okengine 0.11.2 → 0.12.0

package/src/console/ui-next/src/features/vault/lib/progress.ts

@@ -0,0 +1,51 @@
+/**
+ * Honest dual-phase copy for master-key rotation progress.
+ */
+
+/** Dual-KEK vs retired-old-key phases. */
+export type RewrapPhase = 1 | 2;
+
+/** Operator-facing rewrap progress. */
+export interface RewrapProgressLine {
+  readonly phase: RewrapPhase;
+  readonly headline: string;
+  readonly detail: string;
+}
+
+/**
+ * Format adapter-native rotate-master progress.
+ *
+ * Phase 1 (dual-read): both KEKs live; old key still required.
+ * Phase 2 (done): old master key no longer opens the vault.
+ *
+ * @param options - Last batch + list status
+ */
+export function formatRewrapProgress(options: {
+  readonly kekVersion: number;
+  readonly remaining: number | null;
+  readonly rewrapTargetKekVersion: number | null;
+}): RewrapProgressLine | null {
+  const remaining = options.remaining;
+  const target = options.rewrapTargetKekVersion;
+  const inFlight = (remaining !== null && remaining > 0) || target !== null;
+  if (!inFlight) {
+    if (remaining === 0) {
+      return {
+        phase: 2,
+        headline: `KEK v${options.kekVersion} — rotation complete`,
+        detail: "The previous master key no longer opens this vault.",
+      };
+    }
+    return null;
+  }
+  const toward = target ?? options.kekVersion;
+  const left = remaining ?? 0;
+  return {
+    phase: 1,
+    headline: `kek v${options.kekVersion} → v${toward}`,
+    detail:
+      left > 0
+        ? `${left} DEK${left === 1 ? "" : "s"} still on the old key. Both master keys stay live.`
+        : "Both master keys stay live until remaining is 0.",
+  };
+}

package/src/console/ui-next/src/features/vault/lib/search.test.ts

@@ -0,0 +1,139 @@
+import { describe, expect, test } from "bun:test";
+import { VAULT_FIXTURE } from "./fixture.ts";
+import {
+  applySearchSuggestion,
+  formatVaultSearch,
+  hasIsToken,
+  matchesVaultSearch,
+  parseVaultSearch,
+  toggleIsToken,
+  tokenizeVaultSearch,
+  vaultSearchSuggestions,
+} from "./search.ts";
+
+const NOW = 1_700_000_000_000;
+
+describe("parseVaultSearch", () => {
+  test("empty query has no tokens", () => {
+    expect(parseVaultSearch("").tokens).toEqual([]);
+    expect(parseVaultSearch("   ").tokens).toEqual([]);
+  });
+
+  test("parses operators and free text", () => {
+    const q = parseVaultSearch(
+      "is:unset kind:secret from:.env.local reader:payments fp:sha256 stripe",
+    );
+    expect(q.tokens).toEqual([
+      { kind: "is", value: "unset" },
+      { kind: "kind", value: "secret" },
+      { kind: "from", value: ".env.local" },
+      { kind: "reader", value: "payments" },
+      { kind: "fp", value: "sha256" },
+      { kind: "text", value: "stripe" },
+    ]);
+  });
+
+  test("rotate:due becomes is:overdue; quoted spans stay text", () => {
+    const q = parseVaultSearch('rotate:due "GitHub Issues" has:readers');
+    expect(q.tokens).toContainEqual({ kind: "is", value: "overdue" });
+    expect(q.tokens).toContainEqual({ kind: "text", value: "GitHub Issues" });
+    expect(q.tokens).toContainEqual({ kind: "has", value: "readers" });
+  });
+
+  test("unknown operators stay text", () => {
+    expect(parseVaultSearch("foo:bar").tokens).toEqual([{ kind: "text", value: "foo:bar" }]);
+  });
+});
+
+describe("matchesVaultSearch", () => {
+  test("empty matches all", () => {
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch(""), NOW)).toBe(true);
+  });
+
+  test("text matches name, description, readers, and fingerprint", () => {
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("stripe"), NOW)).toBe(true);
