comisai 1.0.15 → 1.0.17

package/node_modules/@comis/web/dist/assets/security-D15st4xx.js

@@ -0,0 +1,1224 @@
+import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S as B}from"./index-CEcM1R_C.js";import"./ic-tabs-B7QtM_v8.js";import"./ic-empty-state-60l2ePhd.js";import"./ic-tag-CPPUnDLF.js";import"./ic-relative-time-3FqpjeAI.js";import"./ic-connection-dot-CnT1b8xr.js";import"./ic-select-Ce-Raudx.js";import"./ic-array-editor-B7m6x7-S.js";import"./ic-icon-xeGTVhVG.js";var j=Object.defineProperty,F=Object.getOwnPropertyDescriptor,T=(e,t,i,a)=>{for(var r=a>1?void 0:a?F(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&j(t,i,r),r};let g=class extends x{constructor(){super(...arguments),this.label="",this.value="",this.placeholder="env:SECRET_NAME or file:/path",this.disabled=!1,this._visible=!1}_onInput(e){const t=e.target.value;this.dispatchEvent(new CustomEvent("change",{detail:t,bubbles:!0,composed:!0}))}_toggleVisibility(){this._visible=!this._visible}render(){return s`
+      <div class="field-wrapper">
+        ${this.label?s`<label>${this.label}</label>`:p}
+        <div class="input-row">
+          <input
+            type=${this._visible?"text":"password"}
+            .value=${this.value}
+            placeholder=${this.placeholder}
+            ?disabled=${this.disabled}
+            @input=${this._onInput}
+          />
+          <button
+            class="toggle-btn"
+            type="button"
+            aria-label=${this._visible?"Hide value":"Show value"}
+            @click=${this._toggleVisibility}
+          >${this._visible?"🙈":"👁"}</button>
+        </div>
+        <span class="hint">Format: env:VAR_NAME or file:/path/to/secret</span>
+      </div>
+    `}};g.styles=[_,S,w`
+      :host {
+        display: block;
+      }
+
+      .field-wrapper {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+      }
+
+      label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .input-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-xs);
+      }
+
+      input {
+        flex: 1;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+        transition: border-color var(--ic-transition);
+      }
+
+      input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      input::placeholder {
+        color: var(--ic-text-dim);
+      }
+
+      input:disabled {
+        opacity: 0.5;
+        cursor: not-allowed;
+      }
+
+      .toggle-btn {
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-dim);
+        cursor: pointer;
+        padding: 0.5rem;
+        font-size: var(--ic-text-sm);
+        line-height: 1;
+        flex-shrink: 0;
+      }
+
+      .toggle-btn:hover {
+        color: var(--ic-text);
+      }
+
+      .hint {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        font-style: italic;
+      }
+    `];T([d()],g.prototype,"label",2);T([d()],g.prototype,"value",2);T([d()],g.prototype,"placeholder",2);T([d({type:Boolean})],g.prototype,"disabled",2);T([l()],g.prototype,"_visible",2);g=T([$("ic-secret-input")],g);var L=Object.defineProperty,G=Object.getOwnPropertyDescriptor,R=(e,t,i,a)=>{for(var r=a>1?void 0:a?G(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&L(t,i,r),r};let y=class extends x{constructor(){super(...arguments),this._tokens=[],this._newTokenScopes=[],this._newSecretDisplay=null}connectedCallback(){super.connectedCallback()}updated(e){e.has("rpc")&&this.rpc&&this._loadTokens()}async _loadTokens(){if(this.rpc)try{const e=await this.rpc.call("tokens.list");this._tokens=e.tokens??[]}catch{}}async _revokeToken(e){if(this.rpc)try{await this.rpc.call("tokens.revoke",{id:e}),this._tokens=this._tokens.filter(t=>t.id!==e),n.show(`Token "${e}" revoked`,"success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(t){const i=t instanceof Error?t.message:"Failed to revoke token";n.show(i,"error")}}async _rotateToken(e){if(this.rpc)try{const t=await this.rpc.call("tokens.rotate",{id:e});this._newSecretDisplay=t.secret,n.show(`Token "${e}" rotated -- new secret shown below`,"success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(t){const i=t instanceof Error?t.message:"Failed to rotate token";n.show(i,"error")}}_onScopeToggle(e,t){t?this._newTokenScopes=[...this._newTokenScopes,e]:this._newTokenScopes=this._newTokenScopes.filter(i=>i!==e)}async _generateToken(){if(this.rpc)try{const e=await this.rpc.call("tokens.create",{scopes:[...this._newTokenScopes]});this._tokens=[...this._tokens,{id:e.id,scopes:e.scopes}],this._newSecretDisplay=e.secret,this._newTokenScopes=[],n.show("Token created -- secret shown below","success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(e){const t=e instanceof Error?e.message:"Failed to create token";n.show(t,"error")}}_renderTokenRow(e){return s`
+      <div class="data-cell" role="cell">${e.id}</div>
+      <div class="data-cell scopes-cell" role="cell">
+        ${e.scopes.map(t=>s`<ic-tag variant="info">${t}</ic-tag>`)}
+      </div>
+      <div class="data-cell" role="cell">
+        <div class="token-actions">
+          <button class="rotate-btn" @click=${()=>this._rotateToken(e.id)}>Rotate</button>
+          <button class="revoke-btn" @click=${()=>this._revokeToken(e.id)}>Revoke</button>
+        </div>
+      </div>
+    `}render(){return s`
+      <div class="grid-table grid-table--tokens" role="table" aria-label="API tokens">
+        <div class="header-cell" role="columnheader">Token ID</div>
+        <div class="header-cell" role="columnheader">Scopes</div>
+        <div class="header-cell" role="columnheader">Actions</div>
+        ${this._tokens.map(e=>this._renderTokenRow(e))}
+      </div>
+
+      ${this._newSecretDisplay?s`
+            <div class="new-secret-banner">
+              <div class="secret-label">New Token Secret</div>
+              <div class="secret-value">${this._newSecretDisplay}</div>
+              <div class="secret-warning">Copy this secret now. It will not be shown again.</div>
+            </div>
+          `:p}
+
+      <div class="create-form">
+        <div class="create-form-title">Create Token</div>
+        <div class="form-field">
+          <label class="form-label">Scopes</label>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-rpc"
+              .checked=${this._newTokenScopes.includes("rpc")}
+              @change=${e=>this._onScopeToggle("rpc",e.target.checked)}
+            /><label for="scope-rpc">rpc</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-ws"
+              .checked=${this._newTokenScopes.includes("ws")}
+              @change=${e=>this._onScopeToggle("ws",e.target.checked)}
+            /><label for="scope-ws">ws</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-admin"
+              .checked=${this._newTokenScopes.includes("admin")}
+              @change=${e=>this._onScopeToggle("admin",e.target.checked)}
