aegis-desktop 1.0.13 → 1.0.15

package/renderer/fingerprint.js

@@ -1,722 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * fingerprint.js — the φ(α) panel: authorship key, sealed records, the vault.
- *
- * The IPC surface has existed since 5072779 (`fingerprintStatus` …
- * `fingerprintVaultAudit`, desktop/preload.js:171-183, main.js:750-765) and
- * until now nothing in desktop/renderer/ called any of it —
- * `grep -rn fingerprint desktop/renderer/` returned nothing, so a GUI user had
- * no button for a feature the terminal has had since `aegiscode fingerprint`.
- * This file is that button.
- *
- * It obeys the same two rules the backend half already keeps:
- *
- *   1. **The key never reaches the DOM.** No payload from main carries
- *      `secret`, and nothing here invents a field that might. What gets painted
- *      is `status.keyFingerprint` — the derived 12-hex tag — which is public by
- *      construction (client/authorship-key.js prints exactly this).
- *   2. **A refusal is shown, not swallowed.** Every handler resolves
- *      `{ ok: false, error }` instead of throwing, so the panel prints the
- *      reason ("this key file is readable by other users", "rclone is not
- *      installed") rather than an empty state that reads like success.
- *
- * Pure formatting (`keyLine`, `anchorVerdict`, `auditVerdict`, …) is kept
- * separate from painting so test/renderer-fingerprint.test.mjs can assert the
- * strings that carry the three-claim anchor verdict without standing up a DOM —
- * and the functions it asserts are the exact ones that paint.
- *
- * Classic script, no imports: loaded before app.js by index.html and called
- * from init(). It does not auto-mount, so requiring it under test has no side
- * effects.
- */
-
-(function (root, factory) {
-  const api = factory();
-  // `module` first: under Node the test requires this file directly, and the
-  // renderer's `window` is not there.
-  if (typeof module !== 'undefined' && module.exports) module.exports = api;
-  if (root) root.aegisFingerprint = api;
-})(typeof window !== 'undefined' ? window : null, function () {
-  /** Every id this file reads. The test asserts each one exists in index.html —
-   *  a typo here is otherwise a silent no-op, which is how a panel ships with
-   *  one dead button and no error. */
-  const IDS = {
-    cardStatus: 'fp-card-status',
-    cardOpen: 'fp-open',
-    overlay: 'fp-overlay',
-    backdrop: 'fp-backdrop',
-    close: 'fp-close',
-    keySource: 'fp-key-source',
-    keyPath: 'fp-key-path',
-    keyTag: 'fp-key-tag',
-    keyWarning: 'fp-key-warning',
-    vaultTarget: 'fp-vault-target',
-    vaultBackendDrive: 'fp-vault-backend-drive',
-    vaultBackendCloud: 'fp-vault-backend-aegiscloud',
-    vaultBackendOff: 'fp-vault-backend-off',
-    label: 'fp-label',
-    publishOnMint: 'fp-publish-on-mint',
-    autoSeal: 'fp-auto-seal',
-    autoSealLabel: 'fp-auto-seal-label',
-    autoHint: 'fp-auto-hint',
-    sealNow: 'fp-seal-now',
-    keygen: 'fp-keygen',
-    seal: 'fp-seal',
-    sealCard: 'fp-seal-card',
-    verify: 'fp-verify',
-    publish: 'fp-publish',
-    anchor: 'fp-anchor',
-    backupTo: 'fp-backup-to',
-    backup: 'fp-backup',
-    vault: 'fp-vault',
-    audit: 'fp-audit',
-    vaultList: 'fp-vault-list',
-    out: 'fp-out',
-    driveStatus: 'fp-drive-status',
-    driveSignIn: 'fp-drive-signin',
-    driveConnect: 'fp-drive-connect',
-    driveSyncNow: 'fp-drive-sync',
-  };
-
-  // ------------------------------------------------------------- formatting
-
-  const dash = (v) => (v === null || v === undefined || v === '' ? '–' : String(v));
-
-  /** The one-line state that goes in the sidebar card, where there is room for
-   *  a sentence and not a table. */
-  function keyLine(status) {
-    if (!status) return 'checking…';
-    if (status.ok === false) return status.error || 'unavailable';
-    if (!status.configured) return 'no key — mint one to seal records';
-    return `key ${dash(status.keyFingerprint)} · ${dash(status.keySource)}`;
-  }
-
-  /** Everything the panel can say about the key without saying the key. */
-  function statusRows(status) {
-    if (!status || status.ok === false) {
-      return [{ k: 'state', v: (status && status.error) || 'unavailable' }];
-    }
-    const rows = [
-      { k: 'key', v: status.configured ? status.keyFingerprint : 'none' },
-      { k: 'source', v: dash(status.keySource) },
-      { k: 'expected at', v: dash(status.defaultKeyPath) },
-      { k: 'history', v: status.historyPresent ? status.historyPath : 'none yet' },
-    ];
-    // Only when it resolves somewhere else than expected is it worth a row: a
-    // key coming from AEGIS_AUTHORSHIP_SECRET or --secret is exactly the
-    // situation where "which key am I actually signing with" needs an answer.
-    if (status.configured && status.keyPath && status.keyPath !== status.defaultKeyPath) {
-      rows.splice(2, 0, { k: 'in use', v: status.keyPath });
-    }
-    return rows;
-  }
-
-  /** The 0644 refusal is the one failure where the fix is a command the user
-   *  can run, so it is surfaced as a warning line rather than buried in the
-   *  result pane. */
-  function keyWarning(status) {
-    const err = status && status.error ? String(status.error) : '';
-    return /chmod/i.test(err) ? err : '';
-  }
-
-  /** One line per vault entry. Tolerant of the key the shared module chooses,
-   *  because the panel's job here is to show what came back, not to insist. */
-  function vaultRows(list) {
-    if (!list || list.ok === false) {
-      return [{ name: 'vault unavailable', detail: (list && list.error) || 'unknown error' }];
-    }
-    const items = Array.isArray(list.records) ? list.records
-      : Array.isArray(list.items) ? list.items
-      : Array.isArray(list.entries) ? list.entries
-      : [];
-    if (!items.length) return [{ name: 'nothing published yet', detail: '' }];
-    return items.map((it) => {
-      const name = it.name || it.file || it.path || it.id || 'record';
-      const parts = [it.id, it.publishedAt || it.createdAt, it.url].filter(Boolean);
-      return { name: String(name), detail: parts.join(' · ') };
-    });
-  }
-
-  /**
-   * The one-line summary of the Google Drive card — `desktop/lib/
-   * google-connect.js`'s `status()` shape, `{signedIn, connected, email}`.
