okengine 0.10.2 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +76 -10
- package/site/content/docs/ai/mcp.mdx +0 -1
- package/site/content/docs/deployment/docker-swarm.mdx +48 -111
- package/site/content/docs/deployment/docker.mdx +43 -36
- package/site/content/docs/deployment/index.mdx +9 -9
- package/site/content/docs/deployment/kubernetes.mdx +4 -4
- package/site/content/docs/elements/ai.mdx +7 -13
- package/site/content/docs/elements/channel.mdx +9 -13
- package/site/content/docs/elements/clock.mdx +8 -14
- package/site/content/docs/elements/flow.mdx +46 -54
- package/site/content/docs/elements/gate.mdx +6 -11
- package/site/content/docs/elements/signal.mdx +2 -8
- package/site/content/docs/elements/store.mdx +79 -93
- package/site/content/docs/elements/vault.mdx +89 -76
- package/site/content/docs/get-started/basic-usage.mdx +8 -14
- package/site/content/docs/get-started/installation.mdx +36 -36
- package/site/content/docs/get-started/introduction.mdx +11 -0
- package/site/content/docs/get-started/why.mdx +3 -4
- package/site/content/docs/index.mdx +0 -1
- package/site/content/docs/meta.json +0 -1
- package/site/content/docs/plugins/anonymous.mdx +1 -1
- package/site/content/docs/plugins/magic-link.mdx +11 -11
- package/site/content/docs/plugins/otp.mdx +2 -2
- package/site/content/docs/plugins/passkey.mdx +1 -1
- package/site/content/docs/plugins/two-factor.mdx +1 -1
- package/site/content/docs/plugins/username.mdx +1 -1
- package/site/content/docs/recipes/caddy.mdx +1 -1
- package/site/content/docs/recipes/cockroachdb.mdx +2 -2
- package/site/content/docs/recipes/dragonfly.mdx +1 -1
- package/site/content/docs/recipes/index.mdx +1 -2
- package/site/content/docs/recipes/llama-cpp.mdx +21 -23
- package/site/content/docs/recipes/mailpit.mdx +11 -11
- package/site/content/docs/recipes/meilisearch.mdx +10 -10
- package/site/content/docs/recipes/meta.json +0 -1
- package/site/content/docs/recipes/ollama.mdx +1 -1
- package/site/content/docs/recipes/pgdog.mdx +12 -9
- package/site/content/docs/recipes/postgres.mdx +3 -3
- package/site/content/docs/recipes/redis.mdx +2 -2
- package/site/content/docs/recipes/rustfs.mdx +10 -7
- package/site/content/docs/recipes/sglang.mdx +1 -1
- package/site/content/docs/recipes/supabase-docker.mdx +1 -1
- package/site/content/docs/recipes/timescale.mdx +2 -2
- package/site/content/docs/recipes/valkey.mdx +1 -1
- package/site/content/docs/recipes/vllm.mdx +1 -1
- package/site/content/docs/recipes/yugabytedb.mdx +2 -2
- package/site/content/docs/reference/cli.md +61 -38
- package/site/content/docs/reference/configuration.mdx +145 -70
- package/site/content/docs/reference/environment-variables.mdx +36 -28
- package/site/content/docs/reference/errors.mdx +28 -29
- package/site/content/docs/reference/fx.mdx +14 -7
- package/site/content/docs/reference/i18n.mdx +17 -6
- package/site/content/docs/reference/index.mdx +5 -0
- package/site/content/docs/reference/meta.json +1 -0
- package/site/content/docs/reference/migrating-environments.mdx +158 -0
- package/site/content/docs/reference/plugins.mdx +2 -2
- package/src/auth/gate-auth.test.ts +12 -10
- package/src/cli/ai-setup/ai-setup.test.ts +30 -16
- package/src/cli/ai-setup/apply.ts +111 -15
- package/src/cli/ai-setup/catalog.ts +3 -3
- package/src/cli/ai-setup/index.ts +1 -1
- package/src/cli/ai-setup/prompts.ts +1 -1
- package/src/cli/ai-setup/recommend.test.ts +1 -1
- package/src/cli/ask-seed.test.ts +3 -3
- package/src/cli/build.ts +8 -9
- package/src/cli/db-auto-push.test.ts +6 -3
- package/src/cli/db-auto-push.ts +7 -5
- package/src/cli/db-seed.ts +7 -8
- package/src/cli/db.test.ts +70 -71
- package/src/cli/db.ts +86 -12
- package/src/cli/dev-controller.test.ts +35 -0
- package/src/cli/dev-controller.ts +298 -0
- package/src/cli/dev-controls.ts +11 -65
- package/src/cli/dev-db-push.test.ts +47 -15
- package/src/cli/dev-schema-sync.test.ts +11 -11
- package/src/cli/dev-schema-sync.ts +10 -10
- package/src/cli/dev-session-lock.test.ts +106 -0
- package/src/cli/dev-session-lock.ts +209 -0
- package/src/cli/dev.test.ts +246 -114
- package/src/cli/dev.ts +153 -205
- package/src/cli/doc-staleness.test.ts +3 -6
- package/src/cli/docker-clean.test.ts +33 -1
- package/src/cli/docker-clean.ts +28 -33
- package/src/cli/docker-cli.test.ts +12 -11
- package/src/cli/docker.ts +95 -20
- package/src/cli/doctor.test.ts +40 -0
- package/src/cli/doctor.ts +142 -9
- package/src/cli/drizzle-env.test.ts +11 -13
- package/src/cli/drizzle-env.ts +18 -11
- package/src/cli/ensure-drizzle-config.ts +11 -14
- package/src/cli/hero-meta.test.ts +15 -15
- package/src/cli/hero-meta.ts +10 -9
- package/src/cli/index.ts +36 -6
- package/src/cli/load-config.images.test.ts +44 -10
- package/src/cli/load-config.source.test.ts +50 -0
- package/src/cli/load-config.ts +35 -29
- package/src/cli/meilisearch-local.ts +1 -2
- package/src/cli/mode.ts +7 -58
- package/src/cli/registry.ts +175 -19
- package/src/cli/resolve-dev-sql-env.test.ts +8 -16
- package/src/cli/resolve-dev-sql-env.ts +13 -15
- package/src/cli/safe-defaults.test.ts +29 -11
- package/src/cli/schema.ts +65 -16
- package/src/cli/test.ts +58 -0
- package/src/cli/tui/App.tsx +252 -0
- package/src/cli/tui/DevLive.tsx +116 -0
- package/src/cli/tui/components/ConfirmDialog.tsx +48 -0
- package/src/cli/tui/components/HeaderBar.tsx +67 -0
- package/src/cli/tui/components/LogStream.tsx +47 -0
- package/src/cli/tui/components/PanelCard.tsx +39 -0
- package/src/cli/tui/components/SelectRow.tsx +37 -0
- package/src/cli/tui/components/SlashPalette.tsx +172 -0
- package/src/cli/tui/components/Spinner.tsx +32 -0
- package/src/cli/tui/components/StatusBar.tsx +51 -0
- package/src/cli/tui/components/StatusDot.tsx +37 -0
- package/src/cli/tui/components/TabBar.tsx +49 -0
- package/src/cli/tui/components/Wordmark.tsx +43 -0
- package/src/cli/tui/format.ts +38 -0
- package/src/cli/tui/keys.test.ts +18 -0
- package/src/cli/tui/keys.ts +26 -0
- package/src/cli/tui/launch.test.ts +18 -0
- package/src/cli/tui/launch.ts +57 -0
- package/src/cli/tui/panels/Dashboard.tsx +201 -0
- package/src/cli/tui/panels/Database.tsx +198 -0
- package/src/cli/tui/panels/Dev.tsx +257 -0
- package/src/cli/tui/panels/Docker.tsx +357 -0
- package/src/cli/tui/panels/Navigator.test.ts +22 -0
- package/src/cli/tui/panels/Navigator.tsx +213 -0
- package/src/cli/tui/slash-catalog.test.ts +31 -0
- package/src/cli/tui/slash-catalog.ts +184 -0
- package/src/cli/tui/slash-run.ts +54 -0
- package/src/cli/tui/state/ports.ts +95 -0
- package/src/cli/tui/theme.ts +24 -0
- package/src/cli/vault-cmd.test.ts +402 -0
- package/src/cli/vault-cmd.ts +727 -69
- package/src/cli/vault-secure-input.test.ts +56 -0
- package/src/cli/vault-secure-input.ts +124 -0
- package/src/compiler/effects-infer.ts +7 -0
- package/src/compiler/extract.ts +12 -0
- package/src/compiler/fixtures/skyport/oke.config.ts +7 -5
- package/src/compiler/fixtures/skyport/src/flows/payments/index.ts +1 -1
- package/src/compiler/fixtures/skyport.expected.json +1 -1
- package/src/compiler/generate-adopt.ts +27 -1
- package/src/compiler-entry.ts +7 -0
- package/src/config/define-config.test.ts +111 -47
- package/src/config/driver-defaults.test.ts +115 -0
- package/src/config/driver-defaults.ts +156 -0
- package/src/config/index.ts +246 -131
- package/src/config/resolve-driver.test.ts +14 -19
- package/src/console/server/app.ts +4 -2
- package/src/console/server/console.test.ts +58 -1
- package/src/console/server/flows.ts +22 -2
- package/src/console/server/index.ts +3 -0
- package/src/console/server/operator-db.test.ts +55 -13
- package/src/console/server/operator-db.ts +305 -263
- package/src/console/server/serve.ts +16 -7
- package/src/console/server/state.ts +31 -9
- package/src/console/server/vault.test.ts +120 -5
- package/src/console/server/vault.ts +208 -12
- package/src/console/ui/dist/assets/{index-D-9KFce5.js → index--Y0Uaz-m.js} +2 -2
- package/src/console/ui/dist/assets/panel-vault-BkZdJPX8.js +1 -0
- package/src/console/ui/dist/assets/style-C3L349iZ.css +3 -0
- package/src/console/ui/dist/index.html +2 -2
- package/src/console/ui/shell/client.ts +16 -0
- package/src/console/ui/shell/panels/vault/VaultPanel.tsx +54 -1