+            /><label for="scope-admin">admin</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-api"
+              .checked=${this._newTokenScopes.includes("api")}
+              @change=${e=>this._onScopeToggle("api",e.target.checked)}
+            /><label for="scope-api">api</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-all"
+              .checked=${this._newTokenScopes.includes("*")}
+              @change=${e=>this._onScopeToggle("*",e.target.checked)}
+            /><label for="scope-all">* (all)</label>
+          </div>
+        </div>
+        <button class="generate-btn" @click=${()=>this._generateToken()}>Generate</button>
+      </div>
+    `}};y.styles=[_,S,w`
+      :host {
+        display: block;
+      }
+
+      .grid-table {
+        display: grid;
+        width: 100%;
+      }
+
+      .grid-table--tokens {
+        grid-template-columns: 1fr 1fr 10rem;
+      }
+
+      .grid-table .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+      }
+
+      .grid-table .data-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .scopes-cell {
+        display: flex;
+        gap: var(--ic-space-xs);
+        flex-wrap: wrap;
+      }
+
+      .create-form {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-md);
+        margin-top: var(--ic-space-lg);
+        max-width: 32rem;
+      }
+
+      .create-form-title {
+        font-size: var(--ic-text-sm);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-field {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .checkbox-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .checkbox-row input[type="checkbox"] {
+        accent-color: var(--ic-accent);
+      }
+
+      .checkbox-row label {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        cursor: pointer;
+      }
+
+      .generate-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-accent);
+        color: white;
+        border: none;
+        border-radius: var(--ic-radius-md);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .generate-btn:hover {
+        opacity: 0.9;
+      }
+
+      .revoke-btn {
+        padding: 0.25rem 0.5rem;
+        background: none;
+        border: 1px solid var(--ic-error);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-error);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .revoke-btn:hover {
+        background: color-mix(in srgb, var(--ic-error) 10%, transparent);
+      }
+
+      .rotate-btn {
+        padding: 0.25rem 0.5rem;
+        background: none;
+        border: 1px solid var(--ic-accent);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-accent);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .rotate-btn:hover {
+        background: color-mix(in srgb, var(--ic-accent) 10%, transparent);
+      }
+
+      .token-actions {
+        display: flex;
+        gap: var(--ic-space-xs);
+      }
+
+      .new-secret-banner {
+        background: color-mix(in srgb, var(--ic-success) 10%, transparent);
+        border: 1px solid var(--ic-success);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-sm) var(--ic-space-md);
+        margin-top: var(--ic-space-md);
+        max-width: 32rem;
+      }
+
+      .new-secret-banner .secret-label {
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-success);
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .new-secret-banner .secret-value {
+        font-family: ui-monospace, monospace;
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        word-break: break-all;
+      }
+
+      .new-secret-banner .secret-warning {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-top: var(--ic-space-xs);
+      }
+    `];R([d({attribute:!1})],y.prototype,"rpc",2);R([l()],y.prototype,"_tokens",2);R([l()],y.prototype,"_newTokenScopes",2);R([l()],y.prototype,"_newSecretDisplay",2);y=R([$("ic-token-manager")],y);var V=Object.defineProperty,K=Object.getOwnPropertyDescriptor,I=(e,t,i,a)=>{for(var r=a>1?void 0:a?K(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&V(t,i,r),r};const U={low:"success",medium:"warning",high:"error",critical:"error"},J={low:"var(--ic-success)",medium:"var(--ic-warning)",high:"var(--ic-error)",critical:"var(--ic-error)"};let C=class extends x{constructor(){super(...arguments),this.approval=null,this._reason="",this._expanded=!1}_onApprove(){this.approval&&this.dispatchEvent(new CustomEvent("approve",{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}_onDeny(){this.approval&&this.dispatchEvent(new CustomEvent("deny",{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}render(){if(!this.approval)return p;const e=this.approval,t=U[e.classification]??"default",i=J[e.classification]??"var(--ic-border)";return s`
+      <div
+        class="card"
+        role="article"
+        aria-label="${e.agentId} ${e.action} approval request"
+        style="border-left-color: ${i};"
+      >
+        <div class="card-header">
+          <span class="agent-id">${e.agentId}</span>
+          <span class="action-name">${e.action}</span>
+          <ic-tag variant=${t}>${e.classification}</ic-tag>
+        </div>
+        <div class="timestamp">
+          <ic-relative-time .timestamp=${e.requestedAt}></ic-relative-time>
+        </div>
+        ${e.user?s`<div class="user-row"><span class="user-label">Requested by:</span> ${e.user}</div>`:p}
+        <button
+          class="context-toggle"
+          @click=${()=>{this._expanded=!this._expanded}}
+        >${this._expanded?"Hide details":"Show details"}</button>
+        ${this._expanded?s`<div class="context-details">${e.context}</div>`:p}
+        <input
+          class="reason-input"
+          type="text"
+          placeholder="Reason (optional)"
+          aria-label="Decision reason"
+          .value=${this._reason}
+          @input=${a=>{this._reason=a.target.value}}
+        />
+        <div class="action-buttons">
+          <button class="approve-btn" @click=${()=>this._onApprove()}>Approve</button>
+          <button class="deny-btn" @click=${()=>this._onDeny()}>Deny</button>
+        </div>
+      </div>
+    `}};C.styles=[_,S,w`
+      :host {
+        display: block;
+        width: 100%;
+      }
+
+      .card {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-lg);
+        padding: var(--ic-space-md);
+        border-left: 3px solid var(--ic-border);
+      }
+
+      .card-header {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        flex-wrap: wrap;
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .agent-id {
+        font-weight: 600;
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+      }
+
+      .action-name {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text-muted);
+        font-family: ui-monospace, monospace;
+      }
+
+      .timestamp {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .user-row {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .user-label {