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("payments.charge"), NOW)).toBe(
+      true,
+    );
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("sha256:aaaa"), NOW)).toBe(true);
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("nope"), NOW)).toBe(false);
+  });
+
+  test("is:blast and is:shared match the fixture secret", () => {
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("is:blast"), NOW)).toBe(true);
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("is:shared"), NOW)).toBe(true);
+    expect(matchesVaultSearch(VAULT_FIXTURE[1]!, parseVaultSearch("is:blast"), NOW)).toBe(false);
+  });
+
+  test("kind:config and from:process.env match the fixture config", () => {
+    expect(matchesVaultSearch(VAULT_FIXTURE[1]!, parseVaultSearch("kind:config"), NOW)).toBe(true);
+    expect(matchesVaultSearch(VAULT_FIXTURE[1]!, parseVaultSearch("from:process.env"), NOW)).toBe(
+      true,
+    );
+    expect(matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("kind:config"), NOW)).toBe(false);
+  });
+
+  test("operators AND together", () => {
+    expect(
+      matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("is:blast kind:secret"), NOW),
+    ).toBe(true);
+    expect(
+      matchesVaultSearch(VAULT_FIXTURE[0]!, parseVaultSearch("is:blast kind:config"), NOW),
+    ).toBe(false);
+  });
+
+  test("config cleartext is searchable; secret values are not in the row", () => {
+    expect(matchesVaultSearch(VAULT_FIXTURE[1]!, parseVaultSearch("app.example"), NOW)).toBe(true);
+  });
+
+  test("does not search sensitive cleartext even if a row leaked one", () => {
+    const leaked = { ...VAULT_FIXTURE[0]!, cleartext: "sk_live_DO_NOT_LEAK_fixture" };
+    expect(matchesVaultSearch(leaked, parseVaultSearch("sk_live_DO_NOT_LEAK"), NOW)).toBe(false);
+  });
+});
+
+describe("toggleIsToken", () => {
+  test("adds and removes is:unset without dropping text", () => {
+    expect(toggleIsToken("stripe", "unset")).toBe("is:unset stripe");
+    expect(toggleIsToken("is:unset stripe", "unset")).toBe("stripe");
+    expect(hasIsToken("is:unset stripe", "unset")).toBe(true);
+  });
+});
+
+describe("formatVaultSearch", () => {
+  test("round-trips operators then text", () => {
+    const raw = "is:unset kind:secret stripe";
+    expect(formatVaultSearch(parseVaultSearch(raw).tokens)).toBe(raw);
+  });
+});
+
+describe("vaultSearchSuggestions", () => {
+  test("empty query returns the catalog", () => {
+    expect(vaultSearchSuggestions("", VAULT_FIXTURE).length).toBeGreaterThan(5);
+  });
+
+  test("is: prefix filters is: operators", () => {
+    const hits = vaultSearchSuggestions("is:bl", VAULT_FIXTURE);
+    expect(hits.some((h) => h.token === "is:blast")).toBe(true);
+    expect(hits.every((h) => h.token.startsWith("is:"))).toBe(true);
+  });
+
+  test("reader: suggests flow ids", () => {
+    const hits = vaultSearchSuggestions("reader:pay", VAULT_FIXTURE);
+    expect(hits.map((h) => h.token)).toContain("reader:payments.charge");
+  });
+});
+
+describe("applySearchSuggestion", () => {
+  test("replaces the trailing token", () => {
+    expect(applySearchSuggestion("is:un", "is:unset")).toBe("is:unset ");
+    expect(applySearchSuggestion("stripe is:un", "is:unset")).toBe("stripe is:unset ");
+    expect(applySearchSuggestion("stripe ", "is:blast")).toBe("stripe is:blast ");
+  });
+});
+
+describe("tokenizeVaultSearch", () => {
+  test("keeps quoted phrases", () => {
+    expect(tokenizeVaultSearch('is:unset "GitHub Issues"')).toEqual(["is:unset", "GitHub Issues"]);
+  });
+});

package/src/console/ui-next/src/features/vault/lib/search.ts

@@ -0,0 +1,403 @@
+/**
+ * Deep vault search — GitHub-style operators over contracts (console §9.8).
