aegis-desktop 0.8.12 → 0.8.13

package/renderer/fingerprint.js

@@ -0,0 +1,583 @@
+'use strict';
+
+/**
+ * fingerprint.js — the φ(α) panel: authorship key, sealed records, the vault.
+ *
+ * The IPC surface has existed since 5072779 (`fingerprintStatus` …
+ * `fingerprintVaultAudit`, desktop/preload.js:171-183, main.js:750-765) and
+ * until now nothing in desktop/renderer/ called any of it —
+ * `grep -rn fingerprint desktop/renderer/` returned nothing, so a GUI user had
+ * no button for a feature the terminal has had since `aegiscode fingerprint`.
+ * This file is that button.
+ *
+ * It obeys the same two rules the backend half already keeps:
+ *
+ *   1. **The key never reaches the DOM.** No payload from main carries
+ *      `secret`, and nothing here invents a field that might. What gets painted
+ *      is `status.keyFingerprint` — the derived 12-hex tag — which is public by
+ *      construction (client/authorship-key.js prints exactly this).
+ *   2. **A refusal is shown, not swallowed.** Every handler resolves
+ *      `{ ok: false, error }` instead of throwing, so the panel prints the
+ *      reason ("this key file is readable by other users", "rclone is not
+ *      installed") rather than an empty state that reads like success.
+ *
+ * Pure formatting (`keyLine`, `anchorVerdict`, `auditVerdict`, …) is kept
+ * separate from painting so test/renderer-fingerprint.test.mjs can assert the
+ * strings that carry the three-claim anchor verdict without standing up a DOM —
+ * and the functions it asserts are the exact ones that paint.
+ *
+ * Classic script, no imports: loaded before app.js by index.html and called
+ * from init(). It does not auto-mount, so requiring it under test has no side
+ * effects.
+ */
+
+(function (root, factory) {
+  const api = factory();
+  // `module` first: under Node the test requires this file directly, and the
+  // renderer's `window` is not there.
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.aegisFingerprint = api;
+})(typeof window !== 'undefined' ? window : null, function () {
+  /** Every id this file reads. The test asserts each one exists in index.html —
+   *  a typo here is otherwise a silent no-op, which is how a panel ships with
+   *  one dead button and no error. */
+  const IDS = {
+    cardStatus: 'fp-card-status',
+    cardOpen: 'fp-open',
+    overlay: 'fp-overlay',
+    backdrop: 'fp-backdrop',
+    close: 'fp-close',
+    keySource: 'fp-key-source',
+    keyPath: 'fp-key-path',
+    keyTag: 'fp-key-tag',
+    keyWarning: 'fp-key-warning',
+    vaultTarget: 'fp-vault-target',
+    label: 'fp-label',
+    publishOnMint: 'fp-publish-on-mint',
+    autoSeal: 'fp-auto-seal',
+    autoSealLabel: 'fp-auto-seal-label',
+    autoHint: 'fp-auto-hint',
+    sealNow: 'fp-seal-now',
+    keygen: 'fp-keygen',
+    seal: 'fp-seal',
+    sealCard: 'fp-seal-card',
+    verify: 'fp-verify',
+    publish: 'fp-publish',
+    anchor: 'fp-anchor',
+    backupTo: 'fp-backup-to',
+    backup: 'fp-backup',
+    vault: 'fp-vault',
+    audit: 'fp-audit',
+    vaultList: 'fp-vault-list',
+    out: 'fp-out',
+  };
+
+  // ------------------------------------------------------------- formatting
+
+  const dash = (v) => (v === null || v === undefined || v === '' ? '–' : String(v));
+
+  /** The one-line state that goes in the sidebar card, where there is room for
+   *  a sentence and not a table. */
+  function keyLine(status) {
+    if (!status) return 'checking…';
+    if (status.ok === false) return status.error || 'unavailable';
+    if (!status.configured) return 'no key — mint one to seal records';
+    return `key ${dash(status.keyFingerprint)} · ${dash(status.keySource)}`;
+  }
+
+  /** Everything the panel can say about the key without saying the key. */
+  function statusRows(status) {
+    if (!status || status.ok === false) {
+      return [{ k: 'state', v: (status && status.error) || 'unavailable' }];
+    }
+    const rows = [
+      { k: 'key', v: status.configured ? status.keyFingerprint : 'none' },
+      { k: 'source', v: dash(status.keySource) },
+      { k: 'expected at', v: dash(status.defaultKeyPath) },
+      { k: 'history', v: status.historyPresent ? status.historyPath : 'none yet' },
+    ];
+    // Only when it resolves somewhere else than expected is it worth a row: a
+    // key coming from AEGIS_AUTHORSHIP_SECRET or --secret is exactly the
+    // situation where "which key am I actually signing with" needs an answer.
