@jini-ai/admin 0.3.9 → 0.4.0

package/dist/security/adapters/memory.js

@@ -0,0 +1,60 @@
+import { START_FRESH_CONFIRMATION } from '../rules.js';
+/** Fake backend: retains only read models, never credential material. */
+export function createMemorySecurityApi({ providers = [], rows = [] }, _optional = {}) {
+    let items = rows.map(r => Object.freeze({ ...r }));
+    let sequence = 0;
+    function store(kind) {
+        function project(id, patch, providerId, initial) {
+            const now = new Date().toISOString();
+            return Object.freeze({ kind, id, providerId, label: patch.label ?? initial?.label ?? '', configured: true, isDefault: kind === 'custom' ? false : patch.isDefault ?? initial?.isDefault ?? !items.some(r => r.kind === kind && r.providerId === providerId), createdAt: initial?.createdAt ?? now, updatedAt: now,
+                ...(kind === 'custom' ? { category: patch.category ?? initial?.category ?? 'general', baseUrl: patch.baseUrl ?? initial?.baseUrl ?? '', additionalHosts: Object.freeze([...(patch.additionalHosts ?? initial?.additionalHosts ?? [])]), ...((patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) ? { username: (patch.username !== undefined ? patch.username : patch.connection?.username ?? initial?.username) } : {}) } : {}),
+            });
+        }
+        function check(label, providerId, id) { if (items.some(r => r.kind === kind && r.id !== id && (kind === 'custom' || r.providerId === providerId) && r.label.toLowerCase() === label.toLowerCase()))
+            throw new Error('Duplicate label'); }
+        function insert(row) {
+            if (row.isDefault)
+                items = items.map(r => r.kind === kind && r.providerId === row.providerId ? Object.freeze({ ...r, isDefault: false }) : r);
+            items = [...items.filter(r => !(r.kind === kind && r.id === row.id)), row];
+            return row;
+        }
+        return {
+            async list(_r, o = {}) { o.signal?.throwIfAborted(); return Object.freeze(items.filter(r => r.kind === kind)); },
+            async create(input, o = {}) { o.signal?.throwIfAborted(); if (!Object.values(input.connection).some(v => v.trim()) || !input.label.trim())
+                throw new Error('Incomplete credential'); const providerId = kind === 'custom' ? '' : input.connection.providerId ?? ''; check(input.label, providerId); return insert(project(`credential-${++sequence}`, input, providerId)); },
+            async update({ id, patch }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); if (!old)
+                throw new Error('Credential not found'); check(patch.label ?? old.label, old.providerId, id); return insert(project(id, patch, old.providerId, old)); },
+            async remove({ id }, o = {}) { o.signal?.throwIfAborted(); const old = items.find(r => r.id === id && r.kind === kind); items = items.filter(r => !(r.id === id && r.kind === kind)); if (old?.isDefault) {
+                const next = items.filter(r => r.kind === kind && r.providerId === old.providerId).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0];
+                if (next)
+                    insert(Object.freeze({ ...next, isDefault: true }));
+            } },
+        };
+    }
+    return { async providers(_r, o = {}) { o.signal?.throwIfAborted(); return providers; }, publish: store('publish'), sourceControl: store('source-control'), custom: store('custom') };
+}
+export function createMemoryOtherCredentials({ rows = [] }, _optional = {}) {
+    let items = rows.map(row => Object.freeze({ ...row }));
+    return {
+        async list({ store }, o = {}) { o.signal?.throwIfAborted(); return items.filter(r => r.store === store); },
+        async replace({ store, id, token }, o = {}) { o.signal?.throwIfAborted(); const row = items.find(r => r.store === store && r.id === id); if (!row?.supportsReplace || !token.trim())
+            throw new Error('Replacement unavailable'); items = items.map(r => r === row ? Object.freeze({ ...r, configured: true, updatedAt: new Date().toISOString() }) : r); },
+        async remove({ store, id }, o = {}) { o.signal?.throwIfAborted(); items = items.filter(r => r.store !== store || r.id !== id); },
+    };
+}
+export function createMemoryRootKey({ status = { active: false, source: 'none', state: 'missing', keyFilePath: '/memory/key', runtimeMode: 'local' }, preview = { removes: 0, affectedWebhooks: [], detail: 'Remove saved credentials and create a new root key.', runtimeMode: 'local' } }, _optional = {}) {
+    let current = Object.freeze({ ...status });
+    function activate(outcome) { current = Object.freeze({ ...current, active: true, state: 'active', source: 'file', fingerprint: 'memory-fingerprint' }); return { outcome, fingerprint: 'memory-fingerprint', keyFilePath: current.keyFilePath, runtimeMode: current.runtimeMode }; }
+    return {
+        async status(_r, o = {}) { o.signal?.throwIfAborted(); return current; },
+        async generate(_r, o = {}) { o.signal?.throwIfAborted(); if (current.active)
+            return { ...activate('already-active') }; if (current.state !== 'missing')
+            throw new Error('Key dependent data'); return activate('created'); },
+        async importToken({ token }, o = {}) { o.signal?.throwIfAborted(); if (!/^[0-9a-f]{64}$/i.test(token))
+            throw new Error('Invalid token'); return { ...activate('unlocked'), resealed: 0 }; },
+        async previewStartFresh(_r, o = {}) { o.signal?.throwIfAborted(); return preview; },
+        async startFresh({ confirm }, o = {}) { o.signal?.throwIfAborted(); if (confirm !== START_FRESH_CONFIRMATION)
+            throw new Error('Confirmation required'); return { ...activate('started-fresh'), discarded: preview.removes, kept: 0, affectedWebhooks: preview.affectedWebhooks, restorePointId: 'memory-restore-point' }; },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/dist/security/conformance/security-api.conformance.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityApiPort } from '../ports.js';
+import type { CredentialProvider } from '../models.js';
+/** Use a disposable backend: this contract creates, updates and removes credentials. */
+export declare function runSecurityApiConformance({ createApi, provider }: {
+    createApi: (required: Record<string, never>, optional?: Record<string, never>) => SecurityApiPort | Promise<SecurityApiPort>;
+    provider: CredentialProvider;
+}, _optional?: {}): Promise<{
+    passed: number;
+}>;
+//# sourceMappingURL=security-api.conformance.d.ts.map

