agent-webui 2.7.1__tar.gz → 2.8.1__tar.gz

{agent_webui-2.7.1 → agent_webui-2.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-webui
-Version: 2.7.1
+Version: 2.8.1
 Summary: Agent Web Interface for Pydantic AI Agents
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
@@ -9,7 +9,10 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Environment :: Console
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
-Requires-Python: <3.15,>=3.12
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: agent-utilities<4.0.0,>=3.0.0
@@ -97,7 +100,7 @@ credentials and gateway delegation on the server side.
 |---|---|
 | Browser presentation, local interaction state, accessible route composition, and the FastAPI boundary | Arbora owns public routing, identity, policy, and fleet supervision; Agent Utilities owns agent behavior; Epistemic Graph owns durable knowledge; connector services own external-system effects |
 
-Current package Version: 2.7.1.
+Current package Version: 2.8.1.
 
 ## Key capabilities
 
@@ -126,7 +129,9 @@ then use the shared platform map to move between components:
 
 ## Architecture
 
-![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)
+[![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#webui)
+
+[Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#webui)
 
 People also enter through Agent Terminal UI and Geniusbot or Arbora-hosted
 messaging; Agent Terminal UI exposes REST operations, with no ACP conversational

{agent_webui-2.7.1 → agent_webui-2.8.1}/README.md

@@ -54,7 +54,7 @@ credentials and gateway delegation on the server side.
 |---|---|
 | Browser presentation, local interaction state, accessible route composition, and the FastAPI boundary | Arbora owns public routing, identity, policy, and fleet supervision; Agent Utilities owns agent behavior; Epistemic Graph owns durable knowledge; connector services own external-system effects |
 
-Current package Version: 2.7.1.
+Current package Version: 2.8.1.
 
 ## Key capabilities
 
@@ -83,7 +83,9 @@ then use the shared platform map to move between components:
 
 ## Architecture
 
-![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)
+[![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#webui)
+
+[Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#webui)
 
 People also enter through Agent Terminal UI and Geniusbot or Arbora-hosted
 messaging; Agent Terminal UI exposes REST operations, with no ACP conversational

agent_webui-2.8.1/agent/agent_webui/__tests__/test_run_identity.py

@@ -0,0 +1,218 @@
+"""WEBUI-API-R011.2: conversation labels and admitted run identity stay distinct."""
+
+# spec: WEBUI-API-R011.2.1
+
+import asyncio
+
+import pytest
+from agent_webui.orchestrator_model import (
+    _conversation_session_id,
+    _run_identity,
+    build_orchestrator_model,
+)
+from pydantic_ai import Agent
+from pydantic_ai.messages import ModelRequest, UserPromptPart
+
+
+def request(text='hello', conversation_id=None):
+    return ModelRequest(
+        parts=[UserPromptPart(content=text)], conversation_id=conversation_id
+    )
+
+
+def task_result(task_id, context='owned-context'):
+    return {
+        'value': {
+            'id': task_id,
+            'contextId': context,
+            'metadata': {
+                'arbora': {
+                    'runId': 'run-' + task_id,
+                    'runTraceRef': 'opaque-ref-' + task_id,
+                }
+            },
+            'artifacts': [{'parts': [{'kind': 'text', 'text': 'reply-' + task_id}]}],
+        }
+    }
+
+
+def test_explicit_identity_is_stable_not_content_derived():
+    assert _conversation_session_id([request('one', 'c1')]) == 'webui:c1'
+    assert _conversation_session_id([request('two', 'c1')]) == 'webui:c1'
+    assert _conversation_session_id([request('one', 'c2')]) == 'webui:c2'
+    assert _conversation_session_id([request()]) != _conversation_session_id(
+        [request()]
+    )
+
+
+def test_conflicting_identity_refused():
+    with pytest.raises(ValueError, match='Conflicting'):
+        _conversation_session_id(
+            [request(conversation_id='a'), request(conversation_id='b')]
+        )
+
+
+def test_explicit_references_only_no_guessed_trace():
+    metadata = _run_identity(task_result('t1'), 'webui:c1')
+    assert metadata is not None
+    identity = metadata['arbora_run']
+    assert identity == {
+        'conversation_context': 'webui:c1',
+        'task_id': 't1',
+        'context_id': 'owned-context',
+        'run_id': 'run-t1',
+        'run_trace_ref': 'opaque-ref-t1',
+    }
+    assert _run_identity({'value': {'status': {}}}, 'webui:c1') is None
+    assert _run_identity({'result': task_result('nested')}, 'webui:c1') is None
+    assert _run_identity({'value': {'id': 't', 'contextId': 'c'}}, 'webui:c1') == {
+        'arbora_run': {
+            'conversation_context': 'webui:c1',
+            'task_id': 't',
+            'context_id': 'c',
+        }
+    }
+
+
+@pytest.mark.parametrize(
+    'field,value', [('id', 1), ('contextId', ''), ('contextId', ['c'])]
+)
+def test_invalid_returned_identity_refused(field, value):
+    result = task_result('t1')
+    result['value'][field] = value
+    assert _run_identity(result, 'webui:c1') is None
+
+
+async def test_stream_metadata_is_request_local_and_preserves_exact_refs():
+    calls = []
+
+    async def invoke(op, params, *, idempotency_key):
+        context = params['message']['contextId']
+        calls.append((context, idempotency_key))
+        await asyncio.sleep(0)
+        return task_result(context)
+
+    agent = Agent(build_orchestrator_model(invoke=invoke))
+
+    async def run(conversation):
+        async with agent.run_stream('hello', conversation_id=conversation) as result:
+            await result.get_output()
+            return result.response
+
+    one, two = await asyncio.gather(run('one'), run('two'))
+    assert one.metadata['arbora_run']['task_id'] == 'webui:one'
+    assert two.metadata['arbora_run']['task_id'] == 'webui:two'
+    assert one.metadata['arbora_run']['run_trace_ref'] == 'opaque-ref-webui:one'
+    from pydantic_ai.ui.vercel_ai import VercelAIAdapter
+
+    wire = VercelAIAdapter.dump_messages([one])[0]
+    assert wire.metadata['arbora_run'] == one.metadata['arbora_run']
+    # Repeated turns share conversation identity, not a fabricated task/run ID.
+    again = await run('one')
+    assert again.metadata['arbora_run']['conversation_context'] == 'webui:one'
+    assert calls[0][1] != calls[-1][1]
+    assert calls[-1][0] == 'webui:one'
+
+
+async def test_failed_stream_does_not_reuse_previous_identity():
+    calls = 0
+
+    async def invoke(op, params, *, idempotency_key):
+        nonlocal calls
+        calls += 1
+        if calls == 2:
+            raise RuntimeError('unavailable')
+        return task_result('first' if calls == 1 else 'third')
+
+    agent = Agent(build_orchestrator_model(invoke=invoke))
+    first = await agent.run('first', conversation_id='one')
+    assert first.response.metadata['arbora_run']['task_id'] == 'first'
+    with pytest.raises(RuntimeError, match='unavailable'):
+        async with agent.run_stream('second', conversation_id='two') as result:
+            await result.get_output()
+    async with agent.run_stream('retry', conversation_id='two') as result:
+        await result.get_output()
+        assert result.response.metadata['arbora_run']['task_id'] == 'third'
+        assert (
+            result.response.metadata['arbora_run']['conversation_context']
+            == 'webui:two'
+        )
+
+
+@pytest.mark.parametrize('malformed', [False, True])
+async def test_real_vercel_stream_propagates_served_identity_without_repeating_effects(
+    malformed,
+):
+    import json
+
+    from pydantic_ai.ui.vercel_ai import VercelAIAdapter
+    from starlette.requests import Request
+
+    calls = []
+
+    async def invoke(op, params, *, idempotency_key):
+        calls.append(params)
+        result = task_result('wire-task')
+        if malformed:
+            result['value']['id'] = 42
+        return {'ok': True, 'result': result, 'meta': {'registry_digest': 'test'}}
+
+    payload = json.dumps(
+        {
+            'id': '/selected',
+            'trigger': 'submit-message',
+            'messages': [
+                {
+                    'id': 'u1',
+                    'role': 'user',
+                    'parts': [{'type': 'text', 'text': 'hello'}],
+                }
+            ],
+        }
+    ).encode()
+
+    async def receive():
+        return {'type': 'http.request', 'body': payload, 'more_body': False}
+
+    request = Request(
+        {
+            'type': 'http',
+            'method': 'POST',
+            'path': '/api/chats/messages',
+            'headers': [(b'content-type', b'application/json')],
+        },
+        receive,
+    )
+    response = await VercelAIAdapter.dispatch_request(
+        request, agent=Agent(build_orchestrator_model(invoke=invoke)), sdk_version=7
+    )
+    assert hasattr(response, 'body_iterator'), response.body
+    chunks = [chunk async for chunk in response.body_iterator]
+    body = ''.join(
+        chunk.decode() if isinstance(chunk, bytes) else chunk for chunk in chunks
+    )
+    assert len(calls) == 1
+    assert calls[0]['message']['contextId'] == 'webui:/selected'
+    assert 'reply-wire-task' in body
+    events = [
+        json.loads(line[6:])
+        for line in body.splitlines()
+        if line.startswith('data: ') and line != 'data: [DONE]'
+    ]
+    metadata = [
+        event['messageMetadata']
+        for event in events
+        if event['type'] == 'message-metadata'
+    ]
+    assert len(metadata) == 1
+    if malformed:
+        assert 'arbora_run' not in metadata[0]
+    else:
+        assert metadata[0]['arbora_run']['task_id'] == 'wire-task'
+        assert metadata[0]['arbora_run']['run_trace_ref'] == 'opaque-ref-wire-task'
+
+
+def test_error_envelope_cannot_supply_identity():
+    assert (
+        _run_identity({'ok': False, 'result': task_result('fake')}, 'webui:c') is None
+    )

