feat(registry): add authentication and ECS deployment support

apps/papillon/frontend/src/commands/approval.rs

@@ -0,0 +1,38 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+/// Signed challenge for identity authorization.
+/// Must match the backend SignedChallenge structure.
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct SignedChallenge {
+    pub challenge_id: String,
+    pub signature_b64: String,
+}
+
+/// Payload for the approval command.
+#[derive(Serialize, Deserialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct ApprovalPayload {
+    pub approval_request_id: String,
+    pub approved: bool,
+    pub signed_challenge: SignedChallenge,
+    pub filled_values: Option<HashMap<String, String>>,
+    pub selected_agent_names: Option<Vec<String>>,
+}
+
+/// Call the backend approval command.
+///
+/// In desktop builds (Tauri), this invokes the `canvas_approve_block` command.
+/// In WASM builds, this would call through the bridge (currently returning an error).
+pub async fn approve_intent_plan(payload: ApprovalPayload) -> Result<(), String> {
+    #[cfg(target_family = "wasm")]
+    {
+        crate::bridge::invoke("canvas_approve_block", &payload).await
+    }
+
+    #[cfg(not(target_family = "wasm"))]
+    {
+        let _ = payload; // Silence unused warning
+        Err("approve_intent_plan is only available in Tauri builds".to_string())
+    }
+}

apps/papillon/frontend/src/commands/mod.rs

@@ -0,0 +1 @@
+pub mod approval;

apps/papillon/frontend/src/components/agent_curation_list.rs

@@ -0,0 +1,102 @@
+use leptos::prelude::*;
+use papillon_shared::{AgentCandidate, IntentPlan};
+
+#[component]
+pub fn AgentCurationList(
+    plan: IntentPlan,
+    selected_agents: RwSignal<Vec<String>>,
+) -> impl IntoView {
+    // Initialize selected agents from plan if not already set
+    let initial_selected = plan.candidates
+        .iter()
+        .filter(|c| Some(&c.did) == plan.selected_agent_did.as_ref())
+        .map(|c| c.did.clone())
+        .collect::<Vec<_>>();
+
+    if selected_agents.get_untracked().is_empty() && !initial_selected.is_empty() {
+        selected_agents.set(initial_selected);
+    }
+
+    view! {
+        <div class="agent-curation-list">
+            <For
+                each=move || plan.candidates.clone()
+                key=|c| c.did.clone()
+                children=move |candidate| {
+                    view! {
+                        <AgentCurationCard
+                            agent=candidate
+                            selected=selected_agents.read_only()
+                            on_toggle=selected_agents
+                        />
+                    }
+                }
+            />
+        </div>
+    }
+}
+
+#[component]
+fn AgentCurationCard(
+    agent: AgentCandidate,
+    selected: ReadSignal<Vec<String>>,
+    on_toggle: RwSignal<Vec<String>>,
+) -> impl IntoView {
+    let agent_did = agent.did.clone();
+    let agent_did_for_toggle = agent.did.clone();
+
+    let is_selected = Memo::new(move |_| selected.get().contains(&agent_did));
+
+    // On-device detection (simplified: check if did:key)
+    let is_on_device = agent.did.starts_with("did:key:");
+
+    // Truncate DID for display
+    let truncated_did = truncate_did(&agent.did);
+
+    view! {
+        <div
+            class="agent-card"
+            class:selected=is_selected
+        >
+            <label class="agent-card-checkbox-label">
+                <input
+                    type="checkbox"
+                    class="agent-card-checkbox"
+                    checked=is_selected
+                    on:change=move |_| {
+                        on_toggle.update(|list| {
+                            if list.contains(&agent_did_for_toggle) {
+                                list.retain(|d| d != &agent_did_for_toggle);
+                            } else {
+                                list.push(agent_did_for_toggle.clone());
+                            }
+                        });
+                    }
+                />
+                <div class="agent-card-info">
+                    <div class="agent-card-header">
+                        <span class="agent-card-name">{agent.name.clone()}</span>
+                        <Show when=move || is_on_device>
+                            <span class="trust-badge on-device">"On-Device"</span>
+                        </Show>
+                    </div>
+                    <span class="agent-card-did">{truncated_did}</span>
+                    <div class="agent-card-disclosure">
+                        <span class="disclosure-count">
+                            {agent.requires_disclosure.len()}
+                            " "
+                            {if agent.requires_disclosure.len() == 1 { "property" } else { "properties" }}
+                        </span>
+                    </div>
+                </div>
+            </label>
+        </div>
+    }
+}
+
+fn truncate_did(did: &str) -> String {
+    if did.len() <= 30 {
+        return did.to_string();
+    }
+    format!("{}...{}", &did[..20], &did[did.len() - 8..])
+}

apps/papillon/frontend/src/components/agent_selector.rs

@@ -0,0 +1,55 @@
+use leptos::prelude::*;
+use papillon_shared::AgentInfo;
+
+/// Multi-select agent picker for a block container.
+/// Shows only agents matching the container's SchemaSignature.
+#[component]
+pub fn AgentSelector(
+    /// List of compatible agents (filtered by signature)
+    agents: Vec<AgentInfo>,
+    /// Currently selected agent names
+    selected: RwSignal<Vec<String>>,
+) -> impl IntoView {
+    let toggle_agent = move |name: String| {
+        selected.update(|sel| {
+            if sel.contains(&name) {
+                sel.retain(|n| n != &name);
+            } else {
+                sel.push(name);
+            }
+        });
+    };
+
+    view! {
+        <div class="agent-selector">
+            <div class="agent-selector-header">"Select Agents"</div>
+            <div class="agent-selector-list">
+                <For
+                    each=move || agents.clone()
+                    key=|agent| agent.name.clone()
+                    children=move |agent| {
+                        let agent_name_for_click = agent.name.clone();
+                        let agent_name_for_check = agent.name.clone();
+                        let agent_name_for_class = agent.name.clone();
+
+                        view! {
+                            <button
+                                class="agent-selector-item"
+                                class:selected=move || selected.get().contains(&agent_name_for_class)
+                                on:click=move |_| toggle_agent(agent_name_for_click.clone())
+                            >
+                                <div class="agent-checkbox">
+                                    {move || if selected.get().contains(&agent_name_for_check) { "✓" } else { "" }}
+                                </div>
+                                <div class="agent-info">
+                                    <div class="agent-name">{agent.name.clone()}</div>
+                                    <div class="agent-provider">{agent.provider_name.clone()}</div>
+                                </div>
+                            </button>
+                        }
+                    }
+                />
+            </div>
+        </div>
+    }
+}