+        color: var(--ic-text-muted);
+      }
+
+      .context-toggle {
+        background: none;
+        border: none;
+        color: var(--ic-accent);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        padding: 0;
+        font-family: inherit;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .context-toggle:hover {
+        text-decoration: underline;
+      }
+
+      .context-details {
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-muted);
+        white-space: pre-wrap;
+        word-break: break-word;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .reason-input {
+        width: 100%;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+        margin-bottom: var(--ic-space-sm);
+        box-sizing: border-box;
+      }
+
+      .reason-input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      .action-buttons {
+        display: flex;
+        gap: var(--ic-space-sm);
+        flex-wrap: wrap;
+      }
+
+      .approve-btn {
+        padding: 0.375rem 0.75rem;
+        background: color-mix(in srgb, var(--ic-success) 15%, transparent);
+        border: 1px solid var(--ic-success);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-success);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        font-weight: 500;
+      }
+
+      .approve-btn:hover {
+        background: color-mix(in srgb, var(--ic-success) 25%, transparent);
+      }
+
+      .deny-btn {
+        padding: 0.375rem 0.75rem;
+        background: color-mix(in srgb, var(--ic-error) 15%, transparent);
+        border: 1px solid var(--ic-error);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-error);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        font-weight: 500;
+      }
+
+      .deny-btn:hover {
+        background: color-mix(in srgb, var(--ic-error) 25%, transparent);
+      }
+    `];I([d({type:Object})],C.prototype,"approval",2);I([l()],C.prototype,"_reason",2);I([l()],C.prototype,"_expanded",2);C=I([$("ic-approval-card")],C);var Q=Object.defineProperty,Y=Object.getOwnPropertyDescriptor,k=(e,t,i,a)=>{for(var r=a>1?void 0:a?Y(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&Q(t,i,r),r};function M(e){return{id:e.requestId,agentId:e.agentId,action:e.action||e.toolName,classification:e.trustLevel==="admin"?"low":e.trustLevel==="user"?"medium":"high",context:JSON.stringify(e.params,null,2),requestedAt:e.createdAt}}const q="ic:approval-history",H=10080*60*1e3;function X(){try{const e=localStorage.getItem(q);if(!e)return[];const t=JSON.parse(e),i=Date.now()-H;return t.filter(a=>a.resolvedAt>i)}catch{return[]}}function P(e){try{const t=Date.now()-H,i=e.filter(a=>a.resolvedAt>t);localStorage.setItem(q,JSON.stringify(i))}catch{}}let m=class extends x{constructor(){super(...arguments),this.securityConfig={},this.activeSubTab="pending",this._pendingApprovals=[],this._resolvedApprovals=[],this._approvalRules={defaultMode:"manual",timeoutMs:0}}connectedCallback(){super.connectedCallback(),this._resolvedApprovals=X()}updated(e){e.has("rpc")&&this.rpc&&this._loadApprovals(),e.has("securityConfig")&&(this._approvalRules=this.securityConfig.approvalRules??{defaultMode:"manual",timeoutMs:0})}async _loadApprovals(){if(this.rpc)try{const e=await this.rpc.call("admin.approval.pending");this._pendingApprovals=(e.requests??[]).map(M)}catch{}}onApprovalPending(e){const t=e;t?.requestId&&(this._pendingApprovals=[M(t),...this._pendingApprovals])}onApprovalResolved(e){const t=e,i=t?.requestId;if(!i)return;this._pendingApprovals=this._pendingApprovals.filter(o=>o.id!==i);const r={...M(t),outcome:t.approved?"approved":"denied",reason:t.reason??"",resolvedAt:t.resolvedAt??Date.now(),resolvedBy:t.approvedBy??"system"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}async _handleApprove(e){if(!this.rpc)return;const{id:t,reason:i}=e.detail;try{await this.rpc.call("admin.approval.resolve",{requestId:t,approved:!0,approvedBy:"operator",reason:i});const a=this._pendingApprovals.find(r=>r.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(r=>r.id!==t),a){const r={...a,outcome:"approved",reason:i,resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}n.show("Approval granted","success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(a){n.show(a instanceof Error?a.message:"Failed to approve request","error")}}async _handleDeny(e){if(!this.rpc)return;const{id:t,reason:i}=e.detail;try{await this.rpc.call("admin.approval.resolve",{requestId:t,approved:!1,approvedBy:"operator",reason:i});const a=this._pendingApprovals.find(r=>r.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(r=>r.id!==t),a){const r={...a,outcome:"denied",reason:i,resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}n.show("Approval denied","success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(a){n.show(a instanceof Error?a.message:"Failed to deny request","error")}}async _handleResolveAll(e){if(!(!this.rpc||this._pendingApprovals.length===0))try{const t=await this.rpc.call("admin.approval.resolveAll",{approved:e,approvedBy:"operator",reason:e?"Bulk approved by operator":"Bulk denied by operator"});for(const i of this._pendingApprovals){const a={...i,outcome:e?"approved":"denied",reason:e?"Bulk approved by operator":"Bulk denied by operator",resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[a,...this._resolvedApprovals]}this._pendingApprovals=[],P(this._resolvedApprovals),n.show(`${t.resolved} approval(s) ${e?"approved":"denied"}`,"success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(t){n.show(t instanceof Error?t.message:"Bulk operation failed","error")}}async _handleClearDenialCache(){if(this.rpc)try{await this.rpc.call("admin.approval.clearDenialCache",{}),n.show("Denial cache cleared","success")}catch(e){n.show(e instanceof Error?e.message:"Failed to clear denial cache","error")}}async _patchConfig(e,t){if(!this.rpc)return!1;try{const i=e.indexOf("."),a=i>0?e.slice(0,i):e,r=i>0?e.slice(i+1):void 0;return await this.rpc.call("config.patch",{section:a,key:r,value:t}),n.show("Configuration updated","success"),!0}catch(i){return n.show(i instanceof Error?i.message:"Failed to update configuration","error"),!1}}async _onActionConfirmationChange(e,t){const i={...this.securityConfig.actionConfirmation,[e]:t};await this._patchConfig("security.actionConfirmation",i)}async _onAgentToAgentEnabledChange(e){const t={...this.securityConfig.agentToAgent,enabled:e};await this._patchConfig("security.agentToAgent",t)}async _onAgentToAgentAllowChange(e){const t={...this.securityConfig.agentToAgent,allowAgents:e};await this._patchConfig("security.agentToAgent",t)}async _onPermissionToggleChange(e){const t={...this.securityConfig.permission,enableNodePermissions:e};await this._patchConfig("security.permission",t)}async _onPermissionPathsChange(e,t){const i={...this.securityConfig.permission,[e]:t};await this._patchConfig("security.permission",i)}async _saveApprovalRules(){if(this.rpc)try{await this.rpc.call("config.patch",{section:"security",key:"approvalRules",value:this._approvalRules}),n.show("Approval rules updated","success")}catch(e){n.show(e instanceof Error?e.message:"Failed to update approval rules","error")}}_renderHistoryRow(e){const t=e.outcome==="approved"?"success":"error",i={low:"success",medium:"warning",high:"error",critical:"error"}[e.classification]??"default";return s`