{agent_webui-2.7.1 → agent_webui-2.8.1}/agent/agent_webui/__tests__/test_security_boundaries.py

@@ -270,7 +270,7 @@ def _run_html_document(body_chunks: list[bytes], policy: str | None = None) -> l
     return messages
 
 
-@pytest.mark.spec('DS-08')
+@pytest.mark.spec('WEBUI-DESIGN-R009')
 def test_html_documents_carry_a_fresh_style_nonce() -> None:
     chunks = [b'<meta property="csp-nonce" nonce="AGENT_WEBUI_', b'CSP_NONCE">']
     first = _run_html_document(chunks)

{agent_webui-2.7.1 → agent_webui-2.8.1}/agent/agent_webui/__tests__/test_served_operations.py

@@ -185,7 +185,7 @@ def _client(app: Any, scope: str = _ADMIN) -> TestClient:
         ),
     ],
 )
-# spec: APIUI-06.1
+# spec: WEBUI-API-R011.1
 def test_read_routes_project_the_served_operation(
     app, arbora, method, path, body, op_id, value, sent, expected
 ) -> None:
@@ -272,7 +272,7 @@ def test_a_arbora_refusal_keeps_its_status(app, arbora, code, status) -> None:
         ('/cron/calendar', 'schedule.tasks.read'),
     ],
 )
-# spec: APIUI-06.1
+# spec: WEBUI-API-R011.1
 def test_routes_without_a_served_operation_answer_not_available(
     app, arbora, path, operation
 ) -> None:

{agent_webui-2.7.1 → agent_webui-2.8.1}/agent/agent_webui/api_extensions.py

@@ -18,7 +18,7 @@ import uuid
 from collections.abc import Awaitable, Callable
 from concurrent import futures as _futures
 from dataclasses import dataclass, replace
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from ipaddress import ip_address
 from pathlib import Path
 from typing import Annotated, Any, Literal
@@ -1320,9 +1320,7 @@ def _list_files_dir_entry(dir_path: Path, base_path: Path) -> dict[str, Any] | N
     return {
         'name': str(dir_path.relative_to(base_path)),
         'size': 0,
-        'modified_iso': datetime.fromtimestamp(
-            st.st_mtime, tz=timezone.utc
-        ).isoformat(),
+        'modified_iso': datetime.fromtimestamp(st.st_mtime, tz=UTC).isoformat(),
         'is_dir': True,
     }
 
@@ -1339,9 +1337,7 @@ def _list_files_file_entry(
     return {
         'name': str(file_path.relative_to(base_path)),
         'size': st.st_size,
-        'modified_iso': datetime.fromtimestamp(
-            st.st_mtime, tz=timezone.utc
-        ).isoformat(),
+        'modified_iso': datetime.fromtimestamp(st.st_mtime, tz=UTC).isoformat(),
         'is_dir': False,
     }
 
@@ -5586,7 +5582,7 @@ def _system_prompt_record(sys_prompt: str) -> dict[str, Any]:
         'description': 'The default system prompt configured for this agent.',
         'author': 'System',
         'version': 1,
-        'created_at': datetime.now(timezone.utc).isoformat(),
+        'created_at': datetime.now(UTC).isoformat(),
     }
 
 
@@ -9921,7 +9917,7 @@ def _atlas_response_body(response: JSONResponse) -> Any | None:
 
 
 def _atlas_observed_at() -> str:
-    return datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')
+    return datetime.now(UTC).isoformat().replace('+00:00', 'Z')
 
 
 def _atlas_valid_reference(value: Any) -> str | None:

{agent_webui-2.7.1 → agent_webui-2.8.1}/agent/agent_webui/apps/markets/router.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 import re
 import time
 from collections.abc import Awaitable, Callable
-from typing import Annotated, Any, Literal, TypeVar
+from typing import Annotated, Any, Literal
 
 from fastapi import APIRouter, HTTPException, Query
 from pydantic import AfterValidator, BaseModel, ConfigDict, Field
@@ -39,7 +39,6 @@ from .snapshots import (
 )
 from .timeframes import TIMEFRAMES, range_start
 
-T = TypeVar('T')
 Timeframe = Literal['1m', '15m', '1h', '4h', '12h', '1D', '1W', '1M']
 RangeCode = Literal['1M', '3M', '1Y', '5Y', 'all']
 AssetClass = Literal[
@@ -111,7 +110,7 @@ def _layers(raw: str) -> frozenset[str]:
     return chosen
 
 
-async def _guarded(call: Awaitable[T]) -> T:
+async def _guarded[T](call: Awaitable[T]) -> T:
     try:
         return await call
     except MarketsRefused as error:

agent_webui-2.8.1/agent/agent_webui/auth_policy.py

@@ -0,0 +1,99 @@
+"""Immutable deployment identity selection, never a request-controlled fallback."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import StrEnum
+
+
+class AuthMode(StrEnum):
+    """The operator's explicit identity owner; legacy defaults stay protected."""
+
+    REQUIRED = 'required'
+    NONE = 'none'
+    EG = 'eg'
+    OIDC = 'oidc'
+
+
+def resolve_auth_mode(value: str | None) -> AuthMode:
+    """Reject unknown settings rather than accidentally enabling anonymous access."""
+    try:
+        return AuthMode('required' if value is None else value)
+    except ValueError:
+        raise ValueError(
+            'WebUI auth mode must be required, none, eg, or oidc'
+        ) from None
+
+
+def validate_auth_mode(
+    mode: AuthMode,
+    *,
+    loopback: bool,
+    has_verifier: bool,
+    has_boundary: bool,
+    has_browser_sso: bool,
+    boundary_mode: str | None = None,
+) -> None:
+    """Validate composition without creating credentials or changing settings."""
+    if mode is AuthMode.NONE:
+        if not loopback:
+            raise RuntimeError(
+                'Explicit WebUI no-auth mode requires a loopback listener'
+            )
+        if has_verifier or has_boundary or has_browser_sso:
+            raise RuntimeError('WebUI no-auth mode conflicts with configured identity')
+    if mode is AuthMode.EG and (not has_boundary or boundary_mode != 'eg'):
+        raise RuntimeError(
+            'WebUI EG mode requires the host session boundary identified as eg'
+        )
+    if mode is AuthMode.OIDC and (
+        has_boundary or not has_verifier or not has_browser_sso
+    ):
+        raise RuntimeError(
+            'WebUI OIDC mode requires its complete verifier and browser SSO, not an EG boundary'
+        )
+
+
+@dataclass(frozen=True)
+class AnonymousReadPolicy:
+    """Explicit exact read routes selected by trusted host composition.
+
+    No wildcard, mutation, direct workspace/configuration access or attended
+    browser control is admitted. Expanding those capabilities requires their
+    upstream anonymous policy/confirmation contract, not a fabricated grant.
+    """
+
+    routes: frozenset[str] = frozenset()
+
+    def __post_init__(self):
+        routes = self.routes
+        if type(routes) is not frozenset or any(
+            type(path) is not str
+            or not path.startswith('/api/')
+            or any(char in path for char in '*{}?%#')
+            or '..' in path
+            for path in routes
+        ):
+            raise ValueError('Anonymous read policy requires exact API paths')
+
+    def allows(self, method: str, path: str, *, admin: bool) -> bool:
+        reserved = (
+            '/api/enhanced',
+            '/api/files',
+            '/api/download',
+            '/api/config',
+            '/api/config-files',
+            '/api/editor-context',
+            '/api/browser',
+            '/api/mcp',
+            '/api/identity',
+            '/api/secrets',
+        )
+        return (
+            not admin
+            and method in {'GET', 'HEAD'}
+            and path in self.routes
+            and not any(
+                path == prefix or path.startswith(prefix + '/') for prefix in reserved
+            )
+        )