package/dist/security/conformance/security-api.conformance.js

@@ -0,0 +1,48 @@
+import { credentialStore } from '../rules.js';
+/** Use a disposable backend: this contract creates, updates and removes credentials. */
+export async function runSecurityApiConformance({ createApi, provider }, _optional = {}) {
+    const api = await createApi({}), target = credentialStore({ api, kind: provider.kind });
+    let passed = 0;
+    function check(value, message) { if (!value)
+        throw new Error(`Security contract: ${message}`); passed++; }
+    const suffix = `${Date.now()}-${Math.random()}`;
+    const secret = `contract-secret-${suffix}`;
+    const connection = { providerId: provider.id, [provider.tokenField]: secret, ...Object.fromEntries(provider.fields.filter(f => f.name !== provider.tokenField).map(f => [f.name, 'test-value'])) };
+    const ids = [];
+    try {
+        const a = await target.create({ label: `First ${suffix}`, connection }, {});
+        ids.push(a.id);
+        check(a.configured, 'create produces configured summary');
+        check(!JSON.stringify(a).includes(secret), 'create cannot return secret');
+        const b = await target.create({ label: `Second ${suffix}`, connection }, {});
+        ids.push(b.id);
+        const renamed = await target.update({ id: a.id, patch: { label: `Renamed ${suffix}` } }, {});
+        check(renamed.id === a.id && renamed.label === `Renamed ${suffix}`, 'metadata update preserves identity');
+        const replaced = await target.update({ id: a.id, patch: { connection } }, {});
+        check(!JSON.stringify(replaced).includes(secret), 'replacement cannot return secret');
+        await target.update({ id: b.id, patch: { isDefault: true } }, {});
+        const listed = await target.list({}, {});
+        check(listed.filter(r => r.providerId === provider.id && r.isDefault).length === 1 && listed.find(r => r.id === b.id)?.isDefault === true, 'one server-owned default');
+        await target.remove({ id: b.id }, {});
+        const remaining = await target.list({}, {});
+        check(!remaining.some(r => r.id === b.id) && remaining.some(r => r.providerId === provider.id && r.isDefault), 'remove promotes remaining connection');
+        await target.remove({ id: b.id }, {});
+        check(true, 'remove is idempotent');
+        const abort = new AbortController();
+        abort.abort();
+        let refused = false;
+        try {
+            await target.create({ label: `Aborted ${suffix}`, connection }, { signal: abort.signal });
+        }
+        catch {
+            refused = true;
+        }
+        check(refused && !(await target.list({}, {})).some(r => r.label === `Aborted ${suffix}`), 'aborted mutation writes nothing');
+    }
+    finally {
+        for (const id of ids)
+            await target.remove({ id }, {});
+    }
+    return { passed };
+}
+//# sourceMappingURL=security-api.conformance.js.map

