@jini-ai/admin 0.3.10 → 0.4.1

package/dist/security/react/hooks/CredentialEditor.hooks.js

@@ -0,0 +1,14 @@
+import { CATEGORIES } from '../../rules.js';
+export function useCredentialEditor({ controller, draft, saving }, _optional = {}) {
+    const provider = controller?.getSnapshot().providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
+    const fields = (provider?.fields ?? []).filter(f => f.name !== provider?.tokenField).map(field => ({ ...field, value: draft.values[field.name] ?? '', onValueChange({ value }) { controller?.setDraft({ patch: { values: { ...draft.values, [field.name]: value } } }); } }));
+    return { categories: CATEGORIES.slice(1), fields, tokenLabel: provider?.fields.find(f => f.name === provider.tokenField)?.label ?? 'Access token', title: draft.id ? 'Edit credential' : 'Add credential', saving,
+        onLabel({ value }) { controller?.setDraft({ patch: { label: value } }); },
+        onToken({ value }) { controller?.setDraft({ patch: { token: value } }); },
+        onUrl({ value }) { controller?.setDraft({ patch: { baseUrl: value } }); },
+        onUsername({ value }) { controller?.setDraft({ patch: { username: value } }); },
+        onHosts({ value }) { controller?.setDraft({ patch: { additionalHosts: value } }); },
+        onCategory({ value }) { controller?.setDraft({ patch: { category: value } }); },
+        save() { void controller?.save({}); }, cancel() { controller?.cancel({}); }, };
+}
+//# sourceMappingURL=CredentialEditor.hooks.js.map

package/dist/security/react/hooks/RootKeyTab.hooks.d.ts

@@ -0,0 +1,29 @@
+import type { TabViewProps } from '../../../react/bind-react.js';
+export declare function useRootKeyTab({ permissions, params }: TabViewProps, _optional?: {}): {
+    denied: boolean;
+    loading: boolean;
+    saving: boolean;
+    status: import("../../models.js").RootKeyStatus | null | undefined;
+    error: string | null | undefined;
+    result: string | null | undefined;
+    scopeNotice: string;
+    token: string;
+    confirm: string;
+    confirming: boolean;
+    preview: import("../../models.js").RootKeyPreview | null | undefined;
+    locked: boolean;
+    canGenerate: boolean;
+    canConfirm: boolean;
+    onToken({ value }: {
+        value: string;
+    }): void;
+    onConfirmText({ value }: {
+        value: string;
+    }): void;
+    generate(): void;
+    unlock(): void;
+    previewFresh(): void;
+    cancelFresh(): void;
+    confirmFresh(): Promise<void>;
+};
+//# sourceMappingURL=RootKeyTab.hooks.d.ts.map

package/dist/security/react/hooks/RootKeyTab.hooks.js

@@ -0,0 +1,19 @@
+import { useController } from '../../../react/use-controller.js';
+import { createRootKeyController } from '../../controllers/root-key.controller.js';
+import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../../rules.js';
+import { useSecurityPorts } from './SecurityPorts.hooks.js';
+const unavailable = { async status() { throw new Error('Unavailable'); }, async generate() { throw new Error('Unavailable'); }, async importToken() { throw new Error('Unavailable'); }, async previewStartFresh() { throw new Error('Unavailable'); }, async startFresh() { throw new Error('Unavailable'); } };
+export function useRootKeyTab({ permissions = [], params }, _optional = {}) {
+    const { rootKey } = useSecurityPorts({});
+    const key = permissions.join('\0');
+    const { controller, snapshot: s } = useController({ create: () => createRootKeyController({ api: rootKey ?? unavailable, permissions }), dependencies: [rootKey, key] }, { start: ({ controller }) => { void controller.load({}); } });
+    return { denied: !rootKey || !permissions.includes(ROOT_KEY_PERMISSION), loading: s?.loading ?? true, saving: s?.saving ?? false, status: s?.status, error: s?.error, result: s?.result,
+        scopeNotice: typeof params.scopeNotice === 'string' ? params.scopeNotice : 'This key protects saved credentials. Keep its backup separate from the database.',
+        token: s?.token ?? '', confirm: s?.confirm ?? '', confirming: s?.confirming ?? false, preview: s?.preview,
+        locked: isRootKeyLocked({ status: s?.status ?? null }), canGenerate: s?.status?.state === 'missing' && !s.status.active, canConfirm: !!s?.preview && s.confirm === START_FRESH_CONFIRMATION,
+        onToken({ value }) { controller?.setToken({ value }); }, onConfirmText({ value }) { controller?.setConfirm({ value }); },
+        generate() { void controller?.generate({}); }, unlock() { void controller?.importToken({}); }, previewFresh() { void controller?.preview({}); },
+        cancelFresh() { controller?.cancel({}); }, async confirmFresh() { if (!await controller?.startFresh({}))
+            throw new Error('Recovery was not completed'); }, };
+}
+//# sourceMappingURL=RootKeyTab.hooks.js.map

