aidevops 3.32.4 → 3.32.6

package/packages/gui-web/src/VaultBadges.tsx

@@ -1,5 +1,4 @@
 import type { GuiVaultCollectionSummary, GuiVaultStatusData } from "@aidevops/gui-shared";
-import type { KeyboardEvent, MouseEvent } from "react";
 import { FiLock, FiUnlock } from "react-icons/fi";
 import type { SurfaceId } from "./app-model";
 import { text } from "./app-model";
@@ -24,14 +23,38 @@ export function vaultCollectionTooltip(collection: GuiVaultCollectionSummary): s
   return text.vaultTooltip;
 }
 
-export type VaultDialogIntent = "setup" | "unlock" | "lock";
+export type VaultDialogIntent = "setup" | "unlock" | "lock" | "recover" | "unavailable";
+
+const vaultActionLabels: Record<VaultDialogIntent, string> = {
+  lock: "Lock Vault",
+  recover: "Review recovery",
+  setup: "Set up Vault",
+  unavailable: "Check Vault status",
+  unlock: "Unlock Vault",
+};
+
+const authoritativeStatusIntents: Partial<Record<GuiVaultStatusData["status"], VaultDialogIntent>> = {
+  locked: "unlock",
+  uninitialized: "setup",
+};
 
 export function vaultDialogIntentForStatus(vault: GuiVaultStatusData): VaultDialogIntent {
+  let intent = authoritativeStatusIntents[vault.status] ?? "unavailable";
   if (vault.unlocked) {
-    return "lock";
+    intent = "lock";
+  } else if (vault.status === "corrupted") {
+    intent = "recover";
+  } else if (vault.helper_status !== "available" || vault.status === "unknown") {
+    intent = "unavailable";
+  } else if (intent === "setup" && !vaultSetupIsRequired(vault)) {
+    intent = "unavailable";
   }
 
-  return vault.readiness.setup_required || !vault.initialized ? "setup" : "unlock";
+  return intent;
+}
+
+export function vaultActionLabel(intent: VaultDialogIntent): string {
+  return vaultActionLabels[intent];
 }
 
 export function VaultPadlock({ collection, compact = false, onActivate, vault }: {
@@ -40,41 +63,78 @@ export function VaultPadlock({ collection, compact = false, onActivate, vault }:
   onActivate?: (intent: VaultDialogIntent) => void;
   vault: GuiVaultStatusData;
 }) {
-  const locked = collection.state !== "unlocked" || !vault.unlocked;
-  const stateLabel = locked ? "Locked" : "Unlocked";
-  const Icon = locked ? FiLock : FiUnlock;
-  const tooltip = `${stateLabel}: ${vaultCollectionTooltip(collection)}`;
-  const className = compact ? "vault-padlock compact" : "vault-padlock";
-
-  const activate = (event: MouseEvent<HTMLSpanElement> | KeyboardEvent<HTMLSpanElement>) => {
-    if (onActivate === undefined) {
-      return;
-    }
-
-    event.preventDefault();
-    event.stopPropagation();
-    onActivate(vaultDialogIntentForStatus(vault));
-  };
+  const intent = vaultDialogIntentForStatus(vault);
+  const presentation = vaultPadlockPresentation(collection, compact, onActivate !== undefined, intent, vault);
+  const content = <PadlockContent presentation={presentation} />;
 
-  const handleKeyDown = (event: KeyboardEvent<HTMLSpanElement>) => {
-    if (event.key === "Enter" || event.key === " ") {
-      activate(event);
-    }
-  };
+  if (onActivate === undefined) {
+    return <span aria-label={presentation.tooltip} className={presentation.className} data-vault-state={presentation.state} role="img" title={presentation.tooltip}>{content}</span>;
+  }
 