- package/src/console/ui/vault/VaultA11yView.tsx +33 -1
- package/src/console/ui/vault/backend.test.ts +75 -0
- package/src/console/ui/vault/backend.ts +117 -0
- package/src/console/ui/vault/fixture.ts +21 -2
- package/src/console/ui/vault/index.ts +11 -1
- package/src/console/ui/vault/types.ts +26 -0
- package/src/docker/compose.ts +164 -61
- package/src/docker/derive.ts +106 -12
- package/src/docker/docker.test.ts +156 -110
- package/src/docker/helpers.ts +98 -0
- package/src/docker/images-config.test.ts +163 -0
- package/src/docker/index.ts +30 -5
- package/src/docker/recipes/index.ts +0 -3
- package/src/docker/recipes/llama-cpp.ts +4 -4
- package/src/docker/recipes/pgdog.ts +9 -2
- package/src/docker/resources.test.ts +71 -0
- package/src/docker/resources.ts +176 -0
- package/src/docker/stack-id.test.ts +11 -4
- package/src/docker/stack-id.ts +42 -32
- package/src/docker/stack.integration.test.ts +4 -15
- package/src/docker/types.ts +35 -3
- package/src/drivers/ai-ollama.integration.test.ts +2 -2
- package/src/drivers/conformance.test.ts +11 -12
- package/src/drivers/drizzle-dialect.test.ts +0 -4
- package/src/drivers/drizzle-dialect.ts +7 -13
- package/src/drivers/index.ts +24 -7
- package/src/drivers/journal-postgres.test.ts +3 -1
- package/src/drivers/journal-postgres.ts +4 -2
- package/src/drivers/meilisearch.ts +1 -1
- package/src/drivers/pglite.ts +28 -5
- package/src/drivers/types.ts +9 -11
- package/src/drivers/vault-aws-secrets-manager.test.ts +159 -0
- package/src/drivers/vault-aws-secrets-manager.ts +333 -0
- package/src/drivers/vault-builtin.test.ts +110 -0
- package/src/drivers/vault-builtin.ts +184 -0
- package/src/drivers/vault-driver-removal.test.ts +13 -0
- package/src/drivers/vault-managed.test.ts +95 -0
- package/src/drivers/vault-managed.ts +101 -25
- package/src/drivers/vault-types.ts +25 -5
- package/src/elements/ai/runtime.ts +1 -1
- package/src/elements/clock/chaos.test.ts +4 -1
- package/src/elements/clock/durable.ts +57 -4
- package/src/elements/clock.test.ts +13 -14
- package/src/elements/gate/constants.ts +18 -0
- package/src/elements/gate.test.ts +1 -1
- package/src/elements/gate.ts +2 -2
- package/src/elements/store/domain-ddl.test.ts +5 -12
- package/src/elements/store/emit-drizzle.ts +44 -19
- package/src/elements/store/index-boot.test.ts +15 -116
- package/src/elements/store/load-plugin-tables.ts +1 -1
- package/src/elements/store/resource-list-docs.fixture.ts +12 -6
- package/src/elements/store/resource-list-docs.test.ts +64 -44
- package/src/elements/store/resource.test.ts +17 -10
- package/src/elements/store/runtime.ts +9 -12
- package/src/elements/store/schema-decl.test.ts +16 -32
- package/src/elements/store/seed.test.ts +1 -2
- package/src/elements/store/seed.ts +7 -8
- package/src/elements/store/sql-condition.test.ts +2 -2
- package/src/elements/store/sql-session.test.ts +8 -10
- package/src/elements/store/sql-session.ts +10 -2
- package/src/elements/store.test.ts +13 -13
- package/src/elements/vault/audit.ts +233 -0
- package/src/elements/vault/boot-chain.test.ts +78 -0
- package/src/elements/vault/boot-chain.ts +43 -39
- package/src/elements/vault/builtin-adapter.test.ts +479 -0
- package/src/elements/vault/builtin-adapter.ts +1184 -0
- package/src/elements/vault/crypto.test.ts +237 -0
- package/src/elements/vault/crypto.ts +431 -0
- package/src/elements/vault/declare.ts +164 -3
- package/src/elements/vault/errors.ts +56 -0
- package/src/elements/vault/kms-unseal.test.ts +76 -0
- package/src/elements/vault/kms-unseal.ts +181 -0
- package/src/elements/vault/path.ts +90 -0
- package/src/elements/vault/resilience.test.ts +102 -0
- package/src/elements/vault/resilience.ts +107 -0
- package/src/elements/vault/runtime.ts +36 -4
- package/src/elements/vault/security-checklist.test.ts +130 -0
- package/src/elements/vault/storage.ts +448 -0
- package/src/elements/vault/types.ts +288 -0
- package/src/elements/vault/unseal.ts +150 -0
- package/src/elements/vault.test.ts +72 -4
- package/src/elements/vault.ts +91 -2
- package/src/full.ts +248 -0
- package/src/http.ts +41 -0
- package/src/i18n/interpolate-simple.ts +37 -0
- package/src/i18n/messages.ts +51 -4
- package/src/i18n-entry.ts +7 -0
- package/src/index.ts +35 -145
- package/src/journal-entry.ts +20 -0
- package/src/kernel/adopt-barrel-fresh.test.ts +25 -10
- package/src/kernel/app.ts +40 -42
- package/src/kernel/auto-registry.test.ts +2 -2
- package/src/kernel/boot-bind/ai.test.ts +5 -5
- package/src/kernel/boot-bind/ai.ts +2 -1
- package/src/kernel/boot-bind/channel.test.ts +6 -6
- package/src/kernel/boot-bind/channel.ts +5 -4
- package/src/kernel/boot-bind/clock.ts +5 -5
- package/src/kernel/boot-bind/gate.ts +6 -7
- package/src/kernel/boot-bind/honor-config.test.ts +42 -42
- package/src/kernel/boot-bind/journal.ts +5 -5
- package/src/kernel/boot-bind/signal.ts +3 -1
- package/src/kernel/boot-bind/store.test.ts +55 -37
- package/src/kernel/boot-bind/store.ts +24 -34
- package/src/kernel/boot-bind/vault.ts +19 -4
- package/src/kernel/boot.test.ts +12 -4
- package/src/kernel/boot.ts +31 -19
- package/src/kernel/budget-entry.ts +1 -1
- package/src/kernel/compensate.test.ts +288 -1
- package/src/kernel/compensate.ts +126 -0
- package/src/kernel/concurrency.test.ts +10 -9
- package/src/kernel/effects-stamping.test.ts +27 -2
- package/src/kernel/element-registries.ts +5 -3
- package/src/kernel/flow.ts +4 -2
- package/src/kernel/fx.test.ts +119 -3
- package/src/kernel/fx.ts +215 -40
- package/src/kernel/index.ts +14 -0
- package/src/kernel/journal.ts +130 -7
- package/src/kernel/pipeline.test.ts +20 -6
- package/src/kernel/redacted.test.ts +35 -0
- package/src/kernel/redacted.ts +24 -2
- package/src/kernel/router/create-default.ts +16 -0
- package/src/kernel/router/create-edge.ts +18 -0
- package/src/kernel/router/create.ts +23 -0
- package/src/kernel/router/index.ts +23 -0
- package/src/kernel/router/linear.ts +88 -0
- package/src/kernel/router/regexp.ts +188 -0
- package/src/kernel/router/smart.ts +120 -0
- package/src/kernel/router/trie.ts +108 -0
- package/src/kernel/router/types.ts +56 -0
- package/src/kernel/router.ts +18 -532
- package/src/kernel-entry.ts +43 -0
- package/src/manifest/fixtures/skyport.excerpt.json +1 -1
- package/src/manifest/fixtures/skyport.manifest.json +1 -1
- package/src/plugins/config-source.test.ts +7 -7
- package/src/release/build-lib.ts +58 -0
- package/src/release/exports.test.ts +4 -2
- package/src/release/exports.ts +30 -4
- package/src/release/measure.ts +101 -22
- package/src/runs/duckdb.ts +7 -2
- package/src/shared/optional-peer.ts +41 -0
- package/src/term.test.ts +3 -44
- package/src/test/create-test-app.ts +12 -0
- package/src/test/provisions.integration.test.ts +1 -1
- package/src/test/reset-element-registries.ts +2 -0
- package/src/upgrade/codemods.test.ts +7 -20
- package/src/upgrade/codemods.ts +93 -60
- package/site/content/docs/console/access.mdx +0 -29
- package/site/content/docs/console/ai.mdx +0 -35
- package/site/content/docs/console/architecture.mdx +0 -35
- package/site/content/docs/console/channels.mdx +0 -37
- package/site/content/docs/console/clock.mdx +0 -51
- package/site/content/docs/console/flows.mdx +0 -31
- package/site/content/docs/console/gates.mdx +0 -73
- package/site/content/docs/console/index.mdx +0 -54
- package/site/content/docs/console/manifest-diff.mdx +0 -34
- package/site/content/docs/console/meta.json +0 -24
- package/site/content/docs/console/overview.mdx +0 -40
- package/site/content/docs/console/plugins.mdx +0 -41
- package/site/content/docs/console/privacy.mdx +0 -32
- package/site/content/docs/console/runs.mdx +0 -50
- package/site/content/docs/console/signals.mdx +0 -40
- package/site/content/docs/console/store.mdx +0 -32
- package/site/content/docs/console/tenancy.mdx +0 -32
- package/site/content/docs/console/traces.mdx +0 -38
- package/site/content/docs/console/vault.mdx +0 -41
- package/site/content/docs/recipes/openbao.mdx +0 -141
- package/src/cli/ask-dev-mode.ts +0 -40
- package/src/cli/dev-mode.test.ts +0 -45
- package/src/cli/dev-mode.ts +0 -78
- package/src/cli/openbao-bootstrap.test.ts +0 -150
- package/src/cli/openbao-bootstrap.ts +0 -321