+ *
+ * Free text matches name, description, fingerprints, readers, winner, and
+ * config cleartext. Operators AND together; unknown `key:value` stays text.
+ */
+
+import { contractPosture, isRotateCadence, type VaultIsFilter } from "./posture.ts";
+import type { VaultRecord, VaultResolutionSource } from "./types.ts";
+
+/** Operator kinds the parser understands. */
+export type VaultSearchTokenKind =
+  | "is"
+  | "kind"
+  | "from"
+  | "reader"
+  | "fp"
+  | "has"
+  | "rotate"
+  | "text";
+
+/** One parsed token. */
+export type VaultSearchToken =
+  | { readonly kind: "is"; readonly value: VaultIsFilter }
+  | { readonly kind: "kind"; readonly value: "secret" | "config" }
+  | { readonly kind: "from"; readonly value: string }
+  | { readonly kind: "reader"; readonly value: string }
+  | { readonly kind: "fp"; readonly value: string }
+  | { readonly kind: "has"; readonly value: VaultHasFilter }
+  | { readonly kind: "rotate"; readonly value: string }
+  | { readonly kind: "text"; readonly value: string };
+
+/** `has:` values. */
+export type VaultHasFilter = "readers" | "rotate" | "blast" | "shared";
+
+/** Parsed query. */
+export interface VaultSearchQuery {
+  readonly tokens: readonly VaultSearchToken[];
+  readonly raw: string;
+}
+
+/** Operator help shown in the search popover. */
+export interface VaultSearchSuggestion {
+  readonly token: string;
+  readonly label: string;
+}
+
+const IS_VALUES = new Set<VaultIsFilter>([
+  "unset",
+  "set",
+  "dormant",
+  "blast",
+  "shared",
+  "overdue",
+  "unread",
+  "healthy",
+]);
+
+const KIND_VALUES = new Set<"secret" | "config">(["secret", "config"]);
+const HAS_VALUES = new Set<VaultHasFilter>(["readers", "rotate", "blast", "shared"]);
+
+/** Catalog of operators for the empty-query popover. */
+export const VAULT_SEARCH_CATALOG: readonly VaultSearchSuggestion[] = [
+  { token: "is:unset", label: "No value in this environment" },
+  { token: "is:set", label: "Has a fingerprint or config value" },
+  { token: "is:blast", label: "In-flight durable runs hold this secret" },
+  { token: "is:shared", label: "Fingerprint matches another environment" },
+  { token: "is:dormant", label: "Unread for 90 days, or never" },
+  { token: "is:overdue", label: "Last read older than rotate — never-read counts" },
+  { token: "is:healthy", label: "Set, no blast, no shared, not dormant" },
+  { token: "kind:secret", label: "Sensitive contracts only" },
+  { token: "kind:config", label: "Non-sensitive config only" },
+  { token: "from:.env.local", label: "Winner is .env.local" },
+  { token: "from:driver", label: "Winner is the vault backend (built-in / managed / memory)" },
+  { token: "has:readers", label: "At least one Flow declares a read" },
+  { token: "has:rotate", label: "Contract declares a rotate cadence" },
+  { token: "rotate:never", label: "No rotate cadence (stable secret)" },
+  { token: "reader:", label: "Flow id contains…" },
+  { token: "fp:", label: "Fingerprint contains…" },
+];
+
+const RESOLUTION_SOURCES: readonly VaultResolutionSource[] = [
+  "driver",
+  "process.env",
+  ".env.local",
+  "dev-fallback",
+];
+
+/**
+ * Split on whitespace; quoted spans stay one token.