   return (
-    <span
-      aria-label={tooltip}
-      className={onActivate ? `${className} interactive` : className}
-      data-vault-state={locked ? "locked" : "unlocked"}
-      onClick={activate}
-      onKeyDown={handleKeyDown}
-      role={onActivate ? "button" : undefined}
-      tabIndex={onActivate ? 0 : undefined}
-      title={tooltip}
+    <button
+      aria-label={presentation.tooltip}
+      className={presentation.className}
+      data-vault-state={presentation.state}
+      onClick={(event) => {
+        event.preventDefault();
+        event.stopPropagation();
+        onActivate(intent);
+      }}
+      title={presentation.tooltip}
+      type="button"
     >
-      <Icon aria-hidden="true" focusable="false" />
-      <span>{compact ? stateLabel : `${stateLabel} by Vault`}</span>
-    </span>
+      {content}
+    </button>
   );
 }
+
+interface VaultPadlockPresentation {
+  className: string;
+  label: string;
+  locked: boolean;
+  state: "locked" | "unlocked";
+  tooltip: string;
+}
+
+function vaultPadlockPresentation(collection: GuiVaultCollectionSummary, compact: boolean, interactive: boolean, intent: VaultDialogIntent, vault: GuiVaultStatusData): VaultPadlockPresentation {
+  const locked = collection.state !== "unlocked" || !vault.unlocked;
+  const stateLabel = vaultStateLabel(intent, locked);
+  const compactLabel = compact || intent === "recover" || intent === "unavailable";
+  const classNames = ["vault-padlock"];
+  if (compact) classNames.push("compact");
+  if (interactive) classNames.push("interactive");
+
+  return {
+    className: classNames.join(" "),
+    label: compactLabel ? stateLabel : `${stateLabel} by Vault`,
+    locked,
+    state: locked ? "locked" : "unlocked",
+    tooltip: vaultStateTooltip(intent, stateLabel, collection),
+  };
+}
+
+function PadlockContent({ presentation }: { presentation: VaultPadlockPresentation }) {
+  const Icon = presentation.locked ? FiLock : FiUnlock;
+  return <><Icon aria-hidden="true" focusable="false" /><span>{presentation.label}</span></>;
+}
+
+function vaultStateLabel(intent: VaultDialogIntent, locked: boolean): string {
+  const intentLabels: Partial<Record<VaultDialogIntent, string>> = {
+    recover: "Recovery required",
+    unavailable: "Status unavailable",
+  };
+  return intentLabels[intent] ?? (locked ? "Locked" : "Unlocked");
+}
+
+function vaultStateTooltip(intent: VaultDialogIntent, stateLabel: string, collection: GuiVaultCollectionSummary): string {
+  const intentTooltips: Partial<Record<VaultDialogIntent, string>> = {
+    recover: "Recovery required: Vault metadata is damaged; preserve encrypted data.",
+    unavailable: "Status unavailable: protected content remains hidden until Vault state is authoritative.",
+  };
+  return intentTooltips[intent] ?? `${stateLabel}: ${vaultCollectionTooltip(collection)}`;
+}
+
+function vaultSetupIsRequired(vault: GuiVaultStatusData): boolean {
+  return vault.status === "uninitialized" && vault.setup_state === "uninitialized" && vault.readiness.setup_required;
+}