package/dist/security/react/hooks/SecurityPage.hooks.d.ts

@@ -0,0 +1,17 @@
+import type { ModulePageProps } from '../../../react/bind-react.js';
+export declare function useSecurityPage(props: ModulePageProps, _optional?: {}): {
+    denied: boolean;
+    active: string;
+    ActiveTab: import("react").LazyExoticComponent<import("react").ComponentType<import("../../../react/bind-react.js").TabViewProps>> | undefined;
+    params: Readonly<Record<string, unknown>>;
+    permissions: readonly string[];
+    items: {
+        id: string;
+        label: string;
+        content: null;
+    }[];
+    onValueChange({ value }: {
+        value: string;
+    }): void;
+};
+//# sourceMappingURL=SecurityPage.hooks.d.ts.map

package/dist/security/react/hooks/SecurityPage.hooks.js

@@ -0,0 +1,12 @@
+import { useState } from 'react';
+export function useSecurityPage(props, _optional = {}) {
+    const [local, setLocal] = useState('access-tokens');
+    const visible = props.description.visible ? props.description.tabs.filter(t => t.visible) : [];
+    const active = visible.find(t => t.id.endsWith(`.${props.requestedTab ?? local}`)) ?? visible[0];
+    const id = active?.id.split('.').at(-1);
+    return { denied: !props.description.visible, active: id ?? '', ActiveTab: id ? props.tabs[id] : undefined, params: active?.params ?? {}, permissions: props.description.grants,
+        items: visible.map(t => ({ id: t.id.split('.').at(-1), label: t.label, content: null })),
+        onValueChange({ value }) { setLocal(value); props.onTabChange?.({ tab: value }); },
+    };
+}
+//# sourceMappingURL=SecurityPage.hooks.js.map

package/dist/security/react/hooks/SecurityPorts.hooks.d.ts

@@ -0,0 +1,9 @@
+import type { SecurityApiPort, OtherCredentialsPort, RootKeyPort } from '../../ports.js';
+export interface SecurityPorts {
+    readonly securityApi: SecurityApiPort;
+    readonly otherCredentials?: OtherCredentialsPort;
+    readonly rootKey?: RootKeyPort;
+}
+export declare const SecurityPortsContext: import("react").Context<SecurityPorts | null>;
+export declare function useSecurityPorts(_required?: Record<string, never>, _optional?: {}): SecurityPorts;
+//# sourceMappingURL=SecurityPorts.hooks.d.ts.map

package/dist/security/react/hooks/SecurityPorts.hooks.js

@@ -0,0 +1,6 @@
+import { createContext, useContext } from 'react';
+import { AdminConfigError } from '../../../core/module/index.js';
+export const SecurityPortsContext = createContext(null);
+export function useSecurityPorts(_required = {}, _optional = {}) { const ports = useContext(SecurityPortsContext); if (!ports)
+    throw new AdminConfigError({ issues: ['React scope unavailable: security'] }); return ports; }
+//# sourceMappingURL=SecurityPorts.hooks.js.map