+      <div class="data-cell" role="cell">${e.agentId}</div>
+      <div class="data-cell" role="cell">${e.action}</div>
+      <div class="data-cell" role="cell"><ic-tag variant=${i}>${e.classification}</ic-tag></div>
+      <div class="data-cell" role="cell"><ic-tag variant=${t}>${e.outcome}</ic-tag></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.reason||"---"}</div>
+      <div class="data-cell data-cell--muted" role="cell"><ic-relative-time .timestamp=${e.resolvedAt}></ic-relative-time></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.resolvedBy}</div>
+    `}_renderRulesContent(){const e=this.securityConfig.actionConfirmation??{},t=this.securityConfig.agentToAgent??{},i=this.securityConfig.permission??{},a=[{value:"manual",label:"Manual (all require approval)"},{value:"auto-low",label:"Auto-approve low risk"},{value:"auto-medium",label:"Auto-approve low + medium risk"},{value:"auto-all",label:"Auto-approve all (no approvals)"}];return s`
+      <div class="policy-section">
+        <div class="section-header">Action Confirmation</div>
+        <ic-toggle label="Require for destructive actions"
+          .checked=${e.requireForDestructive??!0}
+          @change=${r=>this._onActionConfirmationChange("requireForDestructive",r.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-sm);">
+          <ic-toggle label="Require for sensitive actions"
+            .checked=${e.requireForSensitive??!1}
+            @change=${r=>this._onActionConfirmationChange("requireForSensitive",r.detail)}
+          ></ic-toggle>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Auto-approve list" .items=${e.autoApprove??[]} placeholder="Action name to auto-approve"
+            @change=${r=>this._onActionConfirmationChange("autoApprove",r.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Agent-to-Agent Policy</div>
+        <ic-toggle label="Enable cross-agent messaging"
+          .checked=${t.enabled??!0}
+          @change=${r=>this._onAgentToAgentEnabledChange(r.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed agents" .items=${t.allowAgents??[]} placeholder="Agent ID"
+            @change=${r=>this._onAgentToAgentAllowChange(r.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Permissions</div>
+        <ic-toggle label="Enable Node.js permission model"
+          .checked=${i.enableNodePermissions??!1}
+          @change=${r=>this._onPermissionToggleChange(r.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed filesystem paths" .items=${i.allowedFsPaths??[]} placeholder="/path/to/allow"
+            @change=${r=>this._onPermissionPathsChange("allowedFsPaths",r.detail)}
+          ></ic-array-editor>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed network hosts" .items=${i.allowedNetHosts??[]} placeholder="hostname or IP"
+            @change=${r=>this._onPermissionPathsChange("allowedNetHosts",r.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Approval Mode</div>
+        <div class="rules-form">
+          <ic-select label="Default Mode" .value=${this._approvalRules.defaultMode} .options=${a}
+            @change=${r=>{this._approvalRules={...this._approvalRules,defaultMode:r.detail}}}
+          ></ic-select>
+          <div class="form-field">
+            <label class="form-label">Timeout (seconds)</label>
+            <input class="number-input" type="number" min="0"
+              .value=${String(Math.round(this._approvalRules.timeoutMs/1e3))}
+              @change=${r=>{const o=parseInt(r.target.value,10);!isNaN(o)&&o>=0&&(this._approvalRules={...this._approvalRules,timeoutMs:o*1e3})}}
+            />
+            <span class="form-hint">0 = no timeout (request waits indefinitely)</span>
+          </div>
+          <button class="save-btn" @click=${()=>this._saveApprovalRules()}>Save Rules</button>
+        </div>
+      </div>
+    `}_renderPendingContent(){const e=[...this._pendingApprovals].sort((t,i)=>i.requestedAt-t.requestedAt);return s`
+      <div class="queue-header">
+        <span>Pending</span>
+        <span class="queue-count">${this._pendingApprovals.length}</span>
+      </div>
+      <div class="bulk-actions">
+        <button class="action-btn action-btn--success" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!0)}>Approve All (${this._pendingApprovals.length})</button>
+        <button class="action-btn action-btn--danger" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!1)}>Deny All (${this._pendingApprovals.length})</button>
+        <button class="action-btn" @click=${()=>this._handleClearDenialCache()}>Clear Denial Cache</button>
+      </div>
+      ${e.length===0?s`<ic-empty-state icon="security" message="No pending approvals" description="Approval requests will appear here as they arrive."></ic-empty-state>`:s`
+            <div class="queue-list">
+              ${e.map(t=>s`
+                <ic-approval-card .approval=${t}
+                  @approve=${i=>this._handleApprove(i)}
+                  @deny=${i=>this._handleDeny(i)}
+                ></ic-approval-card>
+              `)}
+            </div>
+          `}
+
+      <div class="history-divider">Recent History</div>
+      ${this._resolvedApprovals.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No resolved approvals in the last 7 days.</p>`:s`
+            <div class="history-grid" role="table" aria-label="Resolved approvals">
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">Outcome</div>
+              <div class="header-cell" role="columnheader">Reason</div>
+              <div class="header-cell" role="columnheader">Resolved At</div>
+              <div class="header-cell" role="columnheader">Resolved By</div>
+              ${this._resolvedApprovals.map(t=>this._renderHistoryRow(t))}
+            </div>
+          `}
+    `}render(){return this.activeSubTab==="rules"?this._renderRulesContent():this._renderPendingContent()}};m.styles=[_,S,w`
+      :host {
+        display: block;
+      }
+
+      .section-header {
+        font-size: var(--ic-text-base);
+        font-weight: 600;
+        color: var(--ic-text);
+        margin-top: var(--ic-space-lg);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .section-header:first-child {
+        margin-top: 0;
