okengine 0.11.2 → 0.12.0

package/src/console/server/vault.ts

@@ -8,19 +8,29 @@
 
 import { resolveDriverId, type ConfigEnv, type OkeConfig } from "../../config/index.ts";
 import { VAULT_DEFAULTS } from "../../config/driver-defaults.ts";
+import { memoryVaultDriver } from "../../drivers/index.ts";
 import type { VaultDriverId } from "../../drivers/vault-types.ts";
 import { buildVaultBootChain, normalizeVaultDriverId } from "../../elements/vault/boot-chain.ts";
 import {
   createVaultRuntime,
+  VaultError,
   vault as declareVault,
+  type VaultChainLayer,
   type VaultResolutionSource,
   type VaultResolutionStep,
   type VaultRuntime,
   type VaultSecretDecl,
 } from "../../elements/vault.ts";
 import type { VaultStatus } from "../../elements/vault/types.ts";
+import type { AuditChainBreakReason, VaultAuditRecord } from "../../elements/vault/storage.ts";
 import type { JournalRun, JournalStore } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
+import {
+  isVaultContractName,
+  loadVaultOverlay,
+  upsertVaultOverlay,
+  type VaultOverlayContract,
+} from "./vault-overlay.ts";
 
 /** Environment label for fingerprint columns. */
 export type VaultEnvLabel = ConfigEnv | "staging" | (string & {});
@@ -72,6 +82,11 @@ export interface ConsoleVaultRow {
    * not error (may be deliberate).
    */
   readonly sharedFingerprintEnvs: readonly VaultEnvLabel[];
+  /**
+   * `"source"` is Manifest / `vault.secret`. `"console"` is an operator
+   * Add that is not in the Manifest yet.
+   */
+  readonly origin?: "source" | "console";
 }
 
 /**
@@ -121,6 +136,53 @@ export interface ConsoleVaultBackend {
   readonly status: ConsoleVaultBuiltinStatus | null;
   /** Why {@link status} is missing for a builtin backend; `null` otherwise. */
   readonly unavailable: string | null;
+  /** Managed provider id (`aws-secrets-manager`); `null` otherwise. */
+  readonly provider: string | null;
+}
+
+/**
+ * Per-layer values for Manifest vault boot (seeded Console).
+ *
+ * `driver` lands on the backend bag. File / env overlays are memory bags
+ * with the spec source ids so resolution can show a winner per layer
+ * without writing the project's `.env.local`.
+ */
+export interface VaultLayerSeed {
+  readonly driver?: Readonly<Record<string, string>>;
+  readonly processEnv?: Readonly<Record<string, string>>;
+  readonly envLocal?: Readonly<Record<string, string>>;
+  readonly devFallback?: Readonly<Record<string, string>>;
+}
+
+/** Overlay sources that sit after the driver in the spec chain. */
+const VAULT_OVERLAY_SOURCES = ["process.env", ".env.local"] as const;
+
+/**
+ * Insert memory bags for seeded file / env layers (same source ids).
+ *
+ * @param chain - Boot chain from {@link buildVaultBootChain}
+ * @param overlays - Values keyed by spec source
+ */
+export function overlayVaultLayers(
+  chain: readonly VaultChainLayer[],
+  overlays: Partial<
+    Record<(typeof VAULT_OVERLAY_SOURCES)[number], Readonly<Record<string, string>>>
+  >,
+): VaultChainLayer[] {
+  const out = [...chain];
+  for (const source of VAULT_OVERLAY_SOURCES) {
+    const secrets = overlays[source];
+    if (secrets === undefined || Object.keys(secrets).length === 0) continue;
+    const layer: VaultChainLayer = {
+      driver: memoryVaultDriver,
+      source,
+      options: { secrets },
+    };
+    const idx = out.findIndex((l) => l.source === source);
+    if (idx === -1) out.push(layer);
+    else out.splice(idx, 0, layer);
+  }
+  return out;
 }
 