package/packages/gui-web/src/VaultSurface.tsx

@@ -0,0 +1,282 @@
+import type { GuiStatusData, GuiVaultCollectionSummary, GuiVaultStatusData } from "@aidevops/gui-shared";
+import type { ReactElement } from "react";
+import { text } from "./app-model";
+import { type VaultDialogIntent, VaultPadlock, vaultActionLabel, vaultDialogIntentForStatus } from "./VaultBadges";
+
+interface VaultAvailability {
+  custodyDetail: string;
+  custodyValue: string;
+  readinessUnknown: boolean;
+}
+
+interface VaultSurfaceProps {
+  onVaultRequest: (intent: VaultDialogIntent) => void;
+  status: GuiStatusData;
+}
+
+export function VaultSurface({ onVaultRequest, status }: VaultSurfaceProps): ReactElement {
+  const vault = status.vault;
+  const availability = vaultAvailability(vault);
+
+  return (
+    <section className="surface-page vault-surface" aria-label={text.vault}>
+      <VaultHero availability={availability} onVaultRequest={onVaultRequest} vault={vault} />
+      <VaultNotice availability={availability} vault={vault} />
+      <VaultFeatureGrid availability={availability} vault={vault} />
+      <VaultSetupPanel availability={availability} onVaultRequest={onVaultRequest} vault={vault} />
+      <VaultCollectionsPanel onVaultRequest={onVaultRequest} vault={vault} />
+      <VaultDevicesPanel vault={vault} />
+    </section>
+  );
+}
+
+export function LockedVaultGate({ collection, label, onVaultRequest, vault }: {
+  collection: GuiVaultCollectionSummary;
+  label: string;
+  onVaultRequest: (intent: VaultDialogIntent) => void;
+  vault: GuiVaultStatusData;
+}): ReactElement {
+  const intent = vaultDialogIntentForStatus(vault);
+  const copy = lockedGateCopy(intent, label, vault);
+
+  return (
+    <section className="panel vault-locked-gate" aria-label={copy.heading}>
+      <div className="section-heading split-heading">
+        <div>
+          <p className="eyebrow">{collection.data_class}</p>
+          <h2>{copy.heading}</h2>
+          <p>{copy.summary}</p>
+        </div>
+        <VaultPadlock collection={collection} onActivate={onVaultRequest} vault={vault} />
+      </div>
+      <div className="notice compact-notice" role="note">{copy.detail}</div>
+      <button className="secondary-action vault-cta" onClick={() => onVaultRequest(intent)} title={copy.detail} type="button">{vaultActionLabel(intent)}</button>
+    </section>
+  );
+}
+
+function VaultHero({ availability, onVaultRequest, vault }: { availability: VaultAvailability; onVaultRequest: (intent: VaultDialogIntent) => void; vault: GuiVaultStatusData }): ReactElement {
+  const vaultCollection = vault.collections.find((collection) => collection.surface_ids.includes("vault")) ?? vault.collections[0];
+  return (
+    <div className="hero-panel vault-hero">
+      <div className="section-heading split-heading">
+        <div>
+          <p className="eyebrow">{vault.value_policy}</p>
+          <h2>{text.vault}</h2>
+          <p>{text.vaultIntro}</p>
+        </div>
+        {vaultCollection ? <VaultPadlock collection={vaultCollection} onActivate={onVaultRequest} vault={vault} /> : null}
+      </div>
+      <ul aria-label="Vault readiness" className="vault-readiness-strip">
+        {vaultReadiness(vault, availability.readinessUnknown).map((item) => <li key={item.label}><strong>{item.label}</strong>{item.value}</li>)}
+      </ul>
+    </div>
+  );
+}
+
+function VaultNotice({ availability, vault }: { availability: VaultAvailability; vault: GuiVaultStatusData }): ReactElement {
+  const notice = vaultNoticeCopy(vault, availability.readinessUnknown);
+  return <div className={`notice compact-notice${notice.warning ? " warning-notice" : ""}`} role="note">{notice.detail}</div>;
+}
+
+function VaultFeatureGrid({ availability, vault }: { availability: VaultAvailability; vault: GuiVaultStatusData }): ReactElement {
+  return (
+    <div className="vault-card-grid">
+      {vaultFeatureCards(vault, availability).map((card) => <VaultFeatureCard detail={card.detail} key={card.label} label={card.label} value={card.value} />)}
+    </div>
+  );
+}
+
+function VaultFeatureCard({ detail, label, value }: { detail: string; label: string; value: string }): ReactElement {
+  return <article className="vault-feature-card"><span>{label}</span><strong>{value}</strong><small>{detail}</small></article>;
+}
+
+function VaultSetupPanel({ availability, onVaultRequest, vault }: { availability: VaultAvailability; onVaultRequest: (intent: VaultDialogIntent) => void; vault: GuiVaultStatusData }): ReactElement {
+  const intent = vaultDialogIntentForStatus(vault);
+  const detail = availability.readinessUnknown ? availability.custodyDetail : vault.setup_hint;