+      }
+
+      .policy-section {
+        margin-bottom: var(--ic-space-xl);
+        max-width: 40rem;
+      }
+
+      .queue-header {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+      }
+
+      .queue-count {
+        background: var(--ic-accent);
+        color: white;
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        padding: 0.125rem 0.5rem;
+        border-radius: var(--ic-radius-md);
+        min-width: 1.25rem;
+        text-align: center;
+      }
+
+      .queue-list {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-md);
+      }
+
+      .history-divider {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin: var(--ic-space-xl) 0 var(--ic-space-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        font-weight: 600;
+      }
+
+      .history-divider::after {
+        content: "";
+        flex: 1;
+        height: 1px;
+        background: var(--ic-border);
+      }
+
+      .history-grid {
+        display: grid;
+        grid-template-columns: 7rem 8rem 6rem 5rem 1fr 8rem 6rem;
+        width: 100%;
+      }
+
+      .history-grid .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+      }
+
+      .history-grid .data-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .history-grid .data-cell--muted {
+        color: var(--ic-text-muted);
+      }
+
+      .rules-form {
+        max-width: 32rem;
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-md);
+      }
+
+      .save-btn,
+      .action-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-accent);
+        color: white;
+        border: none;
+        border-radius: var(--ic-radius-md);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        align-self: flex-start;
+      }
+
+      .save-btn:hover,
+      .action-btn:hover {
+        opacity: 0.9;
+      }
+
+      .form-field {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .form-hint {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+      }
+
+      .number-input {
+        width: 8rem;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+      }
+
+      .number-input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      .bulk-actions {
+        display: flex;
+        flex-direction: row;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+        flex-wrap: wrap;
+      }
+
+      .action-btn--success {
+        background: var(--ic-success, #22c55e);
+        color: white;
+      }
+
+      .action-btn--danger {
+        background: var(--ic-error, #ef4444);
+        color: white;
+      }
+
+      .action-btn:disabled,
+      .action-btn--success:disabled,
+      .action-btn--danger:disabled {
+        opacity: 0.5;
+        cursor: not-allowed;
+      }
+    `];k([d({attribute:!1})],m.prototype,"rpc",2);k([d({attribute:!1})],m.prototype,"securityConfig",2);k([d({type:String})],m.prototype,"activeSubTab",2);k([l()],m.prototype,"_pendingApprovals",2);k([l()],m.prototype,"_resolvedApprovals",2);k([l()],m.prototype,"_approvalRules",2);m=k([$("ic-approval-queue")],m);var W=Object.defineProperty,Z=Object.getOwnPropertyDescriptor,N=(e,t,i,a)=>{for(var r=a>1?void 0:a?Z(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&W(t,i,r),r};const ee={low:"success",medium:"warning",high:"error",critical:"error"};let z=class extends x{constructor(){super(...arguments),this.event=null}render(){if(!this.event)return s`
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+      `;const e=this.event,t=ee[e.classification]??"default";return s`
+      <div class="cell cell--muted" role="cell">
+        <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+      </div>
+      <div class="cell" role="cell">${e.agentId||"---"}</div>
+      <div class="cell" role="cell">${e.action||"---"}</div>
+      <div class="cell" role="cell">
+        <ic-tag variant=${t}>${e.classification||"unknown"}</ic-tag>
+      </div>
+      <div class="cell cell--muted" role="cell">${e.user||"---"}</div>
+      ${e.details?s`<div class="cell cell--details" role="cell" style="grid-column: 1 / -1;">${e.details}</div>`:p}
+    `}};z.styles=[_,w`
+      :host {
+        display: contents;
+      }
+
+      .cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .cell--muted {
+        color: var(--ic-text-muted);
+      }
+
+      .cell--details {
+        color: var(--ic-text-dim);
+        font-size: var(--ic-text-xs);
+      }
+    `];N([d({type:Object})],z.prototype,"event",2);z=N([$("ic-audit-row")],z);var te=Object.defineProperty,ie=Object.getOwnPropertyDescriptor,E=(e,t,i,a)=>{for(var r=a>1?void 0:a?ie(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&te(t,i,r),r};let f=class extends x{constructor(){super(...arguments),this.activeSubTab="events",this.securityEvents=[],this.inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:"session"},this._auditEntries=[],this._paused=!1,this._pauseBuffer=[],this._expandedEvents=new Set}onAuditEvent(e){const t=e;if(t){if(this._paused){this._pauseBuffer=[...this._pauseBuffer.slice(-199),t];return}this._auditEntries=[...this._auditEntries.slice(-199),t]}}get auditEntries(){return this._auditEntries}get paused(){return this._paused}get pauseBuffer(){return this._pauseBuffer}_severityVariant(e){switch(e){case"critical":case"high":return"error";case"medium":return"warning";default:return"info"}}_toggleEventDetails(e){this._expandedEvents.has(e)?this._expandedEvents.delete(e):this._expandedEvents.add(e),this.requestUpdate()}_togglePause(){if(this._paused){const e=[...this._auditEntries,...this._pauseBuffer].slice(-200);this._auditEntries=e,this._pauseBuffer=[]}this._paused=!this._paused}_renderEventsContent(){return s`
+      <div class="guard-summary">
+        <span style="font-size: var(--ic-text-sm); font-weight: 500; color: var(--ic-text-muted);">Input Guard</span>
+        <ic-tag variant="error">${this.inputGuardSummary.blockedAttempts} blocked</ic-tag>
+        ${this.inputGuardSummary.patternsTriggered.length>0?s`<ic-tag variant="warning">${this.inputGuardSummary.patternsTriggered.join(", ")}</ic-tag>`:p}
+      </div>
+      ${this.securityEvents.length===0?s`<ic-empty-state icon="security" message="No security events" description="Security events will appear here in real-time as they are detected."></ic-empty-state>`:s`
+            <div role="list" aria-label="Security events">
+              ${this.securityEvents.map(e=>s`
+                  <div class="event-row" role="listitem">
+                    <ic-tag variant=${this._severityVariant(e.severity)}>${e.severity}</ic-tag>
+                    <ic-tag variant="default">${e.type}</ic-tag>
+                    <span class="event-message">${e.message}</span>
+                    ${e.agentId?s`<ic-tag variant="info">${e.agentId}</ic-tag>`:p}
+                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+                    <button class="event-details-toggle"