+    if (status.configured && status.keyPath && status.keyPath !== status.defaultKeyPath) {
+      rows.splice(2, 0, { k: 'in use', v: status.keyPath });
+    }
+    return rows;
+  }
+
+  /** The 0644 refusal is the one failure where the fix is a command the user
+   *  can run, so it is surfaced as a warning line rather than buried in the
+   *  result pane. */
+  function keyWarning(status) {
+    const err = status && status.error ? String(status.error) : '';
+    return /chmod/i.test(err) ? err : '';
+  }
+
+  /** One line per vault entry. Tolerant of the key the shared module chooses,
+   *  because the panel's job here is to show what came back, not to insist. */
+  function vaultRows(list) {
+    if (!list || list.ok === false) {
+      return [{ name: 'vault unavailable', detail: (list && list.error) || 'unknown error' }];
+    }
+    const items = Array.isArray(list.records) ? list.records
+      : Array.isArray(list.items) ? list.items
+      : Array.isArray(list.entries) ? list.entries
+      : [];
+    if (!items.length) return [{ name: 'nothing published yet', detail: '' }];
+    return items.map((it) => {
+      const name = it.name || it.file || it.path || it.id || 'record';
+      const parts = [it.id, it.publishedAt || it.createdAt, it.url].filter(Boolean);
+      return { name: String(name), detail: parts.join(' · ') };
+    });
+  }
+
+  /** The anchor answer, kept as three separate claims on purpose: "the file is
+   *  gone", "the file was replaced" and "the key that sealed it has moved on"
+   *  are three different situations, and one boolean hides the interesting one
+   *  (client/record-vault.js checkAnchor). `present` is read as well as
+   *  `presence` because that spelling was a real bug once. */
+  function anchorVerdict(a) {
+    if (!a || a.ok === false) {
+      return { ok: false, label: (a && a.error) || 'anchor check failed', claims: [] };
+    }
+    const present = a.present !== undefined ? a.present : a.presence;
+    const claims = [
+      { k: 'present', v: present },
+      { k: 'unchanged', v: a.unchanged },
+      { k: 'attested', v: a.attested },
+    ];
+    const ok = present === true && a.unchanged === true && a.attested === true;
+    return {
+      ok,
+      // Ambiguity is not success: an undefined claim is reported as unknown,
+      // never folded into a yes.
+      label: ok ? 'the published copy is this record' : 'the published copy is not verifiably this record',
+      claims,
+    };
+  }
+
+  /** What the audit found. A finding is a fact about the vault, not an error
+   *  from it, so a clean run says so explicitly rather than showing nothing. */
+  function auditVerdict(a) {
+    if (!a || a.ok === false) return { ok: false, label: (a && a.error) || 'audit failed', findings: [] };
+    const findings = Array.isArray(a.findings) ? a.findings
+      : Array.isArray(a.leaks) ? a.leaks
+      : Array.isArray(a.hits) ? a.hits
+      : [];
+    if (findings.length) {
+      return { ok: false, label: `${findings.length} item(s) in the vault look like key material`, findings };
+    }
+    return { ok: true, label: 'no key material in the vault', findings: [] };
+  }
+
+  /** A minted record as the panel reports it. The local file is the evidence —
+   *  a failed publish does not unseal it (desktop/lib/fingerprint.js mint) —
+   *  so an upload failure is said beside the seal, not instead of it. */
+  function sealLine(r) {
+    if (!r || r.ok === false) return { ok: false, text: (r && r.error) || 'seal failed' };
+    const rec = r.record || {};
+    const bits = [`sealed ${dash(rec.id)}`, `key ${dash(rec.keyFingerprint)}`, r.out];
+    // Both halves of the session, in the record and in the line: the key that
+    // sealed it, and the mind that answered. An un-nominated AI credential reads
+    // as "ai unobserved", never as a borrowed key.