 /** Options when projecting the vault list. */
@@ -139,6 +201,10 @@ export interface ProjectVaultOptions {
   /** Durable journal — blast radius is queried, not estimated. */
   readonly journal?: JournalStore | null;
   readonly now?: () => number;
+  /** Project root — loads `.oke/vault-contracts.json` when set. */
+  readonly cwd?: string;
+  /** Preloaded Console overlay (tests). */
+  readonly overlay?: readonly VaultOverlayContract[];
 }
 
 /**
@@ -153,14 +219,16 @@ export async function projectVaultList(options: ProjectVaultOptions): Promise<{
 }> {
   const env = options.env ?? "dev";
   const now = options.now ?? (() => Date.now());
-  const names = collectNames(options.manifest, options.runtime);
+  const overlay =
+    options.overlay ?? (options.cwd !== undefined ? await loadVaultOverlay(options.cwd) : []);
+  const names = collectNames(options.manifest, options.runtime, overlay);
   const journalRuns = options.journal
     ? await options.journal.list()
     : ([] as readonly JournalRun[]);
 
   const secrets: ConsoleVaultRow[] = [];
   for (const name of names) {
-    const contract = contractOf(name, options.manifest, options.runtime);
+    const contract = contractOf(name, options.manifest, options.runtime, overlay);
     const sensitive = contract.sensitive;
     const readers = readersOf(options.manifest, name);
     const blastRadius = blastRadiusOf(journalRuns, readers, now());
@@ -202,6 +270,11 @@ export async function projectVaultList(options: ProjectVaultOptions): Promise<{
       blastRadius,
       lastReadAt,
       sharedFingerprintEnvs,
+      origin: options.manifest?.vault?.[name]
+        ? "source"
+        : overlay.some((c) => c.name === name)
+          ? "console"
+          : "source",
     });
   }
 
@@ -266,11 +339,12 @@ export async function probeVaultBackend(
 ): Promise<ConsoleVaultBackend> {
   const env = options.env ?? "dev";
   const driverId = resolveVaultDriverId(options.config, env);
+  const processEnv = options.processEnv ?? process.env;
+  const provider = managedProviderOf(driverId, processEnv);
   if (driverId !== "vault") {
-    return { driverId, builtin: false, status: null, unavailable: null };
+    return { driverId, builtin: false, status: null, unavailable: null, provider };
   }
 
-  const processEnv = options.processEnv ?? process.env;
   const keyHeld = (processEnv[VAULT_MASTER_KEY_ENV] ?? "").trim().length > 0;
 
   const load = options.loadStatus ?? defaultBuiltinStatusLoader(processEnv);
@@ -280,6 +354,7 @@ export async function probeVaultBackend(
       builtin: true,
       status: null,
       unavailable: "No SQL URL configured — set DATABASE_URL or OKE_STORE_SQL_URL",
+      provider,
     };
   }
 
@@ -290,6 +365,7 @@ export async function probeVaultBackend(
       builtin: true,
       status: { ...toConsoleVaultStatus(status), sealed: !keyHeld },
       unavailable: null,
+      provider,
     };
   } catch (error) {
     // Uninitialized / unreachable is an ordinary operator state, not a crash.
@@ -298,10 +374,231 @@ export async function probeVaultBackend(
       builtin: true,
       status: null,
       unavailable: error instanceof Error ? error.message : String(error),
+      provider,
     };
   }
 }
 