+ *
+ * @param raw - Query string
+ */
+export function tokenizeVaultSearch(raw: string): readonly string[] {
+  const out: string[] = [];
+  const re = /"([^"]+)"|(\S+)/g;
+  let match: RegExpExecArray | null;
+  while ((match = re.exec(raw)) !== null) {
+    const token = match[1] ?? match[2] ?? "";
+    if (token.length > 0) out.push(token);
+  }
+  return out;
+}
+
+/**
+ * Parse a vault search string into typed tokens.
+ *
+ * @param raw - Query string
+ */
+export function parseVaultSearch(raw: string): VaultSearchQuery {
+  const tokens: VaultSearchToken[] = [];
+  for (const part of tokenizeVaultSearch(raw)) {
+    const parsed = parseOperator(part);
+    if (parsed) tokens.push(parsed);
+    else tokens.push({ kind: "text", value: part });
+  }
+  return { tokens, raw };
+}
+
+/**
+ * Reconstruct a query string from tokens (operators first, then text).
+ *
+ * @param tokens - Parsed tokens
+ */
+export function formatVaultSearch(tokens: readonly VaultSearchToken[]): string {
+  const ops: string[] = [];
+  const text: string[] = [];
+  for (const token of tokens) {
+    if (token.kind === "text") {
+      text.push(needsQuotes(token.value) ? `"${token.value}"` : token.value);
+      continue;
+    }
+    ops.push(`${token.kind}:${token.value}`);
+  }
+  return [...ops, ...text].join(" ").trim();
+}
+
+/**
+ * Toggle an `is:` filter in a raw query.
+ *
+ * @param raw - Current query
+ * @param value - Filter to toggle
+ */
+export function toggleIsToken(raw: string, value: VaultIsFilter): string {
+  const parsed = parseVaultSearch(raw);
+  const has = parsed.tokens.some((t) => t.kind === "is" && t.value === value);
+  const next = has
+    ? parsed.tokens.filter((t) => !(t.kind === "is" && t.value === value))
+    : [...parsed.tokens, { kind: "is", value } as const];
+  return formatVaultSearch(next);
+}
+
+/**
+ * Whether the query already includes this `is:` filter.
+ *
+ * @param raw - Current query
+ * @param value - Filter
+ */
+export function hasIsToken(raw: string, value: VaultIsFilter): boolean {
+  return parseVaultSearch(raw).tokens.some((t) => t.kind === "is" && t.value === value);
+}
+
+/**
+ * Match a contract against a parsed query. Empty query matches all.
+ *
+ * @param row - Vault row
+ * @param query - Parsed query
+ * @param now - Clock (epoch ms)
+ */
+export function matchesVaultSearch(
+  row: VaultRecord,
+  query: VaultSearchQuery,
+  now: number,
+): boolean {
+  if (query.tokens.length === 0) return true;
+  const posture = contractPosture(row, now);
+  for (const token of query.tokens) {
+    if (!matchToken(row, token, posture)) return false;
+  }
+  return true;
+}
+
+/**
+ * Suggestions for the current trailing token (or the full catalog).