+  return (
+    <section className="panel vault-setup-panel" aria-label={text.vaultSetup}>
+      <div className="section-heading split-heading">
+        <div>
+          <p className="eyebrow">{text.vaultSetup}</p>
+          <h2>{vaultSetupHeading(vault, availability.readinessUnknown)}</h2>
+          <p>{detail}</p>
+        </div>
+        <button className="secondary-action vault-cta" onClick={() => onVaultRequest(intent)} title={availability.readinessUnknown ? availability.custodyDetail : vault.unlock_hint} type="button">{vaultActionLabel(intent)}</button>
+      </div>
+      {availability.readinessUnknown ? <VaultUnavailableSetupNotice vault={vault} /> : <VaultSetupSteps unlockHint={vault.unlock_hint} />}
+    </section>
+  );
+}
+
+function VaultUnavailableSetupNotice({ vault }: { vault: GuiVaultStatusData }): ReactElement {
+  const detail = vault.status === "corrupted"
+    ? "Use recovery guidance only. Preserve the current Vault directory and do not run initialization commands."
+    : "Retry authoritative status before following setup or unlock instructions.";
+  return <p className="empty-state">{detail}</p>;
+}
+
+function VaultSetupSteps({ unlockHint }: { unlockHint: string }): ReactElement {
+  return (
+    <>
+      <ol className="vault-step-list">
+        <li>Initialize locally with the hidden-prompt helper.</li>
+        <li>Verify the harmless restart test before migrating real data.</li>
+        <li>Keep passphrases, recovery material, and private keys out of chat, arguments, environment variables, logs, issues, and fixtures.</li>
+      </ol>
+      <code>{unlockHint}</code>
+    </>
+  );
+}
+
+function VaultCollectionsPanel({ onVaultRequest, vault }: { onVaultRequest: (intent: VaultDialogIntent) => void; vault: GuiVaultStatusData }): ReactElement {
+  return (
+    <section className="panel" aria-label="Vault encrypted collections">
+      <div className="section-heading">
+        <p className="eyebrow">{text.vaultStatus}</p>
+        <h2>Encrypted collections</h2>
+        <p>{text.vaultCollectionIntro}</p>
+      </div>
+      <ul className="object-list vault-collection-list">
+        {vault.collections.map((collection) => <VaultCollectionRow collection={collection} key={collection.id} onVaultRequest={onVaultRequest} vault={vault} />)}
+      </ul>
+    </section>
+  );
+}
+
+function VaultCollectionRow({ collection, onVaultRequest, vault }: { collection: GuiVaultCollectionSummary; onVaultRequest: (intent: VaultDialogIntent) => void; vault: GuiVaultStatusData }): ReactElement {
+  return (
+    <li>
+      <strong>{collection.label}</strong>
+      <VaultPadlock collection={collection} compact onActivate={onVaultRequest} vault={vault} />
+      <span>{collection.preview_policy}</span>
+      <small>{collection.labels.join(", ")}</small>
+      <small>{collection.surface_ids.join(", ")}</small>
+    </li>
+  );
+}
+
+function VaultDevicesPanel({ vault }: { vault: GuiVaultStatusData }): ReactElement {
+  return (
+    <section className="panel" aria-label="Vault devices and audit">
+      <div className="section-heading split-heading">
+        <div>
+          <p className="eyebrow">{text.vaultDevices}</p>
+          <h2>Devices, sync, messages, backups, and audit</h2>
+          <p>These placeholders expose readiness and redacted metadata only. Git, object storage, messaging, SSH, VPNs, and VPS disks remain untrusted transports.</p>
+        </div>
+        <span className="count-pill">{vault.sync.transport_policy}</span>
+      </div>
+      <div className="vault-device-grid">
+        {vault.devices.map((device) => (
+          <article className="vault-device-card" key={device.id_ref}>
+            <p className="eyebrow">{device.trust_state}</p>
+            <h3>{device.label}</h3>
+            <Detail label="device" value={device.id_ref} />
+            <Detail label="last seen" value={device.last_seen} />
+            <Detail label="audit head" value={device.audit_head_ref} />
+          </article>
+        ))}
+      </div>
+    </section>
+  );
+}
+
+function Detail({ label, value }: { label: string; value: string }): ReactElement {
+  return <span><small>{label}</small><strong>{value}</strong></span>;
+}
+
+function vaultAvailability(vault: GuiVaultStatusData): VaultAvailability {
+  const readinessUnknown = vault.helper_status !== "available" || vault.status === "unknown" || vault.status === "corrupted";
+  let custodyDetail = vault.unlock_hint;
+  let custodyValue = vault.locked ? "locked" : "unlocked";
+  if (readinessUnknown) {
+    custodyDetail = "The local helper did not return authoritative lock metadata.";
+    custodyValue = "unavailable";