package/dist/security/react/index.d.ts

@@ -0,0 +1,215 @@
+export { useSecurityPorts } from './hooks/SecurityPorts.hooks.js';
+export declare function security(_required: Record<string, never>, { rootKeyScopeNotice }?: {
+    rootKeyScopeNotice?: string;
+}): {
+    pages: {
+        secrets: {
+            tabs: {
+                'root-key': {
+                    params: {
+                        scopeNotice: string;
+                    } | {
+                        scopeNotice?: never;
+                    };
+                    label: "Root key";
+                    permissions: readonly ["admin.security.tokens.manage"];
+                    optional: {
+                        readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+                    };
+                };
+                'access-tokens': {
+                    readonly label: "Access tokens";
+                };
+            };
+            path: "/secrets";
+            label: "Secrets";
+            permissions: readonly ["security.read"];
+            nav: {
+                readonly group: "system";
+                readonly icon: "key";
+            };
+        };
+    };
+    id: "security";
+    requires: {
+        readonly securityApi: import("../../core/module/token.js").AdminPortToken<import("../ports.js").SecurityApiPort, "admin.security.api">;
+    };
+    optional: {
+        readonly otherCredentials: import("../../core/module/token.js").AdminPortToken<import("../ports.js").OtherCredentialsPort, "admin.security.other">;
+        readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+    };
+    messages: {
+        readonly security: "Secrets";
+        readonly accessTokens: "Access tokens";
+        readonly rootKey: "Root key";
+        readonly denied: "Permission denied";
+        readonly loading: "Loading credentials…";
+        readonly remove: "Remove credential";
+        readonly replace: "Replace";
+        readonly save: "Save";
+        readonly cancel: "Cancel";
+    };
+} & {
+    react: {
+        module: {
+            pages: {
+                secrets: {
+                    tabs: {
+                        'root-key': {
+                            params: {
+                                scopeNotice: string;
+                            } | {
+                                scopeNotice?: never;
+                            };
+                            label: "Root key";
+                            permissions: readonly ["admin.security.tokens.manage"];
+                            optional: {
+                                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+                            };
+                        };
+                        'access-tokens': {
+                            readonly label: "Access tokens";
+                        };
+                    };
+                    path: "/secrets";
+                    label: "Secrets";
+                    permissions: readonly ["security.read"];
+                    nav: {
+                        readonly group: "system";
+                        readonly icon: "key";
+                    };
+                };
+            };
+            id: "security";
+            requires: {
+                readonly securityApi: import("../../core/module/token.js").AdminPortToken<import("../ports.js").SecurityApiPort, "admin.security.api">;
+            };
+            optional: {
+                readonly otherCredentials: import("../../core/module/token.js").AdminPortToken<import("../ports.js").OtherCredentialsPort, "admin.security.other">;
+                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+            };
+            messages: {
+                readonly security: "Secrets";
+                readonly accessTokens: "Access tokens";
+                readonly rootKey: "Root key";
+                readonly denied: "Permission denied";
+                readonly loading: "Loading credentials…";
+                readonly remove: "Remove credential";
+                readonly replace: "Replace";
+                readonly save: "Save";
+                readonly cancel: "Cancel";
+            };
+        };
+        pages: {
+            secrets: {
+                Page: import("react").LazyExoticComponent<import("react").ComponentType<import("../../react/bind-react.js").ModulePageProps>>;
+                tabs: {
+                    'root-key': import("react").LazyExoticComponent<import("react").ComponentType<import("../../react/bind-react.js").TabViewProps>>;
+                    'access-tokens': import("react").LazyExoticComponent<import("react").ComponentType<import("../../react/bind-react.js").TabViewProps>>;
+                };
+            };
+        };
+        Provider: ({ admin, children }: {
+            admin: import("../../core/module/types.js").AdminInstance;
+            children: import("react").ReactNode;
+        }, _optional?: Record<string, never>) => import("react").FunctionComponentElement<import("react").ProviderProps<import("../../core/module/types.js").ScopedPorts<{
+            pages: {
+                secrets: {
+                    tabs: {
+                        'root-key': {
+                            params: {
+                                scopeNotice: string;
+                            } | {
+                                scopeNotice?: never;
+                            };
+                            label: "Root key";
+                            permissions: readonly ["admin.security.tokens.manage"];
+                            optional: {
+                                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+                            };
+                        };
+                        'access-tokens': {
+                            readonly label: "Access tokens";
+                        };
+                    };
+                    path: "/secrets";
+                    label: "Secrets";
+                    permissions: readonly ["security.read"];
+                    nav: {
+                        readonly group: "system";
+                        readonly icon: "key";
+                    };
+                };
+            };
+            id: "security";
+            requires: {
+                readonly securityApi: import("../../core/module/token.js").AdminPortToken<import("../ports.js").SecurityApiPort, "admin.security.api">;
+            };
+            optional: {
+                readonly otherCredentials: import("../../core/module/token.js").AdminPortToken<import("../ports.js").OtherCredentialsPort, "admin.security.other">;
+                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+            };
+            messages: {
+                readonly security: "Secrets";
+                readonly accessTokens: "Access tokens";
+                readonly rootKey: "Root key";
+                readonly denied: "Permission denied";
+                readonly loading: "Loading credentials…";
+                readonly remove: "Remove credential";
+                readonly replace: "Replace";
+                readonly save: "Save";
+                readonly cancel: "Cancel";
+            };
+        }> | null>>;
+        usePorts: (_required?: Record<string, never>, _optional?: Record<string, never>) => import("../../core/module/types.js").ScopedPorts<{
+            pages: {
+                secrets: {
+                    tabs: {
+                        'root-key': {
+                            params: {
+                                scopeNotice: string;
+                            } | {
+                                scopeNotice?: never;
+                            };
+                            label: "Root key";
+                            permissions: readonly ["admin.security.tokens.manage"];
+                            optional: {
+                                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+                            };
+                        };
+                        'access-tokens': {
+                            readonly label: "Access tokens";
+                        };
+                    };
+                    path: "/secrets";
+                    label: "Secrets";
+                    permissions: readonly ["security.read"];
+                    nav: {
+                        readonly group: "system";
+                        readonly icon: "key";
+                    };
+                };
+            };
+            id: "security";
+            requires: {
+                readonly securityApi: import("../../core/module/token.js").AdminPortToken<import("../ports.js").SecurityApiPort, "admin.security.api">;
+            };
+            optional: {
+                readonly otherCredentials: import("../../core/module/token.js").AdminPortToken<import("../ports.js").OtherCredentialsPort, "admin.security.other">;
+                readonly rootKey: import("../../core/module/token.js").AdminPortToken<import("../ports.js").RootKeyPort, "admin.security.root-key">;
+            };
+            messages: {
+                readonly security: "Secrets";
+                readonly accessTokens: "Access tokens";
+                readonly rootKey: "Root key";
+                readonly denied: "Permission denied";
+                readonly loading: "Loading credentials…";
+                readonly remove: "Remove credential";
+                readonly replace: "Replace";
+                readonly save: "Save";
+                readonly cancel: "Cancel";
+            };
+        }>;
+    };
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/security/react/index.js