-   *
-   * Three distinct states, because "not connected" means something different
-   * depending on whether this machine has signed in with Google at all:
-   * connecting Drive before signing in attaches the tokens to a different
-   * account than the one this machine polls (see google-connect.js's header
-   * comment), so the line has to say WHICH step is next, not just "no".
-   */
-  function driveLine(status) {
-    if (!status || status.ok === false) return (status && status.error) || 'unavailable';
-    if (!status.signedIn) return 'not signed in — sign in with Google first';
-    if (!status.connected) return 'signed in · Google Drive not connected yet';
-    return `Google Drive connected${status.email ? ` · ${status.email}` : ''}`;
-  }
-
-  /** The anchor answer, kept as three separate claims on purpose: "the file is
-   *  gone", "the file was replaced" and "the key that sealed it has moved on"
-   *  are three different situations, and one boolean hides the interesting one
-   *  (client/record-vault.js checkAnchor). `present` is read as well as
-   *  `presence` because that spelling was a real bug once. */
-  function anchorVerdict(a) {
-    if (!a || a.ok === false) {
-      return { ok: false, label: (a && a.error) || 'anchor check failed', claims: [] };
-    }
-    const present = a.present !== undefined ? a.present : a.presence;
-    const claims = [
-      { k: 'present', v: present },
-      { k: 'unchanged', v: a.unchanged },
-      { k: 'attested', v: a.attested },
-    ];
-    const ok = present === true && a.unchanged === true && a.attested === true;
-    return {
-      ok,
-      // Ambiguity is not success: an undefined claim is reported as unknown,
-      // never folded into a yes.
-      label: ok ? 'the published copy is this record' : 'the published copy is not verifiably this record',
-      claims,
-    };
-  }
-
-  /** What the audit found. A finding is a fact about the vault, not an error
-   *  from it, so a clean run says so explicitly rather than showing nothing. */
-  function auditVerdict(a) {
-    if (!a || a.ok === false) return { ok: false, label: (a && a.error) || 'audit failed', findings: [] };
-    const findings = Array.isArray(a.findings) ? a.findings
-      : Array.isArray(a.leaks) ? a.leaks
-      : Array.isArray(a.hits) ? a.hits
-      : [];
-    if (findings.length) {
-      return { ok: false, label: `${findings.length} item(s) in the vault look like key material`, findings };
-    }
-    return { ok: true, label: 'no key material in the vault', findings: [] };
-  }
-
-  /** A minted record as the panel reports it. The local file is the evidence —
-   *  a failed publish does not unseal it (desktop/lib/fingerprint.js mint) —
-   *  so an upload failure is said beside the seal, not instead of it. */
-  function sealLine(r) {
-    if (!r || r.ok === false) return { ok: false, text: (r && r.error) || 'seal failed' };
-    const rec = r.record || {};
-    const bits = [`sealed ${dash(rec.id)}`, `key ${dash(rec.keyFingerprint)}`, r.out];
-    // Both halves of the session, in the record and in the line: the key that
-    // sealed it, and the mind that answered. An un-nominated AI credential reads
-    // as "ai unobserved", never as a borrowed key.
-    bits.push(
-      rec.aiKey
-        ? `ai ${dash(rec.ai)} on ${dash(rec.aiKey)}`
-        : `ai unobserved${rec.ai ? ` (${dash(rec.ai)})` : ''}`,
-    );
-    if (r.vault && r.vault.url) bits.push(`published ${r.vault.url}`);
-    else if (r.vault) bits.push(`published ${dash(r.vault.remote || r.vault.path)}`);
-    if (r.vaultError) bits.push(`publish failed: ${r.vaultError}`);
-    return { ok: true, text: bits.filter(Boolean).join(' · '), file: r.out || null, record: r.record || null };
-  }
-
-  // ---------------------------------------------------------------- painting
-
-  /**
-   * One line describing the auto-seal state, in the same voice as the rest of
-   * the panel: what is armed, what it has filed, and the last thing that went
-   * wrong. Pure, so the test asserts the string the panel paints.
-   */
-  function autoMintLine(s) {
-    if (!s || typeof s !== 'object') return '–';
-    if (s.enabled !== true) return 'off — sealing stays a button';
-    const bits = [];
-    const secs = Number(s.quietMs);
-    bits.push(Number.isFinite(secs) ? `seals ${Math.round(secs / 1000)}s after the last turn` : 'seals when the session goes quiet');
-    if (s.publish) bits.push('publishes to the vault');
-    if (s.pendingTurns) bits.push(`${s.pendingTurns} turn${s.pendingTurns === 1 ? '' : 's'} pending`);
-    if (s.seals) bits.push(`${s.seals} sealed`);
-    if (s.failures) bits.push(`${s.failures} failed`);
-    if (s.lastError) bits.push(`last error: ${s.lastError}`);
-    return bits.join(' · ');
-  }
-
-  function mount({ api, doc, auto } = {}) {
-    const d = doc || (typeof document !== 'undefined' ? document : null);
-    if (!d) throw new Error('fingerprint: mount needs a document');
-    const bridge = api || (typeof window !== 'undefined' ? window.aegis : null);
-    // The automation bridge (main.js registerAutoIpc). Injectable for the same
-    // reason `api` is, and optional: a preload predating that surface leaves the
-    // auto-seal control inert rather than throwing at mount.