+  }
+  if (vault.status === "corrupted") {
+    custodyDetail = "Metadata is damaged. Preserve encrypted data and use the recovery guidance.";
+    custodyValue = "recovery";
+  }
+  return { custodyDetail, custodyValue, readinessUnknown };
+}
+
+function vaultReadiness(vault: GuiVaultStatusData, readinessUnknown: boolean): Array<{ label: string; value: string }> {
+  return [
+    { label: "migration", value: migrationReadiness(vault, readinessUnknown) },
+    { label: "setup", value: setupReadiness(vault, readinessUnknown) },
+    { label: "restart test", value: restartReadiness(vault, readinessUnknown) },
+    { label: "remote unlock", value: vault.readiness.remote_unlock_enabled ? "enabled" : "disabled" },
+  ];
+}
+
+function migrationReadiness(vault: GuiVaultStatusData, readinessUnknown: boolean): string {
+  return readinessUnknown ? "unknown" : vault.readiness.migration_allowed ? "ready" : "blocked";
+}
+
+function setupReadiness(vault: GuiVaultStatusData, readinessUnknown: boolean): string {
+  let value = vault.setup_state === "migration-ready" ? "complete" : "in progress";
+  if (vault.readiness.setup_required) value = "required";
+  if (readinessUnknown) value = "unknown";
+  return value;
+}
+
+function restartReadiness(vault: GuiVaultStatusData, readinessUnknown: boolean): string {
+  let value = vault.setup_state === "migration-ready" ? "verified" : "pending";
+  if (vault.readiness.restart_test_required) value = "required";
+  if (vault.status === "uninitialized") value = "not started";
+  if (readinessUnknown) value = "unknown";
+  return value;
+}
+
+function vaultFeatureCards(vault: GuiVaultStatusData, availability: VaultAvailability): Array<{ detail: string; label: string; value: string }> {
+  return [
+    { label: text.vaultStatus, value: vault.status, detail: "Metadata-only lock state from the local helper." },
+    { label: text.vaultSetup, value: vault.setup_state, detail: availability.readinessUnknown ? availability.custodyDetail : vault.setup_hint },
+    { label: text.vaultLockUnlock, value: availability.custodyValue, detail: availability.custodyDetail },
+    { label: text.vaultDevices, value: `${vault.devices.length} device`, detail: "Device trust metadata only; private keys are never exposed." },
+    { label: text.vaultSync, value: vault.sync.status, detail: "Encrypted bundles and signed manifests over untrusted transports." },
+    { label: text.vaultMessages, value: vault.secure_messages.status, detail: "Secure message placeholders keep payloads hidden while locked." },
+    { label: text.vaultBackups, value: vault.backups.status, detail: "Encrypted backups and recovery flows are metadata-only here." },
+    { label: text.vaultAudit, value: vault.audit.status, detail: `${vault.audit.event_count} redacted audit events; ${vault.audit.latest_event_ref}.` },
+  ];
+}
+
+function vaultNoticeCopy(vault: GuiVaultStatusData, readinessUnknown: boolean): { detail: string; warning: boolean } {
+  let detail = vault.locked
+    ? `${text.vaultLockedPreview} ${vault.unlock_hint}`
+    : "Vault is unlocked for this local session. Protected actions remain read-only until audited write routes are implemented.";
+  let warning = false;
+  if (readinessUnknown) {
+    detail = "Vault lock state is unavailable. Setup and unlock guidance remains disabled until status is authoritative.";
+    warning = true;
+  }
+  if (vault.status === "corrupted") {
+    detail = "Vault metadata needs recovery. Preserve existing encrypted data and do not initialise over it.";
+  }
+  return { detail, warning };
+}
+
+function vaultSetupHeading(vault: GuiVaultStatusData, readinessUnknown: boolean): string {
+  let heading = vault.readiness.setup_required ? "Setup required" : "Setup metadata";
+  if (readinessUnknown) heading = "Setup status unavailable";
+  if (vault.status === "corrupted") heading = "Recovery required";
+  return heading;
+}
+
+function lockedGateCopy(intent: VaultDialogIntent, label: string, vault: GuiVaultStatusData): { detail: string; heading: string; summary: string } {
+  let detail = `${text.vaultTooltip} ${vault.unlock_hint}`;
+  let heading = `${label} is locked`;
+  let summary: string = text.vaultLockedPreview;
+  if (intent === "unavailable") {
+    detail = "Protected content remains hidden until the local helper returns authoritative status.";
+    heading = `${label} Vault status is unavailable`;
+    summary = detail;
+  }
+  if (intent === "recover") {
+    detail = "Protected content remains hidden while damaged Vault metadata is reviewed.";
+    heading = `${label} needs Vault recovery`;
+    summary = detail;
+  }
+  return { detail, heading, summary };
+}