+                      @click=${()=>this._toggleEventDetails(e.id)}
+                    >${this._expandedEvents.has(e.id)?"hide":"details"}</button>
+                  </div>
+                  ${this._expandedEvents.has(e.id)?s`<pre class="event-details">${JSON.stringify(e.details,null,2)}</pre>`:p}
+                `)}
+            </div>
+          `}
+    `}_renderAuditContent(){return s`
+      <div class="audit-controls">
+        <button class="pause-btn" ?data-active=${this._paused}
+          @click=${()=>this._togglePause()}
+        >${this._paused?"Resume":"Pause"}</button>
+        ${this._paused?s`<span style="font-size: var(--ic-text-xs); color: var(--ic-text-dim);">${this._pauseBuffer.length} buffered</span>`:p}
+      </div>
+      ${this._auditEntries.length===0?s`<ic-empty-state icon="security" message="No audit events" description="Events will appear here as they occur."></ic-empty-state>`:s`
+            <div class="audit-grid" role="table" aria-label="Audit log">
+              <div class="header-cell" role="columnheader">Time</div>
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">User</div>
+              ${this._auditEntries.map(e=>s`<ic-audit-row .event=${e} role="row"></ic-audit-row>`)}
+            </div>
+          `}
+    `}render(){return this.activeSubTab==="audit"?this._renderAuditContent():this._renderEventsContent()}};f.styles=[_,S,w`
+      :host {
+        display: block;
+      }
+
+      .guard-summary {
+        display: flex;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm) var(--ic-space-md);
+        background: var(--ic-surface-alt, var(--ic-surface-2));
+        border-radius: var(--ic-radius-md);
+        margin-bottom: var(--ic-space-md);
+        align-items: center;
+        flex-wrap: wrap;
+      }
+
+      .event-row {
+        display: flex;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm) var(--ic-space-sm);
+        border-bottom: 1px solid var(--ic-border);
+        align-items: center;
+      }
+
+      .event-message {
+        flex: 1;
+        font-size: var(--ic-text-sm);
+      }
+
+      .event-details {
+        font-family: ui-monospace, monospace;
+        font-size: var(--ic-text-xs);
+        background: var(--ic-surface-alt, var(--ic-surface-2));
+        padding: var(--ic-space-sm);
+        border-radius: var(--ic-radius-md);
+        max-height: 200px;
+        overflow: auto;
+        white-space: pre-wrap;
+        margin-top: var(--ic-space-xs);
+      }
+
+      .event-details-toggle {
+        cursor: pointer;
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        background: none;
+        border: none;
+        font-family: inherit;
+        padding: 0;
+      }
+
+      .event-details-toggle:hover {
+        color: var(--ic-text-muted);
+      }
+
+      .audit-controls {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+      }
+
+      .pause-btn {
+        padding: 0.375rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .pause-btn[data-active] {
+        background: var(--ic-warning);
+        color: var(--ic-bg);
+        border-color: var(--ic-warning);
+      }
+
+      .audit-grid {
+        display: grid;
+        grid-template-columns: 8rem 7rem 1fr 6rem 6rem;
+        overflow-y: auto;
+        max-height: 600px;
+      }
+
+      .audit-grid .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+        position: sticky;
+        top: 0;
+        z-index: 1;
+      }
+    `];E([d({type:String})],f.prototype,"activeSubTab",2);E([d({attribute:!1})],f.prototype,"securityEvents",2);E([d({attribute:!1})],f.prototype,"inputGuardSummary",2);E([l()],f.prototype,"_auditEntries",2);E([l()],f.prototype,"_paused",2);f=E([$("ic-security-event-feed")],f);var re=Object.defineProperty,ae=Object.getOwnPropertyDescriptor,u=(e,t,i,a)=>{for(var r=a>1?void 0:a?ae(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&re(t,i,r),r};const b=200,O=100,se=[{id:"events",label:"Security Events"},{id:"audit",label:"Audit Log"},{id:"tokens",label:"API Tokens"},{id:"secrets",label:"Secrets"},{id:"rules",label:"Approval Rules"},{id:"pending",label:"Pending Approvals"},{id:"health",label:"Provider Health"}];let v=class extends x{constructor(){super(...arguments),this.rpcClient=null,this.apiClient=null,this.eventDispatcher=null,this._sse=null,this._loadState="loading",this._error="",this._activeTab="events",this._securityEvents=[],this._inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:"session"},this._securityConfig={},this._providerHealth=[],this._failoverLog=[],this._authCooldowns=[],this._healthReloadDebounce=null}_scheduleHealthReload(e=300){this._healthReloadDebounce!==null&&clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=setTimeout(()=>{this._healthReloadDebounce=null,this._loadProviderHealth()},e)}connectedCallback(){super.connectedCallback(),this._initSse()}disconnectedCallback(){super.disconnectedCallback(),this._healthReloadDebounce!==null&&(clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=null)}updated(e){e.has("rpcClient")&&this.rpcClient&&this._loadData(),e.has("eventDispatcher")&&this.eventDispatcher&&!this._sse&&this._initSse()}get _eventFeed(){return this.shadowRoot?.querySelector("ic-security-event-feed")??null}get _approvalQueue(){return this.shadowRoot?.querySelector("ic-approval-queue")??null}_initSse(){!this.eventDispatcher||this._sse||(this._sse=new B(this,this.eventDispatcher,{"audit:event":e=>{this._eventFeed?.onAuditEvent(e);const t=e;if(t.actionType==="output_guard"){const i=t.metadata??{},a=i.action,r=a==="redacted"?"high":"medium",o=i.findingCount??0,c={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"output_guard",severity:r,message:`Output guard ${a??"scan"}: ${o} finding(s)`,details:{findingTypes:i.findingTypes,severities:i.severities,action:i.action,context:i.context},timestamp:t.timestamp??Date.now(),agentId:t.agentId};this._securityEvents=[c,...this._securityEvents].slice(0,b)}},"approval:requested":e=>{this._approvalQueue?.onApprovalPending(e)},"approval:resolved":e=>{this._approvalQueue?.onApprovalResolved(e)},"security:injection_detected":e=>{const t=e,i=t.riskLevel??"medium",r={high:"high",medium:"medium",low:"low"}[i]??"medium",o=t.source??"unknown",c=t.patterns??