+    bits.push(
+      rec.aiKey
+        ? `ai ${dash(rec.ai)} on ${dash(rec.aiKey)}`
+        : `ai unobserved${rec.ai ? ` (${dash(rec.ai)})` : ''}`,
+    );
+    if (r.vault && r.vault.url) bits.push(`published ${r.vault.url}`);
+    else if (r.vault) bits.push(`published ${dash(r.vault.remote || r.vault.path)}`);
+    if (r.vaultError) bits.push(`publish failed: ${r.vaultError}`);
+    return { ok: true, text: bits.filter(Boolean).join(' · '), file: r.out || null, record: r.record || null };
+  }
+
+  // ---------------------------------------------------------------- painting
+
+  /**
+   * One line describing the auto-seal state, in the same voice as the rest of
+   * the panel: what is armed, what it has filed, and the last thing that went
+   * wrong. Pure, so the test asserts the string the panel paints.
+   */
+  function autoMintLine(s) {
+    if (!s || typeof s !== 'object') return '–';
+    if (s.enabled !== true) return 'off — sealing stays a button';
+    const bits = [];
+    const secs = Number(s.quietMs);
+    bits.push(Number.isFinite(secs) ? `seals ${Math.round(secs / 1000)}s after the last turn` : 'seals when the session goes quiet');
+    if (s.publish) bits.push('publishes to the vault');
+    if (s.pendingTurns) bits.push(`${s.pendingTurns} turn${s.pendingTurns === 1 ? '' : 's'} pending`);
+    if (s.seals) bits.push(`${s.seals} sealed`);
+    if (s.failures) bits.push(`${s.failures} failed`);
+    if (s.lastError) bits.push(`last error: ${s.lastError}`);
+    return bits.join(' · ');
+  }
+
+  function mount({ api, doc, auto } = {}) {
+    const d = doc || (typeof document !== 'undefined' ? document : null);
+    if (!d) throw new Error('fingerprint: mount needs a document');
+    const bridge = api || (typeof window !== 'undefined' ? window.aegis : null);
+    // The automation bridge (main.js registerAutoIpc). Injectable for the same
+    // reason `api` is, and optional: a preload predating that surface leaves the
+    // auto-seal control inert rather than throwing at mount.
+    const autoBridge = auto || (typeof window !== 'undefined' ? window.auto : null);
+
+    const el = (id) => d.getElementById(id);
+    const state = { status: null, last: null, busy: false, mounted: true };
+
+    function say(text, bad) {
+      const out = el(IDS.out);
+      if (!out) return;
+      out.textContent = text;
+      out.className = bad ? 'fp-out fp-bad' : 'fp-out';
+    }
+
+    /** Every bridge call goes through here. A handler that rejects (Electron
+     *  turns a thrown main-process error into a rejected invoke) must not leave
+     *  the panel mid-action, so the catch produces the same `{ ok, error }`
+     *  shape the handlers themselves do. */
+    async function call(name, payload) {
+      if (!bridge || typeof bridge[name] !== 'function') {
+        return { ok: false, error: `this build has no ${name} bridge` };
+      }
+      try {
+        const r = await bridge[name](payload);
+        if (!r || typeof r !== 'object') return { ok: false, error: `${name} returned nothing` };
+        return r;
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    }
+
+    function paintStatus() {
+      const s = state.status;
+      const card = el(IDS.cardStatus);
+      if (card) card.textContent = keyLine(s);
+      const src = el(IDS.keySource);
+      const pth = el(IDS.keyPath);
+      const tag = el(IDS.keyTag);
+      const warn = el(IDS.keyWarning);
+      const vt = el(IDS.vaultTarget);
+      const rows = statusRows(s);
+      const pick = (k) => {
+        const row = rows.find((r) => r.k === k);
+        return row ? row.v : '–';
+      };
+      if (src) src.textContent = pick('source');
+      if (pth) pth.textContent = s && s.keyPath ? s.keyPath : pick('expected at');
+      if (tag) tag.textContent = s && s.configured ? dash(s.keyFingerprint) : 'none';
+      if (warn) {
+        const w = keyWarning(s);
+        warn.textContent = w;
+        warn.hidden = !w;
+      }
+      if (vt && s && s.vault) {
+        vt.textContent = `${dash(s.vault.remote)}:${dash(s.vault.recordsDir || s.vault.root)}`;
+      } else if (vt) {
+        vt.textContent = '–';
+      }
+      // A key that is present makes keygen a REPLACE, which orphans every
+      // record sealed with the old one. Saying that on the button is the whole
+      // warning; the confirm below is the second line of defence.