+ *
+ * @param raw - Query string
+ * @param secrets - Rows used to suggest readers / fingerprints
+ */
+export function vaultSearchSuggestions(
+  raw: string,
+  secrets: readonly VaultRecord[],
+): readonly VaultSearchSuggestion[] {
+  const trailing = trailingToken(raw);
+  if (trailing === null) return VAULT_SEARCH_CATALOG;
+
+  const lower = trailing.toLowerCase();
+  if (lower.startsWith("is:") || lower === "is") {
+    return filterCatalog(
+      VAULT_SEARCH_CATALOG.filter((s) => s.token.startsWith("is:")),
+      trailing,
+    );
+  }
+  if (lower.startsWith("kind:") || lower === "kind") {
+    return filterCatalog(
+      [
+        { token: "kind:secret", label: "Sensitive contracts only" },
+        { token: "kind:config", label: "Non-sensitive config only" },
+      ],
+      trailing,
+    );
+  }
+  if (lower.startsWith("from:") || lower === "from") {
+    return filterCatalog(
+      RESOLUTION_SOURCES.map((source) => ({
+        token: `from:${source}`,
+        label:
+          source === "driver"
+            ? "Winner is the vault backend (built-in / managed / memory)"
+            : `Winner is ${source}`,
+      })),
+      trailing,
+    );
+  }
+  if (lower.startsWith("has:") || lower === "has") {
+    return filterCatalog(
+      VAULT_SEARCH_CATALOG.filter((s) => s.token.startsWith("has:")),
+      trailing,
+    );
+  }
+  if (lower.startsWith("reader:") || lower === "reader") {
+    const needle = lower.startsWith("reader:") ? lower.slice("reader:".length) : "";
+    const ids = new Set<string>();
+    for (const row of secrets) {
+      for (const reader of row.readers) {
+        if (needle.length === 0 || reader.toLowerCase().includes(needle)) ids.add(reader);
+      }
+    }
+    return [...ids].slice(0, 8).map((id) => ({
+      token: `reader:${id}`,
+      label: "Flow that reads this contract",
+    }));
+  }
+  if (lower.startsWith("fp:") || lower === "fp") {
+    const needle = lower.startsWith("fp:") ? lower.slice("fp:".length) : "";
+    const fps = new Set<string>();
+    for (const row of secrets) {
+      for (const fp of Object.values(row.fingerprints)) {
+        if (needle.length === 0 || fp.toLowerCase().includes(needle)) fps.add(fp);
+      }
+      if (
+        row.fingerprint &&
+        (needle.length === 0 || row.fingerprint.toLowerCase().includes(needle))
+      ) {
+        fps.add(row.fingerprint);
+      }
+    }
+    return [...fps].slice(0, 8).map((fp) => ({
+      token: `fp:${fp}`,
+      label: "Exact fingerprint",
+    }));
+  }
+  if (lower.startsWith("rotate:") || lower === "rotate") {
+    return filterCatalog(
+      [
+        { token: "rotate:due", label: "Last read older than rotate — never-read counts" },
+        { token: "has:rotate", label: "Contract declares a rotate cadence" },
+        { token: "rotate:never", label: "No rotate cadence (stable secret)" },
+      ],
+      trailing,
+    );
+  }
+
+  const q = lower;
+  return VAULT_SEARCH_CATALOG.filter(
+    (s) => s.token.includes(q) || s.label.toLowerCase().includes(q),
+  );
+}
+
+/**
+ * Replace the trailing token with `next`, or append when the query ends in space.
+ *
+ * @param raw - Current query
+ * @param next - Token to apply
+ */
+export function applySearchSuggestion(raw: string, next: string): string {
+  if (raw.length === 0 || /\s$/.test(raw)) {
+    return `${raw}${next} `.replace(/^\s+/, "");
+  }
+  const lastSpace = raw.lastIndexOf(" ");
+  if (lastSpace < 0) return `${next} `;
+  return `${raw.slice(0, lastSpace + 1)}${next} `;
+}
+
+function parseOperator(part: string): VaultSearchToken | null {
+  if (part.startsWith('"')) return null;
+  const colon = part.indexOf(":");
+  if (colon <= 0) return null;
+  const key = part.slice(0, colon).toLowerCase();
+  const value = part.slice(colon + 1);
+  if (value.length === 0) return null;
+
+  if (key === "is") {
+    const v = value.toLowerCase();