-    const autoBridge = auto || (typeof window !== 'undefined' ? window.auto : null);
-
-    const el = (id) => d.getElementById(id);
-    const state = { status: null, last: null, busy: false, mounted: true };
-
-    function say(text, bad) {
-      const out = el(IDS.out);
-      if (!out) return;
-      out.textContent = text;
-      out.className = bad ? 'fp-out fp-bad' : 'fp-out';
-    }
-
-    /** Every bridge call goes through here. A handler that rejects (Electron
-     *  turns a thrown main-process error into a rejected invoke) must not leave
-     *  the panel mid-action, so the catch produces the same `{ ok, error }`
-     *  shape the handlers themselves do. */
-    async function call(name, payload) {
-      if (!bridge || typeof bridge[name] !== 'function') {
-        return { ok: false, error: `this build has no ${name} bridge` };
-      }
-      try {
-        const r = await bridge[name](payload);
-        if (!r || typeof r !== 'object') return { ok: false, error: `${name} returned nothing` };
-        return r;
-      } catch (e) {
-        return { ok: false, error: (e && e.message) || String(e) };
-      }
-    }
-
-    function paintStatus() {
-      const s = state.status;
-      const card = el(IDS.cardStatus);
-      if (card) card.textContent = keyLine(s);
-      const src = el(IDS.keySource);
-      const pth = el(IDS.keyPath);
-      const tag = el(IDS.keyTag);
-      const warn = el(IDS.keyWarning);
-      const vt = el(IDS.vaultTarget);
-      const rows = statusRows(s);
-      const pick = (k) => {
-        const row = rows.find((r) => r.k === k);
-        return row ? row.v : '–';
-      };
-      if (src) src.textContent = pick('source');
-      if (pth) pth.textContent = s && s.keyPath ? s.keyPath : pick('expected at');
-      if (tag) tag.textContent = s && s.configured ? dash(s.keyFingerprint) : 'none';
-      if (warn) {
-        const w = keyWarning(s);
-        warn.textContent = w;
-        warn.hidden = !w;
-      }
-      if (vt && s && s.vault) {
-        // The default backend is the account (`aegiscloud`), where "gdrive" is
-        // not where anything goes — printing `gdrive:AEGIS-AGPL/records` for a
-        // cloud publish would name a folder the record never touches. Say the
-        // backend for that case, and keep the remembered rclone target for the
-        // case where it IS a remote. 'off' names neither — nothing is resolved
-        // behind it (desktop/lib/fingerprint.js's status() short-circuits
-        // before ever calling vaultTarget()), so the line says so plainly
-        // rather than printing the leftover "–:–" two dashes would read as.
-        vt.textContent = s.vault.backend === 'off'
-          ? 'nothing — sync is off'
-          : s.vault.backend === 'aegiscloud'
-            ? `aegiscloud:${dash(s.vault.recordsDir)}`
-            : `${dash(s.vault.remote)}:${dash(s.vault.recordsDir || s.vault.root)}`;
-      } else if (vt) {
-        vt.textContent = '–';
-      }
-      // A key that is present makes keygen a REPLACE, which orphans every
-      // record sealed with the old one. Saying that on the button is the whole
-      // warning; the confirm below is the second line of defence.
-      const kg = el(IDS.keygen);
-      if (kg) kg.textContent = s && s.configured ? 'Replace key…' : 'Mint key';
-    }
-
-    /**
-     * The three backend buttons' pressed state.
-     *
-     * Deliberately read from `getVaultBackend` (the preference the user set),
-     * NOT from `status().vault.backend` (the resolved record-vault.js
-     * backend id): the preference vocabulary is 'aegiscloud' | 'drive' | 'off',
-     * the resolved one is 'aegiscloud' | 'rclone' | 'off' — a 'drive'
-     * preference resolves to 'rclone', so pressing "Google Drive" from status
-     * alone would never read back as pressed.
-     */
-    function paintVaultBackend(backend) {
-      const map = {
-        drive: el(IDS.vaultBackendDrive),
-        aegiscloud: el(IDS.vaultBackendCloud),
-        off: el(IDS.vaultBackendOff),
-      };
-      for (const [key, btn] of Object.entries(map)) {
-        if (btn) btn.setAttribute('aria-pressed', String(key === backend));
-      }
-    }
-
-    async function loadVaultBackend() {
-      const r = await call('getVaultBackend');
-      state.vaultBackend = r && r.backend ? r.backend : 'aegiscloud';
-      paintVaultBackend(state.vaultBackend);
-      return state.vaultBackend;
-    }
-
-    const doSetVaultBackend = (backend) =>
-      action(`vault: ${backend === 'drive' ? 'Google Drive' : backend === 'off' ? 'no sync' : 'AE'}`, async () => {
-        const r = await call('setVaultBackend', backend);
-        return r && r.backend ? { ok: true, ...r } : { ok: false, error: 'could not save that' };
-      }, {
-        // The "publishes to" line names the backend too, so both it and the
-        // three buttons must repaint the moment the preference changes — not
-        // just on the next open().
-        after: (r) => (r && r.ok ? refresh() : null),
-        say: (r) => (r.ok ? `vault backend set to ${dash(r.backend)}` : `could not save that: ${r.error}`),
-      });
-
-    /**
-     * Google Drive — memory backup (desktop/lib/google-connect.js, exposed
-     * over `aegis.driveSignIn`/`driveConnect`/`driveStatus`/`driveSyncMemory`).
-     *
-     * Distinct from the vault backend buttons above: those choose where a
-     * SEALED φ(α) RECORD is published (rclone or the account vault). This is
-     * the account's AEGIS CLOUD MEMORY, backed up to the user's own Drive
-     * through real Google OAuth — unrelated data, unrelated credential.