+      const kg = el(IDS.keygen);
+      if (kg) kg.textContent = s && s.configured ? 'Replace key…' : 'Mint key';
+    }
+
+    function paintVault(list) {
+      const ul = el(IDS.vaultList);
+      if (!ul) return;
+      ul.textContent = '';
+      for (const row of vaultRows(list)) {
+        const li = d.createElement('li');
+        li.className = 'fp-vault-row';
+        const name = d.createElement('span');
+        name.className = 'fp-vault-name';
+        name.textContent = row.name;
+        li.appendChild(name);
+        if (row.detail) {
+          const det = d.createElement('span');
+          det.className = 'fp-vault-detail';
+          det.textContent = row.detail;
+          li.appendChild(det);
+        }
+        ul.appendChild(li);
+      }
+    }
+
+    async function refresh() {
+      state.status = await call('fingerprintStatus');
+      paintStatus();
+      await loadAutoMint();
+      return state.status;
+    }
+
+    /**
+     * The auto-seal control (settings.js `__autoMint`, through lib/auto.js).
+     *
+     * Read-only paint from MAIN, for the reason the rest of this panel is: the
+     * renderer must never be the place that decides a record gets filed, and a
+     * checkbox state this file invented would disagree with the timer the moment
+     * anything else (the queue card's window, a restart) changed the setting.
+     */
+    function renderAutoMint(s) {
+      if (!s || typeof s !== 'object') return;
+      const sw = el(IDS.autoSeal);
+      if (sw) sw.checked = s.enabled === true;
+      const label = el(IDS.autoSealLabel);
+      if (label) label.textContent = s.enabled ? 'sealing automatically when quiet' : 'seal automatically when quiet';
+      const hint = el(IDS.autoHint);
+      if (!hint) return;
+      hint.textContent = autoMintLine(s);
+    }
+
+    async function loadAutoMint() {
+      if (!autoBridge || typeof autoBridge.status !== 'function') {
+        const hint = el(IDS.autoHint);
+        // Said plainly rather than left blank: an inert toggle with no
+        // explanation is the failure mode this whole panel exists to avoid.
+        if (hint) hint.textContent = 'this build has no automation bridge — sealing stays a button';
+        return null;
+      }
+      try {
+        const r = await autoBridge.status();
+        if (r && r.mint) renderAutoMint(r.mint);
+        return r;
+      } catch (e) {
+        const hint = el(IDS.autoHint);
+        if (hint) hint.textContent = `automation status unavailable: ${(e && e.message) || String(e)}`;
+        return null;
+      }
+    }
+
+    /** Persist the switch through main and paint main's answer. */
+    async function setAutoMint(enabled) {
+      if (!autoBridge || typeof autoBridge.setMint !== 'function') return null;
+      const publish = Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked);
+      try {
+        const r = await autoBridge.setMint({ enabled: Boolean(enabled), publish });
+        if (r && r.mint) renderAutoMint(r.mint);
+        else if (r && r.ok === false) say(r.error || 'could not save that', true);
+        return r;
+      } catch (e) {
+        say(`could not save that: ${(e && e.message) || String(e)}`, true);
+        return null;
+      }
+    }
+
+    /** Seal right now, through the automation rather than the raw mint: the
+     *  same call resets the pending-turn counter, so the quiet timer will not
+     *  file a second identical record for this session. */
+    async function doSealNow() {
+      const publish = Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked);
+      return action('seal now', async () => {
+        if (!autoBridge || typeof autoBridge.sealNow !== 'function') {
+          return { ok: false, error: 'this build has no automation bridge' };
+        }
+        return autoBridge.sealNow(publish);
+      }, {
+        paint: (r) => { if (r && r.ok && r.out) state.last = { file: r.out, record: r.record || null }; },
+        say: (r) => {
+          if (!r) return 'seal now: nothing happened';