{agent_webui-2.7.1 → agent_webui-2.8.1}/agent/agent_webui/contact_delivery.py

@@ -263,7 +263,7 @@ async def _deliver_with_deadline(
             timeout=_DELIVERY_TIMEOUT_SECONDS,
         )
         return ContactDeliveryResult.model_validate(raw_outcome, strict=True)
-    except (ValidationError, asyncio.TimeoutError) as error:
+    except (TimeoutError, ValidationError) as error:
         logger.error(
             'Contact delivery outcome unknown: error_type=%s',
             type(error).__name__,

agent_webui-2.8.1/agent/agent_webui/dist/assets/AdminView-DkoVw_JQ.js

@@ -0,0 +1 @@
+import{i as e,r as t,s as n}from"./bundle-mjs-DIyOrgL5.js";import{t as r}from"./createLucideIcon-DTQSidPf.js";import{t as i}from"./refresh-cw-BVhl5aJX.js";import{t as a}from"./server-CE-xbAAj.js";import{t as o}from"./badge-nQZ87mVE.js";import{E as s,S as c,a as l,c as u,f as d,w as f,x as p}from"./api-validation-CCoR_LRu.js";import{E as m,Jn as h,Nn as g,O as _,T as v,Un as y,Yt as b,Zn as x,ar as S,dn as C,dt as w,fr as ee,ft as te,k as T,mt as ne,or as re,rn as E,rr as ie,w as D,yn as ae,zn as O}from"./index-BL_57l7k.js";import{i as oe,n as k,r as se,t as ce}from"./tabs-A3rvoq-T.js";import{n as A}from"./identity-CwkFopGE.js";import{t as j}from"./unavailable-notice-B7WdWNor.js";import M from"./UserManagementView-xO_SUluQ.js";var N={name:`archive`,size:24,node:[[`rect`,{width:`20`,height:`5`,x:`2`,y:`3`,rx:`1`,key:`1wp1u1`}],[`path`,{d:`M4 8v11a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8`,key:`1s80jp`}],[`path`,{d:`M10 12h4`,key:`a56b0p`}]]};N.node;var le=r(N),P={name:`database-backup`,size:24,node:[[`ellipse`,{cx:`12`,cy:`5`,rx:`9`,ry:`3`,key:`msslwz`}],[`path`,{d:`M3 12a9 3 0 0 0 5 2.69`,key:`1ui2ym`}],[`path`,{d:`M21 9.3V5`,key:`6k6cib`}],[`path`,{d:`M3 5v14a9 3 0 0 0 6.47 2.88`,key:`i62tjy`}],[`path`,{d:`M12 12v4h4`,key:`1bxaet`}],[`path`,{d:`M13 20a5 5 0 0 0 9-3 4.5 4.5 0 0 0-4.5-4.5c-1.33 0-2.54.54-3.41 1.41L12 16`,key:`1f4ei9`}]]};P.node;var ue=r(P),F=n(e(),1),I=c({endpoint:s(),local:d(),reachable:d().optional(),breaker:s().optional()}),L=c({mode:u([`single`,`sharded`]),default_graph:s().optional(),endpoints:l(I)});function R(){return w(`/dashboard/daemon/shards`,L)}function z(){return w(`/dashboard/daemon/status`)}var B=c({total_nodes:p(),total_relationships:p(),available:d().optional(),source_graphs:l(s()).optional(),degraded_graphs:l(s()).optional(),partial:d().optional()}),V=c({by_type:f(s(),p()),type_count:p(),total_typed_nodes:p(),truncated:d(),available:d(),source_graphs:l(s()),degraded_graphs:l(s()),partial:d()}),H=c({source_systems:l(s())});function U(){return w(`/enhanced/graph/stats`,B)}function de(){return w(`/enhanced/graph/node-types`,V)}function fe(){return w(`/enhanced/code/instances`,H)}function pe(){return ne(`/configure`,{action:`backup_status`})}function me(){return te(`/graph/configure`,{action:`backup_create`})}var W=t();function G(e){return e===void 0?`-`:e>=1e6?`${(e/1e6).toFixed(1)}M`:e>=1e3?`${(e/1e3).toFixed(1)}k`:String(e)}function he({stats:e,placement:t}){return(0,W.jsxs)(`div`,{className:`grid grid-cols-2 md:grid-cols-3 gap-4`,children:[(0,W.jsxs)(`div`,{className:`rounded border p-3`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Nodes`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold`,children:G(e?.total_nodes)})]}),(0,W.jsxs)(`div`,{className:`rounded border p-3`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Relationships`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold`,children:G(e?.total_relationships)})]}),(0,W.jsxs)(`div`,{className:`rounded border p-3`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Shard placement`}),(0,W.jsx)(`p`,{className:`text-lg font-semibold`,children:t.length?`${String(t.length)} shard(s)`:`-`})]})]})}function ge({byType:e,nodeTypes:t}){return e.length===0?null:(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`p`,{className:`text-sm font-medium mb-2 flex items-center gap-1`,children:[(0,W.jsx)(x,{className:`size-3.5`}),`Counts by type`,(0,W.jsxs)(`span`,{className:`text-muted-foreground font-normal`,children:[`(`,G(t?.type_count),` types, `,G(t?.total_typed_nodes),` nodes)`]})]}),t?.partial===!0&&(0,W.jsxs)(`p`,{className:`mb-2 flex items-center gap-1.5 text-xs text-amber-500`,children:[(0,W.jsx)(C,{className:`size-3.5 shrink-0`}),`Partial — excludes `,t.degraded_graphs.join(`, `),`.`]}),(0,W.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:e.map(([e,t])=>(0,W.jsxs)(o,{variant:`outline`,className:`gap-1`,children:[e,(0,W.jsx)(`span`,{className:`text-muted-foreground`,children:G(t)})]},e))})]})}function _e(e){return e?.partial===!0?(0,W.jsxs)(`p`,{className:`flex items-center gap-1.5 text-xs text-amber-500`,children:[(0,W.jsx)(C,{className:`size-3.5 shrink-0`}),`These totals are partial — `,(e.degraded_graphs??[]).join(`, `),` could not be read.`]}):null}function ve(e){return e.length===0?null:(0,W.jsxs)(`div`,{children:[(0,W.jsx)(`p`,{className:`text-sm font-medium mb-2`,children:`Placed on`}),(0,W.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:e.map(e=>(0,W.jsxs)(o,{variant:e.reachable?`default`:`destructive`,className:`font-mono text-xs gap-1`,children:[e.endpoint,e.local&&(0,W.jsx)(`span`,{className:`opacity-70`,children:`· local`})]},e.endpoint))})]})}function ye({defaultGraph:e,stats:t,placement:n,byType:r,nodeTypes:i}){return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsxs)(T,{className:`text-base flex items-center gap-2`,children:[(0,W.jsx)(g,{className:`size-4`}),(0,W.jsx)(`span`,{className:`font-mono`,children:e}),(0,W.jsx)(o,{variant:`secondary`,children:`active`})]}),(0,W.jsx)(m,{children:`The active graph tenant served by this backend.`})]}),(0,W.jsxs)(v,{className:`space-y-4`,children:[he({stats:t,placement:n}),ge({byType:r,nodeTypes:i}),_e(t),ve(n)]})]})}function be({loading:e,sourcesUnavailable:t,sources:n}){return e?(0,W.jsx)(O,{className:`size-4 animate-spin text-muted-foreground`}):t?(0,W.jsx)(j,{what:`Indexed source tenants`}):n.length===0?(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`No indexed source tenants reported.`}):(0,W.jsx)(`div`,{className:`flex flex-wrap gap-2`,children:n.map(e=>(0,W.jsx)(o,{variant:`secondary`,className:`font-mono text-xs`,children:e},e))})}function xe(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(null),[a,o]=(0,F.useState)(null),[s,c]=(0,F.useState)([]),[l,u]=(0,F.useState)(!1),[d,f]=(0,F.useState)(!1),p=async()=>{f(!0);let[e,n,i,a]=await Promise.all([U(),R(),fe(),de()]);t(e.ok?e.data:null),r(a.ok?a.data:null),o(n.ok?n.data:null),c(i.ok&&i.data?i.data.source_systems:[]),u(!i.ok),f(!1)};(0,F.useEffect)(()=>{p()},[]);let g=a?.default_graph??