import{r as d,k as e}from"./index-BVfpSx5Q.js";import{L as R}from"./layout-NiehYZnq.js";import{P as L,K as i,S as x,C as y}from"./ui-DGkmnhL-.js";import{u as A,R as P,L as $,E as M}from"./DefenseDataState--cwdhwZV.js";const t={surface:"rgba(255,255,255,0.025)",border:"rgba(255,255,255,0.08)",text:"#f5f5f5",dim:"#8a8a8a",muted:"#5e5e5e",accent:"#c9b787"},c={verified:"#c9b787",rotating:"#3b82f6",anomalous:"#ef4444",suspended:"#f59e0b"},j={agent:"⬡",service:"◈",connector:"◆","tool-server":"◇",human:"●"},m={minimal:"#5e5e5e",standard:"#8a8a8a",elevated:"#c9b787",admin:"#f5f5f5"},f={critical:"#ef4444",high:"#f59e0b",medium:"#3b82f6",low:"#8a8a8a"};function U(){const[o,T]=d.useState("inventory"),[p,C]=d.useState(null),[v,I]=d.useState(0),{data:n,loading:b,error:u,lastUpdated:w,refresh:N}=A("/api/internal/a11oy/defense/agent-zero-trust"),a=(n==null?void 0:n.identities)??[],E=(n==null?void 0:n.anomalies)??[];d.useEffect(()=>{if(a.length===0)return;const s=setInterval(()=>I(r=>(r+1)%a.length),3e3);return()=>clearInterval(s)},[a.length]);const h=a.filter(s=>s.type!=="human").length,g=a.filter(s=>s.type==="human").length,k=g>0?Math.round(h/g):h,S=a.filter(s=>s.status==="anomalous").length,l=a.find(s=>s.id===p);return e.jsxs(R,{children:[e.jsx(L,{label:"AGENT ZERO TRUST",title:"Identity-First Agent Security",subtitle:"Every agent identity is untrusted by default — inspired by PANW's 82:1 machine-to-human identity ratio finding. Credential rotation, MCP token scoping, least-privilege enforcement, and behavioral anomaly detection.",status:"LIVE"}),e.jsx(P,{loading:b,error:u,lastUpdated:w,onRefresh:N}),!n&&b?e.jsx($,{label:"Loading agent identity inventory…"}):!n&&u?e.jsx(M,{error:u,onRetry:N}):e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-6 gap-3 mb-8",children:[e.jsx(i,{label:"IDENTITIES",value:a.length,sub:"registered",accent:t.accent}),e.jsx(i,{label:"MACHINE:HUMAN",value:`${k}:1`,sub:"identity ratio",accent:t.accent}),e.jsx(i,{label:"VERIFIED",value:a.filter(s=>s.status==="verified").length,sub:"active",accent:t.accent}),e.jsx(i,{label:"ANOMALOUS",value:S,sub:"flagged",accent:S>0?"#ef4444":t.accent}),e.jsx(i,{label:"MCP TOKENS",value:a.reduce((s,r)=>s+r.mcpTokens,0),sub:"scoped",accent:t.dim}),e.jsx(i,{label:"AVG TRUST",value:a.length?Math.round(a.reduce((s,r)=>s+r.trustScore,0)/a.length):0,sub:"score",accent:t.accent})]}),e.jsxs("div",{className:"p-4 rounded-lg mb-6",style:{background:"rgba(201,183,135,0.04)",border:"1px solid rgba(201,183,135,0.15)"},children:[e.jsx("div",{className:"text-[9px] font-mono uppercase tracking-widest mb-2",style:{color:t.accent},children:"MACHINE-TO-HUMAN IDENTITY RATIO"}),e.jsxs("div",{className:"flex items-end gap-4",children:[e.jsxs("div",{className:"flex-1",children:[e.jsxs("div",{className:"flex gap-0.5 flex-wrap",children:[a.filter(s=>s.type!=="human").map((s,r)=>e.jsx("div",{className:"w-3 h-3 rounded-sm transition-all",style:{background:r===v?t.accent:"rgba(201,183,135,0.15)",border:`1px solid ${r===v?t.accent:"rgba(201,183,135,0.08)"}`}},r)),a.filter(s=>s.type==="human").map((s,r)=>e.jsx("div",{className:"w-3 h-3 rounded-full",style:{background:t.text,border:`1px solid ${t.text}`}},`h-${r}`))]}),e.jsxs("div",{className:"text-[10px] mt-2",style:{color:t.dim},children:[h," machine identities for every ",g," human — each is an attack surface that requires zero-trust verification"]})]}),e.jsxs("div",{className:"text-3xl font-mono font-bold