package/packages/gui-web/src/status-client.ts

@@ -6,6 +6,7 @@ import {
   type GuiFileRootId,
   type GuiResponseEnvelope,
   type GuiStatusData,
+  type GuiVaultStatusData,
   statusFixture,
 } from "../../gui-shared/src";
 
@@ -28,10 +29,15 @@ export function mockedStatus(): GuiResponseEnvelope<GuiStatusData> {
       authority: "aidevops helpers",
       path_refs: ["~/.aidevops/agents", "~/.config/aidevops/settings.json"],
     },
-    data: statusFixture,
+    data: { ...statusFixture, secrets: [] },
   });
 }
 
+export function unavailableStatus(): GuiResponseEnvelope<GuiStatusData> {
+  const envelope = mockedStatus();
+  return { ...envelope, data: { ...envelope.data, vault: unavailableVault("error") } };
+}
+
 export async function fetchFileExplorer(
   rootId: GuiFileRootId,
   relativePath = "",
@@ -68,6 +74,7 @@ export function mockedFileExplorer(rootId: GuiFileRootId): GuiResponseEnvelope<G
 function normalizeStatusEnvelope(envelope: GuiResponseEnvelope<Partial<GuiStatusData>>): GuiResponseEnvelope<GuiStatusData> {
   const data = envelope.data ?? {};
 