`__commons__`,y=a?.endpoints??[],b=Object.entries(n?.by_type??{}).sort((e,t)=>t[1]-e[1]);return(0,W.jsxs)(`div`,{className:`space-y-6`,"data-testid":`admin-tenants-panel`,children:[(0,W.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`h2`,{className:`text-lg font-semibold flex items-center gap-2`,children:[(0,W.jsx)(ee,{className:`size-5`}),`Tenants & Graphs`]}),(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`Per-tenant node/edge counts and shard placement.`})]}),(0,W.jsxs)(E,{variant:`outline`,size:`sm`,onClick:()=>{p()},disabled:d,children:[(0,W.jsx)(i,{className:d?`size-4 animate-spin`:`size-4`}),(0,W.jsx)(`span`,{className:`ml-2`,children:`Refresh`})]})]}),ye({defaultGraph:g,stats:e,placement:y,byType:b,nodeTypes:n}),(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsxs)(T,{className:`text-base flex items-center gap-2`,children:[(0,W.jsx)(h,{className:`size-4`}),`Indexed source tenants`]}),(0,W.jsx)(m,{children:`Ingested source-systems that carry code in the graph.`})]}),(0,W.jsx)(v,{children:be({loading:d,sourcesUnavailable:l,sources:s})})]}),(0,W.jsx)(`p`,{className:`text-xs text-muted-foreground`,children:`Note: full multi-tenant enumeration (a per-tenant catalog with per-tenant counts) is not yet exposed over the REST surface — the engine tenant catalog is reachable only over the UDS client. This panel shows the active graph with real statistics and shard placement plus indexed source tenants.`})]})}function Se(e){if(!e)return`outline`;let t=e.toLowerCase();return t===`closed`?`default`:t===`open`?`destructive`:`secondary`}function Ce({topology:e,endpoints:t,reachable:n}){return(0,W.jsxs)(`div`,{className:`grid grid-cols-2 md:grid-cols-4 gap-4`,children:[(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Mode`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold capitalize`,children:e?.mode??`-`})]})}),(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Shards`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold`,children:t.length||`-`})]})}),(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Reachable`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold`,children:t.length?`${String(n)}/${String(t.length)}`:`-`})]})}),(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Default graph`}),(0,W.jsx)(`p`,{className:`text-lg font-semibold font-mono truncate`,children:e?.default_graph??`-`})]})})]})}function we(e,t){return(0,W.jsxs)(`div`,{className:`flex items-center justify-between rounded border p-3 text-sm`,children:[(0,W.jsxs)(`div`,{className:`flex items-center gap-3 min-w-0`,children:[(0,W.jsx)(a,{className:`size-4 shrink-0 text-muted-foreground`}),(0,W.jsxs)(`div`,{className:`flex flex-col min-w-0`,children:[(0,W.jsx)(`span`,{className:`font-mono truncate`,children:e.endpoint}),(0,W.jsxs)(`span`,{className:`text-xs text-muted-foreground`,children:[`writer #`,t,` `,e.local?`· local`:`· remote`]})]})]}),(0,W.jsxs)(`div`,{className:`flex items-center gap-2 shrink-0`,children:[e.local&&(0,W.jsx)(o,{variant:`outline`,children:`local`}),e.breaker&&(0,W.jsx)(o,{variant:Se(e.breaker),className:`font-mono text-xs`,children:e.breaker}),e.reachable?(0,W.jsxs)(o,{variant:`default`,className:`gap-1`,children:[(0,W.jsx)(re,{className:`size-3`}),`up`]}):(0,W.jsxs)(o,{variant:`destructive`,className:`gap-1`,children:[(0,W.jsx)(S,{className:`size-3`}),`down`]})]})]},e.endpoint)}function Te(e){return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{className:`text-base`,children:`Shards`}),(0,W.jsx)(m,{children:`Each configured engine endpoint and its live health.`})]}),(0,W.jsx)(v,{children:e.length===0?(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`No shard endpoints reported.`}):(0,W.jsx)(`div`,{className:`space-y-2`,children:e.map(we)})})]})}function Ee(e){return(0,W.jsxs)(`div`,{className:`flex flex-wrap gap-2 text-sm`,children:[e.role!==void 0&&(0,W.jsxs)(o,{variant:`secondary`,className:`gap-1`,children:[`role: `,e.role]}),(0,W.jsxs)(o,{variant:e.running?`default`:`outline`,className:`gap-1`,children:[e.running?(0,W.jsx)(O,{className:`size-3 animate-spin`}):(0,W.jsx)(S,{className:`size-3`}),e.running?`running`:`stopped`]}),e.queue_depth!==void 0&&(0,W.jsxs)(o,{variant:`secondary`,children:[`queue: `,String(e.queue_depth)]})]})}function De(e){return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{className:`text-base`,children:`Daemon`}),(0,W.jsx)(m,{children:`The consolidated KG background daemon that hosts the local shard.`})]}),(0,W.jsx)(v,{children:e?Ee(e):(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`Daemon status unavailable.`})})]})}function Oe({unavailable:e,topologyError:t,topology:n,endpoints:r,reachable:i,daemon:a}){return e?(0,W.jsxs)(`p`,{className:`text-muted-foreground text-sm`,children:[`The `,(0,W.jsx)(`code`,{children:`/api/dashboard/daemon/shards`}),` route is not activated on this backend yet.`]}):t?(0,W.jsx)(j,{what:`Shard topology (${t})`}):(0,W.jsxs)(W.Fragment,{children:[Ce({topology:n,endpoints:r,reachable:i}),Te(r),De(a)]})}function ke(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(null),[a,s]=(0,F.useState)(!1),[c,l]=(0,F.useState)(null),[u,d]=(0,F.useState)(!1),f=async()=>{d(!0);let[e,n]=await Promise.all([R(),z()]);s(e.unavailable),l(!e.ok&&!e.unavailable?e.error??`The shard topology request failed.`:null),t(e.ok?e.data:null),r(n.ok?n.data:null),d(!1)};(0,F.useEffect)(()=>{f()},[]);let p=e?.endpoints??[],m=p.filter(e=>e.reachable).length;return(0,W.jsxs)(`div`,{className:`space-y-6`,"data-testid":`admin-shards-panel`,children:[(0,W.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`h2`,{className:`text-lg font-semibold flex items-center gap-2`,children:[(0,W.jsx)(y,{className:`size-5`}),`Shard Topology`,e&&(0,W.jsx)(o,{variant:`secondary`,className:`uppercase`,children:e.mode})]}),(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`K-way writer layout, per-shard reachability and circuit-breaker state.`})]}),(0,W.jsxs)(E,{variant:`outline`,size:`sm`,onClick:()=>{f()},disabled:u,children:[(0,W.jsx)(i,{className:u?`size-4 animate-spin`:`size-4`}),(0,W.jsx)(`span`,{className:`ml-2`,children:`Refresh`})]})]}),Oe({unavailable:a,topologyError:c,topology:e,endpoints:p,reachable:m,daemon:n})]})}function Ae(e){if(e===void 0)return`-`;let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return`${n.toFixed(1)} ${t[r]}`}function je(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(!1),[i,a]=(0,F.useState)(!1),[o,s]=(0,F.useState)(!1),c=async()=>{a(!0);let e=await pe();r(!e.ok),t(e.ok?e.data:null),a(!1)};return(0,F.useEffect)(()=>{c()},[]),{status:e,loading:i,triggering:o,wired:!n,refresh:c,onTrigger:async()=>{s(!0),await me(),await c(),s(!1)}}}function Me({loading:e,triggering:t,wired:n,onRefresh:r,onTrigger:a}){return(0,W.jsxs)(`div`,{className:`flex items-center gap-2`,children:[(0,W.jsxs)(E,{variant:`outline`,size:`sm`,onClick:r,disabled:e,children:[(0,W.jsx)(i,{className:e?