package/dist/security/controllers/access-tokens.controller.d.ts

@@ -0,0 +1,44 @@
+import type { SecurityApiPort } from '../ports.js';
+import type { CredentialSummary, CredentialProvider, CredentialDraft, CredentialKind, CredentialCategory } from '../models.js';
+export declare function createAccessTokensController({ api, permissions }: {
+    api: SecurityApiPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        rows: readonly CredentialSummary[];
+        providers: readonly CredentialProvider[];
+        draft: CredentialDraft | null;
+        loading: boolean;
+        saving: boolean;
+        error: string | null;
+        errors: Readonly<Record<string, string>>;
+        query: string;
+        category: CredentialCategory | "all";
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    begin: ({ row, kind, providerId }: {
+        row?: CredentialSummary;
+        kind?: CredentialKind;
+        providerId?: string;
+    }, _optional?: {}) => void;
+    save: (_required: Record<string, never>, _optional?: {}) => Promise<boolean>;
+    setDraft({ patch }: {
+        patch: Partial<Omit<CredentialDraft, "kind" | "id" | "providerId">>;
+    }, _optional?: {}): void;
+    cancel(_required: Record<string, never>, _optional?: {}): void;
+    filter({ query, category }: {
+        query?: string;
+        category?: CredentialCategory | "all";
+    }, _optional?: {}): void;
+    remove({ row }: {
+        row: CredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    makeDefault({ row }: {
+        row: CredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=access-tokens.controller.d.ts.map