[],D={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"injection",severity:r,message:`Injection detected from ${o}`,details:{patterns:c,source:o,sessionKey:t.sessionKey},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[D,...this._securityEvents].slice(0,b);const A=[...new Set([...this._inputGuardSummary.patternsTriggered,...c])];this._inputGuardSummary={...this._inputGuardSummary,blockedAttempts:this._inputGuardSummary.blockedAttempts+1,patternsTriggered:A}},"security:injection_rate_exceeded":e=>{const t=e,i=t.count??0,a=t.threshold??0,r=t.action??"block",o={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"input_guard",severity:"critical",message:`Rate limit exceeded: ${i}/${a} (action: ${r})`,details:{sessionKey:t.sessionKey,count:i,threshold:a,action:r},timestamp:Date.now()};this._securityEvents=[o,...this._securityEvents].slice(0,b)},"security:memory_tainted":e=>{const t=e,i=t.blocked??!1,a=t.originalTrustLevel??"unknown",r=t.adjustedTrustLevel??"unknown",o={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"memory_tainted",severity:i?"high":"medium",message:`Memory tainted for ${t.agentId??"unknown"}: ${a} -> ${r}`,details:{patterns:t.patterns,blocked:i,originalTrustLevel:a,adjustedTrustLevel:r},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[o,...this._securityEvents].slice(0,b)},"security:warn":e=>{const t=e,i={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"warn",severity:"medium",message:t.message??"Security warning",details:{category:t.category},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[i,...this._securityEvents].slice(0,b)},"secret:accessed":e=>{const t=e,i=t.outcome??"unknown",r={denied:"high",not_found:"medium",success:"low"}[i]??"medium",o=t.secretName??"unknown",c={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"secret_access",severity:r,message:`Secret '${o}' ${i} by ${t.agentId??"unknown"}`,details:{secretName:o,outcome:i},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[c,...this._securityEvents].slice(0,b)},"secret:modified":e=>{const t=e,i=t.secretName??"unknown",a=t.action??"modified",r={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"secret_access",severity:"medium",message:`Secret '${i}' ${a}`,details:{secretName:i,action:a},timestamp:Date.now()};this._securityEvents=[r,...this._securityEvents].slice(0,b)},"provider:degraded":e=>{const i=e.provider??"";this._providerHealth=this._providerHealth.map(a=>a.providerId===i?{...a,status:"degraded"}:a),this._scheduleHealthReload()},"provider:recovered":e=>{const i=e.provider??"";this._providerHealth=this._providerHealth.map(a=>a.providerId===i?{...a,status:"healthy"}:a),this._scheduleHealthReload()},"model:auth_cooldown":e=>{const t=e,i={keyName:t.keyName,provider:t.provider,cooldownMs:t.cooldownMs,failureCount:t.failureCount,timestamp:t.timestamp};this._authCooldowns=[i,...this._authCooldowns].slice(0,50),this._scheduleHealthReload(500)},"model:fallback_attempt":e=>{const t=e,i={fromProvider:t.fromProvider,fromModel:t.fromModel,toProvider:t.toProvider,toModel:t.toModel,error:t.error,attemptNumber:t.attemptNumber,timestamp:t.timestamp};this._failoverLog=[i,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"model:fallback_exhausted":e=>{const t=e,i={provider:t.provider,model:t.model,totalAttempts:t.totalAttempts,timestamp:t.timestamp,exhausted:!0};this._failoverLog=[i,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"observability:token_usage":()=>{this._scheduleHealthReload(500)}}))}async _loadProviderHealth(){if(this.rpcClient)try{const e=await this.rpcClient.call("agent.cacheStats"),t=Date.now(),i=t-300*1e3,a=(e.providers??[]).map(r=>{const o=this._failoverLog.filter(h=>h.fromProvider===r.provider||h.provider===r.provider),c=o.length>0?Math.max(...o.map(h=>h.timestamp)):void 0;let D="healthy";const A=this._authCooldowns.find(h=>h.provider===r.provider&&h.timestamp+h.cooldownMs>t);return A&&(D="degraded"),this._failoverLog.find(h=>h.exhausted===!0&&h.provider===r.provider&&h.timestamp>i)&&(D="down"),{providerId:r.provider,name:r.provider,status:D,cacheHitRate:r.cacheHitRate,failoverCount:o.length,lastFailover:c,authCooldownUntil:A?A.timestamp+A.cooldownMs:void 0}});this._providerHealth=a}catch{}}async _loadData(){if(this.rpcClient){this._loadState="loading",this._error="";try{const e=await this.rpcClient.call("config.read");this._securityConfig=e.config.security??{},this._loadState="loaded",this._loadProviderHealth()}catch(e){this._error=e instanceof Error?e.message:"Failed to load security configuration",this._loadState="error"}}}async _patchConfig(e,t){if(!this.rpcClient)return!1;try{const i=e.indexOf("."),a=i>0?e.slice(0,i):e,r=i>0?e.slice(i+1):void 0;return await this.rpcClient.call("config.patch",{section:a,key:r,value:t}),n.show("Configuration updated","success"),!0}catch(i){const a=i instanceof Error?i.message:"Failed to update configuration";return n.show(a,"error"),!1}}async _onSecretsEnabledChange(e){const t={...this._securityConfig.secrets,enabled:e};await this._patchConfig("security.secrets",t)&&(this._securityConfig={...this._securityConfig,secrets:t})}_renderSecretsTab(){const e=this._securityConfig.secrets??{};return s`
+      <div class="policy-section">
+        <div class="section-header">Encrypted Secrets Store</div>
+        <ic-toggle
+          label="Enabled"
+          .checked=${e.enabled??!1}
+          @change=${t=>this._onSecretsEnabledChange(t.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <div class="tls-row">
+            <span class="tls-label">DB Path</span>
+            <span class="tls-value">${e.dbPath??"secrets.db"}</span>
+          </div>
+        </div>
+      </div>
+    `}_statusToDotStatus(e){switch(e){case"healthy":return"connected";case"degraded":return"reconnecting";case"down":return"disconnected";default:return"disconnected"}}_renderHealthTab(){const e=Date.now(),t=this._authCooldowns.filter(i=>i.timestamp+i.cooldownMs>e);return s`
+      <div class="section-header">Provider Status</div>
+      ${this._providerHealth.length===0?s`<ic-empty-state icon="cloud" message="No provider data" description="Provider health data will appear after LLM calls are made."></ic-empty-state>`:s`
+            <div class="health-grid">
+              ${this._providerHealth.map(i=>s`
+                  <div class="health-card">
+                    <div class="health-card-header">
+                      <strong>${i.name}</strong>
+                      <ic-connection-dot
+                        status=${this._statusToDotStatus(i.status)}
+                        size="8px"
+                      ></ic-connection-dot>
+                    </div>
+                    <ic-progress-bar
+                      .value=${Math.round(i.cacheHitRate*100)}
+                      label="Cache Hit Rate"
+                      .thresholds=${{green:101,yellow:102}}
+                    ></ic-progress-bar>
+                    <div class="health-card-stat">
+                      Failovers: ${i.failoverCount}
+                      ${i.lastFailover?s` &mdash; last <ic-relative-time .timestamp=${i.lastFailover}></ic-relative-time>`:p}
+                    </div>
+                    ${i.authCooldownUntil&&i.authCooldownUntil>e?s`
+                          <div class="health-card-stat">
+                            <ic-tag variant="warning">Auth cooldown</ic-tag>