`size-4 animate-spin`:`size-4`}),(0,W.jsx)(`span`,{className:`ml-2`,children:`Refresh`})]}),(0,W.jsxs)(E,{size:`sm`,onClick:a,disabled:!n||t,title:n?`Trigger an online backup`:`Backup REST twin not wired yet`,children:[t?(0,W.jsx)(O,{className:`size-4 animate-spin`}):(0,W.jsx)(le,{className:`size-4`}),(0,W.jsx)(`span`,{className:`ml-2`,children:`Trigger backup`})]})]})}function Ne(){return(0,W.jsxs)(D,{className:`border-dashed`,children:[(0,W.jsxs)(_,{children:[(0,W.jsxs)(T,{className:`text-base flex items-center gap-2`,children:[(0,W.jsx)(o,{variant:`outline`,children:`read-only · not wired`}),`Backup/PITR not exposed over REST yet`]}),(0,W.jsxs)(m,{children:[`Online backup / restore (EG-090) is reachable today only over the epistemic-graph UDS client (a`,(0,W.jsx)(`code`,{children:` Method::Backup`}),` op streaming a per-shard MVCC snapshot). This panel will list snapshots, show the PITR window, and enable the trigger control as soon as the REST twin is wired; until then it is read-only by design and shows no fabricated backups.`]})]}),(0,W.jsxs)(v,{className:`text-sm text-muted-foreground space-y-2`,children:[(0,W.jsx)(`p`,{className:`font-medium text-foreground`,children:`The engine backup model:`}),(0,W.jsxs)(`ul`,{className:`list-disc pl-5 space-y-1`,children:[(0,W.jsx)(`li`,{children:`Online per-shard MVCC snapshot streamed verbatim (no write-stall).`}),(0,W.jsx)(`li`,{children:`Point-in-time restore to a chosen LSN / timestamp within the retained window.`})]})]})]})}function Pe({status:e,backupCount:t}){return(0,W.jsxs)(`div`,{className:`grid grid-cols-2 md:grid-cols-3 gap-4`,children:[(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Snapshots`}),(0,W.jsx)(`p`,{className:`text-2xl font-bold`,children:t})]})}),(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Last backup`}),(0,W.jsx)(`p`,{className:`text-lg font-semibold`,children:e?.last_backup_at??`-`})]})}),(0,W.jsx)(D,{children:(0,W.jsxs)(v,{className:`pt-6`,children:[(0,W.jsxs)(`p`,{className:`text-sm text-muted-foreground flex items-center gap-1`,children:[(0,W.jsx)(ie,{className:`size-3.5`}),`PITR window`]}),(0,W.jsxs)(`p`,{className:`text-xs font-mono`,children:[e?.pitr_window?.earliest??`-`,` → `,e?.pitr_window?.latest??`-`]})]})})]})}function Fe({backup:e}){return(0,W.jsxs)(`div`,{className:`flex items-center justify-between rounded border p-2 text-sm`,children:[(0,W.jsxs)(`div`,{className:`flex flex-col min-w-0`,children:[(0,W.jsx)(`span`,{className:`font-mono truncate`,children:e.id}),(0,W.jsxs)(`span`,{className:`text-xs text-muted-foreground`,children:[e.created_at??`-`,` `,e.shard?`· ${e.shard}`:``,` `,e.lsn?`· LSN ${e.lsn}`:``]})]}),(0,W.jsx)(o,{variant:`secondary`,children:Ae(e.size_bytes)})]})}function Ie({backups:e}){return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{className:`text-base`,children:`Snapshots`}),(0,W.jsx)(m,{children:`Retained backups available for point-in-time restore.`})]}),(0,W.jsx)(v,{children:e.length===0?(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`No snapshots yet.`}):(0,W.jsx)(`div`,{className:`space-y-2`,children:e.map(e=>(0,W.jsx)(Fe,{backup:e},e.id))})})]})}function Le({loading:e,wired:t,status:n,backups:r}){return e?(0,W.jsx)(O,{className:`size-5 animate-spin text-muted-foreground`}):t?(0,W.jsxs)(W.Fragment,{children:[(0,W.jsx)(Pe,{status:n,backupCount:r.length}),(0,W.jsx)(Ie,{backups:r})]}):(0,W.jsx)(Ne,{})}function Re(){let e=je(),t=e.status?.backups??[];return(0,W.jsxs)(`div`,{className:`space-y-6`,"data-testid":`admin-backup-panel`,children:[(0,W.jsxs)(`div`,{className:`flex items-center justify-between`,children:[(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`h2`,{className:`text-lg font-semibold flex items-center gap-2`,children:[(0,W.jsx)(ue,{className:`size-5`}),`Backup & PITR`]}),(0,W.jsx)(`p`,{className:`text-muted-foreground text-sm`,children:`Online backups and point-in-time restore (CONCEPT:EG-090).`})]}),(0,W.jsx)(Me,{loading:e.loading,triggering:e.triggering,wired:e.wired,onRefresh:()=>{e.refresh()},onTrigger:()=>{e.onTrigger()}})]}),(0,W.jsx)(Le,{loading:e.loading,wired:e.wired,status:e.status,backups:t})]})}var K=[[`idle_ms`,`Idle timeout`],[`absolute_ms`,`Absolute lifetime`],[`privileged_idle_ms`,`Privileged idle timeout`],[`privileged_absolute_ms`,`Privileged absolute lifetime`]];function ze(e){return Object.values(e).every(e=>Number.isInteger(e)&&e>=6e4&&e<=2592e6)}function q(e,t){return e===void 0||t===void 0||e<=t}function Be(e){return ze(e)&&q(e.idle_ms,e.absolute_ms)&&q(e.privileged_idle_ms,e.idle_ms)&&q(e.privileged_absolute_ms,e.absolute_ms)&&q(e.privileged_idle_ms,e.privileged_absolute_ms)}function Ve(e){return Object.fromEntries(K.flatMap(([t])=>e[t]===void 0?[]:[[t,e[t]]]))}function He(e,t){return Object.fromEntries(K.flatMap(([n])=>e[n]===t[n]?[]:[[n,e[n]]]))}function Ue({field:e,label:t,valueMs:n,onChangeMs:r}){return(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`label`,{className:`block text-sm`,htmlFor:e,children:[t,` (minutes)`]}),(0,W.jsx)(b,{id:e,type:`number`,min:1,max:43200,value:Math.round(n/6e4),onChange:e=>{r(Number(e.target.value)*6e4)}})]})}function We(e,t){return!Number.isInteger(e)||e<8||e>256||!Be(t)}function Ge({registration:e,setRegistration:t,fallback:n,setFallback:r,minimum:i,setMinimum:a,durations:o,setDurations:s,onSave:c}){return(0,W.jsxs)(W.Fragment,{children:[(0,W.jsx)(`label`,{className:`block text-sm`,htmlFor:`registration-policy`,children:`Registration`}),(0,W.jsxs)(`select`,{id:`registration-policy`,className:`rounded border bg-background p-2`,value:e,onChange:e=>{t(e.target.value)},children:[(0,W.jsx)(`option`,{value:`disabled`,children:`Disabled`}),(0,W.jsx)(`option`,{value:`admin_only`,children:`Administrator only`}),(0,W.jsx)(`option`,{value:`invite`,children:`Invitation`}),(0,W.jsx)(`option`,{value:`open`,children:`Open`})]}),(0,W.jsx)(`label`,{className:`block text-sm`,htmlFor:`policy-fallback`,children:`Local fallback`}),(0,W.jsxs)(`select`,{id:`policy-fallback`,className:`rounded border bg-background p-2`,value:n,onChange:e=>{r(e.target.value)},children:[(0,W.jsx)(`option`,{value:`off`,children:`Off`}),(0,W.jsx)(`option`,{value:`break_glass`,children:`Break glass only`}),(0,W.jsx)(`option`,{value:`full`,children:`Full`})]}),(0,W.jsx)(`label`,{className:`block text-sm`,htmlFor:`password-minimum`,children:`Minimum password length`}),(0,W.jsx)(b,{id:`password-minimum`,type:`number`,min:8,max:256,value:i,onChange:e=>{a(Number(e.target.value))}}),K.map(([e,t])=>{let n=o[e];return n===void 0?null:(0,W.jsx)(Ue,{field:e,label:t,valueMs:n,onChangeMs:t=>{s(n=>({...n,[e]:t}))}},e)}),(0,W.jsx)(E,{type:`button`,disabled:We(i,o),onClick:c,children:`Save identity policy`})]})}function Ke(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(`disabled`),[i,a]=(0,F.useState)(`break_glass`),[o,s]=(0,F.useState)(12),[c,l]=(0,F.useState)({}),[u,d]=(0,F.useState)(null),f=e=>{t(e),e.kind===`ready`&&(r(e.result.registration_policy),a(e.result.local_fallback),s(e.result.password_min_chars),l(Ve(e.result)))};(0,F.useEffect)(()=>{let e=!0;return A(`identity.policy.get`).then(t=>{e&&f(t)}),()=>{e=!1}},[]);let p=async()=>{if(e?.kind!