flex-shrink-0",style:{color:t.accent},children:[k,":1"]})]})]}),e.jsx("div",{className:"flex gap-1 mb-6",children:["inventory","rotation","mcp-matrix","anomalies"].map(s=>e.jsx("button",{onClick:()=>T(s),className:"px-4 py-2 text-[10px] font-mono uppercase tracking-widest rounded-md transition-all",style:{background:o===s?"rgba(201,183,135,0.1)":"transparent",color:o===s?t.accent:t.muted,border:`1px solid ${o===s?"rgba(201,183,135,0.2)":"transparent"}`,cursor:"pointer"},children:s.replace("-"," ")},s))}),o==="inventory"&&e.jsxs("div",{className:"grid lg:grid-cols-3 gap-6",children:[e.jsxs("div",{className:"lg:col-span-2 space-y-2",children:[e.jsx(x,{children:"Agent Identity Inventory"}),a.map(s=>e.jsx("button",{onClick:()=>C(s.id),className:"w-full text-left rounded-lg p-4 transition-all",style:{background:p===s.id?"rgba(201,183,135,0.05)":t.surface,border:`1px solid ${p===s.id?"rgba(201,183,135,0.2)":s.status==="anomalous"?"rgba(239,68,68,0.3)":t.border}`},children:e.jsxs("div",{className:"flex items-center gap-3",children:[e.jsx("span",{className:"text-lg",style:{color:c[s.status]},children:j[s.type]}),e.jsxs("div",{className:"flex-1 min-w-0",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"text-xs font-medium",style:{color:t.text},children:s.name}),e.jsx("span",{className:"text-[9px] font-mono px-1.5 py-0.5 rounded",style:{background:`${c[s.status]}15`,color:c[s.status]},children:s.status}),e.jsx("span",{className:"text-[9px] font-mono",style:{color:t.muted},children:s.type})]}),e.jsxs("div",{className:"text-[10px] font-mono mt-0.5",style:{color:t.dim},children:[s.credentialType," · Trust: ",s.trustScore," · Privilege: ",e.jsx("span",{style:{color:m[s.privilegeLevel]},children:s.privilegeLevel})]})]}),e.jsxs("div",{className:"text-right",children:[e.jsxs("div",{className:"text-[10px] font-mono",style:{color:s.anomalyCount>0?"#ef4444":t.accent},children:[s.mcpTokens," tokens"]}),e.jsx("div",{className:"text-[9px] font-mono",style:{color:t.muted},children:s.anomalyCount>0?`${s.anomalyCount} anomalies`:"clean"})]})]})},s.id))]}),e.jsx("div",{children:l?e.jsxs("div",{className:"rounded-lg p-5 sticky top-4",style:{background:t.surface,border:`1px solid ${t.border}`},children:[e.jsxs("div",{className:"flex items-center gap-2 mb-1",children:[e.jsx("span",{className:"text-lg",style:{color:c[l.status]},children:j[l.type]}),e.jsx("div",{className:"text-sm font-medium",style:{color:t.text},children:l.name})]}),e.jsxs("div",{className:"text-[10px] font-mono mb-4",style:{color:t.dim},children:[l.id," · ",l.type]}),e.jsxs("div",{className:"space-y-3 text-[10px]",children:[e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Credential Type:"})," ",e.jsx("span",{style:{color:t.text},children:l.credentialType})]}),e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Privilege Level:"})," ",e.jsx("span",{style:{color:m[l.privilegeLevel]},children:l.privilegeLevel})]}),e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Trust Score:"})," ",e.jsx("span",{className:"font-mono font-bold",style:{color:l.trustScore>=90?t.accent:l.trustScore>=50?t.dim:"#ef4444"},children:l.trustScore})]}),e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Rotation Interval:"})," ",e.jsxs("span",{style:{color:t.text},children:[l.rotationIntervalHrs,"h"]})]}),e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Last Rotation:"})," ",e.jsx("span",{style:{color:t.dim},children:l.lastRotation})]}),e.jsxs("div",{children:[e.jsx("span",{style:{color:t.muted},children:"Next