@@ -0,0 +1,10 @@
+import { bindReact } from '../../react/bind-react.js';
+import { securityModule } from '../security.module.js';
+import { SecurityPortsContext } from './hooks/SecurityPorts.hooks.js';
+export { useSecurityPorts } from './hooks/SecurityPorts.hooks.js';
+export function security(_required, { rootKeyScopeNotice } = {}) {
+    const module = { ...securityModule, pages: { secrets: { ...securityModule.pages.secrets, tabs: { ...securityModule.pages.secrets.tabs, 'root-key': { ...securityModule.pages.secrets.tabs['root-key'], params: rootKeyScopeNotice ? { scopeNotice: rootKeyScopeNotice } : {} } } } } };
+    const react = bindReact({ module, views: { secrets: { page: () => import('./pages/SecurityPage.js'), tabs: { 'access-tokens': () => import('./tabs/AccessTokensTab.js'), 'root-key': () => import('./tabs/RootKeyTab.js') } } } }, { context: SecurityPortsContext });
+    return Object.assign(module, { react });
+}
+//# sourceMappingURL=index.js.map

package/dist/security/react/pages/SecurityPage.d.ts

@@ -0,0 +1,4 @@
+import type { ModulePageProps } from '../../../react/bind-react.js';
+export declare function SecurityPage(props: ModulePageProps, _optional?: {}): import("react").JSX.Element;
+export default SecurityPage;
+//# sourceMappingURL=SecurityPage.d.ts.map

package/dist/security/react/pages/SecurityPage.js

@@ -0,0 +1,10 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { Suspense } from 'react';
+import { Tabs, Notice, Spinner } from '@jini-ai/ui-kit/react';
+import { useSecurityPage } from '../hooks/SecurityPage.hooks.js';
+export function SecurityPage(props, _optional = {}) {
+    const vm = useSecurityPage(props);
+    return _jsxs("section", { "data-jini-part": "security.page", children: [_jsx("h1", { children: props.description.label }), vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs(_Fragment, { children: [_jsx(Tabs, { label: "Security views", value: vm.active, items: vm.items, onValueChange: vm.onValueChange }), _jsx(Suspense, { fallback: _jsx(Spinner, { label: "Loading credentials\u2026" }), children: vm.ActiveTab && _jsx(vm.ActiveTab, { params: vm.params, permissions: vm.permissions }, vm.active) })] })] });
+}
+export default SecurityPage;
+//# sourceMappingURL=SecurityPage.js.map

package/dist/security/react/tabs/AccessTokensTab.d.ts

@@ -0,0 +1,4 @@
+import type { TabViewProps } from '../../../react/bind-react.js';
+export declare function AccessTokensTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
+export default AccessTokensTab;
+//# sourceMappingURL=AccessTokensTab.d.ts.map