+                            ${Math.ceil((i.authCooldownUntil-e)/1e3)}s remaining
+                          </div>
+                        `:p}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Failover Event Log</div>
+      ${this._failoverLog.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No failover events recorded</p>`:s`
+            <div class="failover-log">
+              ${this._failoverLog.map(i=>s`
+                  <div class="failover-entry">
+                    <ic-relative-time .timestamp=${i.timestamp}></ic-relative-time>
+                    ${i.exhausted?s`
+                          <span>${i.provider??"unknown"} exhausted after ${i.totalAttempts??"?"} attempts</span>
+                          <ic-tag variant="error">EXHAUSTED</ic-tag>
+                        `:s`
+                          <span>${i.fromProvider??"?"}/${i.fromModel??"?"} &rarr; ${i.toProvider??"?"}/${i.toModel??"?"}</span>
+                          ${i.attemptNumber!=null?s`<ic-tag variant="info">#${i.attemptNumber}</ic-tag>`:p}
+                          ${i.error?s`<span style="color: var(--ic-text-dim);">${i.error}</span>`:p}
+                        `}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Auth Cooldowns</div>
+      ${t.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No active cooldowns</p>`:s`
+            <div class="cooldown-list">
+              ${t.map(i=>s`
+                  <div class="cooldown-entry">
+                    <ic-tag variant="warning">${i.provider}</ic-tag>
+                    <span>${i.keyName}</span>
+                    <span style="color: var(--ic-text-dim);">${i.failureCount} failures</span>
+                    <span>${Math.ceil((i.timestamp+i.cooldownMs-e)/1e3)}s remaining</span>
+                  </div>
+                `)}
+            </div>
+          `}
+    `}_renderTabContent(){switch(this._activeTab){case"events":return s`<ic-security-event-feed
+          activeSubTab="events"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case"audit":return s`<ic-security-event-feed
+          activeSubTab="audit"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case"tokens":return s`<ic-token-manager .rpc=${this.rpcClient}></ic-token-manager>`;case"secrets":return this._renderSecretsTab();case"rules":return s`<ic-approval-queue
+          activeSubTab="rules"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case"pending":return s`<ic-approval-queue
+          activeSubTab="pending"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case"health":return this._renderHealthTab();default:return p}}render(){return this._loadState==="loading"?s`<ic-skeleton-view variant="list"></ic-skeleton-view>`:this._loadState==="error"?s`
+        <div class="error-container">
+          <span class="error-message">${this._error}</span>
+          <button class="retry-btn" @click=${()=>this._loadData()}>Retry</button>
+        </div>
+      `:s`
+      <div class="view-header">
+        <div class="view-title">Security</div>
+      </div>
+      <ic-tabs
+        .tabs=${se}
+        .activeTab=${this._activeTab}
+        @tab-change=${e=>{this._activeTab=e.detail}}
+      ></ic-tabs>
+      <div class="tab-content">
+        ${this._renderTabContent()}
+      </div>
+    `}};v.styles=[_,S,w`
+      :host {
+        display: block;
+      }
+
+      .view-header {
+        margin-bottom: var(--ic-space-lg);
+      }
+
+      .view-title {
+        font-size: 1.125rem;
+        font-weight: 600;
+      }
+
+      .state-container {
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 3rem;
+      }
+
+      .error-container {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 0.75rem;
+        padding: 3rem;
+      }
+
+      .error-message {
+        color: var(--ic-error);
+        font-size: var(--ic-text-sm);
+      }
+
+      .retry-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .retry-btn:hover {
+        background: var(--ic-border);
+      }
+
+      .tab-content {
+        margin-top: var(--ic-space-md);
+      }
+
+      .section-header {
+        font-size: var(--ic-text-base);
+        font-weight: 600;
+        color: var(--ic-text);
+        margin-top: var(--ic-space-lg);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .section-header:first-child {
+        margin-top: 0;
+      }
+
+      /* Secrets tab styles */
+      .policy-section {
+        margin-bottom: var(--ic-space-xl);
+        max-width: 40rem;
+      }
+
+      .tls-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+      }
+
+      .tls-label {
+        font-weight: 500;
+        color: var(--ic-text-muted);
+        min-width: 6rem;
+      }
+
+      .tls-value {
+        font-family: ui-monospace, monospace;
+        color: var(--ic-text);
+        font-size: var(--ic-text-xs);
+      }
+
+      /* Provider Health tab */
+      .health-grid {
+        display: grid;
+        grid-template-columns: 1fr;
+        gap: var(--ic-space-md);
+      }
+
+      @media (min-width: 768px) {
+        .health-grid {
+          grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+        }
+      }
+
+      .health-card {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-md);
+      }
+
+      .health-card-header {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .health-card-header strong {
+        font-size: var(--ic-text-sm);
+      }
+
+      .health-card-stat {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text-muted);
+        margin-top: var(--ic-space-xs);
+      }
+
+      .failover-log {
+        max-height: 300px;
+        overflow-y: auto;
+        margin-top: var(--ic-space-md);
+      }
+
+      .failover-entry {
+        display: flex;
+        flex-direction: row;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm);
+        border-bottom: 1px solid var(--ic-border);
+        font-size: var(--ic-text-sm);
+        align-items: center;
+        flex-wrap: wrap;
+      }
+
+      .cooldown-list {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-sm);
+        margin-top: var(--ic-space-md);
+      }
+
+      .cooldown-entry {
+        display: flex;
+        gap: var(--ic-space-sm);
+        align-items: center;
+        font-size: var(--ic-text-sm);
+      }
+    `];u([d({attribute:!1})],v.prototype,"rpcClient",2);u([d({attribute:!1})],v.prototype,"apiClient",2);u([d({attribute:!1})],v.prototype,"eventDispatcher",2);u([l()],v.prototype,"_loadState",2);u([l()],v.prototype,"_error",2);u([l()],v.prototype,"_activeTab",2);u([l()],v.prototype,"_securityEvents",2);u([l()],v.prototype,"_inputGuardSummary",2);u([l()],v.prototype,"_securityConfig",2);u([l()],v.prototype,"_providerHealth",2);u([l()],v.prototype,"_failoverLog",2);u([l()],v.prototype,"_authCooldowns",2);v=u([$("ic-security-view")],v);export{v as IcSecurityView};