-     */
-    function paintDrive(status) {
-      const line = el(IDS.driveStatus);
-      if (line) line.textContent = driveLine(status);
-      const connectBtn = el(IDS.driveConnect);
-      if (connectBtn) connectBtn.disabled = Boolean(status && !status.signedIn);
-      const syncBtn = el(IDS.driveSyncNow);
-      if (syncBtn) syncBtn.disabled = Boolean(!status || !status.connected);
-    }
-
-    async function loadDriveStatus() {
-      const r = await call('driveStatus');
-      state.drive = r;
-      paintDrive(r);
-      return r;
-    }
-
-    const doDriveSignIn = () =>
-      action('sign in with Google', () => call('driveSignIn'), {
-        after: (r) => (r && r.ok ? loadDriveStatus() : null),
-        say: (r) => (r.ok ? `signed in${r.username ? ` as ${r.username}` : ''}` : `sign-in failed: ${r.error}`),
-      });
-
-    const doDriveConnect = () =>
-      action('connect Google Drive', () => call('driveConnect'), {
-        after: (r) => (r && r.ok ? loadDriveStatus() : null),
-        say: (r) => (r.ok ? `Google Drive connected${r.email ? ` · ${r.email}` : ''}` : `could not connect: ${r.error}`),
-      });
-
-    const doDriveSyncNow = () =>
-      action('back up memory to Drive', () => call('driveSyncMemory'), {
-        say: (r) => (r.ok
-          ? `backed up ${r.count} memory entr${r.count === 1 ? 'y' : 'ies'}${r.webViewLink ? ` → ${r.webViewLink}` : ''}`
-          : `backup failed: ${r.error}`),
-      });
-
-    function paintVault(list) {
-      const ul = el(IDS.vaultList);
-      if (!ul) return;
-      ul.textContent = '';
-      for (const row of vaultRows(list)) {
-        const li = d.createElement('li');
-        li.className = 'fp-vault-row';
-        const name = d.createElement('span');
-        name.className = 'fp-vault-name';
-        name.textContent = row.name;
-        li.appendChild(name);
-        if (row.detail) {
-          const det = d.createElement('span');
-          det.className = 'fp-vault-detail';
-          det.textContent = row.detail;
-          li.appendChild(det);
-        }
-        ul.appendChild(li);
-      }
-    }
-
-    async function refresh() {
-      state.status = await call('fingerprintStatus');
-      paintStatus();
-      await loadAutoMint();
-      await loadVaultBackend();
-      await loadDriveStatus();
-      return state.status;
-    }
-
-    /**
-     * The auto-seal control (settings.js `__autoMint`, through lib/auto.js).
-     *
-     * Read-only paint from MAIN, for the reason the rest of this panel is: the
-     * renderer must never be the place that decides a record gets filed, and a
-     * checkbox state this file invented would disagree with the timer the moment
-     * anything else (the queue card's window, a restart) changed the setting.
-     */
-    function renderAutoMint(s) {
-      if (!s || typeof s !== 'object') return;
-      const sw = el(IDS.autoSeal);
-      if (sw) sw.checked = s.enabled === true;
-      const label = el(IDS.autoSealLabel);
-      if (label) label.textContent = s.enabled ? 'sealing automatically when quiet' : 'seal automatically when quiet';
-      const hint = el(IDS.autoHint);
-      if (!hint) return;
-      hint.textContent = autoMintLine(s);
-    }
-
-    async function loadAutoMint() {
-      if (!autoBridge || typeof autoBridge.status !== 'function') {
-        const hint = el(IDS.autoHint);
-        // Said plainly rather than left blank: an inert toggle with no
-        // explanation is the failure mode this whole panel exists to avoid.
-        if (hint) hint.textContent = 'this build has no automation bridge — sealing stays a button';
-        return null;
-      }
-      try {
-        const r = await autoBridge.status();
-        if (r && r.mint) renderAutoMint(r.mint);
-        return r;
-      } catch (e) {
-        const hint = el(IDS.autoHint);
-        if (hint) hint.textContent = `automation status unavailable: ${(e && e.message) || String(e)}`;
-        return null;
-      }
-    }
-
-    /** Persist the switch through main and paint main's answer. */
-    async function setAutoMint(enabled) {
-      if (!autoBridge || typeof autoBridge.setMint !== 'function') return null;
-      const publish = Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked);
-      try {
-        const r = await autoBridge.setMint({ enabled: Boolean(enabled), publish });
-        if (r && r.mint) renderAutoMint(r.mint);
-        else if (r && r.ok === false) say(r.error || 'could not save that', true);
-        return r;
-      } catch (e) {
-        say(`could not save that: ${(e && e.message) || String(e)}`, true);
-        return null;
-      }
-    }
-
-    /** Seal right now, through the automation rather than the raw mint: the
-     *  same call resets the pending-turn counter, so the quiet timer will not
-     *  file a second identical record for this session. */
-    async function doSealNow() {
-      const publish = Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked);
-      return action('seal now', async () => {
-        if (!autoBridge || typeof autoBridge.sealNow !== 'function') {
-          return { ok: false, error: 'this build has no automation bridge' };
-        }
-        return autoBridge.sealNow(publish);
-      }, {
-        paint: (r) => { if (r && r.ok && r.out) state.last = { file: r.out, record: r.record || null }; },
-        say: (r) => {
-          if (!r) return 'seal now: nothing happened';
-          if (r.ok === false) return `seal failed: ${r.error || 'unknown'}`;
-          if (r.type === 'skip') return `nothing to seal (${r.reason || 'no new turns'})`;
-          const line = sealLine(r);
-          return line.ok ? `sealed ${dash((r.record || {}).id)} → ${dash(r.out)}` : `seal failed: ${line.text}`;
-        },
-      });
-    }
-
-    /** Run one action, repaint what it changed, and say what it did. `confirm`
-     *  is injectable so the harness can answer it deterministically. */
-    async function action(label, fn, opts) {
-      const o = opts || {};
-      if (state.busy) return null;
-      state.busy = true;
-      say(`${label}…`, false);
-      try {
-        const r = await fn();
-        if (o.paint) o.paint(r);
-        if (o.after) await o.after(r);
-        say(o.say ? o.say(r) : `${label}: ${r && r.ok === false ? r.error : 'done'}`, Boolean(r && r.ok === false));
-        return r;
-      } finally {
-        state.busy = false;
-      }
-    }
-
-    const doKeygen = () =>
-      action('mint key', () => call('fingerprintKeygen', {
-        force: Boolean(state.status && state.status.configured),
-      }), {
-        // Only after a successful mint: status moved from "no key" to a key,
-        // and repainting is what turns "Mint key" into "Replace key…".