- package/src/cli/openbao-restart.integration.test.ts +0 -145
- package/src/console/ui/dist/assets/panel-vault-Za1GyJfM.js +0 -1
- package/src/console/ui/dist/assets/style-C8MxEWPd.css +0 -3
- package/src/docker/recipes/openbao.ts +0 -47
- package/src/drivers/libsql.ts +0 -179
- package/src/drivers/sqlite.ts +0 -44
- package/src/drivers/vault-openbao.test.ts +0 -97
- package/src/drivers/vault-openbao.ts +0 -143
|
@@ -1,3 +0,0 @@
|
|
|
1
|
-
/*! tailwindcss v4.3.3 | MIT License | https://tailwindcss.com */
|
|
2
|
-
@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-space-y-reverse:0;--tw-divide-y-reverse:0;--tw-border-style:solid;--tw-leading:initial;--tw-font-weight:initial;--tw-tracking:initial;--tw-ordinal:initial;--tw-slashed-zero:initial;--tw-numeric-figure:initial;--tw-numeric-spacing:initial;--tw-numeric-fraction:initial;--tw-outline-style:solid;--tw-duration:initial}}}@layer theme{:root,:host{--font-sans:-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", "Noto Sans", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";--font-mono:ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;--color-red-600:oklch(57.7% .245 27.325);--color-red-700:oklch(50.5% .213 27.518);--color-amber-800:oklch(47.3% .137 46.201);--color-black:#000;--color-white:#fff;--spacing:.25rem;--container-xs:20rem;--container-sm:24rem;--container-md:28rem;--container-lg:32rem;--container-2xl:42rem;--container-5xl:64rem;--text-xs:.75rem;--text-xs--line-height:calc(1 / .75);--text-sm:.875rem;--text-sm--line-height:calc(1.25 / .875);--text-base:1rem;--text-base--line-height:calc(1.5 / 1);--text-lg:1.125rem;--text-lg--line-height:calc(1.75 / 1.125);--text-xl:1.25rem;--text-xl--line-height:calc(1.75 / 1.25);--text-2xl:1.5rem;--text-2xl--line-height:calc(2 / 1.5);--text-3xl:1.875rem;--text-3xl--line-height:calc(2.25 / 1.875);--font-weight-normal:400;--font-weight-medium:500;--font-weight-semibold:600;--tracking-tight:-.025em;--tracking-wide:.025em;--tracking-wider:.05em;--leading-snug:1.375;--leading-relaxed:1.625;--radius-sm:.25rem;--default-transition-duration:.15s;--default-transition-timing-function:cubic-bezier(.4, 0, .2, 1);--default-font-family:var(--font-sans);--default-mono-font-family:var(--font-mono)}}@layer base{*,:after,:before,::backdrop{box-sizing:border-box;border:0 solid;margin:0;padding:0}::file-selector-button{box-sizing:border-box;border:0 solid;margin:0;padding:0}html,:host{-webkit-text-size-adjust:100%;tab-size:4;line-height:1.5;font-family:var(--default-font-family,-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", "Noto Sans", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji");font-feature-settings:var(--default-font-feature-settings,normal);font-variation-settings:var(--default-font-variation-settings,normal);-webkit-tap-highlight-color:transparent}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;-webkit-text-decoration:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:var(--default-mono-font-family,ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace);font-feature-settings:var(--default-mono-font-feature-settings,normal);font-variation-settings:var(--default-mono-font-variation-settings,normal);font-size:1em}small{font-size:80%}sub,sup{vertical-align:baseline;font-size:75%;line-height:0;position:relative}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}:-moz-focusring:where(:not(iframe)){outline:auto}progress{vertical-align:baseline}summary{display:list-item}ol,ul,menu{list-style:none}img,svg,video,canvas,audio,iframe,embed,object{vertical-align:middle;display:block}img,video{max-width:100%;height:auto}button,input,select,optgroup,textarea{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}::file-selector-button{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}:where(select:is([multiple],[size])) optgroup{font-weight:bolder}:where(select:is([multiple],[size])) optgroup option{padding-inline-start:20px}::file-selector-button{margin-inline-end:4px}::placeholder{opacity:1}@supports (not ((-webkit-appearance:-apple-pay-button))) or (contain-intrinsic-size:1px){::placeholder{color:currentColor}@supports (color:color-mix(in lab, red, red)){::placeholder{color:color-mix(in oklab, currentcolor 50%, transparent)}}}textarea{resize:vertical}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-date-and-time-value{min-height:1lh;text-align:inherit}::-webkit-datetime-edit{display:inline-flex}::-webkit-datetime-edit-fields-wrapper{padding:0}::-webkit-datetime-edit{padding-block:0}::-webkit-datetime-edit-year-field{padding-block:0}::-webkit-datetime-edit-month-field{padding-block:0}::-webkit-datetime-edit-day-field{padding-block:0}::-webkit-datetime-edit-hour-field{padding-block:0}::-webkit-datetime-edit-minute-field{padding-block:0}::-webkit-datetime-edit-second-field{padding-block:0}::-webkit-datetime-edit-millisecond-field{padding-block:0}::-webkit-datetime-edit-meridiem-field{padding-block:0}::-webkit-calendar-picker-indicator{line-height:1}:-moz-ui-invalid{box-shadow:none}button,input:where([type=button],[type=reset],[type=submit]){appearance:button}::file-selector-button{appearance:button}::-webkit-inner-spin-button{height:auto}::-webkit-outer-spin-button{height:auto}[hidden]:where(:not([hidden=until-found])){display:none!important}}@layer components;@layer utilities{.visible{visibility:visible}.sr-only{clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.absolute{position:absolute}.fixed{position:fixed}.relative{position:relative}.sticky{position:sticky}.inset-0{inset:0}.inset-y-0{inset-block:0}.top-0{top:0}.right-\[min\(28\%\,20rem\)\]{right:min(28%,20rem)}.left-\[min\(28\%\,20rem\)\]{left:min(28%,20rem)}.z-10{z-index:10}.z-20{z-index:20}.z-50{z-index:50}.col-span-2{grid-column:span 2/span 2}.mx-auto{margin-inline:auto}.mt-1{margin-top:var(--spacing)}.mt-2{margin-top:calc(var(--spacing) * 2)}.mt-3{margin-top:calc(var(--spacing) * 3)}.mt-4{margin-top:calc(var(--spacing) * 4)}.mt-6{margin-top:calc(var(--spacing) * 6)}.mt-8{margin-top:calc(var(--spacing) * 8)}.mt-auto{margin-top:auto}.mr-2{margin-right:calc(var(--spacing) * 2)}.mr-3{margin-right:calc(var(--spacing) * 3)}.mr-auto{margin-right:auto}.mb-1{margin-bottom:var(--spacing)}.mb-2{margin-bottom:calc(var(--spacing) * 2)}.mb-3{margin-bottom:calc(var(--spacing) * 3)}.mb-4{margin-bottom:calc(var(--spacing) * 4)}.mb-8{margin-bottom:calc(var(--spacing) * 8)}.ml-1{margin-left:var(--spacing)}.ml-2{margin-left:calc(var(--spacing) * 2)}.ml-auto{margin-left:auto}.block{display:block}.contents{display:contents}.flex{display:flex}.grid{display:grid}.inline-block{display:inline-block}.inline-flex{display:inline-flex}.size-1\.5{width:calc(var(--spacing) * 1.5);height:calc(var(--spacing) * 1.5)}.h-1\.5{height:calc(var(--spacing) * 1.5)}.h-2{height:calc(var(--spacing) * 2)}.h-4{height:calc(var(--spacing) * 4)}.h-6{height:calc(var(--spacing) * 6)}.h-7{height:calc(var(--spacing) * 7)}.h-12{height:calc(var(--spacing) * 12)}.h-16{height:calc(var(--spacing) * 16)}.h-40{height:calc(var(--spacing) * 40)}.h-64{height:calc(var(--spacing) * 64)}.h-\[calc\(100vh-3rem\)\]{height:calc(100vh - 3rem)}.h-auto{height:auto}.h-full{height:100%}.max-h-48{max-height:calc(var(--spacing) * 48)}.min-h-0{min-height:0}.min-h-2{min-height:calc(var(--spacing) * 2)}.min-h-8{min-height:calc(var(--spacing) * 8)}.min-h-10{min-height:calc(var(--spacing) * 10)}.min-h-20{min-height:calc(var(--spacing) * 20)}.min-h-24{min-height:calc(var(--spacing) * 24)}.w-2{width:calc(var(--spacing) * 2)}.w-5{width:calc(var(--spacing) * 5)}.w-6{width:calc(var(--spacing) * 6)}.w-16{width:calc(var(--spacing) * 16)}.w-24{width:calc(var(--spacing) * 24)}.w-56{width:calc(var(--spacing) * 56)}.w-64{width:calc(var(--spacing) * 64)}.w-72{width:calc(var(--spacing) * 72)}.w-80{width:calc(var(--spacing) * 80)}.w-auto{width:auto}.w-full{width:100%}.max-w-2xl{max-width:var(--container-2xl)}.max-w-5xl{max-width:var(--container-5xl)}.max-w-lg{max-width:var(--container-lg)}.max-w-md{max-width:var(--container-md)}.max-w-prose{max-width:65ch}.max-w-sm{max-width:var(--container-sm)}.max-w-xs{max-width:var(--container-xs)}.min-w-0{min-width:0}.min-w-2{min-width:calc(var(--spacing) * 2)}.min-w-8{min-width:calc(var(--spacing) * 