package/dist/security/react/tabs/AccessTokensTab.js

@@ -0,0 +1,10 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Button, TextField, Select, Notice, ConfirmDialog, Spinner } from '@jini-ai/ui-kit/react';
+import { useAccessTokensTab } from '../hooks/AccessTokensTab.hooks.js';
+import { CredentialEditor } from '../components/CredentialEditor.js';
+export function AccessTokensTab(props, _optional = {}) {
+    const vm = useAccessTokensTab(props);
+    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Access tokens", children: [_jsx(TextField, { label: "Search tokens", type: "search", value: vm.query, onValueChange: vm.onQuery }), _jsx(Select, { label: "Category", value: vm.category, options: vm.categories, onValueChange: vm.onCategory }), _jsxs("p", { role: "status", children: [vm.matched, " of ", vm.total, " tokens saved"] }), _jsx(Button, { onPress: vm.reload, disabled: vm.saving, children: "Reload" }), vm.loading && _jsx(Spinner, { label: "Loading credentials\u2026" }), vm.errors.map((error, i) => _jsx(Notice, { tone: "danger", children: error }, i)), vm.providers.map(p => _jsxs("section", { children: [_jsxs("h2", { children: [p.provider.label, " \u00B7 ", p.provider.category] }), _jsx("p", { children: p.provider.help }), p.provider.tokenPageUrl && _jsxs("a", { href: p.provider.tokenPageUrl, target: "_blank", rel: "noreferrer", children: ["Manage tokens at ", p.provider.vendorLabel] }), p.canWrite && _jsxs(Button, { onPress: p.add, disabled: vm.saving, children: ["Add ", p.provider.label, " token"] })] }, `${p.provider.kind}:${p.provider.id}`)), vm.rows.map(item => _jsxs("article", { children: [_jsx("h3", { children: item.label }), _jsxs("p", { children: [item.row.kind, " \u00B7 ", item.row.isDefault ? 'Default' : 'Saved', " \u00B7 ", item.row.updatedAt] }), item.canWrite && _jsxs(_Fragment, { children: [_jsxs(Button, { onPress: item.edit, disabled: vm.saving, children: ["Edit ", item.label] }), item.row.kind !== 'custom' && !item.row.isDefault && _jsx(Button, { onPress: item.makeDefault, disabled: vm.saving, children: "Make default" }), _jsxs(Button, { onPress: item.remove, disabled: vm.saving, children: ["Remove ", item.label] })] })] }, `${item.row.kind}:${item.row.id}`)), vm.otherRows.map(item => _jsxs("article", { children: [_jsx("h3", { children: item.row.label }), _jsxs("p", { children: ["Configured", item.row.envNames && _jsxs(_Fragment, { children: [" \u00B7 ", item.row.envNames.length, " environment variables set"] })] }), item.canWrite && _jsxs(_Fragment, { children: [item.row.supportsReplace && _jsxs(_Fragment, { children: [_jsx(TextField, { label: `New key for ${item.row.label}`, type: "password", value: item.token, onValueChange: item.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsxs(Button, { onPress: item.replace, disabled: vm.saving, children: ["Replace ", item.row.label] })] }), _jsxs(Button, { onPress: item.remove, disabled: vm.saving, children: ["Remove ", item.row.label] })] })] }, `${item.row.store}:${item.row.id}`)), vm.canAddCustom && _jsx(Button, { onPress: vm.addCustom, disabled: vm.saving, children: "Add custom provider" }), vm.draft && _jsx(CredentialEditor, { controller: vm.controller, draft: vm.draft, saving: vm.saving }), vm.removal && _jsx(ConfirmDialog, { open: true, title: "Remove credential", body: "Removing this saved connection cannot revoke the token at its provider.", consequence: "Operations using this connection may stop working. Revoke the token at its provider separately.", confirmLabel: "Remove credential", onConfirm: vm.confirmRemove, onCancel: vm.cancelRemove, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
+}
+export default AccessTokensTab;
+//# sourceMappingURL=AccessTokensTab.js.map

package/dist/security/react/tabs/RootKeyTab.d.ts

@@ -0,0 +1,4 @@
+import type { TabViewProps } from '../../../react/bind-react.js';
+export declare function RootKeyTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
+export default RootKeyTab;
+//# sourceMappingURL=RootKeyTab.d.ts.map

package/dist/security/react/tabs/RootKeyTab.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Button, TextField, Notice, ConfirmDialog, Spinner } from '@jini-ai/ui-kit/react';
+import { useRootKeyTab } from '../hooks/RootKeyTab.hooks.js';
+export function RootKeyTab(props, _optional = {}) {
+    const vm = useRootKeyTab(props);
+    return vm.denied ? _jsx(Notice, { tone: "danger", children: "Permission denied" }) : _jsxs("section", { "aria-label": "Root key", children: [_jsx(Notice, { children: vm.scopeNotice }), vm.loading && _jsx(Spinner, { label: "Loading root key status\u2026" }), vm.error && _jsx(Notice, { tone: "danger", children: vm.error }), vm.result && _jsx(Notice, { tone: "success", children: vm.result }), vm.status && _jsxs("p", { children: [vm.status.state, " \u00B7 ", vm.status.fingerprint, " \u00B7 ", vm.status.source] }), vm.canGenerate && _jsx(Button, { onPress: vm.generate, pending: vm.saving, children: "Create root key" }), vm.locked && _jsxs(_Fragment, { children: [_jsx(TextField, { label: "Old root key", type: "password", value: vm.token, onValueChange: vm.onToken, disabled: vm.saving, attrs: { 'data-agent-private': 'true' } }), _jsx(Button, { onPress: vm.unlock, pending: vm.saving, children: "Unlock saved credentials" }), _jsx(Button, { onPress: vm.previewFresh, disabled: vm.saving || vm.loading, children: "Start fresh" })] }), vm.confirming && _jsx(ConfirmDialog, { open: true, title: "Start fresh", body: _jsxs(_Fragment, { children: [_jsx("p", { children: vm.preview?.detail }), _jsxs("p", { children: [vm.preview?.removes, " credentials will be removed."] }), vm.preview?.affectedWebhooks.map(w => _jsxs("p", { children: [w.label, " \u00B7 ", w.targetUrl] }, `${w.label}:${w.targetUrl}`)), _jsx(TextField, { label: "Type START FRESH", value: vm.confirm, onValueChange: vm.onConfirmText, disabled: vm.saving })] }), consequence: "Saved credentials will be removed. Update affected webhook receivers with new signing secrets.", confirmLabel: "Start fresh", onConfirm: vm.confirmFresh, onCancel: vm.cancelFresh, pending: vm.saving, agentMayConfirm: false, tone: "danger" })] });
+}
+export default RootKeyTab;
+//# sourceMappingURL=RootKeyTab.js.map