-        after: refresh,
-        say: (r) => (r.ok
-          ? `minted ${dash(r.keyFingerprint)} at ${dash(r.path)}`
-          : `mint failed: ${r.error}`),
-      });
-
-    const doSeal = () =>
-      action('seal session', () => call('fingerprintMint', {
-        label: (el(IDS.label) && el(IDS.label).value.trim()) || null,
-        publish: Boolean(el(IDS.publishOnMint) && el(IDS.publishOnMint).checked),
-      }), {
-        paint: (r) => { if (r.ok) state.last = { file: r.out, record: r.record }; },
-        say: (r) => {
-          const line = sealLine(r);
-          return line.ok ? `sealed ${dash((r.record || {}).id)} → ${dash(r.out)}` : `seal failed: ${line.text}`;
-        },
-      });
-
-    /** Verify/publish/anchor act on the record this panel sealed. A path is
-     *  preferred over the in-memory record because the sha256 in the anchor is
-     *  then about the bytes on disk rather than a re-serialisation of them
-     *  (desktop/lib/fingerprint.js publish makes the same argument) — so `file`
-     *  wins when there is one, and the record is the fallback for a host where
-     *  the write failed but the seal did not. */
-    const doVerify = () =>
-      action('verify', async () => {
-        if (state.last && state.last.file) return call('fingerprintVerify', { file: state.last.file });
-        if (state.last && state.last.record) return call('fingerprintVerify', { record: state.last.record });
-        return { ok: false, error: 'nothing sealed in this window yet — seal a session first' };
-      }, {
-        say: (r) => (r.ok ? `verified ${dash(r.id)} · key ${dash(r.keySource)}` : `not verified: ${r.error || r.reason}`),
-      });
-
-    const doPublish = () =>
-      action('publish', () => {
-        if (state.last && state.last.file) return call('fingerprintPublish', { file: state.last.file });
-        if (state.last && state.last.record) return call('fingerprintPublish', { record: state.last.record });
-        return { ok: false, error: 'nothing sealed in this window yet — seal a session first' };
-      }, {
-        say: (r) => (r.ok
-          ? `published ${dash(r.url || r.path)}${r.sha256 ? ` · sha256 ${String(r.sha256).slice(0, 12)}` : ''}`
-          : `publish failed: ${r.error}`),
-      });
-
-    const doAnchor = () =>
-      action('check anchor', () => {
-        if (state.last && state.last.file) return call('fingerprintAnchor', { file: state.last.file });
-        return call('fingerprintAnchor', {});
-      }, {
-        say: (r) => {
-          const v = anchorVerdict(r);
-          const claims = v.claims.map((c) => `${c.k} ${c.v === true ? 'yes' : c.v === false ? 'no' : 'unknown'}`).join(' · ');
-          return `${v.label}${claims ? ` — ${claims}` : ''}`;
-        },
-      });
-
-    const doBackup = () =>
-      action('back up key', () => {
-        const to = el(IDS.backupTo) && el(IDS.backupTo).value.trim();
-        if (!to) return { ok: false, error: 'backup needs a destination directory' };
-        return call('fingerprintBackup', { to });
-      }, {
-        say: (r) => (r.ok ? `key copied to ${dash(r.to || r.path)}` : `backup refused: ${r.error}`),
-      });
-
-    const doVault = () =>
-      action('list vault', () => call('fingerprintVault'), {
-        paint: paintVault,
-        say: (r) => (r.ok ? `vault listed — ${vaultRows(r).length} entry(ies)` : `vault unavailable: ${r.error}`),
-      });
-
-    const doAudit = () =>
-      action('audit vault', () => call('fingerprintVaultAudit'), {
-        say: (r) => {
-          const v = auditVerdict(r);
-          const names = v.findings.map((f) => (f && (f.path || f.name)) || String(f)).slice(0, 3);
-          return `${v.label}${names.length ? ` — ${names.join(', ')}` : ''}`;
-        },
-      });
-
-    const isOpen = () => {
-      const o = el(IDS.overlay);
-      return Boolean(o) && !o.hidden;
-    };
-
-    async function open() {
-      const o = el(IDS.overlay);
-      if (!o) return;
-      o.hidden = false;
-      // Body class so the page behind cannot scroll under the sheet, matching
-      // the memory inspector's `.memory-open` rule.
-      if (d.body && d.body.classList) d.body.classList.add('fp-open');
-      await refresh();
-      await doVault();
-      const f = el(IDS.close);
-      if (f) f.focus();
-    }
-
-    function close() {
-      const o = el(IDS.overlay);
-      if (!o) return;
-      o.hidden = true;
-      if (d.body && d.body.classList) d.body.classList.remove('fp-open');
-      const btn = el(IDS.cardOpen);
-      if (btn) btn.focus();
-    }
-
-    // ------------------------------------------------------------- listeners
-    // Bound here rather than in app.js so the panel owns its own markup: every
-    // id in IDS is read by this file only, and the test asserts they all exist.
-    const bind = (id, type, fn) => {
-      const node = el(id);
-      if (node) node.addEventListener(type, fn);
-    };
-
-    bind(IDS.cardOpen, 'click', open);
-    bind(IDS.close, 'click', close);
-    bind(IDS.backdrop, 'click', close);
-    bind(IDS.keygen, 'click', doKeygen);
-    bind(IDS.seal, 'click', doSeal);
-    // The sidebar's one-click seal runs the same action; on success it also
-    // opens the panel, because a record filed silently behind a closed sheet is
-    // indistinguishable from a button that did nothing.
-    bind(IDS.sealCard, 'click', async () => {
-      const r = await doSeal();
-      if (r && r.ok) await open();
-    });
-    bind(IDS.verify, 'click', doVerify);
-    bind(IDS.publish, 'click', doPublish);
-    bind(IDS.anchor, 'click', doAnchor);
-    bind(IDS.backup, 'click', doBackup);
-    bind(IDS.vault, 'click', doVault);
-    bind(IDS.audit, 'click', doAudit);
-    bind(IDS.vaultBackendDrive, 'click', () => doSetVaultBackend('drive'));
-    bind(IDS.vaultBackendCloud, 'click', () => doSetVaultBackend('aegiscloud'));
-    bind(IDS.vaultBackendOff, 'click', () => doSetVaultBackend('off'));
-    bind(IDS.driveSignIn, 'click', doDriveSignIn);
-    bind(IDS.driveConnect, 'click', doDriveConnect);
-    bind(IDS.driveSyncNow, 'click', doDriveSyncNow);
-    // The auto-seal switch is the ONE control on this panel that can file a
-    // record with nobody watching, so it is the one that must repaint from
-    // main's answer rather than from the checkbox the user just clicked.