==`ready`)return;let r=await A(`identity.policy.set`,{expected_epoch:e.result.epoch,registration_policy:n,local_fallback:i,password_min_chars:o,...He(c,e.result)});d(r),r.kind===`ready`&&t(r)};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Identity policy`}),(0,W.jsx)(m,{children:`Policy changes use the current configuration epoch and require fresh MFA.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[e===null&&(0,W.jsx)(`p`,{role:`status`,children:`Loading identity policy…`}),e!==null&&e.kind!==`ready`&&(0,W.jsx)(`p`,{role:`status`,children:e.message}),e?.kind===`ready`&&(0,W.jsx)(Ge,{registration:n,setRegistration:r,fallback:i,setFallback:a,minimum:o,setMinimum:s,durations:c,setDurations:l,onSave:()=>{p()}}),Object.keys(c).length>0&&(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Changing a session duration revokes existing sessions immediately.`}),(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`MFA policy editing is unavailable until the engine exposes those fields.`}),u&&(0,W.jsx)(`p`,{role:`status`,children:u.kind===`ready`?`Identity policy saved.`:u.message})]})]})}function J(e,t){return(e===`identity.sessions.list`||e===`identity.api_keys.list`)&&!t}function qe(e,t){return e.principal_id??e.id??e.handle??e.key_id??t}function Je(e,t){return e.name??e.username??e.principal_id??e.id??e.handle??e.key_id??`Record ${t+1}`}function Y(e){return e.handle??e.id??e.key_id??``}function Ye({item:e,index:t,revokeOp:n,onRevoke:r}){return(0,W.jsxs)(`li`,{className:`rounded border p-2`,children:[(0,W.jsx)(`strong`,{children:Je(e,t)}),e.status&&(0,W.jsx)(`span`,{className:`ml-2 text-muted-foreground`,children:e.status}),e.description&&(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:e.description}),n&&Y(e)&&(0,W.jsx)(E,{type:`button`,size:`sm`,variant:`outline`,className:`ml-2`,onClick:()=>{r(Y(e))},children:`Revoke`})]})}function Xe({state:e,revokeOp:t,loadingHint:n,onRevoke:r,onLoadMore:i}){return e===null?(0,W.jsx)(`p`,{role:`status`,children:n}):e.kind===`ready`?Array.isArray(e.result.items)?e.result.items.length===0?(0,W.jsx)(`p`,{role:`status`,children:`No records reported.`}):(0,W.jsxs)(W.Fragment,{children:[(0,W.jsx)(`ul`,{className:`space-y-2`,children:e.result.items.map((e,n)=>(0,W.jsx)(Ye,{item:e,index:n,revokeOp:t,onRevoke:r},qe(e,n)))}),e.result.next_cursor&&(0,W.jsx)(E,{type:`button`,variant:`outline`,onClick:i,children:`Load more`})]}):(0,W.jsx)(`p`,{role:`alert`,children:`The identity service returned an invalid list.`}):(0,W.jsx)(`p`,{role:`status`,children:e.message})}function Ze(e,t){let[n,r]=(0,F.useState)(null),[i,a]=(0,F.useState)(0),[o,s]=(0,F.useState)(null);return(0,F.useEffect)(()=>{let n=!0;return J(e,t)?()=>void 0:(A(e,{...e===`identity.audit.list`||e===`identity.api_keys.list`?{limit:50}:{},...t?{principal_id:t}:{}}).then(e=>{n&&r(e)}),()=>{n=!1})},[e,t,i]),{state:n,mutation:o,revoke:async(e,t)=>{if(!e)return;let n=await A(e,{id:t});s(n),n.kind===`ready`&&a(e=>e+1)},loadMore:async()=>{if(n?.kind!==`ready`||!n.result.next_cursor)return;let i=await A(e,{after:n.result.next_cursor,limit:50,...t?{principal_id:t}:{}});i.kind===`ready`?r({kind:`ready`,result:{items:[...n.result.items,...i.result.items],next_cursor:i.result.next_cursor}}):s(i)},refresh:()=>{a(e=>e+1)}}}function X({title:e,op:t,description:n,principalId:r,revokeOp:i}){let a=Ze(t,r),o=J(t,r)?`Enter a principal id to inspect its records.`:`Loading…`;return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:e}),(0,W.jsx)(m,{children:n})]}),(0,W.jsxs)(v,{children:[r&&(0,W.jsxs)(`p`,{className:`mb-2 text-xs text-muted-foreground`,children:[`Principal: `,r]}),a.state!==null&&(0,W.jsx)(E,{type:`button`,size:`sm`,variant:`outline`,className:`mb-3`,onClick:a.refresh,children:`Refresh`}),(0,W.jsx)(Xe,{state:a.state,revokeOp:i,loadingHint:o,onRevoke:e=>{a.revoke(i,e)},onLoadMore:()=>{a.loadMore()}}),a.mutation&&(0,W.jsx)(`p`,{role:`status`,children:a.mutation.kind===`ready`?`Revocation confirmed.`:a.mutation.message})]})]})}function Z({kind:e}){let[t,n]=(0,F.useState)(``),[r,i]=(0,F.useState)(``);return(0,W.jsxs)(`div`,{className:`space-y-3`,children:[(0,W.jsxs)(`form`,{className:`flex gap-2`,onSubmit:e=>{e.preventDefault(),i(t.trim())},children:[(0,W.jsx)(b,{"aria-label":`${e===`sessions`?`Session`:`API key`} principal id`,placeholder:`Principal id`,value:t,onChange:e=>{n(e.target.value)}}),(0,W.jsxs)(E,{type:`submit`,disabled:!t.trim(),children:[`Load `,e]})]}),(0,W.jsx)(X,{title:e===`sessions`?`Sessions`:`API keys`,op:e===`sessions`?`identity.sessions.list`:`identity.api_keys.list`,principalId:r,revokeOp:e===`sessions`?`identity.sessions.revoke`:`identity.api_keys.revoke`,description:e===`sessions`?`Sessions for the selected principal.`:`Metadata only; secrets are never displayed.`})]})}function Q({kind:e}){let[t,n]=(0,F.useState)(``),[r,i]=(0,F.useState)(``),[a,o]=(0,F.useState)(``),[s,c]=(0,F.useState)(``),[l,u]=(0,F.useState)(`add`),[d,f]=(0,F.useState)(null),[p,h]=(0,F.useState)(!1),g=e===`group`,y=g?`Group`:`Role`,x=async()=>{h(!0);let e=a.split(`,`).map(e=>e.trim()).filter(Boolean);f(await A(g?`identity.groups.upsert`:`identity.roles.upsert`,g?{group_id:t,name:r,roles:e}:{role_id:t,name:r,scopes:e})),h(!1)},S=async()=>{h(!0),f(await A(g?`identity.groups.change_membership`:`identity.roles.change_user_role`,g?{principal_id:s,group_id:t,change:l}:{principal_id:s,role_id:t,change:l})),h(!1)};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsxs)(T,{children:[y,` administration`]}),(0,W.jsx)(m,{children:`Writes require administrator authority and fresh MFA.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[(0,W.jsxs)(`div`,{className:`grid gap-2 sm:grid-cols-3`,children:[(0,W.jsx)(b,{"aria-label":`${y} id`,placeholder:`${y} id`,value:t,onChange:e=>{n(e.target.value)}}),(0,W.jsx)(b,{"aria-label":`${y} name`,placeholder:`Display name`,value:r,onChange:e=>{i(e.target.value)}}),(0,W.jsx)(b,{"aria-label":g?