+          if (r.ok === false) return `seal failed: ${r.error || 'unknown'}`;
+          if (r.type === 'skip') return `nothing to seal (${r.reason || 'no new turns'})`;
+          const line = sealLine(r);
+          return line.ok ? `sealed ${dash((r.record || {}).id)} → ${dash(r.out)}` : `seal failed: ${line.text}`;
+        },
+      });
+    }
+
+    /** Run one action, repaint what it changed, and say what it did. `confirm`
+     *  is injectable so the harness can answer it deterministically. */
+    async function action(label, fn, opts) {
+      const o = opts || {};
+      if (state.busy) return null;
+      state.busy = true;
+      say(`${label}…`, false);
+      try {
+        const r = await fn();
+        if (o.paint) o.paint(r);
+        if (o.after) await o.after(r);
+        say(o.say ? o.say(r) : `${label}: ${r && r.ok === false ? r.error : 'done'}`, Boolean(r && r.ok === false));
+        return r;
+      } finally {
+        state.busy = false;
+      }
+    }
+
+    const doKeygen = () =>
+      action('mint key', () => call('fingerprintKeygen', {
+        force: Boolean(state.status && state.status.configured),
+      }), {
+        // Only after a successful mint: status moved from "no key" to a key,
+        // and repainting is what turns "Mint key" into "Replace key…".
+        after: refresh,
+        say: (r) => (r.ok
+          ? `minted ${dash(r.keyFingerprint)} at ${dash(r.path)}`
+          : `mint failed: ${r.error}`),
+      });
+
+    const doSeal = () =>
+      action('seal session', () => call('fingerprintMint', {
+        label: (el(IDS.label) && el(IDS.label).value.trim()) || null,
+        publish: Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked),
+      }), {
+        paint: (r) => { if (r.ok) state.last = { file: r.out, record: r.record }; },
+        say: (r) => {
+          const line = sealLine(r);
+          return line.ok ? `sealed ${dash((r.record || {}).id)} → ${dash(r.out)}` : `seal failed: ${line.text}`;
+        },
+      });
+
+    /** Verify/publish/anchor act on the record this panel sealed. A path is
+     *  preferred over the in-memory record because the sha256 in the anchor is
+     *  then about the bytes on disk rather than a re-serialisation of them
+     *  (desktop/lib/fingerprint.js publish makes the same argument) — so `file`
+     *  wins when there is one, and the record is the fallback for a host where
+     *  the write failed but the seal did not. */
+    const doVerify = () =>
+      action('verify', async () => {
+        if (state.last && state.last.file) return call('fingerprintVerify', { file: state.last.file });
+        if (state.last && state.last.record) return call('fingerprintVerify', { record: state.last.record });
+        return { ok: false, error: 'nothing sealed in this window yet — seal a session first' };
+      }, {
+        say: (r) => (r.ok ? `verified ${dash(r.id)} · key ${dash(r.keySource)}` : `not verified: ${r.error || r.reason}`),
+      });
+
+    const doPublish = () =>
+      action('publish', () => {
+        if (state.last && state.last.file) return call('fingerprintPublish', { file: state.last.file });
+        if (state.last && state.last.record) return call('fingerprintPublish', { record: state.last.record });
+        return { ok: false, error: 'nothing sealed in this window yet — seal a session first' };
+      }, {
+        say: (r) => (r.ok
+          ? `published ${dash(r.url || r.path)}${r.sha256 ? ` · sha256 ${String(r.sha256).slice(0, 12)}` : ''}`
+          : `publish failed: ${r.error}`),
+      });
+
+    const doAnchor = () =>
+      action('check anchor', () => {
+        if (state.last && state.last.file) return call('fingerprintAnchor', { file: state.last.file });
+        return call('fingerprintAnchor', {});
+      }, {
+        say: (r) => {
+          const v = anchorVerdict(r);
+          const claims = v.claims.map((c) => `${c.k} ${c.v === true ? 'yes' : c.v === false ? 'no' : 'unknown'}`).join(' · ');
+          return `${v.label}${claims ? ` — ${claims}` : ''}`;