-    if (el(IDS.autoSeal)) {
-      bind(IDS.autoSeal, 'change', () => {
-        const box = el(IDS.autoSeal);
-        return setAutoMint(Boolean(box && box.checked));
-      });
-    }
-    if (el(IDS.sealNow)) bind(IDS.sealNow, 'click', doSealNow);
-
-    return {
-      open,
-      close,
-      isOpen,
-      refresh,
-      loadAutoMint,
-      state,
-      // Exposed for the test and for app.js's on-demand repaint. Every one is
-      // idempotent, so calling them from a console is safe.
-      actions: {
-        doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit,
-        doSetVaultBackend, doDriveSignIn, doDriveConnect, doDriveSyncNow,
-      },
-      loadVaultBackend,
-      loadDriveStatus,
-    };
-  }
-
-  return {
-    IDS,
-    mount,
-    // Pure, and asserted as such by the test.
-    keyLine,
-    statusRows,
-    keyWarning,
-    vaultRows,
-    anchorVerdict,
-    auditVerdict,
-    sealLine,
-    autoMintLine,
-    driveLine,
-    dash,
-  };
-});
+"use strict";!function(e,t){const n=function(){const e={cardStatus:"fp-card-status",cardOpen:"fp-open",overlay:"fp-overlay",backdrop:"fp-backdrop",close:"fp-close",keySource:"fp-key-source",keyPath:"fp-key-path",keyTag:"fp-key-tag",keyWarning:"fp-key-warning",vaultTarget:"fp-vault-target",vaultBackendDrive:"fp-vault-backend-drive",vaultBackendCloud:"fp-vault-backend-aegiscloud",vaultBackendOff:"fp-vault-backend-off",label:"fp-label",publishOnMint:"fp-publish-on-mint",autoSeal:"fp-auto-seal",autoSealLabel:"fp-auto-seal-label",autoHint:"fp-auto-hint",sealNow:"fp-seal-now",keygen:"fp-keygen",seal:"fp-seal",sealCard:"fp-seal-card",verify:"fp-verify",publish:"fp-publish",anchor:"fp-anchor",backupTo:"fp-backup-to",backup:"fp-backup",vault:"fp-vault",audit:"fp-audit",vaultList:"fp-vault-list",out:"fp-out",driveStatus:"fp-drive-status",driveSignIn:"fp-drive-signin",driveConnect:"fp-drive-connect",driveSyncNow:"fp-drive-sync"},t=e=>null==e||""===e?"–":String(e);function n(e){return e?!1===e.ok?e.error||"unavailable":e.configured?`key ${t(e.keyFingerprint)} · ${t(e.keySource)}`:"no key — mint one to seal records":"checking…"}function a(e){if(!e||!1===e.ok)return[{k:"state",v:e&&e.error||"unavailable"}];const n=[{k:"key",v:e.configured?e.keyFingerprint:"none"},{k:"source",v:t(e.keySource)},{k:"expected at",v:t(e.defaultKeyPath)},{k:"history",v:e.historyPresent?e.historyPath:"none yet"}];return e.configured&&e.keyPath&&e.keyPath!==e.defaultKeyPath&&n.splice(2,0,{k:"in use",v:e.keyPath}),n}function o(e){const t=e&&e.error?String(e.error):"";return/chmod/i.test(t)?t:""}function i(e){if(!e||!1===e.ok)return[{name:"vault unavailable",detail:e&&e.error||"unknown error"}];const t=Array.isArray(e.records)?e.records:Array.isArray(e.items)?e.items:Array.isArray(e.entries)?e.entries:[];return t.length?t.map((e=>{const t=e.name||e.file||e.path||e.id||"record",n=[e.id,e.publishedAt||e.createdAt,e.url].filter(Boolean);return{name:String(t),detail:n.join(" · ")}})):[{name:"nothing published yet",detail:""}]}function r(e){return e&&!1!==e.ok?e.signedIn?e.connected?"Google Drive connected"+(e.email?` · ${e.email}`:""):"signed in · Google Drive not connected yet":"not signed in — sign in with Google first":e&&e.error||"unavailable"}function s(e){if(!e||!1===e.ok)return{ok:!1,label:e&&e.error||"anchor check failed",claims:[]};const t=void 0!==e.present?e.present:e.presence,n=[{k:"present",v:t},{k:"unchanged",v:e.unchanged},{k:"attested",v:e.attested}],a=!0===t&&!0===e.unchanged&&!0===e.attested;return{ok:a,label:a?"the published copy is this record":"the published copy is not verifiably this record",claims:n}}function l(e){if(!e||!1===e.ok)return{ok:!1,label:e&&e.error||"audit failed",findings:[]};const t=Array.isArray(e.findings)?e.findings:Array.isArray(e.leaks)?e.leaks:Array.isArray(e.hits)?e.hits:[];return t.length?{ok:!1,label:`${t.length} item(s) in the vault look like key material`,findings:t}:{ok:!0,label:"no key material in the vault",findings:[]}}function u(e){if(!e||!1===e.ok)return{ok:!1,text:e&&e.error||"seal failed"};const n=e.record||{},a=[`sealed ${t(n.id)}`,`key ${t(n.keyFingerprint)}`,e.out];return a.push(n.aiKey?`ai ${t(n.ai)} on ${t(n.aiKey)}`:"ai unobserved"+(n.ai?` (${t(n.ai)})`:"")),e.vault&&e.vault.url?a.push(`published ${e.vault.url}`):e.vault&&a.push(`published ${t(e.vault.remote||e.vault.path)}`),e.vaultError&&a.push(`publish failed: ${e.vaultError}`),{ok:!0,text:a.filter(Boolean).join(" · "),file:e.out||null,record:e.record||null}}function c(e){if(!e||"object"!=typeof e)return"–";if(!0!==e.enabled)return"off — sealing stays a button";const t=[],n=Number(e.quietMs);return t.push(Number.isFinite(n)?