Rotation:"})," ",e.jsx("span",{style:{color:t.accent},children:l.nextRotation})]}),l.mcpScopes.length>0&&e.jsxs("div",{children:[e.jsxs("div",{className:"mb-1",style:{color:t.muted},children:["MCP Scopes (",l.mcpScopes.length,"):"]}),e.jsx("div",{className:"flex flex-wrap gap-1",children:l.mcpScopes.map(s=>e.jsx("span",{className:"text-[9px] font-mono px-1.5 py-0.5 rounded",style:{background:"rgba(201,183,135,0.08)",color:t.accent},children:s},s))})]}),l.anomalyCount>0&&e.jsx("div",{className:"p-2 rounded",style:{background:"rgba(239,68,68,0.06)",border:"1px solid rgba(239,68,68,0.15)"},children:e.jsxs("span",{style:{color:"#ef4444"},children:[l.anomalyCount," anomalies detected"]})})]})]}):e.jsx("div",{className:"rounded-lg p-8 text-center",style:{background:t.surface,border:`1px solid ${t.border}`},children:e.jsx("div",{className:"text-xs",style:{color:t.muted},children:"Select an identity to inspect"})})})]}),o==="rotation"&&e.jsxs(e.Fragment,{children:[e.jsx(x,{children:"Credential Rotation Schedule"}),e.jsx("p",{className:"text-xs mb-4",style:{color:t.dim},children:"All agent credentials rotate on enforced schedules. High-privilege identities rotate more frequently. Expired credentials are automatically revoked."}),e.jsx("div",{className:"rounded-lg overflow-hidden mb-8",style:{border:`1px solid ${t.border}`},children:e.jsxs("table",{className:"w-full text-xs",children:[e.jsx("thead",{children:e.jsx("tr",{style:{background:"rgba(255,255,255,0.02)"},children:["Identity","Type","Credential","Interval","Last Rotation","Next Rotation","Status"].map(s=>e.jsx("th",{className:"text-left px-4 py-2.5 font-mono text-[9px] uppercase tracking-wider",style:{color:t.muted,borderBottom:`1px solid ${t.border}`},children:s},s))})}),e.jsx("tbody",{children:a.map(s=>e.jsxs("tr",{style:{borderBottom:"1px solid rgba(255,255,255,0.04)"},children:[e.jsx("td",{className:"px-4 py-2.5 font-medium",style:{color:t.text},children:s.name}),e.jsx("td",{className:"px-4 py-2.5 font-mono",style:{color:t.dim},children:s.type}),e.jsx("td",{className:"px-4 py-2.5 font-mono",style:{color:t.dim},children:s.credentialType}),e.jsxs("td",{className:"px-4 py-2.5 font-mono",style:{color:t.accent},children:[s.rotationIntervalHrs,"h"]}),e.jsx("td",{className:"px-4 py-2.5 font-mono",style:{color:t.dim},children:s.lastRotation==="—"?"—":new Date(s.lastRotation).toLocaleTimeString()}),e.jsx("td",{className:"px-4 py-2.5 font-mono",style:{color:t.accent},children:s.nextRotation==="—"?"—":new Date(s.nextRotation).toLocaleTimeString()}),e.jsx("td",{className:"px-4 py-2.5",children:e.jsx("span",{className:"text-[9px] font-mono px-1.5 py-0.5 rounded",style:{background:`${c[s.status]}15`,color:c[s.status]},children:s.status})})]},s.id))})]})})]}),o==="mcp-matrix"&&e.jsxs(e.Fragment,{children:[e.jsx(x,{children:"MCP Token Scope Matrix"}),e.jsx("p",{className:"text-xs mb-4",style:{color:t.dim},children:"Every MCP tool server token is scoped to specific capabilities. Agents can only invoke tools within their granted scopes. No wildcard access permitted."