+/**
+ * Provider id for the managed driver, when set.
+ *
+ * @param driverId - Resolved vault driver
+ * @param processEnv - Process environment
+ */
+function managedProviderOf(
+  driverId: VaultDriverId,
+  processEnv: Readonly<Record<string, string | undefined>>,
+): string | null {
+  if (driverId !== "managed") return null;
+  const raw = processEnv.OKE_VAULT_PROVIDER?.trim();
+  return raw && raw.length > 0 ? raw : null;
+}
+
+/** Operator-safe audit row (epoch-ms timestamps, no chain hashes). */
+export interface ConsoleVaultAuditRow {
+  readonly id: string;
+  readonly seq: number;
+  readonly action: string;
+  readonly path: string | null;
+  readonly actorType: string;
+  readonly actorId: string | null;
+  readonly success: boolean;
+  readonly errorCode: string | null;
+  readonly errorMessage: string | null;
+  readonly requestId: string | null;
+  readonly createdAt: number;
+}
+
+/** `GET /console/vault/audit/verify` body. */
+export interface ConsoleVaultAuditVerifyResult {
+  readonly ok: boolean;
+  readonly brokenAt: string | null;
+  readonly reason: AuditChainBreakReason | null;
+  readonly row: ConsoleVaultAuditRow | null;
+}
+
+/** `POST /console/vault/rotate-master` success body (minus `at`). */
+export interface ConsoleVaultRotateMasterResult {
+  readonly kekVersion: number;
+  readonly remaining: number;
+  readonly masterKey: string | null;
+}
+
+/** In-process master-rotation handle — process-global, not session-scoped. */
+export interface ConsoleVaultRotateHandle {
+  readonly adapter: import("../../elements/vault/builtin-adapter.ts").BuiltinVaultAdapter;
+  close(): Promise<void>;
+  inFlight: boolean;
+}
+
+/** Options for {@link openConsoleBuiltinAdapter}. */
+export interface OpenConsoleBuiltinAdapterOptions {
+  readonly config?: OkeConfig | null;
+  readonly env?: ConfigEnv;
+  readonly processEnv?: Readonly<Record<string, string | undefined>>;
+  /** When true, unseal from `OKE_VAULT_MASTER_KEY`. Verify stays sealed. */
+  readonly unseal: boolean;
+  readonly kekRewrapBatchSize?: number;
+}
+
+/** Opened built-in adapter for Console operator actions. */
+export interface OpenedConsoleBuiltinAdapter {
+  readonly adapter: import("../../elements/vault/builtin-adapter.ts").BuiltinVaultAdapter;
+  close(): Promise<void>;
+}
+
+/**
+ * Open the built-in Vault adapter for Console verify / rotate-master.
+ *
+ * Never accepts a master key in the HTTP body. Unseal uses
+ * `OKE_VAULT_MASTER_KEY` only when {@link OpenConsoleBuiltinAdapterOptions.unseal}
+ * is true.
+ *
+ * @param options - Config / env / unseal
+ */
+export async function openConsoleBuiltinAdapter(
+  options: OpenConsoleBuiltinAdapterOptions,
+): Promise<OpenedConsoleBuiltinAdapter> {
+  const env = options.env ?? "dev";
+  const driverId = resolveVaultDriverId(options.config, env);
+  if (driverId !== "vault") {
+    throw new ConsoleVaultUnsupportedError(
+      `vault: backend ${driverId} has no seal lifecycle or master rotation`,
+    );
+  }
+  const processEnv = options.processEnv ?? process.env;
+  const url = processEnv.DATABASE_URL ?? processEnv.OKE_STORE_SQL_URL;
+  if (url === undefined || url.trim().length === 0) {
+    throw new ConsoleVaultUnsupportedError(
+      "No SQL URL configured — set DATABASE_URL or OKE_STORE_SQL_URL",
+    );
+  }
+  const keyHeld = (processEnv[VAULT_MASTER_KEY_ENV] ?? "").trim().length > 0;
+  if (options.unseal && !keyHeld) {
+    throw new ConsoleVaultSealedError(
+      "This process holds no master key — export OKE_VAULT_MASTER_KEY or run `oke vault unseal`",
+    );
+  }
