;
+}
+/** No reveal operation: the host owns storage, encryption, key creation and recovery. */
+export interface RootKeyPort {
+    status(required: Record<string, never>, optional?: RequestOptions): Promise<RootKeyStatus>;
+    generate(required: Record<string, never>, optional?: RequestOptions): Promise<RootKeyResult>;
+    importToken(required: {
+        token: string;
+    }, optional?: RequestOptions): Promise<RootKeyResult>;
+    previewStartFresh(required: Record<string, never>, optional?: RequestOptions): Promise<RootKeyPreview>;
+    startFresh(required: {
+        confirm: string;
+    }, optional?: RequestOptions): Promise<RootKeyResult>;
+}
+export declare const securityApiToken: import("../core/module/token.js").AdminPortToken<SecurityApiPort, "admin.security.api">;
+export declare const otherCredentialsToken: import("../core/module/token.js").AdminPortToken<OtherCredentialsPort, "admin.security.other">;
+export declare const rootKeyToken: import("../core/module/token.js").AdminPortToken<RootKeyPort, "admin.security.root-key">;
+export interface SecurityTransportPort {
+    request<T>(required: {
+        path: string;
+        method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+        body?: unknown;
+    }, optional?: RequestOptions): Promise<T>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/security/ports.js

@@ -0,0 +1,5 @@
+import { adminPort } from '../core/module/token.js';
+export const securityApiToken = adminPort({ id: 'admin.security.api' });
+export const otherCredentialsToken = adminPort({ id: 'admin.security.other' });
+export const rootKeyToken = adminPort({ id: 'admin.security.root-key' });
+//# sourceMappingURL=ports.js.map

package/dist/security/react/components/CredentialEditor.d.ts

@@ -0,0 +1,3 @@
+import { type CredentialEditorProps } from '../hooks/CredentialEditor.hooks.js';
+export declare function CredentialEditor(props: CredentialEditorProps, _optional?: {}): import("react").JSX.Element;
+//# sourceMappingURL=CredentialEditor.d.ts.map

package/dist/security/react/components/CredentialEditor.js

@@ -0,0 +1,8 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { Button, TextField, TextArea, Select, Dialog } from '@jini-ai/ui-kit/react';
+import { useCredentialEditor } from '../hooks/CredentialEditor.hooks.js';
+export function CredentialEditor(props, _optional = {}) {
+    const vm = useCredentialEditor(props);
+    return _jsxs(Dialog, { open: true, title: vm.title, onClose: vm.cancel, pending: vm.saving, children: [_jsx(TextField, { label: "Name", value: props.draft.label, onValueChange: vm.onLabel, disabled: vm.saving }), _jsx(TextField, { label: vm.tokenLabel, type: "password", value: props.draft.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), vm.fields.map(field => _jsx(TextField, { label: field.label, type: field.secret ? 'password' : 'text', value: field.value, onValueChange: field.onValueChange, required: field.required === true, disabled: vm.saving }, field.name)), props.draft.kind === 'custom' && _jsxs(_Fragment, { children: [_jsx(Select, { label: "Category", value: props.draft.category, options: vm.categories, onValueChange: vm.onCategory, disabled: vm.saving }), _jsx(TextField, { label: "Base URL", type: "url", value: props.draft.baseUrl, onValueChange: vm.onUrl, disabled: vm.saving }), _jsx(TextField, { label: "Username", value: props.draft.username, onValueChange: vm.onUsername, disabled: vm.saving }), _jsx(TextArea, { label: "Additional hosts", value: props.draft.additionalHosts, onValueChange: vm.onHosts, disabled: vm.saving })] }), _jsx(Button, { onPress: vm.save, pending: vm.saving, children: "Save" }), _jsx(Button, { onPress: vm.cancel, disabled: vm.saving, children: "Cancel" })] });
+}
+//# sourceMappingURL=CredentialEditor.js.map