8)}.min-w-\[4px\]{min-width:4px}.min-w-\[8rem\]{min-width:8rem}.min-w-\[12rem\]{min-width:12rem}.min-w-\[16rem\]{min-width:16rem}.flex-1{flex:1}.shrink-0{flex-shrink:0}.basis-full{flex-basis:100%}.border-collapse{border-collapse:collapse}.cursor-pointer{cursor:pointer}.list-inside{list-style-position:inside}.list-decimal{list-style-type:decimal}.list-disc{list-style-type:disc}.list-none{list-style-type:none}.grid-cols-1{grid-template-columns:repeat(1,minmax(0,1fr))}.grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.grid-cols-\[minmax\(0\,8rem\)_1fr\]{grid-template-columns:minmax(0,8rem) 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.place-items-center{place-items:center}.items-baseline{align-items:baseline}.items-center{align-items:center}.items-end{align-items:flex-end}.items-start{align-items:flex-start}.items-stretch{align-items:stretch}.justify-between{justify-content:space-between}.justify-center{justify-content:center}.gap-0{gap:0}.gap-0\.5{gap:calc(var(--spacing) * .5)}.gap-1{gap:var(--spacing)}.gap-1\.5{gap:calc(var(--spacing) * 1.5)}.gap-2{gap:calc(var(--spacing) * 2)}.gap-3{gap:calc(var(--spacing) * 3)}.gap-4{gap:calc(var(--spacing) * 4)}.gap-6{gap:calc(var(--spacing) * 6)}.gap-8{gap:calc(var(--spacing) * 8)}.gap-px{gap:1px}:where(.space-y-0\.5>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * .5) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * .5) * calc(1 - var(--tw-space-y-reverse)))}:where(.space-y-1>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(var(--spacing) * var(--tw-space-y-reverse));margin-block-end:calc(var(--spacing) * calc(1 - var(--tw-space-y-reverse)))}:where(.space-y-2>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * 2) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * 2) * calc(1 - var(--tw-space-y-reverse)))}:where(.space-y-3>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * 3) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * 3) * calc(1 - var(--tw-space-y-reverse)))}:where(.space-y-4>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * 4) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * 4) * calc(1 - var(--tw-space-y-reverse)))}:where(.space-y-6>:not(:last-child)){--tw-space-y-reverse:0;margin-block-start:calc(calc(var(--spacing) * 6) * var(--tw-space-y-reverse));margin-block-end:calc(calc(var(--spacing) * 6) * calc(1 - var(--tw-space-y-reverse)))}.gap-x-4{column-gap:calc(var(--spacing) * 4)}.gap-y-1{row-gap:var(--spacing)}.gap-y-2{row-gap:calc(var(--spacing) * 2)}:where(.divide-y>:not(:last-child)){--tw-divide-y-reverse:0;border-bottom-style:var(--tw-border-style);border-top-style:var(--tw-border-style);border-top-width:calc(1px * var(--tw-divide-y-reverse));border-bottom-width:calc(1px * calc(1 - var(--tw-divide-y-reverse)))}:where(.divide-\[var\(--oke-line\)\]>:not(:last-child)){border-color:var(--oke-line)}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.overflow-auto{overflow:auto}.overflow-hidden{overflow:hidden}.overflow-x-auto{overflow-x:auto}.overflow-y-auto{overflow-y:auto}.rounded{border-radius:.25rem}.rounded-full{border-radius:2147483647px}.rounded-sm{border-radius:var(--radius-sm)}.border{border-style:var(--tw-border-style);border-width:1px}.border-x{border-inline-style:var(--tw-border-style);border-inline-width:1px}.border-y{border-block-style:var(--tw-border-style);border-block-width:1px}.border-t{border-top-style:var(--tw-border-style);border-top-width:1px}.border-r{border-right-style:var(--tw-border-style);border-right-width:1px}.border-b{border-bottom-style:var(--tw-border-style);border-bottom-width:1px}.border-l{border-left-style:var(--tw-border-style);border-left-width:1px}.border-dashed{--tw-border-style:dashed;border-style:dashed}.border-\[var\(--oke-accent\)\]{border-color:var(--oke-accent)}.border-\[var\(--oke-external\)\]{border-color:var(--oke-external)}.border-\[var\(--oke-line\)\],.border-\[var\(--oke-line\)\]\/50{border-color:var(--oke-line)}@supports (color:color-mix(in lab, red, red)){.border-\[var\(--oke-line\)\]\/50{border-color:color-mix(in oklab, var(--oke-line) 50%, transparent)}}.border-\[var\(--oke-muted\)\]{border-color:var(--oke-muted)}.bg-\[color-mix\(in_oklab\,var\(--oke-accent\)_55\%\,transparent\)\]{background-color:var(--oke-accent)}@supports (color:color-mix(in lab, red, red)){.bg-\[color-mix\(in_oklab\,var\(--oke-accent\)_55\%\,transparent\)\]{background-color:color-mix(in oklab,var(--oke-accent) 55%,transparent)}}.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_3\%\,transparent\)\]{background-color:var(--oke-fg)}@supports (color:color-mix(in lab, red, red)){.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_3\%\,transparent\)\]{background-color:color-mix(in oklab,var(--oke-fg) 3%,transparent)}}.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_6\%\,transparent\)\]{background-color:var(--oke-fg)}@supports (color:color-mix(in lab, red, red)){.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_6\%\,transparent\)\]{background-color:color-mix(in oklab,var(--oke-fg) 6%,transparent)}}.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_35\%\,transparent\)\]{background-color:var(--oke-fg)}@supports (color:color-mix(in lab, red, red)){.bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_35\%\,transparent\)\]{background-color:color-mix(in oklab,var(--oke-fg) 35%,transparent)}}.bg-\[var\(--oke-accent\)\],.bg-\[var\(--oke-accent\)\]\/15{background-color:var(--oke-accent)}@supports (color:color-mix(in lab, red, red)){.bg-\[var\(--oke-accent\)\]\/15{background-color:color-mix(in oklab, var(--oke-accent) 15%, transparent)}}.bg-\[var\(--oke-bg\)\]{background-color:var(--oke-bg)}.bg-\[var\(--oke-danger\)\],.bg-\[var\(--oke-danger\)\]\/10{background-color:var(--oke-danger)}@supports (color:color-mix(in lab, red, red)){.bg-\[var\(--oke-danger\)\]\/10{background-color:color-mix(in oklab, var(--oke-danger) 10%, transparent)}}.bg-\[var\(--oke-external\)\]{background-color:var(--oke-external)}.bg-\[var\(--oke-fg\)\]{background-color:var(--oke-fg)}.bg-\[var\(--oke-line\)\],.bg-\[var\(--oke-line\)\]\/40{background-color:var(--oke-line)}@supports (color:color-mix(in lab, red, red)){.bg-\[var\(--oke-line\)\]\/40{background-color:color-mix(in oklab, var(--oke-line) 40%, transparent)}}.bg-black\/20{background-color:#0003}@supports (color:color-mix(in lab, red, red)){.bg-black\/20{background-color:color-mix(in oklab, var(--color-black) 20%, transparent)}}.bg-black\/50{background-color:#00000080}@supports (color:color-mix(in lab, red, red)){.bg-black\/50{background-color:color-mix(in oklab, var(--color-black) 50%, transparent)}}.bg-transparent{background-color:#0000}.fill-\[var\(--oke-fg\)\]{fill:var(--oke-fg)}.fill-\[var\(--oke-muted\)\]{fill:var(--oke-muted)}.p-0{padding:0}.p-2{padding:calc(var(--spacing) * 2)}.p-3{padding:calc(var(--spacing) * 3)}.p-4{padding:calc(var(--spacing) * 4)}.p-6{padding:calc(var(--spacing) * 6)}.px-1{padding-inline:var(--spacing)}.px-1\.5{padding-inline:calc(var(--spacing) * 1.5)}.px-2{padding-inline:calc(var(--spacing) * 2)}.px-3{padding-inline:calc(var(--spacing) * 3)}.px-4{padding-inline:calc(var(--spacing) * 4)}.px-5{padding-inline:calc(var(--spacing) * 5)}.px-6{padding-inline:calc(var(--spacing) * 6)}.py-0\.5{padding-block:calc(var(--spacing) * .5)}.py-1{padding-block:var(--spacing)}.py-1\.5{padding-block:calc(var(--spacing) * 1.5)}.py-2{padding-block:calc(var(--spacing) * 2)}.py-3{padding-block:calc(var(--spacing) * 3)}.py-4{padding-block:calc(var(--spacing) * 4)}.py-5{padding-block:calc(var(--spacing) * 5)}.py-6{padding-block:calc(var(--spacing) * 6)}.py-8{padding-block:calc(var(--spacing) * 8)}.py-16{padding-block:calc(var(--spacing) * 16)}.pt-3{padding-top:calc(var(--spacing) * 3)}.pt-4{padding-top:calc(var(--spacing) * 4)}.pr-2{padding-right:calc(var(--spacing) * 2)}.pr-3{padding-right:calc(var(--spacing) * 3)}.pr-4{padding-right:calc(var(--spacing) * 4)}.pb-1{padding-bottom:var(--spacing)}.pb-2{padding-bottom:calc(var(--spacing) * 2)}.pb-4{padding-bottom:calc(var(--spacing) * 4)}.pl-4{padding-left:calc(var(--spacing) * 4)}.pl-5{padding-left:calc(var(--spacing) * 