package/dist/security/controllers/access-tokens.controller.js

@@ -0,0 +1,112 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { blankCredentialDraft, buildCredentialPatch, credentialStore, validateCredentialDraft, writePermission, credentialLabel } from '../rules.js';
+export function createAccessTokensController({ api, permissions = [] }, _optional = {}) {
+    const grants = new Set(permissions);
+    const store = createControllerStore({ initial: { rows: [], providers: [], draft: null, loading: false, saving: false, error: null, errors: {}, query: '', category: 'all' } });
+    let generation = 0;
+    const allowed = (kind) => !store.signal.aborted && grants.has('security.read') && grants.has(writePermission({ kind }));
+    async function load(_required, _optional = {}) {
+        if (store.signal.aborted || !grants.has('security.read'))
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        // Independent stores retain their own successful results; one unavailable store cannot hide the rest.
+        const kinds = ['publish', 'source-control', 'custom'];
+        const tasks = kinds.map(async (kind) => {
+            try {
+                const rows = await credentialStore({ api, kind }).list({}, { signal: store.signal });
+                if (ticket === generation) {
+                    const errors = { ...store.getSnapshot().errors };
+                    delete errors[kind];
+                    store.set({ patch: { rows: Object.freeze([...store.getSnapshot().rows.filter(r => r.kind !== kind), ...rows]), errors } });
+                }
+            }
+            catch {
+                if (ticket === generation)
+                    store.set({ patch: { errors: { ...store.getSnapshot().errors, [kind]: 'Credential store unavailable' } } });
+            }
+        });
+        tasks.push((async () => { try {
+            const providers = await api.providers({}, { signal: store.signal });
+            if (ticket === generation)
+                store.set({ patch: { providers, error: null } });
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { error: 'Provider catalog unavailable' } });
+        } })());
+        await Promise.all(tasks);
+        if (ticket === generation)
+            store.set({ patch: { loading: false } });
+    }
+    function begin({ row, kind, providerId }, _optional = {}) {
+        const k = row?.kind ?? kind ?? 'custom';
+        if (!allowed(k) || store.getSnapshot().saving)
+            return;
+        const draft = row ? { ...blankCredentialDraft({ kind: row.kind, providerId: row.providerId }), id: row.id, label: credentialLabel({ row, providers: store.getSnapshot().providers }), category: row.category ?? (row.kind === 'publish' ? 'hosting' : row.kind === 'source-control' ? 'source-control' : 'general'), baseUrl: row.baseUrl ?? '', additionalHosts: row.additionalHosts?.join('\n') ?? '', username: row.username ?? '' } : blankCredentialDraft({ kind: k, ...(providerId ? { providerId } : {}) });
+        store.set({ patch: { draft, error: null } });
+    }
+    async function save(_required, _optional = {}) {
+        const state = store.getSnapshot(), draft = state.draft;
+        if (!draft || !allowed(draft.kind) || state.saving)
+            return false;
+        const error = validateCredentialDraft({ draft, rows: state.rows, providers: state.providers });
+        if (error) {
+            store.set({ patch: { error } });
+            return false;
+        }
+        const patch = buildCredentialPatch({ draft, providers: state.providers });
+        const target = credentialStore({ api, kind: draft.kind });
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const row = draft.id ? await target.update({ id: draft.id, patch }, { signal: store.signal }) : await target.create(patch, { signal: store.signal });
+            // Clear accepted secrets before any later read can fail. A successful save must never leave a saved secret visible.
+            store.set({ patch: { draft: null, rows: Object.freeze([...store.getSnapshot().rows.filter(r => !(r.kind === row.kind && r.id === row.id)), row]) } });
+            // First-create default assignment can change siblings; the server owns that invariant.
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Unable to save credential' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    async function write({ row, remove }) {
+        if (!allowed(row.kind) || store.getSnapshot().saving)
+            return false;
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const target = credentialStore({ api, kind: row.kind });
+            if (remove)
+                await target.remove({ id: row.id }, { signal: store.signal });
+            else
+                await target.update({ id: row.id, patch: { isDefault: true } }, { signal: store.signal });
+            // Remove/default can promote another row. Refetch rather than duplicating server promotion rules.
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Unable to update credential' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load, begin, save,
+        setDraft({ patch }, _optional = {}) { const draft = store.getSnapshot().draft; if (draft && allowed(draft.kind) && !store.getSnapshot().saving)
+            store.set({ patch: { draft: { ...draft, ...patch } } }); },
+        cancel(_required, _optional = {}) { if (!store.getSnapshot().saving)
+            store.set({ patch: { draft: null, error: null } }); },
+        filter({ query, category }, _optional = {}) { store.set({ patch: { ...(query !== undefined ? { query } : {}), ...(category ? { category } : {}) } }); },
+        remove({ row }, _optional = {}) { return write({ row, remove: true }); },
+        makeDefault({ row }, _optional = {}) { if (row.kind === 'custom')
+            return Promise.resolve(false); return write({ row, remove: false }); },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=access-tokens.controller.js.map