package/dist/security/rules.d.ts

@@ -0,0 +1,57 @@
+import type { CredentialCategory, CredentialDraft, CredentialKind, CredentialPatch, CredentialProvider, CredentialSummary, OtherCredentialSummary, OtherStoreId, RootKeyStatus } from './models.js';
+import type { SecurityApiPort } from './ports.js';
+export declare const START_FRESH_CONFIRMATION = "START FRESH";
+export declare const ROOT_KEY_PERMISSION = "admin.security.tokens.manage";
+export declare const CATEGORIES: readonly {
+    value: CredentialCategory | 'all';
+    label: string;
+}[];
+export declare const OTHER_STORES: readonly OtherStoreId[];
+export declare function writePermission({ kind }: {
+    kind: CredentialKind;
+}, _optional?: {}): "custom-credentials.write" | "system.publish" | "source-control.credentials.write";
+export declare function otherWritePermission({ store }: {
+    store: OtherStoreId;
+}, _optional?: {}): "admin.assistant.manage" | "admin.integrations.manage";
+export declare function credentialStore({ api, kind }: {
+    api: SecurityApiPort;
+    kind: CredentialKind;
+}, _optional?: {}): import("./ports.js").CredentialStorePort;
+export declare function blankCredentialDraft({ kind, providerId }: {
+    kind: CredentialKind;
+    providerId?: string;
+}, _optional?: {}): CredentialDraft;
+/** Legacy sentinel labels are display-only: opening this page must never mutate saved data. */
+export declare function credentialLabel({ row, providers }: {
+    row: CredentialSummary;
+    providers: readonly CredentialProvider[];
+}, _optional?: {}): string;
+export declare function credentialCategory({ row }: {
+    row: CredentialSummary;
+}, _optional?: {}): CredentialCategory;
+export declare function filterCredentials({ rows, query, category, providers }: {
+    rows: readonly CredentialSummary[];
+    query: string;
+    category: CredentialCategory | 'all';
+    providers: readonly CredentialProvider[];
+}, _optional?: {}): CredentialSummary[];
+export declare function filterOtherCredentials({ rows, query, category }: {
+    rows: readonly OtherCredentialSummary[];
+    query: string;
+    category: CredentialCategory | 'all';
+}, _optional?: {}): OtherCredentialSummary[];
+/** A custom row is its own provider identity; its username can change without retyping its token. */
+export declare function validateCredentialDraft({ draft, rows, providers }: {
+    draft: CredentialDraft;
+    rows: readonly CredentialSummary[];
+    providers: readonly CredentialProvider[];
+}, _optional?: {}): string | null;
+/** Omitting connection preserves the saved secret. Never send an empty or half-blank replacement. */
+export declare function buildCredentialPatch({ draft, providers }: {
+    draft: CredentialDraft;
+    providers: readonly CredentialProvider[];
+}, _optional?: {}): CredentialPatch;
+export declare function isRootKeyLocked({ status }: {
+    status: RootKeyStatus | null;
+}, _optional?: {}): boolean;
+//# sourceMappingURL=rules.d.ts.map