5)}.text-center{text-align:center}.text-left{text-align:left}.align-top{vertical-align:top}.font-mono{font-family:var(--font-mono)}.text-2xl{font-size:var(--text-2xl);line-height:var(--tw-leading,var(--text-2xl--line-height))}.text-3xl{font-size:var(--text-3xl);line-height:var(--tw-leading,var(--text-3xl--line-height))}.text-base{font-size:var(--text-base);line-height:var(--tw-leading,var(--text-base--line-height))}.text-lg{font-size:var(--text-lg);line-height:var(--tw-leading,var(--text-lg--line-height))}.text-sm{font-size:var(--text-sm);line-height:var(--tw-leading,var(--text-sm--line-height))}.text-xl{font-size:var(--text-xl);line-height:var(--tw-leading,var(--text-xl--line-height))}.text-xs{font-size:var(--text-xs);line-height:var(--tw-leading,var(--text-xs--line-height))}.text-\[10px\]{font-size:10px}.text-\[11px\]{font-size:11px}.text-\[13px\]{font-size:13px}.leading-10{--tw-leading:calc(var(--spacing) * 10);line-height:calc(var(--spacing) * 10)}.leading-relaxed{--tw-leading:var(--leading-relaxed);line-height:var(--leading-relaxed)}.leading-snug{--tw-leading:var(--leading-snug);line-height:var(--leading-snug)}.font-medium{--tw-font-weight:var(--font-weight-medium);font-weight:var(--font-weight-medium)}.font-normal{--tw-font-weight:var(--font-weight-normal);font-weight:var(--font-weight-normal)}.font-semibold{--tw-font-weight:var(--font-weight-semibold);font-weight:var(--font-weight-semibold)}.tracking-\[0\.2em\]{--tw-tracking:.2em;letter-spacing:.2em}.tracking-\[0\.14em\]{--tw-tracking:.14em;letter-spacing:.14em}.tracking-\[0\.15em\]{--tw-tracking:.15em;letter-spacing:.15em}.tracking-tight{--tw-tracking:var(--tracking-tight);letter-spacing:var(--tracking-tight)}.tracking-wide{--tw-tracking:var(--tracking-wide);letter-spacing:var(--tracking-wide)}.tracking-wider{--tw-tracking:var(--tracking-wider);letter-spacing:var(--tracking-wider)}.break-all{word-break:break-all}.whitespace-pre-wrap{white-space:pre-wrap}.text-\[var\(--oke-accent\)\]{color:var(--oke-accent)}.text-\[var\(--oke-danger\)\]{color:var(--oke-danger)}.text-\[var\(--oke-external\)\]{color:var(--oke-external)}.text-\[var\(--oke-fg\)\]{color:var(--oke-fg)}.text-\[var\(--oke-muted\)\]{color:var(--oke-muted)}.text-\[var\(--oke-warn\,var\(--oke-muted\)\)\]{color:var(--oke-warn,var(--oke-muted))}.text-amber-800{color:var(--color-amber-800)}.text-black{color:var(--color-black)}.text-red-600{color:var(--color-red-600)}.text-red-700{color:var(--color-red-700)}.text-white{color:var(--color-white)}.normal-case{text-transform:none}.uppercase{text-transform:uppercase}.tabular-nums{--tw-numeric-spacing:tabular-nums;font-variant-numeric:var(--tw-ordinal,) var(--tw-slashed-zero,) var(--tw-numeric-figure,) var(--tw-numeric-spacing,) var(--tw-numeric-fraction,)}.line-through{text-decoration-line:line-through}.underline{text-decoration-line:underline}.decoration-\[var\(--oke-line\)\]{-webkit-text-decoration-color:var(--oke-line);-webkit-text-decoration-color:var(--oke-line);text-decoration-color:var(--oke-line)}.underline-offset-2{text-underline-offset:2px}.opacity-40{opacity:.4}.opacity-70{opacity:.7}.outline{outline-style:var(--tw-outline-style);outline-width:1px}.outline-2{outline-style:var(--tw-outline-style);outline-width:2px}.outline-\[var\(--oke-danger\)\]{outline-color:var(--oke-danger)}.transition-opacity{transition-property:opacity;transition-timing-function:var(--tw-ease,var(--default-transition-timing-function));transition-duration:var(--tw-duration,var(--default-transition-duration))}.duration-150{--tw-duration:.15s;transition-duration:.15s}.placeholder\:text-\[var\(--oke-muted\)\]::placeholder{color:var(--oke-muted)}@media (hover:hover){.hover\:bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_3\%\,transparent\)\]:hover{background-color:var(--oke-fg)}@supports (color:color-mix(in lab, red, red)){.hover\:bg-\[color-mix\(in_oklab\,var\(--oke-fg\)_3\%\,transparent\)\]:hover{background-color:color-mix(in oklab,var(--oke-fg) 3%,transparent)}}.hover\:bg-\[var\(--oke-line\)\]\/20:hover{background-color:var(--oke-line)}@supports (color:color-mix(in lab, red, red)){.hover\:bg-\[var\(--oke-line\)\]\/20:hover{background-color:color-mix(in oklab, var(--oke-line) 20%, transparent)}}.hover\:bg-\[var\(--oke-line\)\]\/40:hover{background-color:var(--oke-line)}@supports (color:color-mix(in lab, red, red)){.hover\:bg-\[var\(--oke-line\)\]\/40:hover{background-color:color-mix(in oklab, var(--oke-line) 40%, transparent)}}.hover\:text-\[var\(--oke-fg\)\]:hover{color:var(--oke-fg)}.hover\:underline:hover{text-decoration-line:underline}}.focus\:not-sr-only:focus{clip-path:none;white-space:normal;width:auto;height:auto;margin:0;padding:0;position:static;overflow:visible}.focus\:absolute:focus{position:absolute}.focus\:top-2:focus{top:calc(var(--spacing) * 2)}.focus\:left-2:focus{left:calc(var(--spacing) * 2)}.focus\:z-50:focus{z-index:50}.focus\:bg-\[var\(--oke-bg\)\]:focus{background-color:var(--oke-bg)}.focus\:px-3:focus{padding-inline:calc(var(--spacing) * 3)}.focus\:py-2:focus{padding-block:calc(var(--spacing) * 2)}.disabled\:opacity-40:disabled{opacity:.4}@media (width>=40rem){.sm\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.sm\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}}@media (width>=48rem){.md\:max-w-xs{max-width:var(--container-xs)}.md\:grid-cols-\[minmax\(0\,1fr\)_minmax\(0\,1\.4fr\)\]{grid-template-columns:minmax(0,1fr) minmax(0,1.4fr)}.md\:grid-cols-\[minmax\(0\,1fr\)_minmax\(0\,1\.5fr\)\]{grid-template-columns:minmax(0,1fr) minmax(0,1.5fr)}}@media (width>=64rem){.lg\:w-80{width:calc(var(--spacing) * 80)}.lg\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.lg\:grid-cols-\[1fr_1fr_1\.2fr\]{grid-template-columns:1fr 1fr 1.2fr}.lg\:grid-cols-\[14rem_1fr_18rem\]{grid-template-columns:14rem 1fr 18rem}.lg\:grid-cols-\[minmax\(0\,1\.2fr\)_minmax\(0\,1fr\)\]{grid-template-columns:minmax(0,1.2fr) minmax(0,1fr)}.lg\:flex-row{flex-direction:row}.lg\:border-t-0{border-top-style:var(--tw-border-style);border-top-width:0}.lg\:border-r{border-right-style:var(--tw-border-style);border-right-width:1px}.lg\:border-b-0{border-bottom-style:var(--tw-border-style);border-bottom-width:0}.lg\:border-l{border-left-style:var(--tw-border-style);border-left-width:1px}}}:root{--oke-bg:#0e1116;--oke-fg:#e8eaed;--oke-muted:#9aa3b2;--oke-line:var(--oke-fg)}@supports (color:color-mix(in lab, red, red)){:root{--oke-line:color-mix(in oklab, var(--oke-fg) 12%, transparent)}}:root{--oke-accent:#3d9a6a;--oke-external:#d97706;--oke-danger:#c44b4b;--oke-font:"IBM Plex Sans", "Segoe UI", sans-serif;--oke-mono:"IBM Plex Mono", ui-monospace, monospace;--oke-dim:.38}@font-face{font-family:IBM Plex Sans;font-style:normal;font-weight:400 600;font-display:swap;src:local(IBM Plex Sans)}html,body,#root{height:100%}body{font-family:var(--oke-font);background:radial-gradient(1200px 600px at 10% -10%, #1a2433 0%, transparent 55%), radial-gradient(900px 500px at 100% 0%, #13201a 0%, transparent 50%), var(--oke-bg);color:var(--oke-fg);font-variant-numeric:tabular-nums;margin:0}*{box-sizing:border-box}a{color:inherit;text-decoration:none}:focus-visible{outline:2px solid var(--oke-accent);outline-offset:2px}@media (prefers-reduced-motion:reduce){*,:before,:after{transition:none!important;animation:none!important}}.sr-only{clip:rect(0, 0, 0, 0);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}@property --tw-space-y-reverse{syntax:"*";inherits:false;initial-value:0}@property --tw-divide-y-reverse{syntax:"*";inherits:false;initial-value:0}@property --tw-border-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-leading{syntax:"*";inherits:false}@property --tw-font-weight{syntax:"*";inherits:false}@property --tw-tracking{syntax:"*";inherits:false}@property --tw-ordinal{syntax:"*";inherits:false}@property --tw-slashed-zero{syntax:"*";inherits:false}@property --tw-numeric-figure{syntax:"*";inherits:false}@property --tw-numeric-spacing{syntax:"*";inherits:false}@property --tw-numeric-fraction{syntax:"*";inherits:false}@property --tw-outline-style{syntax:"*";inherits:false;initial-value:solid}@property --tw-duration{syntax:"*";inherits:false}
|
|
3
|
-
/*$vite$:1*/
|
|
@@ -1,47 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* OpenBao image recipe — durable single-node secrets service (Raft storage).