package/dist/security/controllers/other-credentials.controller.d.ts

@@ -0,0 +1,30 @@
+import type { OtherCredentialsPort } from '../ports.js';
+import type { OtherCredentialSummary } from '../models.js';
+export declare function createOtherCredentialsController({ api, permissions }: {
+    api: OtherCredentialsPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        rows: readonly OtherCredentialSummary[];
+        drafts: Readonly<Record<string, string>>;
+        errors: Readonly<Record<string, string>>;
+        loading: boolean;
+        saving: boolean;
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    setDraft({ key, token }: {
+        key: string;
+        token: string;
+    }, _optional?: {}): void;
+    replace({ row }: {
+        row: OtherCredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    remove({ row }: {
+        row: OtherCredentialSummary;
+    }, _optional?: {}): Promise<boolean>;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=other-credentials.controller.d.ts.map

package/dist/security/controllers/other-credentials.controller.js

@@ -0,0 +1,74 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { OTHER_STORES, otherWritePermission } from '../rules.js';
+export function createOtherCredentialsController({ api, permissions = [] }, _optional = {}) {
+    const grants = new Set(permissions);
+    let generation = 0;
+    const store = createControllerStore({ initial: { rows: [], drafts: {}, errors: {}, loading: false, saving: false } });
+    async function read(id, ticket) {
+        try {
+            const rows = await api.list({ store: id }, { signal: store.signal });
+            if (ticket === generation) {
+                const errors = { ...store.getSnapshot().errors };
+                delete errors[id];
+                store.set({ patch: { rows: [...store.getSnapshot().rows.filter(r => r.store !== id), ...rows], errors } });
+            }
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { errors: { ...store.getSnapshot().errors, [id]: 'Credential store unavailable' } } });
+        }
+    }
+    async function load(_required, _optional = {}) {
+        if (store.signal.aborted || !grants.has('security.read'))
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        await Promise.all(OTHER_STORES.map(id => read(id, ticket)));
+        if (ticket === generation)
+            store.set({ patch: { loading: false } });
+    }
+    // One serial lane: whole-map media writes must read only after the previous write/refetch settled.
+    // This is tab-local; cross-session races still require a server concurrency check.
+    let lane = Promise.resolve();
+    function write(row, remove) {
+        if (store.signal.aborted || !grants.has('security.read') || !grants.has(otherWritePermission({ store: row.store })) || (!remove && !row.supportsReplace))
+            return Promise.resolve(false);
+        const token = store.getSnapshot().drafts[`${row.store}:${row.id}`]?.trim() ?? '';
+        if (!remove && !token)
+            return Promise.resolve(false);
+        const run = lane.then(async () => {
+            if (store.signal.aborted)
+                return false;
+            store.set({ patch: { saving: true } });
+            try {
+                if (remove)
+                    await api.remove({ store: row.store, id: row.id }, { signal: store.signal });
+                else
+                    await api.replace({ store: row.store, id: row.id, token }, { signal: store.signal });
+                const drafts = { ...store.getSnapshot().drafts };
+                delete drafts[`${row.store}:${row.id}`];
+                store.set({ patch: { drafts } });
+                await read(row.store, generation);
+                return !store.signal.aborted;
+            }
+            catch {
+                store.set({ patch: { errors: { ...store.getSnapshot().errors, [row.store]: 'Unable to update credential' } } });
+                return false;
+            }
+            finally {
+                store.set({ patch: { saving: false } });
+            }
+        });
+        lane = run.then(() => undefined);
+        return run;
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
+        setDraft({ key, token }, _optional = {}) { if (!store.signal.aborted && !store.getSnapshot().saving)
+            store.set({ patch: { drafts: { ...store.getSnapshot().drafts, [key]: token } } }); },
+        replace({ row }, _optional = {}) { return write(row, false); },
+        remove({ row }, _optional = {}) { return write(row, true); },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=other-credentials.controller.js.map