package/dist/security/rules.js

@@ -0,0 +1,63 @@
+export const START_FRESH_CONFIRMATION = 'START FRESH';
+export const ROOT_KEY_PERMISSION = 'admin.security.tokens.manage';
+export const CATEGORIES = [
+    { value: 'all', label: 'All' }, { value: 'source-control', label: 'Source control' },
+    { value: 'hosting', label: 'Hosting' }, { value: 'media', label: 'Media' },
+    { value: 'ai', label: 'AI' }, { value: 'ops', label: 'Ops' }, { value: 'general', label: 'General' },
+];
+export const OTHER_STORES = ['site-assistant', 'admin-byok', 'media-provider', 'external-mcp'];
+export function writePermission({ kind }, _optional = {}) { return kind === 'custom' ? 'custom-credentials.write' : kind === 'publish' ? 'system.publish' : 'source-control.credentials.write'; }
+export function otherWritePermission({ store }, _optional = {}) { return store === 'site-assistant' || store === 'admin-byok' ? 'admin.assistant.manage' : 'admin.integrations.manage'; }
+export function credentialStore({ api, kind }, _optional = {}) { return kind === 'source-control' ? api.sourceControl : kind === 'publish' ? api.publish : api.custom; }
+export function blankCredentialDraft({ kind, providerId = '' }, _optional = {}) {
+    return { kind, providerId, label: '', token: '', values: {}, category: kind === 'publish' ? 'hosting' : kind === 'source-control' ? 'source-control' : 'general', baseUrl: '', additionalHosts: '', username: '' };
+}
+/** Legacy sentinel labels are display-only: opening this page must never mutate saved data. */
+export function credentialLabel({ row, providers }, _optional = {}) {
+    if (row.label !== 'default' || row.kind === 'custom')
+        return row.label;
+    return `${providers.find(p => p.kind === row.kind && p.id === row.providerId)?.label ?? row.providerId} token`;
+}
+export function credentialCategory({ row }, _optional = {}) { return row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'); }
+export function filterCredentials({ rows, query, category, providers }, _optional = {}) {
+    const q = query.trim().toLowerCase();
+    return rows.filter(row => (category === 'all' || credentialCategory({ row }) === category) && [credentialLabel({ row, providers }), row.providerId, row.baseUrl ?? '', row.accountLabel ?? ''].join(' ').toLowerCase().includes(q));
+}
+export function filterOtherCredentials({ rows, query, category }, _optional = {}) { return rows.filter(row => (category === 'all' || row.category === category) && `${row.label} ${row.store}`.toLowerCase().includes(query.trim().toLowerCase())); }
+/** A custom row is its own provider identity; its username can change without retyping its token. */
+export function validateCredentialDraft({ draft, rows, providers }, _optional = {}) {
+    if (!draft.label.trim())
+        return 'Enter a name';
+    if (rows.some(r => r.kind === draft.kind && r.id !== draft.id && (draft.kind === 'custom' || r.providerId === draft.providerId) && r.label.trim().toLowerCase() === draft.label.trim().toLowerCase()))
+        return 'That name is already in use';
+    if (!draft.id && !draft.token.trim())
+        return 'Enter an access token';
+    if (draft.kind === 'custom') {
+        try {
+            if (!['http:', 'https:'].includes(new URL(draft.baseUrl).protocol))
+                return 'Enter an HTTP or HTTPS URL';
+        }
+        catch {
+            return 'Enter an HTTP or HTTPS URL';
+        }
+    }
+    else if (!draft.id || draft.token.trim()) {
+        const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
+        if (!provider)
+            return 'Provider is unavailable';
+        if (provider.fields.some(f => f.name !== provider.tokenField && f.required && !draft.values[f.name]?.trim()))
+            return 'Complete all required fields';
+    }
+    return null;
+}
+/** Omitting connection preserves the saved secret. Never send an empty or half-blank replacement. */
+export function buildCredentialPatch({ draft, providers }, _optional = {}) {
+    const provider = providers.find(p => p.kind === draft.kind && p.id === draft.providerId);
+    const token = draft.token.trim();
+    const connection = token ? draft.kind === 'custom'
+        ? { token, ...(draft.username.trim() ? { username: draft.username.trim() } : {}) }
+        : { providerId: draft.providerId, [provider?.tokenField ?? 'token']: token, ...Object.fromEntries((provider?.fields ?? []).filter(f => f.name !== provider?.tokenField && draft.values[f.name]?.trim()).map(f => [f.name, draft.values[f.name].trim()])) } : undefined;
+    return { label: draft.label.trim(), ...(connection ? { connection } : {}), ...(draft.kind === 'custom' ? { category: draft.category, baseUrl: draft.baseUrl.trim(), additionalHosts: draft.additionalHosts.split(/[\n,]/).map(s => s.trim()).filter(Boolean), username: draft.username.trim() || null } : {}) };
+}
+export function isRootKeyLocked({ status }, _optional = {}) { return status?.state === 'missing-with-data' || status?.state === 'mismatch'; }
+//# sourceMappingURL=rules.js.map