package/dist/security/react/hooks/AccessTokensTab.hooks.d.ts

@@ -0,0 +1,94 @@
+import type { TabViewProps } from '../../../react/bind-react.js';
+import type { CredentialSummary, OtherCredentialSummary, CredentialCategory } from '../../models.js';
+export declare function useAccessTokensTab({ permissions }: TabViewProps, _optional?: {}): {
+    denied: boolean;
+    loading: boolean;
+    saving: boolean;
+    rows: {
+        row: CredentialSummary;
+        label: string;
+        canWrite: boolean;
+        edit(): void;
+        remove(): void;
+        makeDefault(): void;
+    }[];
+    otherRows: {
+        row: OtherCredentialSummary;
+        canWrite: boolean;
+        token: string;
+        onToken({ value }: {
+            value: string;
+        }): void;
+        replace(): void;
+        remove(): void;
+    }[];
+    providers: {
+        provider: import("../../models.js").CredentialProvider;
+        canWrite: boolean;
+        add(): void;
+    }[];
+    categories: readonly {
+        value: CredentialCategory | "all";
+        label: string;
+    }[];
+    query: string;
+    category: "all" | CredentialCategory;
+    total: number;
+    matched: number;
+    removal: {
+        row: CredentialSummary | OtherCredentialSummary;
+        type: "access" | "other";
+    } | null;
+    draft: import("../../models.js").CredentialDraft | null;
+    errors: string[];
+    canAddCustom: boolean;
+    addCustom(): void;
+    onQuery({ value }: {
+        value: string;
+    }): void;
+    onCategory({ value }: {
+        value: string;
+    }): void;
+    reload(): void;
+    cancelRemove(): void;
+    confirmRemove(): Promise<void>;
+    controller: {
+        getSnapshot: () => Readonly<{
+            rows: readonly CredentialSummary[];
+            providers: readonly import("../../models.js").CredentialProvider[];
+            draft: import("../../models.js").CredentialDraft | null;
+            loading: boolean;
+            saving: boolean;
+            error: string | null;
+            errors: Readonly<Record<string, string>>;
+            query: string;
+            category: CredentialCategory | "all";
+        }>;
+        subscribe: ({ listener }: {
+            listener: () => void;
+        }) => () => void;
+        load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+        begin: ({ row, kind, providerId }: {
+            row?: CredentialSummary;
+            kind?: import("../../models.js").CredentialKind;
+            providerId?: string;
+        }, _optional?: {}) => void;
+        save: (_required: Record<string, never>, _optional?: {}) => Promise<boolean>;
+        setDraft({ patch }: {
+            patch: Partial<Omit<import("../../models.js").CredentialDraft, "kind" | "id" | "providerId">>;
+        }, _optional?: {}): void;
+        cancel(_required: Record<string, never>, _optional?: {}): void;
+        filter({ query, category }: {
+            query?: string;
+            category?: CredentialCategory | "all";
+        }, _optional?: {}): void;
+        remove({ row }: {
+            row: CredentialSummary;
+        }, _optional?: {}): Promise<boolean>;
+        makeDefault({ row }: {
+            row: CredentialSummary;
+        }, _optional?: {}): Promise<boolean>;
+        dispose(_required?: Record<string, never>, _optional?: {}): void;
+    } | null;
+};
+//# sourceMappingURL=AccessTokensTab.hooks.d.ts.map