`seals ${Math.round(n/1e3)}s after the last turn`:"seals when the session goes quiet"),e.publish&&t.push("publishes to the vault"),e.pendingTurns&&t.push(`${e.pendingTurns} turn${1===e.pendingTurns?"":"s"} pending`),e.seals&&t.push(`${e.seals} sealed`),e.failures&&t.push(`${e.failures} failed`),e.lastError&&t.push(`last error: ${e.lastError}`),t.join(" · ")}return{IDS:e,mount:function({api:d,doc:f,auto:p}={}){const k=f||("undefined"!=typeof document?document:null);if(!k)throw new Error("fingerprint: mount needs a document");const y=d||("undefined"!=typeof window?window.aegis:null),h=p||("undefined"!=typeof window?window.auto:null),v=e=>k.getElementById(e),g={status:null,last:null,busy:!1,mounted:!0};function b(t,n){const a=v(e.out);a&&(a.textContent=t,a.className=n?"fp-out fp-bad":"fp-out")}async function m(e,t){if(!y||"function"!=typeof y[e])return{ok:!1,error:`this build has no ${e} bridge`};try{const n=await y[e](t);return n&&"object"==typeof n?n:{ok:!1,error:`${e} returned nothing`}}catch(e){return{ok:!1,error:e&&e.message||String(e)}}}async function $(){const t=await m("getVaultBackend");return g.vaultBackend=t&&t.backend?t.backend:"aegiscloud",function(t){const n={drive:v(e.vaultBackendDrive),aegiscloud:v(e.vaultBackendCloud),off:v(e.vaultBackendOff)};for(const[e,a]of Object.entries(n))a&&a.setAttribute("aria-pressed",String(e===t))}(g.vaultBackend),g.vaultBackend}const w=e=>L("vault: "+("drive"===e?"Google Drive":"off"===e?"no sync":"AE"),(async()=>{const t=await m("setVaultBackend",e);return t&&t.backend?{ok:!0,...t}:{ok:!1,error:"could not save that"}}),{after:e=>e&&e.ok?N():null,say:e=>e.ok?`vault backend set to ${t(e.backend)}`:`could not save that: ${e.error}`});async function S(){const t=await m("driveStatus");return g.drive=t,function(t){const n=v(e.driveStatus);n&&(n.textContent=r(t));const a=v(e.driveConnect);a&&(a.disabled=Boolean(t&&!t.signedIn));const o=v(e.driveSyncNow);o&&(o.disabled=Boolean(!t||!t.connected))}(t),t}const B=()=>L("sign in with Google",(()=>m("driveSignIn")),{after:e=>e&&e.ok?S():null,say:e=>e.ok?"signed in"+(e.username?` as ${e.username}`:""):`sign-in failed: ${e.error}`}),C=()=>L("connect Google Drive",(()=>m("driveConnect")),{after:e=>e&&e.ok?S():null,say:e=>e.ok?"Google Drive connected"+(e.email?` · ${e.email}`:""):`could not connect: ${e.error}`}),x=()=>L("back up memory to Drive",(()=>m("driveSyncMemory")),{say:e=>e.ok?`backed up ${e.count} memory entr${1===e.count?"y":"ies"}${e.webViewLink?` → ${e.webViewLink}`:""}`:`backup failed: ${e.error}`});function A(t){const n=v(e.vaultList);if(n){n.textContent="";for(const e of i(t)){const t=k.createElement("li");t.className="fp-vault-row";const a=k.createElement("span");if(a.className="fp-vault-name",a.textContent=e.name,t.appendChild(a),e.detail){const n=k.createElement("span");n.className="fp-vault-detail",n.textContent=e.detail,t.appendChild(n)}n.appendChild(t)}}}async function N(){return g.status=await m("fingerprintStatus"),function(){const i=g.status,r=v(e.cardStatus);r&&(r.textContent=n(i));const s=v(e.keySource),l=v(e.keyPath),u=v(e.keyTag),c=v(e.keyWarning),d=v(e.vaultTarget),f=a(i),p=e=>{const t=f.find((t=>t.k===e));return t?t.v:"–"};if(s&&(s.textContent=p("source")),l&&(l.textContent=i&&i.keyPath?i.keyPath:p("expected at")),u&&(u.textContent=i&&i.configured?t(i.keyFingerprint):"none"),c){const e=o(i);c.textContent=e,c.hidden=!e}d&&i&&i.vault?
+// not where anything goes — printing `gdrive:AEGIS-AGPL/records` for a
+d.textContent="off"===i.vault.backend?"nothing — sync is off":"aegiscloud"===i.vault.backend?`aegiscloud:${t(i.vault.recordsDir)}`:`${t(i.vault.remote)}:${t(i.vault.recordsDir||i.vault.root)}`:d&&(d.textContent="–");const k=v(e.keygen);k&&(k.textContent=i&&i.configured?"Replace key…":"Mint key")}(),await M(),await $(),await S(),g.status}function D(t){if(!t||"object"!=typeof t)return;const n=v(e.autoSeal);n&&(n.checked=!0===t.enabled);const a=v(e.autoSealLabel);a&&(a.textContent=t.enabled?"sealing automatically when quiet":"seal automatically when quiet");const o=v(e.autoHint);o&&(o.textContent=c(t))}async function M(){if(!h||"function"!=typeof h.status){const t=v(e.autoHint);return t&&(t.textContent="this build has no automation bridge — sealing stays a button"),null}try{const e=await h.status();return e&&e.mint&&D(e.mint),e}catch(t){const n=v(e.autoHint);return n&&(n.textContent=`automation status unavailable: ${t&&t.message||String(t)}`),null}}async function V(){const n=Boolean(v(e.publishOnMint)&&v(e.publishOnMint).checked);return L("seal now",(async()=>h&&"function"==typeof h.sealNow?h.sealNow(n):{ok:!1,error:"this build has no automation bridge"}),{paint:e=>{e&&e.ok&&e.out&&(g.last={file:e.out,record:e.record||null})},say:e=>{if(!e)return"seal now: nothing happened";if(!1===e.ok)return`seal failed: ${e.error||"unknown"}`;if("skip"===e.type)return`nothing to seal (${e.reason||"no new turns"})`;const n=u(e);return n.ok?