|
|
3
|
-
*
|
|
4
|
-
* Never `-dev`: data lives on a named volume under `/openbao/data`; init +
|
|
5
|
-
* unseal is handled by the CLI bootstrap (keys stay on the host).
|
|
6
|
-
*/
|
|
7
|
-
|
|
8
|
-
import type { ImageRecipe } from "../types.ts";
|
|
9
|
-
|
|
10
|
-
/**
|
|
11
|
-
* Server config passed via `BAO_LOCAL_CONFIG` (official image). Single-node
|
|
12
|
-
* Raft still requires `cluster_addr` / `api_addr` per the OpenBao docs.
|
|
13
|
-
*/
|
|
14
|
-
const OPENBAO_LOCAL_CONFIG = JSON.stringify({
|
|
15
|
-
listener: { tcp: { address: "0.0.0.0:8200", tls_disable: true } },
|
|
16
|
-
// Raft under /openbao/file — the stock entrypoint chowns that dir for the
|
|
17
|
-
// `openbao` user; a root-owned fresh named volume stays writable. Raft does
|
|
18
|
-
// not create nested dirs, so the path must be the chowned dir itself.
|
|
19
|
-
storage: { raft: { path: "/openbao/file", node_id: "oke" } },
|
|
20
|
-
api_addr: "http://0.0.0.0:8200",
|
|
21
|
-
cluster_addr: "http://127.0.0.1:8201",
|
|
22
|
-
disable_mlock: true,
|
|
23
|
-
});
|
|
24
|
-
|
|
25
|
-
/** OpenBao secrets service. API on 8200. */
|
|
26
|
-
export const openbao: ImageRecipe = {
|
|
27
|
-
id: "openbao",
|
|
28
|
-
port: 8200,
|
|
29
|
-
match: (i) => /openbao/i.test(i),
|
|
30
|
-
apply: (s) => ({
|
|
31
|
-
environment: {
|
|
32
|
-
BAO_LOCAL_CONFIG: OPENBAO_LOCAL_CONFIG,
|
|
33
|
-
},
|
|
34
|
-
command: ["server"],
|
|
35
|
-
volumes: [`${s.serviceName}-data:/openbao/file`],
|
|
36
|
-
healthcheck: {
|
|
37
|
-
// `/sys/init` answers 200 even while sealed — only proves the server
|
|
38
|
-
// process is up; bootstrap owns the real unseal step.
|
|
39
|
-
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8200/v1/sys/init >/dev/null 2>&1 || exit 1"],
|
|
40
|
-
interval: "5s",
|
|
41
|
-
timeout: "5s",
|
|
42
|
-
retries: 12,
|
|
43
|
-
start_period: "5s",
|
|
44
|
-
},
|
|
45
|
-
}),
|
|
46
|
-
url: (_s, c) => `http://${c.host}:${c.port}`,
|
|
47
|
-
};
|
package/src/drivers/libsql.ts
DELETED
|
@@ -1,179 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* `libsql` driver — binds `@libsql/client` (optional peer, dynamic import).
|
|
3
|
-
*
|
|
4
|
-
* Protocol-named: libSQL speaks the sqlite wire dialect plus native ANN
|
|
5
|
-
* vectors (`F32_BLOB` + `libsql_vector_idx` + `vector_top_k`). Classic libSQL
|
|
6
|
-
* only — never the Turso Rust rewrite (`@tursodatabase/database`).
|
|
7
|
-
*
|
|
8
|
-
* Serves both the `sql` facet (same `?` placeholder convention as `sqlite`)
|
|
9
|
-
* and the `index` facet (native ANN, no JS-side distance math).
|
|
10
|
-
*
|
|
11
|
-
* Latency note: local file / `:memory:` opens are in-process like sqlite.
|
|
12
|
-
*/
|
|
13
|
-
|
|
14
|
-
import { customType, sqliteTable, text } from "drizzle-orm/sqlite-core";
|
|
15
|
-
import type {
|
|
16
|
-
IndexHit,
|
|
17
|
-
IndexOpenOptions,
|
|
18
|
-
SqlConnectOptions,
|
|
19
|
-
SqlConnection,
|
|
20
|
-
SqlDriver,
|
|
21
|
-
SqlRow,
|
|
22
|
-
VectorIndexDriver,
|
|
23
|
-
VectorIndexStore,
|
|
24
|
-
} from "./types.ts";
|
|
25
|
-
|
|
26
|
-
/** `@libsql/client` is an optional peer — loaded only when this driver runs. */
|
|
27
|
-
type LibsqlModule = typeof import("@libsql/client");
|
|
28
|
-
|
|
29
|
-
async function loadLibsql(): Promise<LibsqlModule> {
|
|
30
|
-
try {
|
|
31
|
-
return await import("@libsql/client");
|
|
32
|
-
} catch {
|
|
33
|
-
throw new Error(
|
|
34
|
-
"libsql driver: install optional peer `@libsql/client` (bun add @libsql/client)",
|
|
35
|
-
);
|
|
36
|
-
}
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
/** Bare file paths become `file:` URLs; `:memory:` / scheme URLs pass through. */
|
|
40
|
-
function normalizeLibsqlUrl(url: string): string {
|
|
41
|
-
if (url === ":memory:" || url.includes("://") || url.startsWith("file:")) return url;
|
|
42
|
-
return `file:${url}`;
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
/**
|
|
46
|
-
* Open a libSQL connection implementing {@link SqlConnection}.
|
|
47
|
-
*
|
|
48
|
-
* @param options - URL (`:memory:` / `file:…` / `libsql://…`) / role
|
|
49
|
-
*/
|
|
50
|
-
export async function connectLibsql(options: SqlConnectOptions = {}): Promise<SqlConnection> {
|
|
51
|
-
const role = options.role ?? "primary";
|
|
52
|
-
const { createClient } = await loadLibsql();
|
|
53
|
-
const client = createClient({ url: normalizeLibsqlUrl(options.url ?? ":memory:") });
|
|
54
|
-
return {
|
|
55
|
-
driverId: "libsql",
|
|
56
|
-
role,
|
|
57
|
-
async query(sql, params = []) {
|
|
58
|
-
const rs = await client.execute({ sql, args: params as never });
|
|
59
|
-
return rs.rows as unknown as SqlRow[];
|
|
60
|
-
},
|
|
61
|
-
async exec(sql, params = []) {
|
|
62
|
-
const rs = await client.execute({ sql, args: params as never });
|
|
63
|
-
return { changes: rs.rowsAffected };
|
|
64
|
-
},
|
|
65
|
-
async close() {
|
|
66
|
-
client.close();
|
|
67
|
-
},
|
|
68
|
-
};
|
|
69
|
-
}
|
|
70
|
-
|
|
71
|
-
/** Protocol-named libsql sql driver. */
|
|
72
|
-
export const libsqlDriver: SqlDriver = {
|
|
73
|
-
id: "libsql",
|
|
74
|
-
facet: "sql",
|
|
75
|
-
connect: connectLibsql,
|
|
76
|
-
};
|
|
77
|
-
|
|
78
|
-
/** libSQL native vector column: `F32_BLOB(dims)` (float32, validated by the engine). */
|
|
79
|
-
const f32Blob = customType<{
|
|
80
|
-
data: readonly number[];
|
|
81
|
-
driverData: string;
|
|
82
|
-
config: { dimensions: number };
|
|
83
|
-
}>({
|
|
84
|
-
dataType(config) {
|
|
85
|
-
return `F32_BLOB(${config?.dimensions ?? 0})`;
|
|
86
|
-
},
|
|
87
|
-
toDriver(value) {
|
|
88
|
-
return JSON.stringify(value);
|
|
89
|
-
},
|
|
90
|
-
});
|
|
91
|
-
|
|
92
|
-
/**
|
|
93
|
-
* Open a libSQL-backed index with native ANN.
|
|
94
|
-
*
|
|
95
|
-
* DDL: `F32_BLOB(dims)` column + `libsql_vector_idx` ANN index (validated
|
|
96
|
-
* against `@libsql/client@0.17`). Queries run `vector_top_k` joined back to
|
|
97
|
-
* the base table — approximate nearest neighbours, never a full scan. Score
|
|
98
|
-
* is cosine similarity (`1 - vector_distance_cos`), matching the memory
|
|
99
|
-
* driver's higher-is-better convention.
|
|
100
|
-
*
|
|
101
|
-
* @param options - Name / dims / shared SQL connection
|
|
102
|
-
*/
|
|
103
|
-
export async function openLibsqlIndex(options: IndexOpenOptions): Promise<VectorIndexStore> {
|
|
104
|
-
const ownsSql = !options.sql;
|
|
105
|
-
const sql = options.sql ?? (await connectLibsql({ url: options.url }));
|
|
106
|
-
if (sql.driverId !== "libsql") {
|
|
107
|
-
if (ownsSql) await sql.close();
|
|
108
|
-
throw new Error(
|
|
109
|
-
`libsql index: needs a libsql SQL connection, got "${sql.driverId}" — ` +
|
|
110
|
-
`set store.sql to "libsql" so the index shares its connection`,
|
|
111
|
-
);
|
|
112
|
-
}
|
|
113
|
-
|
|
114
|
-
const tableName = `oke_idx_${options.name.replace(/[^a-zA-Z0-9_]/g, "_")}`;
|
|
115
|
-
const indexName = `${tableName}_vec`;
|
|
116
|
-
const table = sqliteTable(tableName, {
|
|
117
|
-
id: text("id").primaryKey(),
|
|
118
|
-
embedding: f32Blob("embedding", { dimensions: options.dims }).notNull(),
|
|
119
|
-
meta: text("meta"),
|
|
120
|
-
});
|
|
121
|
-
|
|
122
|
-
await sql.exec(
|
|
123
|
-
`CREATE TABLE IF NOT EXISTS "${tableName}" (id TEXT PRIMARY KEY, embedding ${table.embedding.getSQLType()} NOT NULL, meta TEXT)`,
|
|
124
|
-
);
|
|
125
|
-
// ANN index — fails loud on engines without vector support (never falls back).