+    if (IS_VALUES.has(v as VaultIsFilter)) return { kind: "is", value: v as VaultIsFilter };
+    if (KIND_VALUES.has(v as "secret" | "config")) {
+      return { kind: "kind", value: v as "secret" | "config" };
+    }
+    return null;
+  }
+  if (key === "kind") {
+    const v = value.toLowerCase();
+    if (KIND_VALUES.has(v as "secret" | "config")) {
+      return { kind: "kind", value: v as "secret" | "config" };
+    }
+    return null;
+  }
+  if (key === "from") return { kind: "from", value: value.toLowerCase() };
+  if (key === "reader") return { kind: "reader", value: value.toLowerCase() };
+  if (key === "fp") return { kind: "fp", value: value.toLowerCase() };
+  if (key === "has") {
+    const v = value.toLowerCase();
+    if (HAS_VALUES.has(v as VaultHasFilter)) return { kind: "has", value: v as VaultHasFilter };
+    return null;
+  }
+  if (key === "rotate") {
+    const v = value.toLowerCase();
+    if (v === "due") return { kind: "is", value: "overdue" };
+    return { kind: "rotate", value: v };
+  }
+  return null;
+}
+
+function matchToken(
+  row: VaultRecord,
+  token: VaultSearchToken,
+  posture: ReturnType<typeof contractPosture>,
+): boolean {
+  switch (token.kind) {
+    case "is":
+      return posture[token.value];
+    case "kind":
+      return row.kind === token.value;
+    case "from":
+      return (row.winner ?? "").toLowerCase() === token.value;
+    case "reader":
+      return row.readers.some((id) => id.toLowerCase().includes(token.value));
+    case "fp":
+      return fingerprintHaystack(row).some((fp) => fp.includes(token.value));
+    case "has":
+      if (token.value === "readers") return row.readers.length > 0;
+      if (token.value === "rotate") return isRotateCadence(row.rotate);
+      if (token.value === "blast") return row.blastRadius.count > 0;
+      return row.sharedFingerprintEnvs.length > 0;
+    case "rotate":
+      if (token.value === "never") {
+        return row.kind === "secret" && !isRotateCadence(row.rotate);
+      }
+      return (row.rotate ?? "").toLowerCase() === token.value;
+    case "text":
+      return textHaystack(row).includes(token.value.toLowerCase());
+  }
+}
+
+function fingerprintHaystack(row: VaultRecord): readonly string[] {
+  const out = Object.values(row.fingerprints).map((fp) => fp.toLowerCase());
+  if (row.fingerprint) out.push(row.fingerprint.toLowerCase());
+  return out;
+}
+
+function textHaystack(row: VaultRecord): string {
+  const parts = [
+    row.name,
+    row.description ?? "",
+    row.winner ?? "",
+    row.kind,
+    ...row.readers,
+    ...Object.keys(row.fingerprints),
+    ...Object.values(row.fingerprints),
+    row.fingerprint ?? "",
+    row.sensitive ? "" : (row.cleartext ?? ""),
+  ];
+  return parts.join("\n").toLowerCase();
+}
+
+function needsQuotes(value: string): boolean {
+  return /\s/.test(value);
+}
+
+function trailingToken(raw: string): string | null {
+  if (raw.length === 0 || /\s$/.test(raw)) return null;
+  const parts = tokenizeVaultSearch(raw);
+  return parts[parts.length - 1] ?? null;
+}
+
+function filterCatalog(
+  items: readonly VaultSearchSuggestion[],
+  trailing: string,
+): readonly VaultSearchSuggestion[] {
+  const q = trailing.toLowerCase();
+  return items.filter(
+    (s) => s.token.toLowerCase().startsWith(q) || s.token.toLowerCase().includes(q),
+  );
+}

package/src/console/ui-next/src/features/vault/lib/theme.ts

@@ -0,0 +1,14 @@
+/**
+ * Vault visual tokens — promote the existing secret hue (Traces bars).
+ *
+ * Cool slate, no collision with Signal amber `#FBBF24` or write orange.
+ */
+
+/** Accent for Key wells, rotation progress ink, and rewrap badges. */
+export const VAULT_ACCENT = "#94A3B8";
+
+/** Selection / progress glow (NODE_ACCENT 0.45 recipe). */
+export const VAULT_GLOW = "rgba(148, 163, 184, 0.45)";
+
+/** Icon-well fill (NODE_ACCENT 0.14 recipe). */
+export const VAULT_WELL = "rgba(148, 163, 184, 0.14)";