package/dist/security/security.module.d.ts

@@ -0,0 +1,45 @@
+export declare const securityModule: {
+    readonly id: "security";
+    readonly requires: {
+        readonly securityApi: import("../core/module/token.js").AdminPortToken<import("./ports.js").SecurityApiPort, "admin.security.api">;
+    };
+    readonly optional: {
+        readonly otherCredentials: import("../core/module/token.js").AdminPortToken<import("./ports.js").OtherCredentialsPort, "admin.security.other">;
+        readonly rootKey: import("../core/module/token.js").AdminPortToken<import("./ports.js").RootKeyPort, "admin.security.root-key">;
+    };
+    readonly messages: {
+        readonly security: "Secrets";
+        readonly accessTokens: "Access tokens";
+        readonly rootKey: "Root key";
+        readonly denied: "Permission denied";
+        readonly loading: "Loading credentials…";
+        readonly remove: "Remove credential";
+        readonly replace: "Replace";
+        readonly save: "Save";
+        readonly cancel: "Cancel";
+    };
+    readonly pages: {
+        readonly secrets: {
+            readonly path: "/secrets";
+            readonly label: "Secrets";
+            readonly permissions: readonly ["security.read"];
+            readonly nav: {
+                readonly group: "system";
+                readonly icon: "key";
+            };
+            readonly tabs: {
+                readonly 'access-tokens': {
+                    readonly label: "Access tokens";
+                };
+                readonly 'root-key': {
+                    readonly label: "Root key";
+                    readonly permissions: readonly ["admin.security.tokens.manage"];
+                    readonly optional: {
+                        readonly rootKey: import("../core/module/token.js").AdminPortToken<import("./ports.js").RootKeyPort, "admin.security.root-key">;
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=security.module.d.ts.map

package/dist/security/security.module.js

@@ -0,0 +1,5 @@
+import { defineAdminModule } from '../core/module/index.js';
+import { securityApiToken, otherCredentialsToken, rootKeyToken } from './ports.js';
+import { securityMessagesEn } from './messages.en.js';
+export const securityModule = defineAdminModule({ id: 'security', requires: { securityApi: securityApiToken }, optional: { otherCredentials: otherCredentialsToken, rootKey: rootKeyToken }, messages: securityMessagesEn, pages: { secrets: { path: '/secrets', label: securityMessagesEn.security, permissions: ['security.read'], nav: { group: 'system', icon: 'key' }, tabs: { 'access-tokens': { label: securityMessagesEn.accessTokens }, 'root-key': { label: securityMessagesEn.rootKey, permissions: ['admin.security.tokens.manage'], optional: { rootKey: rootKeyToken } } } } } });
+//# sourceMappingURL=security.module.js.map

package/dist/source-control/adapters/http.d.ts

@@ -0,0 +1,6 @@
+import type { SourceControlApiPort, SourceControlTransportPort } from '../ports.js';
+export declare function createHttpSourceControlApi({ transport, workspacePath }: {
+    transport: SourceControlTransportPort;
+    workspacePath: string;
+}, _optional?: {}): SourceControlApiPort;
+//# sourceMappingURL=http.d.ts.map

package/dist/source-control/adapters/http.js

@@ -0,0 +1,13 @@
+import { sourceControlSummary } from '../rules.js';
+export function createHttpSourceControlApi({ transport, workspacePath }, _optional = {}) {
+    const base = `${workspacePath.replace(/\/$/, '')}/system/source-control`, path = `${base}/credentials`;
+    async function request(suffix, method, options, body) { options.signal?.throwIfAborted(); return transport.request({ path: `${base}${suffix}`, method, ...(body !== undefined ? { body } : {}) }, options); }
+    return {
+        async providers(_required, options = {}) { const r = await request('/providers', 'GET', options); return Object.freeze(r.providers.map(p => Object.freeze({ id: p.id, label: p.label, ...(p.credential ? { credential: Object.freeze({ tokenField: p.credential.tokenField, fields: Object.freeze(p.credential.fields.map(f => Object.freeze({ ...f }))), ...(p.credential.help ? { help: p.credential.help } : {}), ...(p.credential.tokenPageUrl ? { tokenPageUrl: p.credential.tokenPageUrl } : {}) }) } : {}) }))); },
+        async list(_required, options = {}) { const r = await request('/credentials', 'GET', options); return Object.freeze(r.credentials.map(row => sourceControlSummary({ row }))); },
+        async create(input, options = {}) { const r = await request('/credentials', 'POST', options, input); return sourceControlSummary({ row: r.credential }); },
+        async update({ id, patch }, options = {}) { const r = await request(`/credentials/${encodeURIComponent(id)}`, 'PUT', options, patch); return sourceControlSummary({ row: r.credential }); },
+        async remove({ id }, options = {}) { options.signal?.throwIfAborted(); await transport.request({ path: `${path}/${encodeURIComponent(id)}`, method: 'DELETE' }, options); },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/source-control/adapters/memory.d.ts

@@ -0,0 +1,9 @@
+import type { SourceControlApiPort } from '../ports.js';
+import type { SourceControlCredential, SourceControlProvider } from '../models.js';
+export declare function createMemorySourceControlApi({ providers, credentials }: {
+    providers?: readonly SourceControlProvider[];
+    credentials?: readonly SourceControlCredential[];
+}, { now }?: {
+    now?: () => string;
+}): SourceControlApiPort;
+//# sourceMappingURL=memory.d.ts.map