+  const vault = normalizeVault(data.vault);
   return {
     ...envelope,
     data: {
@@ -88,31 +95,72 @@ function normalizeStatusEnvelope(envelope: GuiResponseEnvelope<Partial<GuiStatus
       ai_apps: data.ai_apps ?? statusFixture.ai_apps,
       managed_apps: data.managed_apps ?? statusFixture.managed_apps,
       notifications: data.notifications ?? statusFixture.notifications,
-      vault: {
-        ...statusFixture.vault,
-        ...data.vault,
-        readiness: { ...statusFixture.vault.readiness, ...data.vault?.readiness },
-        collections: data.vault?.collections ?? statusFixture.vault.collections,
-        devices: data.vault?.devices ?? statusFixture.vault.devices,
-        sync: { ...statusFixture.vault.sync, ...data.vault?.sync },
-        secure_messages: { ...statusFixture.vault.secure_messages, ...data.vault?.secure_messages },
-        backups: { ...statusFixture.vault.backups, ...data.vault?.backups },
-        audit: { ...statusFixture.vault.audit, ...data.vault?.audit },
-      },
-      pulse_workers: {
-        ...statusFixture.pulse_workers,
-        ...data.pulse_workers,
-        kpis: data.pulse_workers?.kpis ?? statusFixture.pulse_workers.kpis,
-        attention: data.pulse_workers?.attention ?? statusFixture.pulse_workers.attention,
-        insights: data.pulse_workers?.insights ?? statusFixture.pulse_workers.insights,
-        filters: { ...statusFixture.pulse_workers.filters, ...data.pulse_workers?.filters },
-        charts: data.pulse_workers?.charts ?? statusFixture.pulse_workers.charts,
-        events: data.pulse_workers?.events ?? statusFixture.pulse_workers.events,
-        actions: data.pulse_workers?.actions ?? statusFixture.pulse_workers.actions,
-      },
+      vault,
+      pulse_workers: normalizePulseWorkers(data.pulse_workers),
       capabilities: data.capabilities ?? statusFixture.capabilities,
-      secrets: data.secrets ?? statusFixture.secrets,
+      secrets: visibleSecrets(vault, data.secrets),
       placeholders: data.placeholders ?? statusFixture.placeholders,
     },
   };
 }
+
+function normalizePulseWorkers(
+  pulseWorkers: GuiStatusData["pulse_workers"] | undefined,
+): GuiStatusData["pulse_workers"] {
+  return {
+    ...statusFixture.pulse_workers,
+    ...pulseWorkers,
+    kpis: pulseWorkers?.kpis ?? statusFixture.pulse_workers.kpis,
+    attention: pulseWorkers?.attention ?? statusFixture.pulse_workers.attention,
+    insights: pulseWorkers?.insights ?? statusFixture.pulse_workers.insights,
+    filters: { ...statusFixture.pulse_workers.filters, ...pulseWorkers?.filters },
+    charts: pulseWorkers?.charts ?? statusFixture.pulse_workers.charts,
+    events: pulseWorkers?.events ?? statusFixture.pulse_workers.events,
+    actions: pulseWorkers?.actions ?? statusFixture.pulse_workers.actions,
+  };
+}
+
+function visibleSecrets(
+  vault: GuiVaultStatusData,
+  secrets: GuiStatusData["secrets"] | undefined,
+): GuiStatusData["secrets"] {
+  return vault.status === "unlocked" && vault.unlocked ? secrets ?? [] : [];
+}
+
+function normalizeVault(vault: GuiStatusData["vault"] | undefined): GuiVaultStatusData {
+  if (vault === undefined || vault.status === undefined || vault.setup_state === undefined) {
+    return unavailableVault("unchecked");
+  }
+  return {
+    ...statusFixture.vault,
+    ...vault,
+    readiness: { ...statusFixture.vault.readiness, ...vault.readiness },
+    collections: vault.collections ?? statusFixture.vault.collections,
+    devices: vault.devices ?? statusFixture.vault.devices,
+    sync: { ...statusFixture.vault.sync, ...vault.sync },
+    secure_messages: { ...statusFixture.vault.secure_messages, ...vault.secure_messages },
+    backups: { ...statusFixture.vault.backups, ...vault.backups },
+    audit: { ...statusFixture.vault.audit, ...vault.audit },
+  };
+}
+
+function unavailableVault(helperStatus: GuiVaultStatusData["helper_status"]): GuiVaultStatusData {
+  return {
+    ...statusFixture.vault,
+    status: "unknown",
+    setup_state: "unknown",
+    initialized: false,
+    locked: true,
+    unlocked: false,
+    available: false,
+    helper_status: helperStatus,
+    readiness: {
+      ...statusFixture.vault.readiness,
+      migration_allowed: false,
+      setup_required: false,
+      restart_test_required: false,
+      locked_content_hidden: true,
+    },
+    collections: statusFixture.vault.collections.map((collection) => ({ ...collection, state: collection.state === "planned" ? "planned" : "unknown" })),
+  };
+}