`Group roles`:`Role scopes`,placeholder:g?`Roles, comma separated`:`Scopes, comma separated`,value:a,onChange:e=>{o(e.target.value)}})]}),(0,W.jsxs)(E,{type:`button`,disabled:p||!t.trim()||!r.trim(),onClick:()=>{x()},children:[`Save `,y.toLowerCase()]}),(0,W.jsxs)(`div`,{className:`flex flex-wrap gap-2 border-t pt-3`,children:[(0,W.jsx)(b,{"aria-label":`Member principal id`,className:`max-w-xs`,placeholder:`Principal id`,value:s,onChange:e=>{c(e.target.value)}}),(0,W.jsxs)(`select`,{"aria-label":`Membership action`,className:`rounded border bg-background p-2`,value:l,onChange:e=>{u(e.target.value)},children:[(0,W.jsx)(`option`,{value:`add`,children:`Add`}),(0,W.jsx)(`option`,{value:`remove`,children:`Remove`})]}),(0,W.jsx)(E,{type:`button`,disabled:p||!t.trim()||!s.trim(),onClick:()=>{S()},children:`Apply membership`})]}),d&&(0,W.jsx)(`p`,{role:`status`,children:d.kind===`ready`?`${y} change confirmed. Refresh the list.`:d.message})]})]})}function Qe(){let[e,t]=(0,F.useState)(``),[n,r]=(0,F.useState)(`{"groups":[]}`),[i,a]=(0,F.useState)(null),o=async()=>{try{let t=JSON.parse(n);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`Claims must be an object`);if(!Object.values(t).every(e=>Array.isArray(e)&&e.every(e=>typeof e==`string`)))throw Error(`Every claim must be a string array`);a(await A(`identity.idps.mapping_dry_run`,{idp_id:e,claims:t}))}catch{a({kind:`error`,message:`Enter a JSON object whose values are string arrays.`})}};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Mapping rule dry run`}),(0,W.jsx)(m,{children:`Preview the roles, groups and scopes a sample claim set would receive. This does not change an identity.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[(0,W.jsx)(b,{"aria-label":`Identity provider id`,placeholder:`Identity provider id`,value:e,onChange:e=>{t(e.target.value)}}),(0,W.jsx)(`textarea`,{"aria-label":`Sample claims JSON`,className:`w-full rounded border bg-background p-2 font-mono text-sm`,rows:4,value:n,onChange:e=>{r(e.target.value)}}),(0,W.jsx)(E,{type:`button`,disabled:!e.trim(),onClick:()=>{o()},children:`Evaluate mapping`}),i?.kind!==`ready`&&i!==null&&(0,W.jsx)(`p`,{role:`status`,children:i.message}),i?.kind===`ready`&&(0,W.jsxs)(`dl`,{className:`text-sm space-y-1`,children:[(0,W.jsx)(`dt`,{children:`Roles`}),(0,W.jsx)(`dd`,{children:i.result.roles.join(`, `)||`None`}),(0,W.jsx)(`dt`,{children:`Groups`}),(0,W.jsx)(`dd`,{children:i.result.groups.join(`, `)||`None`}),(0,W.jsx)(`dt`,{children:`Scopes`}),(0,W.jsx)(`dd`,{children:i.result.scopes.join(`, `)||`None`})]})]})]})}function $(){let[e,t]=(0,F.useState)(``),[n,r]=(0,F.useState)(``),[i,a]=(0,F.useState)(`oidc`),[o,s]=(0,F.useState)(`{}`),[c,l]=(0,F.useState)(``),[u,d]=(0,F.useState)(null),f=async()=>{try{let t=JSON.parse(o);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`Invalid configuration`);d(await A(`identity.idps.upsert`,{idp_id:e.trim(),kind:i,display_name:n.trim(),enabled:!1,config_json:o,jit_policy:`deny`,...c.trim()?{secret_ref:c.trim()}:{}}))}catch{d({kind:`error`,message:`Configuration must be a JSON object.`})}};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Configure identity provider`}),(0,W.jsx)(m,{children:`Use a secret reference; do not paste credentials. New providers start disabled with just-in-time provisioning denied until mapping rules are reviewed.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[(0,W.jsxs)(`div`,{className:`grid gap-2 sm:grid-cols-2`,children:[(0,W.jsx)(b,{"aria-label":`Provider id`,placeholder:`Provider id`,value:e,onChange:e=>{t(e.target.value)}}),(0,W.jsx)(b,{"aria-label":`Provider display name`,placeholder:`Display name`,value:n,onChange:e=>{r(e.target.value)}})]}),(0,W.jsxs)(`select`,{"aria-label":`Provider kind`,className:`rounded border bg-background p-2`,value:i,onChange:e=>{a(e.target.value)},children:[(0,W.jsx)(`option`,{value:`oidc`,children:`OIDC`}),(0,W.jsx)(`option`,{value:`saml`,children:`SAML`}),(0,W.jsx)(`option`,{value:`ldap`,children:`LDAP`}),(0,W.jsx)(`option`,{value:`scim`,children:`SCIM`})]}),(0,W.jsx)(b,{"aria-label":`Provider secret reference`,placeholder:`Secret reference (optional)`,value:c,onChange:e=>{l(e.target.value)}}),(0,W.jsx)(`textarea`,{"aria-label":`Provider configuration JSON`,className:`w-full rounded border bg-background p-2 font-mono text-sm`,rows:5,value:o,onChange:e=>{s(e.target.value)}}),(0,W.jsx)(E,{type:`button`,disabled:!e.trim()||!n.trim(),onClick:()=>{f()},children:`Save provider`}),u&&(0,W.jsx)(`p`,{role:`status`,children:u.kind===`ready`?`Provider saved. Refresh the list.`:u.message})]})]})}function $e(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(``),[i,a]=(0,F.useState)(`break_glass`),[o,s]=(0,F.useState)(!1),[c,l]=(0,F.useState)(null);return(0,F.useEffect)(()=>{let e=!0;return A(`identity.mode.status`).then(n=>{e&&t(n)}),()=>{e=!1}},[]),{state:e,target:n,setTarget:r,fallback:i,setFallback:a,acknowledged:o,setAcknowledged:s,transition:c,submit:async()=>{let e=await A(`identity.mode.transition`,n===`external`?{to:n,local_fallback:i}:{to:n});l(e),e.kind===`ready`&&t(await A(`identity.mode.status`))}}}function et(e,t,n){return!e||!t||n?.kind!==`ready`||t===n.result.mode}function tt(){let e=$e();return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Security mode`}),(0,W.jsx)(m,{children:`Mode transitions require a fresh MFA administrator session. A successful transition revokes existing sessions.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[e.state===null&&(0,W.jsx)(`p`,{role:`status`,children:`Loading mode…`}),e.state!==null&&e.state.kind!==`ready`&&(0,W.jsx)(`p`,{role:`status`,children:e.state.message}),e.state?.kind===`ready`&&(0,W.jsxs)(`p`,{children:[`Current mode: `,(0,W.jsx)(`strong`,{children:e.state.result.mode})]}),(0,W.jsx)(`label`,{className:`block text-sm`,htmlFor:`target-mode`,children:`Target mode`}),(0,W.jsxs)(`select`,{id:`target-mode`,className:`rounded border bg-background p-2`,value:e.target,onChange:t=>{e.setTarget(t.target.value)},children:[(0,W.jsx)(`option`,{value:``,children:`Select a mode`}),(0,W.jsx)(`option`,{value:`local`,children:`Local`}),(0,W.jsx)(`option`,{value:`external`,children:`External`})]}),e.target===`external`&&(0,W.jsxs)(`select`,{"aria-label":`Local fallback`,className:`rounded border bg-background p-2`,value:e.fallback,onChange:t=>{e.setFallback(t.target.value)},children:[(0,W.jsx)(`option`,{value:`off`,children:`No local fallback`}),(0,W.jsx)(`option`,{value:`break_glass`,children:`Break glass only`}),(0,W.jsx)(`option`,{value:`full`,children:`Full local fallback`})]}),(0,W.jsxs)(`label`,{className:`flex items-center gap-2 text-sm`,children:[(0,W.jsx)(`input`,{type:`checkbox`,checked:e.acknowledged,onChange:t=>{e.setAcknowledged(t.target.checked)}}),`I understand this transition revokes current sessions.