package/dist/security/controllers/root-key.controller.d.ts

@@ -0,0 +1,35 @@
+import type { RootKeyPort } from '../ports.js';
+import type { RootKeyStatus, RootKeyPreview } from '../models.js';
+export declare function createRootKeyController({ api, permissions }: {
+    api: RootKeyPort;
+    permissions?: readonly string[];
+}, _optional?: {}): {
+    getSnapshot: () => Readonly<{
+        status: RootKeyStatus | null;
+        preview: RootKeyPreview | null;
+        token: string;
+        confirm: string;
+        loading: boolean;
+        saving: boolean;
+        error: string | null;
+        result: string | null;
+        confirming: boolean;
+    }>;
+    subscribe: ({ listener }: {
+        listener: () => void;
+    }) => () => void;
+    load: (_required: Record<string, never>, _optional?: {}) => Promise<void>;
+    setToken({ value }: {
+        value: string;
+    }, _optional?: {}): void;
+    setConfirm({ value }: {
+        value: string;
+    }, _optional?: {}): void;
+    generate(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    importToken(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    preview(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    startFresh(_required: Record<string, never>, _optional?: {}): Promise<boolean>;
+    cancel(_required: Record<string, never>, _optional?: {}): void;
+    dispose(_required?: Record<string, never>, _optional?: {}): void;
+};
+//# sourceMappingURL=root-key.controller.d.ts.map

package/dist/security/controllers/root-key.controller.js

@@ -0,0 +1,90 @@
+import { createControllerStore } from '../../core/module/controller-store.js';
+import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../rules.js';
+export function createRootKeyController({ api, permissions = [] }, _optional = {}) {
+    const granted = permissions.includes(ROOT_KEY_PERMISSION);
+    const store = createControllerStore({ initial: { status: null, preview: null, token: '', confirm: '', loading: false, saving: false, error: null, result: null, confirming: false } });
+    let generation = 0;
+    const allowed = () => granted && !store.signal.aborted;
+    async function load(_required, _optional = {}) {
+        if (!allowed())
+            return;
+        const ticket = ++generation;
+        store.set({ patch: { loading: true } });
+        try {
+            const status = await api.status({}, { signal: store.signal });
+            if (ticket === generation)
+                store.set({ patch: { status, error: null } });
+        }
+        catch {
+            if (ticket === generation)
+                store.set({ patch: { error: 'Root key status unavailable' } });
+        }
+        finally {
+            if (ticket === generation)
+                store.set({ patch: { loading: false } });
+        }
+    }
+    async function execute(run, result) {
+        if (!allowed() || store.getSnapshot().saving)
+            return false;
+        store.set({ patch: { saving: true, error: null } });
+        try {
+            const response = await run();
+            store.set({ patch: { token: '', confirm: '', preview: null, confirming: false, result: response.affectedWebhooks?.length ? `${result} Update receivers: ${response.affectedWebhooks.map(w => `${w.label} (${w.targetUrl})`).join(', ')}` : result } });
+            await load({});
+            return !store.signal.aborted;
+        }
+        catch {
+            store.set({ patch: { error: 'Recovery refused. Check the host key configuration.' } });
+            return false;
+        }
+        finally {
+            store.set({ patch: { saving: false } });
+        }
+    }
+    return {
+        getSnapshot: store.getSnapshot, subscribe: store.subscribe, load,
+        setToken({ value }, _optional = {}) { if (allowed() && !store.getSnapshot().saving)
+            store.set({ patch: { token: value } }); },
+        setConfirm({ value }, _optional = {}) { if (allowed() && !store.getSnapshot().saving)
+            store.set({ patch: { confirm: value } }); },
+        generate(_required, _optional = {}) {
+            const status = store.getSnapshot().status;
+            // No rotate/replace: replacing an active key would orphan every secret sealed under it.
+            if (!status || status.active || status.state !== 'missing')
+                return Promise.resolve(false);
+            return execute(() => api.generate({}, { signal: store.signal }), 'Root key ready');
+        },
+        importToken(_required, _optional = {}) { const token = store.getSnapshot().token.trim(); return token && isRootKeyLocked({ status: store.getSnapshot().status }) ? execute(() => api.importToken({ token }, { signal: store.signal }), 'Unlocked. Saved credentials work again.') : Promise.resolve(false); },
+        async preview(_required, _optional = {}) {
+            if (!allowed() || !isRootKeyLocked({ status: store.getSnapshot().status }) || store.getSnapshot().saving || store.getSnapshot().loading)
+                return false;
+            const ticket = ++generation;
+            store.set({ patch: { loading: true, preview: null, confirm: '', error: null } });
+            try {
+                const preview = await api.previewStartFresh({}, { signal: store.signal });
+                if (ticket !== generation || !allowed())
+                    return false;
+                store.set({ patch: { preview, confirming: true } });
+                return true;
+            }
+            catch {
+                if (ticket === generation)
+                    store.set({ patch: { error: 'Recovery preview unavailable' } });
+                return false;
+            }
+            finally {
+                if (ticket === generation)
+                    store.set({ patch: { loading: false } });
+            }
+        },
+        startFresh(_required, _optional = {}) { const state = store.getSnapshot(); if (!isRootKeyLocked({ status: state.status }) || !state.preview || !state.confirming || state.confirm !== START_FRESH_CONFIRMATION)
+            return Promise.resolve(false); return execute(() => api.startFresh({ confirm: state.confirm }, { signal: store.signal }), 'Done. Re-enter removed credentials.'); },
+        cancel(_required, _optional = {}) { if (!store.getSnapshot().saving) {
+            generation++;
+            store.set({ patch: { confirming: false, preview: null, confirm: '', loading: false } });
+        } },
+        dispose(_required = {}, _optional = {}) { generation++; store.dispose(); },
+    };
+}
+//# sourceMappingURL=root-key.controller.js.map