apps/papillon/frontend/src/components/approval_toast.rs

@@ -0,0 +1,162 @@
+use leptos::prelude::*;
+use crate::state::canvas::CanvasState;
+
+/// Toast notification stack for approval requests.
+/// Fixed bottom-right position, animates in from bottom.
+#[component]
+pub fn ApprovalToastStack() -> impl IntoView {
+    let canvas_state = expect_context::<CanvasState>();
+    let hitl_pending = canvas_state.hitl_pending;
+
+    view! {
+        <Show when=move || hitl_pending.get().is_some()>
+            {move || {
+                hitl_pending.get().map(|req| {
+                    view! {
+                        <ApprovalToast request=req />
+                    }
+                })
+            }}
+        </Show>
+    }
+}
+
+/// Individual approval toast for a single HitL request.
+#[component]
+fn ApprovalToast(request: crate::state::canvas::HitlRequest) -> impl IntoView {
+    let canvas_state = expect_context::<CanvasState>();
+
+    // Humanize action type: strip "schema:" prefix and "Action" suffix
+    let action_display = humanize_action(&request.action_type);
+
+    // Clone fields needed in closures
+    let agent_name = request.agent_name.clone();
+    let disclosure_props_len = request.disclosure_props.len();
+    let has_disclosure = !request.disclosure_props.is_empty();
+
+    // Quick approve handler
+    let quick_approve = move |_| {
+        if disclosure_props_len == 0 {
+            // Zero-disclosure: approve immediately
+            // TODO: wire to canvas_state.approve_block() in Task 18
+            leptos::logging::log!("Quick approve: {}", agent_name);
+            canvas_state.hitl_pending.set(None);
+        } else {
+            // Has disclosure: open workflow panel for review
+            canvas_state.workflow_panel_open.set(true);
+        }
+    };
+
+    // Dismiss handler
+    let dismiss = move |_| {
+        canvas_state.hitl_pending.set(None);
+    };
+
+    view! {
+        <div class="approval-toast">
+            <div class="approval-toast-header">
+                <div class="approval-toast-agent">{request.agent_name.clone()}</div>
+                <button
+                    class="approval-toast-dismiss"
+                    on:click=dismiss
+                    aria-label="Dismiss"
+                >
+                    "×"
+                </button>
+            </div>
+
+            <div class="approval-toast-body">
+                <div class="approval-toast-action">
+                    {action_display}
+                    {move || {
+                        if request.risk_level == "HIGH" {
+                            view! { <span class="approval-toast-risk high">"HIGH"</span> }.into_any()
+                        } else if request.risk_level == "CRITICAL" {
+                            view! { <span class="approval-toast-risk critical">"CRITICAL"</span> }.into_any()
+                        } else {
+                            view! { <></> }.into_any()
+                        }
+                    }}
+                </div>
+
+                <div class="approval-toast-description">
+                    {request.description.clone()}
+                </div>
+
+                {move || {
+                    if !request.disclosure_props.is_empty() {
+                        view! {
+                            <div class="approval-toast-disclosure">
+                                "Requires disclosure: "
+                                {request.disclosure_props.join(", ")}
+                            </div>
+                        }.into_any()
+                    } else {
+                        view! { <></> }.into_any()
+                    }
+                }}
+            </div>
+
+            <div class="approval-toast-footer">
+                {
+                    if has_disclosure {
+                        // Multi-property disclosure: view details button
+                        view! {
+                            <button
+                                class="approval-toast-button details"
+                                on:click=quick_approve
+                            >
+                                "VIEW DETAILS"
+                            </button>
+                        }.into_any()
+                    } else {
+                        // Zero-disclosure: quick approve button
+                        view! {
+                            <button
+                                class="approval-toast-button approve"
+                                on:click=quick_approve
+                            >
+                                "APPROVE"
+                            </button>
+                        }.into_any()
+                    }
+                }
+            </div>
+        </div>
+    }
+}
+
+/// Strip "schema:" prefix and "Action" suffix from action type strings.
+fn humanize_action(action: &str) -> String {
+    action
+        .trim_start_matches("schema:")
+        .trim_end_matches("Action")
+        .to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn humanize_action_strips_prefix_and_suffix() {
+        assert_eq!(humanize_action("schema:SearchAction"), "Search");
+        assert_eq!(humanize_action("schema:WriteAction"), "Write");
+        assert_eq!(humanize_action("schema:ReadAction"), "Read");
+    }
+
+    #[test]
+    fn humanize_action_handles_no_prefix() {
+        assert_eq!(humanize_action("SearchAction"), "Search");
+    }
+
+    #[test]
+    fn humanize_action_handles_no_suffix() {
+        assert_eq!(humanize_action("schema:Search"), "schema:Search");
+    }
+
+    #[test]
+    fn humanize_action_handles_plain_string() {
+        assert_eq!(humanize_action("search"), "search");
+    }
+}