`]}),(0,W.jsx)(E,{type:`button`,disabled:et(e.acknowledged,e.target,e.state),onClick:()=>{e.submit()},children:`Request transition`}),e.transition&&(0,W.jsx)(`p`,{role:`status`,children:e.transition.kind===`ready`?`Transition completed. Sign in again.`:e.transition.message})]})]})}function nt(){let[e,t]=(0,F.useState)(!1),[n,r]=(0,F.useState)(null),i=async()=>{r(await A(`identity.issuer.rotate`))};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Issuer key rotation`}),(0,W.jsx)(m,{children:`Rotate the Arbora signer with overlap. A fresh administrator MFA confirmation is required.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[(0,W.jsxs)(`label`,{className:`flex items-center gap-2 text-sm`,children:[(0,W.jsx)(`input`,{type:`checkbox`,checked:e,onChange:e=>{t(e.target.checked)}}),`I understand issuer rotation changes the signing key.`]}),(0,W.jsx)(E,{type:`button`,disabled:!e,onClick:()=>{i()},children:`Request issuer rotation`}),n&&(0,W.jsx)(`p`,{role:`status`,children:n.kind===`ready`?`Issuer key rotated (epoch ${n.result.epoch}, key ${n.result.issuer_kid_current}).`:n.message})]})]})}function rt(){let[e,t]=(0,F.useState)(``),[n,r]=(0,F.useState)(``),[i,a]=(0,F.useState)(null),[o,s]=(0,F.useState)(null),c=async()=>{a(await A(`identity.scim_clients.list`))};(0,F.useEffect)(()=>{c()},[]);let l=async()=>{let t=await A(`identity.scim_clients.upsert`,{idp_id:e.trim(),principal_id:n.trim()});s(t),t.kind===`ready`&&c()},u=async e=>{let t=await A(`identity.scim_clients.remove`,{idp_id:e});s(t),t.kind===`ready`&&c()};return(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`SCIM clients`}),(0,W.jsx)(m,{children:`Bind an enabled SCIM provider to an active service principal.`})]}),(0,W.jsxs)(v,{className:`space-y-3`,children:[i===null&&(0,W.jsx)(`p`,{role:`status`,children:`Loading SCIM clients…`}),i&&i.kind!==`ready`&&(0,W.jsx)(`p`,{role:`status`,children:i.message}),i?.kind===`ready`&&(0,W.jsx)(`ul`,{className:`space-y-2`,children:i.result.items.map(e=>(0,W.jsxs)(`li`,{className:`flex items-center justify-between rounded border p-2`,children:[(0,W.jsxs)(`span`,{children:[e.idp_id,`: `,(0,W.jsx)(`code`,{children:e.principal_id}),` (`,e.enabled?`enabled`:`disabled`,`)`]}),(0,W.jsx)(E,{type:`button`,variant:`outline`,size:`sm`,onClick:()=>{u(e.idp_id)},children:`Remove`})]},e.idp_id))}),(0,W.jsx)(b,{"aria-label":`SCIM provider id`,placeholder:`Provider id`,value:e,onChange:e=>{t(e.target.value)}}),(0,W.jsx)(b,{"aria-label":`SCIM service principal id`,placeholder:`Service principal id`,value:n,onChange:e=>{r(e.target.value)}}),(0,W.jsx)(E,{type:`button`,disabled:!e.trim()||!n.trim(),onClick:()=>{l()},children:`Bind SCIM client`}),o&&(0,W.jsx)(`p`,{role:`status`,children:o.kind===`ready`?`SCIM client change confirmed.`:o.message})]})]})}function it(){let[e,t]=(0,F.useState)(null),[n,r]=(0,F.useState)(null),i=async()=>{t(await A(`identity.audit.verify`))},a=async()=>{let e=await A(`identity.audit.export`,{limit:500});if(r(e),e.kind!==`ready`)return;let t=URL.createObjectURL(new Blob([JSON.stringify(e.result,null,2)],{type:`application/json`})),n=document.createElement(`a`);n.href=t,n.download=`identity-audit-page.json`,n.click(),URL.revokeObjectURL(t)};return(0,W.jsxs)(`div`,{className:`space-y-4`,children:[(0,W.jsx)(X,{title:`Identity audit`,op:`identity.audit.list`,description:`Identity administration events.`}),(0,W.jsxs)(D,{children:[(0,W.jsxs)(_,{children:[(0,W.jsx)(T,{children:`Audit integrity and export`}),(0,W.jsx)(m,{children:`Verify the chain or export a bounded page with its continuation cursor.`})]}),(0,W.jsxs)(v,{className:`space-y-2`,children:[(0,W.jsxs)(`div`,{className:`flex gap-2`,children:[(0,W.jsx)(E,{type:`button`,variant:`outline`,onClick:()=>{i()},children:`Verify audit chain`}),(0,W.jsx)(E,{type:`button`,variant:`outline`,onClick:()=>{a()},children:`Export first audit page`})]}),e&&(0,W.jsx)(`p`,{role:`status`,children:e.kind===`ready`?e.result.valid?`Audit chain verified.`:`Audit chain broken at sequence ${e.result.first_broken_seq??`unknown`}.`:e.message}),n&&n.kind!==`ready`&&(0,W.jsx)(`p`,{role:`status`,children:n.message})]})]})]})}function at(){return(0,W.jsxs)(`div`,{className:`space-y-6`,"data-testid":`admin-view`,children:[(0,W.jsxs)(`div`,{children:[(0,W.jsxs)(`h1`,{className:`text-2xl font-bold flex items-center gap-2`,children:[(0,W.jsx)(ae,{className:`size-6`}),`Admin Console`]}),(0,W.jsx)(`p`,{className:`text-sm text-muted-foreground`,children:`Arbora identity, security and engine administration.`})]}),(0,W.jsxs)(ce,{defaultValue:`users`,children:[(0,W.jsx)(se,{className:`flex h-auto flex-wrap justify-start`,children:[`users`,`service-accounts`,`groups`,`roles`,`idps`,`sessions`,`api-keys`,`audit`,`security-mode`,`policy`,`tenants`,`shards`,`backup`].map(e=>(0,W.jsx)(oe,{value:e,children:e.replaceAll(`-`,` `)},e))}),(0,W.jsx)(k,{value:`users`,children:(0,W.jsx)(M,{})}),(0,W.jsx)(k,{value:`service-accounts`,children:(0,W.jsx)(X,{title:`Service accounts`,op:`identity.service_accounts.list`,description:`Active service principals from Arbora identity.`})}),(0,W.jsxs)(k,{value:`groups`,className:`space-y-4`,children:[(0,W.jsx)(X,{title:`Groups`,op:`identity.groups.list`,description:`Groups and memberships from Arbora identity.`}),(0,W.jsx)(Q,{kind:`group`})]}),(0,W.jsxs)(k,{value:`roles`,className:`space-y-4`,children:[(0,W.jsx)(X,{title:`Roles and scopes`,op:`identity.roles.list`,description:`Roles and effective scope grants from Arbora identity.`}),(0,W.jsx)(Q,{kind:`role`})]}),(0,W.jsxs)(k,{value:`idps`,className:`space-y-4`,children:[(0,W.jsx)(X,{title:`Identity providers`,op:`identity.idps.list`,description:`Configured external authorities.`}),(0,W.jsx)($,{}),(0,W.jsx)(Qe,{}),(0,W.jsx)(rt,{})]}),(0,W.jsx)(k,{value:`sessions`,children:(0,W.jsx)(Z,{kind:`sessions`})}),(0,W.jsx)(k,{value:`api-keys`,children:(0,W.jsx)(Z,{kind:`api-keys`})}),(0,W.jsx)(k,{value:`audit`,children:(0,W.jsx)(it,{})}),(0,W.jsxs)(k,{value:`security-mode`,className:`space-y-4`,children:[(0,W.jsx)(tt,{}),(0,W.jsx)(nt,{})]}),(0,W.jsx)(k,{value:`policy`,children:(0,W.jsx)(Ke,{})}),(0,W.jsx)(k,{value:`tenants`,children:(0,W.jsx)(xe,{})}),(0,W.jsx)(k,{value:`shards`,children:(0,W.jsx)(ke,{})}),(0,W.jsx)(k,{value:`backup`,children:(0,W.jsx)(Re,{})})]})]})}export{at as default};