+        },
+      });
+
+    const doBackup = () =>
+      action('back up key', () => {
+        const to = el(IDS.backupTo) && el(IDS.backupTo).value.trim();
+        if (!to) return { ok: false, error: 'backup needs a destination directory' };
+        return call('fingerprintBackup', { to });
+      }, {
+        say: (r) => (r.ok ? `key copied to ${dash(r.to || r.path)}` : `backup refused: ${r.error}`),
+      });
+
+    const doVault = () =>
+      action('list vault', () => call('fingerprintVault'), {
+        paint: paintVault,
+        say: (r) => (r.ok ? `vault listed — ${vaultRows(r).length} entry(ies)` : `vault unavailable: ${r.error}`),
+      });
+
+    const doAudit = () =>
+      action('audit vault', () => call('fingerprintVaultAudit'), {
+        say: (r) => {
+          const v = auditVerdict(r);
+          const names = v.findings.map((f) => (f && (f.path || f.name)) || String(f)).slice(0, 3);
+          return `${v.label}${names.length ? ` — ${names.join(', ')}` : ''}`;
+        },
+      });
+
+    const isOpen = () => {
+      const o = el(IDS.overlay);
+      return Boolean(o) && !o.hidden;
+    };
+
+    async function open() {
+      const o = el(IDS.overlay);
+      if (!o) return;
+      o.hidden = false;
+      // Body class so the page behind cannot scroll under the sheet, matching
+      // the memory inspector's `.memory-open` rule.
+      if (d.body && d.body.classList) d.body.classList.add('fp-open');
+      await refresh();
+      await doVault();
+      const f = el(IDS.close);
+      if (f) f.focus();
+    }
+
+    function close() {
+      const o = el(IDS.overlay);
+      if (!o) return;
+      o.hidden = true;
+      if (d.body && d.body.classList) d.body.classList.remove('fp-open');
+      const btn = el(IDS.cardOpen);
+      if (btn) btn.focus();
+    }
+
+    // ------------------------------------------------------------- listeners
+    // Bound here rather than in app.js so the panel owns its own markup: every
+    // id in IDS is read by this file only, and the test asserts they all exist.
+    const bind = (id, type, fn) => {
+      const node = el(id);
+      if (node) node.addEventListener(type, fn);
+    };
+
+    bind(IDS.cardOpen, 'click', open);
+    bind(IDS.close, 'click', close);
+    bind(IDS.backdrop, 'click', close);
+    bind(IDS.keygen, 'click', doKeygen);
+    bind(IDS.seal, 'click', doSeal);
+    // The sidebar's one-click seal runs the same action; on success it also
+    // opens the panel, because a record filed silently behind a closed sheet is
+    // indistinguishable from a button that did nothing.
+    bind(IDS.sealCard, 'click', async () => {
+      const r = await doSeal();
+      if (r && r.ok) await open();
+    });
+    bind(IDS.verify, 'click', doVerify);
+    bind(IDS.publish, 'click', doPublish);
+    bind(IDS.anchor, 'click', doAnchor);
+    bind(IDS.backup, 'click', doBackup);
+    bind(IDS.vault, 'click', doVault);
+    bind(IDS.audit, 'click', doAudit);
+    // The auto-seal switch is the ONE control on this panel that can file a
+    // record with nobody watching, so it is the one that must repaint from
+    // main's answer rather than from the checkbox the user just clicked.
+    if (el(IDS.autoSeal)) {
+      bind(IDS.autoSeal, 'change', () => {
+        const box = el(IDS.autoSeal);
+        return setAutoMint(Boolean(box && box.checked));
+      });
+    }
+    if (el(IDS.sealNow)) bind(IDS.sealNow, 'click', doSealNow);
+
+    return {
+      open,
+      close,
+      isOpen,
+      refresh,
+      loadAutoMint,
+      state,
+      // Exposed for the test and for app.js's on-demand repaint. Every one is
+      // idempotent, so calling them from a console is safe.
+      actions: { doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit },
+    };
+  }
+
+  return {
+    IDS,
+    mount,
+    // Pure, and asserted as such by the test.
+    keyLine,
+    statusRows,
+    keyWarning,
+    vaultRows,
+    anchorVerdict,
+    auditVerdict,
+    sealLine,
+    autoMintLine,
+    dash,
+  };
+});