}),e.jsx("div",{className:"space-y-3 mb-8",children:a.filter(s=>s.mcpTokens>0).map(s=>e.jsxs(y,{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{style:{color:c[s.status]},children:j[s.type]}),e.jsx("span",{className:"text-xs font-medium",style:{color:t.text},children:s.name}),e.jsx("span",{className:"text-[9px] font-mono px-1.5 py-0.5 rounded",style:{background:`${m[s.privilegeLevel]}15`,color:m[s.privilegeLevel]},children:s.privilegeLevel})]}),e.jsxs("span",{className:"text-[10px] font-mono",style:{color:t.accent},children:[s.mcpTokens," tokens"]})]}),e.jsx("div",{className:"flex flex-wrap gap-1",children:s.mcpScopes.map(r=>e.jsx("span",{className:"text-[9px] font-mono px-2 py-1 rounded",style:{background:"rgba(201,183,135,0.06)",border:"1px solid rgba(201,183,135,0.12)",color:t.accent},children:r},r))})]},s.id))}),e.jsxs(y,{children:[e.jsx("div",{className:"text-[9px] font-mono uppercase tracking-widest mb-3",style:{color:t.muted},children:"LEAST-PRIVILEGE ENFORCEMENT"}),e.jsx("div",{className:"space-y-2 text-[10px]",children:[{rule:"No wildcard MCP scopes — every tool call requires explicit scope grant",status:"enforced"},{rule:"Agent privilege cannot exceed its credential type ceiling",status:"enforced"},{rule:"Cross-agent tool sharing requires bilateral scope approval",status:"enforced"},{rule:"Elevated privileges auto-expire after 4 hours without renewal",status:"enforced"},{rule:"Human admin required for any privilege elevation request",status:"enforced"},{rule:"All scope changes logged to Proof Ledger with cryptographic hash",status:"enforced"}].map(s=>e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{style:{color:t.accent},children:"✓"}),e.jsx("span",{style:{color:t.dim},children:s.rule})]},s.rule))})]})]}),o==="anomalies"&&e.jsxs(e.Fragment,{children:[e.jsx(x,{children:"Behavioral Anomaly Timeline"}),e.jsx("p",{className:"text-xs mb-4",style:{color:t.dim},children:"Continuous behavioral fingerprinting detects identity anomalies — credential replay, scope escalation attempts, behavioral pattern mismatches, and unverified agent registration."}),e.jsx("div",{className:"space-y-3 mb-8",children:E.map(s=>e.jsxs(y,{style:{borderLeft:`3px solid ${f[s.severity]}`},children:[e.jsxs("div",{className:"flex items-start justify-between gap-3 mb-2",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center gap-2 mb-1",children:[e.jsx("span",{className:"text-[10px] font-mono",style:{color:t.dim},children:s.id}),e.jsx("span",{className:"text-[9px] font-mono px-1.5 py-0.5 rounded",style:{background:`${f[s.severity]}18`,color:f[s.severity]},children:s.severity}),e.jsx("span",{className:"text-[9px] font-mono",style:{color:t.muted},children:s.type})]}),e.jsx("div",{className:"text-xs font-medium mb-1",style:{color:t.text},children:s.agentName}),e.jsx("p",{className:"text-[10px]",style:{color:t.dim},children:s.description})]}),e.jsx("div",{className:"text-[9px] font-mono flex-shrink-0",style:{color:t.muted},children:new Date(s.timestamp).toLocaleTimeString()})]}),e.jsxs("div",{className:"p-2 rounded mt-2",style:{background:"rgba(201,183,135,0.04)",border:"1px solid rgba(201,183,135,0.1)"},children:[e.jsx("span",{className:"text-[9px] font-mono",style:{color:t.accent},children:"ACTION:"}),e.jsx("span",{className:"text-[10px] ml-1.5",style:{color:t.dim},children:s.action})]})]},s.id))})]}),e.jsxs("div",{className:"p-3 rounded-lg text-xs flex items-center gap-2",style:{background:"rgba(201,183,135,0.04)",border:"1px solid rgba(201,183,135,0.15)",color:t.muted},children:[e.jsx("span",{className:"w-1.5 h-1.5 rounded-full",style:{background:t.accent}})," Agent Zero Trust — every identity verified, every credential rotated, every scope enforced, every anomaly detected. No implicit trust."]})]})]})}export{U as AgentZeroTrust};