`sealed ${t((e.record||{}).id)} → ${t(e.out)}`:`seal failed: ${n.text}`}})}async function L(e,t,n){const a=n||{};if(g.busy)return null;g.busy=!0,b(`${e}…`,!1);try{const n=await t();return a.paint&&a.paint(n),a.after&&await a.after(n),b(a.say?a.say(n):`${e}: ${n&&!1===n.ok?n.error:"done"}`,Boolean(n&&!1===n.ok)),n}finally{g.busy=!1}}const O=()=>L("mint key",(()=>m("fingerprintKeygen",{force:Boolean(g.status&&g.status.configured)})),{after:N,say:e=>e.ok?`minted ${t(e.keyFingerprint)} at ${t(e.path)}`:`mint failed: ${e.error}`}),P=()=>L("seal session",(()=>m("fingerprintMint",{label:v(e.label)&&v(e.label).value.trim()||null,publish:Boolean(v(e.publishOnMint)&&v(e.publishOnMint).checked)})),{paint:e=>{e.ok&&(g.last={file:e.out,record:e.record})},say:e=>{const n=u(e);return n.ok?`sealed ${t((e.record||{}).id)} → ${t(e.out)}`:`seal failed: ${n.text}`}}),E=()=>L("verify",(async()=>g.last&&g.last.file?m("fingerprintVerify",{file:g.last.file}):g.last&&g.last.record?m("fingerprintVerify",{record:g.last.record}):{ok:!1,error:"nothing sealed in this window yet — seal a session first"}),{say:e=>e.ok?`verified ${t(e.id)} · key ${t(e.keySource)}`:`not verified: ${e.error||e.reason}`}),I=()=>L("publish",(()=>g.last&&g.last.file?m("fingerprintPublish",{file:g.last.file}):g.last&&g.last.record?m("fingerprintPublish",{record:g.last.record}):{ok:!1,error:"nothing sealed in this window yet — seal a session first"}),{say:e=>e.ok?`published ${t(e.url||e.path)}${e.sha256?` · sha256 ${String(e.sha256).slice(0,12)}`:""}`:`publish failed: ${e.error}`}),T=()=>L("check anchor",(()=>g.last&&g.last.file?m("fingerprintAnchor",{file:g.last.file}):m("fingerprintAnchor",{})),{say:e=>{const t=s(e),n=t.claims.map((e=>`${e.k} ${!0===e.v?"yes":!1===e.v?"no":"unknown"}`)).join(" · ");return`${t.label}${n?` — ${n}`:""}`}}),j=()=>L("back up key",(()=>{const t=v(e.backupTo)&&v(e.backupTo).value.trim();return t?m("fingerprintBackup",{to:t}):{ok:!1,error:"backup needs a destination directory"}}),{say:e=>e.ok?`key copied to ${t(e.to||e.path)}`:`backup refused: ${e.error}`}),F=()=>L("list vault",(()=>m("fingerprintVault")),{paint:A,say:e=>e.ok?`vault listed — ${i(e).length} entry(ies)`:`vault unavailable: ${e.error}`}),G=()=>L("audit vault",(()=>m("fingerprintVaultAudit")),{say:e=>{const t=l(e),n=t.findings.map((e=>e&&(e.path||e.name)||String(e))).slice(0,3);return`${t.label}${n.length?` — ${n.join(", ")}`:""}`}});async function K(t){const n=v(e.overlay);if(!n)return;if(n.hidden=!1,k.body&&k.body.classList&&k.body.classList.add("fp-open"),await N(),await F(),t&&"drive"===t.focus){const t=v(e.driveStatus);t&&t.scrollIntoView&&t.scrollIntoView({block:"center"});const n=[e.driveSignIn,e.driveConnect,e.driveSyncNow].map(v).find((e=>e&&!e.disabled));return void(n&&n.focus())}const a=v(e.close);a&&a.focus()}function q(){const t=v(e.overlay);if(!t)return;t.hidden=!0,k.body&&k.body.classList&&k.body.classList.remove("fp-open");const n=v(e.cardOpen);n&&n.focus()}const H=(e,t,n)=>{const a=v(e);a&&a.addEventListener(t,n)};return H(e.cardOpen,"click",K),H(e.close,"click",q),H(e.backdrop,"click",q),H(e.keygen,"click",O),H(e.seal,"click",P),H(e.sealCard,"click",(async()=>{const e=await P();e&&e.ok&&await K()})),H(e.verify,"click",E),H(e.publish,"click",I),H(e.anchor,"click",T),H(e.backup,"click",j),H(e.vault,"click",F),H(e.audit,"click",G),H(e.vaultBackendDrive,"click",(()=>w("drive"))),H(e.vaultBackendCloud,"click",(()=>w("aegiscloud"))),H(e.vaultBackendOff,"click",(()=>w("off"))),H(e.driveSignIn,"click",B),H(e.driveConnect,"click",C),H(e.driveSyncNow,"click",x),v(e.autoSeal)&&H(e.autoSeal,"change",(()=>{const t=v(e.autoSeal);return async function(t){if(!h||"function"!=typeof h.setMint)return null;const n=Boolean(v(e.publishOnMint)&&v(e.publishOnMint).checked);try{const e=await h.setMint({enabled:Boolean(t),publish:n});return e&&e.mint?D(e.mint):e&&!1===e.ok&&b(e.error||"could not save that",!0),e}catch(e){return b(`could not save that: ${e&&e.message||String(e)}`,!0),null}}(Boolean(t&&t.checked))})),v(e.sealNow)&&H(e.sealNow,"click",V),{open:K,close:q,isOpen:()=>{const t=v(e.overlay);return Boolean(t)&&!t.hidden},refresh:N,loadAutoMint:M,state:g,actions:{doKeygen:O,doSeal:P,doSealNow:V,doVerify:E,doPublish:I,doAnchor:T,doBackup:j,doVault:F,doAudit:G,doSetVaultBackend:w,doDriveSignIn:B,doDriveConnect:C,doDriveSyncNow:x},loadVaultBackend:$,loadDriveStatus:S}},keyLine:n,statusRows:a,keyWarning:o,vaultRows:i,anchorVerdict:s,auditVerdict:l,sealLine:u,autoMintLine:c,driveLine:r,dash:t}}();"undefined"!=typeof module&&module.exports&&(module.exports=n),e&&(e.aegisFingerprint=n)}("undefined"!=typeof window?window:null);