|
|
126
|
-
await sql.exec(
|
|
127
|
-
`CREATE INDEX IF NOT EXISTS "${indexName}" ON "${tableName}" (libsql_vector_idx(embedding))`,
|
|
128
|
-
);
|
|
129
|
-
|
|
130
|
-
return {
|
|
131
|
-
driverId: "libsql",
|
|
132
|
-
async upsert(id, vector, meta) {
|
|
133
|
-
if (vector.length !== options.dims) {
|
|
134
|
-
throw new Error(`vector dims ${vector.length} !== index dims ${options.dims}`);
|
|
135
|
-
}
|
|
136
|
-
await sql.exec(
|
|
137
|
-
`INSERT INTO "${tableName}" (id, embedding, meta) VALUES (?, vector32(?), ?) ` +
|
|
138
|
-
`ON CONFLICT (id) DO UPDATE SET embedding = excluded.embedding, meta = excluded.meta`,
|
|
139
|
-
[id, JSON.stringify(vector), meta ? JSON.stringify(meta) : null],
|
|
140
|
-
);
|
|
141
|
-
},
|
|
142
|
-
async search(vector, topK = 10): Promise<IndexHit[]> {
|
|
143
|
-
const k = Math.max(1, Math.floor(topK));
|
|
144
|
-
const rows = await sql.query(
|
|
145
|
-
`SELECT t.id AS id, t.meta AS meta, ` +
|
|
146
|
-
`vector_distance_cos(t.embedding, vector32(?)) AS distance ` +
|
|
147
|
-
`FROM vector_top_k('${indexName}', vector32(?), ${k}) AS i ` +
|
|
148
|
-
`JOIN "${tableName}" AS t ON t.rowid = i.id ` +
|
|
149
|
-
`ORDER BY distance ASC`,
|
|
150
|
-
[JSON.stringify(vector), JSON.stringify(vector)],
|
|
151
|
-
);
|
|
152
|
-
return rows.map((row) => {
|
|
153
|
-
const metaRaw = row.meta;
|
|
154
|
-
return {
|
|
155
|
-
id: String(row.id),
|
|
156
|
-
score: 1 - Number(row.distance),
|
|
157
|
-
meta:
|
|
158
|
-
typeof metaRaw === "string"
|
|
159
|
-
? (JSON.parse(metaRaw) as Record<string, unknown>)
|
|
160
|
-
: undefined,
|
|
161
|
-
};
|
|
162
|
-
});
|
|
163
|
-
},
|
|
164
|
-
async delete(id) {
|
|
165
|
-
const result = await sql.exec(`DELETE FROM "${tableName}" WHERE id = ?`, [id]);
|
|
166
|
-
return result.changes > 0;
|
|
167
|
-
},
|
|
168
|
-
async close() {
|
|
169
|
-
if (ownsSql) await sql.close();
|
|
170
|
-
},
|
|
171
|
-
};
|
|
172
|
-
}
|
|
173
|
-
|
|
174
|
-
/** Protocol-named libsql index driver. */
|
|
175
|
-
export const libsqlIndexDriver: VectorIndexDriver = {
|
|
176
|
-
id: "libsql",
|
|
177
|
-
facet: "index",
|
|
178
|
-
open: openLibsqlIndex,
|
|
179
|
-
};
|
package/src/drivers/sqlite.ts
DELETED
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* `sqlite` driver — binds `bun:sqlite` (never better-sqlite3).
|
|
3
|
-
*/
|
|
4
|
-
|
|
5
|
-
import { Database, type SQLQueryBindings } from "bun:sqlite";
|
|
6
|
-
import type { SqlConnectOptions, SqlConnection, SqlDriver, SqlRow } from "./types.ts";
|
|
7
|
-
|
|
8
|
-
/**
|
|
9
|
-
* Open a bun:sqlite connection implementing {@link SqlConnection}.
|
|
10
|
-
*
|
|
11
|
-
* @param options - URL (`:memory:` / path) or injected Database
|
|
12
|
-
*/
|
|
13
|
-
export async function connectSqlite(options: SqlConnectOptions = {}): Promise<SqlConnection> {
|
|
14
|
-
const role = options.role ?? "primary";
|
|
15
|
-
const db =
|
|
16
|
-
options.client instanceof Database ? options.client : new Database(options.url ?? ":memory:");
|
|
17
|
-
|
|
18
|
-
function asBindings(params: readonly unknown[]): SQLQueryBindings[] {
|
|
19
|
-
return params as SQLQueryBindings[];
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
return {
|
|
23
|
-
driverId: "sqlite",
|
|
24
|
-
role,
|
|
25
|
-
async query(sql, params = []) {
|
|
26
|
-
const stmt = db.query(sql);
|
|
27
|
-
return stmt.all(...(asBindings(params) as never[])) as SqlRow[];
|
|
28
|
-
},
|
|
29
|
-
async exec(sql, params = []) {
|
|
30
|
-
const result = db.run(sql, ...(asBindings(params) as never[]));
|
|
31
|
-
return { changes: result.changes };
|
|
32
|
-
},
|
|
33
|
-
async close() {
|
|
34
|
-
db.close();
|
|
35
|
-
},
|
|
36
|
-
};
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
/** Protocol-named sqlite driver. */
|
|
40
|
-
export const sqliteDriver: SqlDriver = {
|
|
41
|
-
id: "sqlite",
|
|
42
|
-
facet: "sql",
|
|
43
|
-
connect: connectSqlite,
|
|
44
|
-
};
|
|
@@ -1,97 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* OpenBao vault driver — KV v2 read + write/delete + fail-loud semantics.
|
|
3
|
-
*/
|
|
4
|
-
|
|
5
|
-
import { describe, expect, test } from "bun:test";
|
|
6
|
-
import { OpenBaoUnavailableError, openbaoVaultDriver } from "./vault-openbao.ts";
|
|
7
|
-
|
|
8
|
-
/** Scripted fetch: LIST + per-key GET, then capture writes/deletes. */
|
|
9
|
-
function fakeKv(
|
|
10
|
-
seed: Record<string, string>,
|
|
11
|
-
calls: { method: string; path: string; body?: string }[],
|
|
12
|
-
) {
|
|
13
|
-
return (async (input: string | URL | Request, init?: RequestInit) => {
|
|
14
|
-
const url = new URL(String(input));
|
|
15
|
-
const method = init?.method ?? "GET";
|
|
16
|
-
calls.push({
|
|
17
|
-
method,
|
|
18
|
-
path: url.pathname + url.search,
|
|
19
|
-
body: typeof init?.body === "string" ? init.body : undefined,
|
|
20
|
-
});
|
|
21
|
-
const mount = "/v1/secret";
|
|
22
|
-
if (method === "GET" && url.pathname === `${mount}/metadata`) {
|
|
23
|
-
return Response.json({ data: { keys: Object.keys(seed) } });
|
|
24
|
-
}
|
|
25
|
-
if (method === "GET" && url.pathname.startsWith(`${mount}/data/`)) {
|
|
26
|
-
const name = decodeURIComponent(url.pathname.slice(`${mount}/data/`.length));
|
|
27
|
-
if (!(name in seed)) return new Response("{}", { status: 404 });
|
|
28
|
-
return Response.json({ data: { data: { value: seed[name] } } });
|
|
29
|
-
}
|
|
30
|
-
if (method === "POST" && url.pathname.startsWith(`${mount}/data/`)) {
|
|
31
|
-
return new Response(null, { status: 204 });
|
|
32
|
-
}
|
|
33
|
-
if (method === "DELETE" && url.pathname.startsWith(`${mount}/data/`)) {
|
|
34
|
-
return new Response(null, { status: 204 });
|
|
35
|
-
}
|
|
36
|
-
return new Response("{}", { status: 404 });
|
|
37
|
-
}) as typeof globalThis.fetch;
|
|
38
|
-
}
|
|
39
|
-
|
|
40
|
-
describe("openbao vault driver", () => {
|
|
41
|
-
test("LIST + GET loads all keys", async () => {
|
|
42
|
-
const calls: { method: string; path: string; body?: string }[] = [];
|
|
43
|
-
const bag = await openbaoVaultDriver.open({
|
|
44
|
-
url: "http://127.0.0.1:8200",
|
|
45
|
-
token: "app-tok",
|
|
46
|
-
fetch: fakeKv({ STRIPE_KEY: "sk_live", DATABASE_URL: "postgres://x" }, calls),
|
|
47
|
-
});
|
|
48
|
-
expect(bag.get("STRIPE_KEY")).toBe("sk_live");
|
|
49
|
-
expect([...bag.names()].sort()).toEqual(["DATABASE_URL", "STRIPE_KEY"]);
|
|
50
|
-
});
|
|
51
|
-
|
|
52
|
-
test("set POSTs KV v2 data payload", async () => {
|
|
53
|
-
const calls: { method: string; path: string; body?: string }[] = [];
|
|
54
|
-
const bag = await openbaoVaultDriver.open({
|
|
55
|
-
url: "http://127.0.0.1:8200",
|
|
56
|
-
token: "app-tok",
|
|
57
|
-
fetch: fakeKv({ STRIPE_KEY: "sk_live" }, calls),
|
|
58
|
-
});
|
|
59
|
-
bag.set?.("STRIPE_KEY", "sk_rotated");
|
|
60
|
-
await Bun.sleep(0);
|
|
61
|
-
const writeCall = calls.find((c) => c.method === "POST");
|
|
62
|
-
expect(writeCall?.path).toBe("/v1/secret/data/STRIPE_KEY");
|
|
63
|
-
expect(writeCall?.body).toBe(JSON.stringify({ data: { value: "sk_rotated" } }));
|
|
64
|
-
expect(bag.get("STRIPE_KEY")).toBe("sk_rotated");
|
|
65
|
-
});
|
|
66
|
-
|
|
67
|
-
test("unreachable remote fails loud (no soft-empty bag)", async () => {
|
|
68
|
-
let failed: unknown;
|
|
69
|
-
try {
|
|
70
|
-
await openbaoVaultDriver.open({
|
|
71
|
-
url: "http://127.0.0.1:9",
|
|
72
|
-
token: "app-tok",
|
|
73
|
-
fetch: (async () => {
|
|
74
|
-
throw new Error("connect ECONNREFUSED");
|
|
75
|
-
}) as unknown as typeof globalThis.fetch,
|
|
76
|
-
});
|
|
77
|
-
} catch (err) {
|
|
78
|
-
failed = err;
|
|
79
|
-
}
|
|
80
|
-
expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
|
|
81
|
-
});
|
|
82
|
-
|
|
83
|
-
test("sealed / 5xx on GET fails loud", async () => {
|
|
84
|
-
const fetchFn = (async (input: string | URL | Request) => {
|
|
85
|
-
const url = String(input);
|
|
86
|
-
if (url.includes("metadata")) return Response.json({ data: { keys: ["STRIPE_KEY"] } });
|
|
87
|
-
return new Response("sealed", { status: 503 });
|
|
88
|
-
}) as typeof globalThis.fetch;
|
|
89
|
-
let failed: unknown;
|
|
90
|
-
try {
|
|
91
|
-
await openbaoVaultDriver.open({ url: "http://127.0.0.1:8200", token: "t", fetch: fetchFn });
|
|
92
|
-
} catch (err) {
|
|
93
|
-
failed = err;
|
|
94
|
-
}
|
|
95
|
-
expect(failed).toBeInstanceOf(OpenBaoUnavailableError);
|
|
96
|
-
});
|
|
97
|
-
});
|
|
@@ -1,143 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* `openbao` vault driver — OpenBao (Vault-compatible) KV v2 HTTP API.