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -0,0 +1,36 @@
+import { useState } from 'react';
+import { useController } from '../../../react/use-controller.js';
+import { createAccessTokensController } from '../../controllers/access-tokens.controller.js';
+import { createOtherCredentialsController } from '../../controllers/other-credentials.controller.js';
+import { CATEGORIES, credentialLabel, filterCredentials, filterOtherCredentials, otherWritePermission, writePermission } from '../../rules.js';
+import { useSecurityPorts } from './SecurityPorts.hooks.js';
+export function useAccessTokensTab({ permissions = [] }, _optional = {}) {
+    const ports = useSecurityPorts({});
+    const key = permissions.join('\0');
+    const canRead = permissions.includes('security.read');
+    const access = useController({ create: () => createAccessTokensController({ api: ports.securityApi, permissions }), dependencies: [ports.securityApi, key] }, { start: ({ controller }) => { void controller.load({}); } });
+    const other = useController({ create: () => createOtherCredentialsController({ api: ports.otherCredentials ?? { async list() { return []; }, async replace() { throw new Error('Unavailable'); }, async remove() { throw new Error('Unavailable'); } }, permissions }), dependencies: [ports.otherCredentials, key] }, { start: ({ controller }) => { void controller.load({}); } });
+    const [removal, setRemoval] = useState(null);
+    const s = access.snapshot, o = other.snapshot;
+    const query = s?.query ?? '', category = s?.category ?? 'all';
+    const rows = s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category }).map(row => ({ row, label: credentialLabel({ row, providers: s.providers }), canWrite: permissions.includes(writePermission({ kind: row.kind })), edit() { access.controller?.begin({ row }); }, remove() { setRemoval({ row, type: 'access' }); }, makeDefault() { void access.controller?.makeDefault({ row }); } })) : [];
+    const otherRows = o ? filterOtherCredentials({ rows: o.rows, query, category }).map(row => ({ row, canWrite: permissions.includes(otherWritePermission({ store: row.store })), token: o.drafts[`${row.store}:${row.id}`] ?? '', onToken({ value }) { other.controller?.setDraft({ key: `${row.store}:${row.id}`, token: value }); }, replace() { void other.controller?.replace({ row }); }, remove() { setRemoval({ row, type: 'other' }); } })) : [];
+    const providers = (s?.providers ?? []).filter(p => (category === 'all' || p.category === category) && `${p.label} ${p.id}`.toLowerCase().includes(query.trim().toLowerCase())).map(provider => ({ provider, canWrite: permissions.includes(writePermission({ kind: provider.kind })), add() { access.controller?.begin({ kind: provider.kind, providerId: provider.id }); } }));
+    // Count remains global across categories; the search count answers how many saved tokens this host holds.
+    const total = (s?.rows.length ?? 0) + (o?.rows.length ?? 0);
+    const matched = (s ? filterCredentials({ rows: s.rows, providers: s.providers, query, category: 'all' }).length : 0) + (o ? filterOtherCredentials({ rows: o.rows, query, category: 'all' }).length : 0);
+    return { denied: !canRead, loading: s?.loading ?? true, saving: (s?.saving ?? false) || (o?.saving ?? false), rows, otherRows, providers, categories: CATEGORIES, query, category, total, matched, removal,
+        draft: s?.draft ?? null, errors: [...(s?.error ? [s.error] : []), ...Object.values(s?.errors ?? {}), ...Object.values(o?.errors ?? {})],
+        canAddCustom: permissions.includes('custom-credentials.write'),
+        addCustom() { access.controller?.begin({ kind: 'custom' }); },
+        onQuery({ value }) { access.controller?.filter({ query: value }); },
+        onCategory({ value }) { access.controller?.filter({ category: value }); },
+        reload() { void access.controller?.load({}); void other.controller?.load({}); },
+        cancelRemove() { if (!s?.saving && !o?.saving)
+            setRemoval(null); },
+        async confirmRemove() { if (!removal)
+            return; const ok = removal.type === 'access' ? await access.controller?.remove({ row: removal.row }) : await other.controller?.remove({ row: removal.row }); if (!ok)
+            throw new Error('Unable to remove credential'); setRemoval(null); },
+        controller: access.controller, };
+}
+//# sourceMappingURL=AccessTokensTab.hooks.js.map

package/dist/security/react/hooks/CredentialEditor.hooks.d.ts

@@ -0,0 +1,49 @@
+import type { CredentialDraft, CredentialCategory } from '../../models.js';
+import type { createAccessTokensController } from '../../controllers/access-tokens.controller.js';
+export interface CredentialEditorProps {
+    readonly controller: ReturnType<typeof createAccessTokensController> | null;
+    readonly draft: CredentialDraft;
+    readonly saving: boolean;
+}
+export declare function useCredentialEditor({ controller, draft, saving }: CredentialEditorProps, _optional?: {}): {
+    categories: {
+        value: CredentialCategory | "all";
+        label: string;
+    }[];
+    fields: {
+        value: string;
+        onValueChange({ value }: {
+            value: string;
+        }): void;
+        name: string;
+        label: string;
+        required?: boolean;
+        secret?: boolean;
+        type?: string;
+        help?: string;
+    }[];
+    tokenLabel: string;
+    title: string;
+    saving: boolean;
+    onLabel({ value }: {
+        value: string;
+    }): void;
+    onToken({ value }: {
+        value: string;
+    }): void;
+    onUrl({ value }: {
+        value: string;
+    }): void;
+    onUsername({ value }: {
+        value: string;
+    }): void;
+    onHosts({ value }: {
+        value: string;
+    }): void;
+    onCategory({ value }: {
+        value: string;
+    }): void;
+    save(): void;
+    cancel(): void;
+};
+//# sourceMappingURL=CredentialEditor.hooks.d.ts.map