package/dist/security/index.d.ts

@@ -0,0 +1,9 @@
+export { securityModule } from './security.module.js';
+export * from './models.js';
+export * from './ports.js';
+export * from './rules.js';
+export { securityMessagesEn } from './messages.en.js';
+export { createAccessTokensController } from './controllers/access-tokens.controller.js';
+export { createOtherCredentialsController } from './controllers/other-credentials.controller.js';
+export { createRootKeyController } from './controllers/root-key.controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.js

@@ -0,0 +1,9 @@
+export { securityModule } from './security.module.js';
+export * from './models.js';
+export * from './ports.js';
+export * from './rules.js';
+export { securityMessagesEn } from './messages.en.js';
+export { createAccessTokensController } from './controllers/access-tokens.controller.js';
+export { createOtherCredentialsController } from './controllers/other-credentials.controller.js';
+export { createRootKeyController } from './controllers/root-key.controller.js';
+//# sourceMappingURL=index.js.map

package/dist/security/messages.en.d.ts

@@ -0,0 +1,12 @@
+export declare const securityMessagesEn: {
+    readonly security: "Secrets";
+    readonly accessTokens: "Access tokens";
+    readonly rootKey: "Root key";
+    readonly denied: "Permission denied";
+    readonly loading: "Loading credentials…";
+    readonly remove: "Remove credential";
+    readonly replace: "Replace";
+    readonly save: "Save";
+    readonly cancel: "Cancel";
+};
+//# sourceMappingURL=messages.en.d.ts.map

package/dist/security/messages.en.js

@@ -0,0 +1,2 @@
+export const securityMessagesEn = { security: 'Secrets', accessTokens: 'Access tokens', rootKey: 'Root key', denied: 'Permission denied', loading: 'Loading credentials…', remove: 'Remove credential', replace: 'Replace', save: 'Save', cancel: 'Cancel' };
+//# sourceMappingURL=messages.en.js.map