|
|
3
|
-
*
|
|
4
|
-
* Protocol-named; image/vendor choice lives in `images`.
|
|
5
|
-
*/
|
|
6
|
-
|
|
7
|
-
import type { VaultBag, VaultDriver, VaultOpenOptions } from "./vault-types.ts";
|
|
8
|
-
|
|
9
|
-
/** Error thrown when the remote OpenBao is unreachable / sealed / errors. */
|
|
10
|
-
export class OpenBaoUnavailableError extends Error {
|
|
11
|
-
constructor(message: string) {
|
|
12
|
-
super(message);
|
|
13
|
-
this.name = "OpenBaoUnavailableError";
|
|
14
|
-
}
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
/**
|
|
18
|
-
* OpenBao KV-v2 bag. Reads are loaded at open when `url` + `token` resolve;
|
|
19
|
-
* writes (`set` / `delete`) hit the HTTP API directly.
|
|
20
|
-
*
|
|
21
|
-
* When `url` and `token` are provided, an unreachable, sealed, or erroring
|
|
22
|
-
* OpenBao is **fatal** (fail-loud) — the bag never silently degrades to an
|
|
23
|
-
* empty / seed-only view.
|
|
24
|
-
*
|
|
25
|
-
* For boot validation the runtime passes declared names; this driver loads
|
|
26
|
-
* all keys under `mount` when the LIST API is available, else falls back to
|
|
27
|
-
* GETs for the seed names.
|
|
28
|
-
*/
|
|
29
|
-
export const openbaoVaultDriver: VaultDriver = {
|
|
30
|
-
id: "openbao",
|
|
31
|
-
async open(options: VaultOpenOptions = {}): Promise<VaultBag> {
|
|
32
|
-
const url = options.url?.replace(/\/$/, "");
|
|
33
|
-
const token = options.token;
|
|
34
|
-
const mount = options.mount ?? "secret";
|
|
35
|
-
const fetchFn = options.fetch ?? globalThis.fetch;
|
|
36
|
-
const map = new Map<string, string>(
|
|
37
|
-
Object.entries(options.secrets ?? {}).filter(
|
|
38
|
-
(e): e is [string, string] => typeof e[1] === "string",
|
|
39
|
-
),
|
|
40
|
-
);
|
|
41
|
-
|
|
42
|
-
const remote = url !== undefined && token !== undefined;
|
|
43
|
-
let mutableRemote = false;
|
|
44
|
-
|
|
45
|
-
if (remote && url !== undefined && token !== undefined) {
|
|
46
|
-
const headers = { "X-Vault-Token": token };
|
|
47
|
-
const base = `${url}/v1/${mount}`;
|
|
48
|
-
|
|
49
|
-
async function listNames(): Promise<string[]> {
|
|
50
|
-
const res = await fetchFn(`${base}/metadata?list=true`, { headers });
|
|
51
|
-
if (!res.ok) return [];
|
|
52
|
-
const body = (await res.json()) as { data?: { keys?: string[] } };
|
|
53
|
-
return (body.data?.keys ?? []).map((k) => k.replace(/\/$/, ""));
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
async function readName(name: string): Promise<boolean> {
|
|
57
|
-
const res = await fetchFn(`${base}/data/${encodeURIComponent(name)}`, { headers });
|
|
58
|
-
if (res.status === 404) return false;
|
|
59
|
-
if (!res.ok) {
|
|
60
|
-
throw new OpenBaoUnavailableError(
|
|
61
|
-
`openbao vault: GET ${name} failed (${res.status}) — sealed or unauthorized?`,
|
|
62
|
-
);
|
|
63
|
-
}
|
|
64
|
-
const body = (await res.json()) as { data?: { data?: Record<string, unknown> } };
|
|
65
|
-
const data = body.data?.data ?? {};
|
|
66
|
-
const value =
|
|
67
|
-
typeof data.value === "string"
|
|
68
|
-
? data.value
|
|
69
|
-
: typeof data[name] === "string"
|
|
70
|
-
? (data[name] as string)
|
|
71
|
-
: JSON.stringify(data);
|
|
72
|
-
map.set(name, value);
|
|
73
|
-
return true;
|
|
74
|
-
}
|
|
75
|
-
|
|
76
|
-
// LIST when the token has metadata list; otherwise only fetch the
|
|
77
|
-
// seed/declared names so a least-privilege token still works. A
|
|
78
|
-
// connection-level failure here must never degrade to an empty bag.
|
|
79
|
-
let names: string[] = [];
|
|
80
|
-
try {
|
|
81
|
-
names = await listNames();
|
|
82
|
-
} catch (err) {
|
|
83
|
-
if (map.size === 0) {
|
|
84
|
-
throw new OpenBaoUnavailableError(
|
|
85
|
-
`openbao vault: unreachable at ${url} — ${err instanceof Error ? err.message : String(err)}`,
|
|
86
|
-
);
|
|
87
|
-
}
|
|
88
|
-
// Fall through: LIST denied but we still have declared names to GET.
|
|
89
|
-
}
|
|
90
|
-
if (names.length > 0) {
|
|
91
|
-
for (const key of names) await readName(key);
|
|
92
|
-
mutableRemote = true;
|
|
93
|
-
} else if (map.size > 0) {
|
|
94
|
-
for (const name of map.keys()) await readName(name);
|
|
95
|
-
mutableRemote = true;
|
|
96
|
-
}
|
|
97
|
-
}
|
|
98
|
-
|
|
99
|
-
return {
|
|
100
|
-
driverId: "openbao",
|
|
101
|
-
get(name) {
|
|
102
|
-
return map.get(name);
|
|
103
|
-
},
|
|
104
|
-
names() {
|
|
105
|
-
return [...map.keys()];
|
|
106
|
-
},
|
|
107
|
-
...(mutableRemote && url !== undefined && token !== undefined
|
|
108
|
-
? {
|
|
109
|
-
set(name: string, value: string) {
|
|
110
|
-
void (async () => {
|
|
111
|
-
const res = await fetchFn(`${url}/v1/${mount}/data/${encodeURIComponent(name)}`, {
|
|
112
|
-
method: "POST",
|
|
113
|
-
headers: { "X-Vault-Token": token, "content-type": "application/json" },
|
|
114
|
-
body: JSON.stringify({ data: { value } }),
|
|
115
|
-
});
|
|
116
|
-
if (!res.ok) {
|
|
117
|
-
throw new OpenBaoUnavailableError(
|
|
118
|
-
`openbao vault: write ${name} failed (${res.status})`,
|
|
119
|
-
);
|
|
120
|
-
}
|
|
121
|
-
map.set(name, value);
|
|
122
|
-
})();
|
|
123
|
-
},
|
|
124
|
-
delete(name: string) {
|
|
125
|
-
const had = map.delete(name);
|
|
126
|
-
void (async () => {
|
|
127
|
-
const res = await fetchFn(`${url}/v1/${mount}/data/${encodeURIComponent(name)}`, {
|
|
128
|
-
method: "DELETE",
|
|
129
|
-
headers: { "X-Vault-Token": token },
|
|
130
|
-
});
|
|
131
|
-
if (!res.ok && res.status !== 404) {
|
|
132
|
-
throw new OpenBaoUnavailableError(
|
|
133
|
-
`openbao vault: delete ${name} failed (${res.status})`,
|
|
134
|
-
);
|
|
135
|
-
}
|
|
136
|
-
})();
|
|
137
|
-
return had;
|
|
138
|
-
},
|
|
139
|
-
}
|
|
140
|
-
: {}),
|
|
141
|
-
};
|
|
142
|
-
},
|
|
143
|
-
};
|