+  const { openBuiltinVaultAdapter } = await import("../../drivers/vault-builtin.ts");
+  const opened = await openBuiltinVaultAdapter({
+    url,
+    env: processEnv,
+    masterKey: options.unseal ? (processEnv[VAULT_MASTER_KEY_ENV] ?? "") : "",
+    ...(options.kekRewrapBatchSize === undefined
+      ? {}
+      : { kekRewrapBatchSize: options.kekRewrapBatchSize }),
+  });
+  return {
+    adapter: opened.adapter,
+    close: () => opened.close(),
+  };
+}
+
+/**
+ * Verify the audit chain (sealed — no master key).
+ *
+ * @param options - Config / env
+ */
+export async function verifyConsoleVaultAudit(
+  options: Omit<OpenConsoleBuiltinAdapterOptions, "unseal"> = {},
+): Promise<ConsoleVaultAuditVerifyResult> {
+  const opened = await openConsoleBuiltinAdapter({ ...options, unseal: false });
+  try {
+    const result = await opened.adapter.verifyAudit();
+    if (result.ok || result.brokenAt === undefined) {
+      return { ok: true, brokenAt: null, reason: null, row: null };
+    }
+    const record = await opened.adapter.readAuditRow(result.brokenAt);
+    return {
+      ok: false,
+      brokenAt: result.brokenAt,
+      reason: result.reason ?? null,
+      row: record ? toConsoleVaultAuditRow(record) : null,
+    };
+  } finally {
+    await opened.close();
+  }
+}
+
+/**
+ * Convert an adapter audit row into the JSON-safe Console shape.
+ *
+ * @param row - Adapter record
+ */
+export function toConsoleVaultAuditRow(row: VaultAuditRecord): ConsoleVaultAuditRow {
+  return {
+    id: row.id,
+    seq: row.seq,
+    action: row.action,
+    path: row.path,
+    actorType: row.actorType,
+    actorId: row.actorId,
+    success: row.success,
+    errorCode: row.errorCode,
+    errorMessage: row.errorMessage,
+    requestId: row.requestId,
+    createdAt: row.createdAt.getTime(),
+  };
+}
+
+/** Built-in backend is missing or not the `vault` driver. */
+export class ConsoleVaultUnsupportedError extends Error {
+  readonly code = "VaultUnsupported" as const;
+  /**
+   * @param message - Secret-free reason
+   */
+  constructor(message: string) {
+    super(message);
+    this.name = "ConsoleVaultUnsupportedError";
+  }
+}
+
+/** This process has no master key. */
+export class ConsoleVaultSealedError extends Error {
+  readonly code = "VaultSealed" as const;
+  /**
+   * @param message - Secret-free reason
+   */
+  constructor(message: string) {
+    super(message);
+    this.name = "ConsoleVaultSealedError";
+  }
+}
+
+/** Lease held, batch in flight, or cold-resume required. */
+export class ConsoleVaultRotateBusyError extends Error {
+  readonly code = "VaultRotateBusy" as const;
+  /**
+   * @param message - Secret-free reason
+   */
+  constructor(message: string) {
+    super(message);
+    this.name = "ConsoleVaultRotateBusyError";
+  }
+}
+
+/**
+ * Map adapter / Console vault errors onto typed Console failures.
+ *
+ * @param error - Caught error
+ */
+export function mapConsoleVaultError(error: unknown): never {
+  if (error instanceof ConsoleVaultSealedError) throw error;
+  if (error instanceof ConsoleVaultRotateBusyError) throw error;
+  if (error instanceof ConsoleVaultUnsupportedError) throw error;
+  if (error instanceof VaultError) {
+    if (error.code === "SEALED") throw new ConsoleVaultSealedError(error.message);
+    if (
+      error.code === "UNSUPPORTED" &&
+      /lease held|already in progress|no master rotation|resume rotate-master/i.test(error.message)
+    ) {
+      throw new ConsoleVaultRotateBusyError(error.message);
+    }
+    throw new ConsoleVaultUnsupportedError(error.message);
+  }
+  throw error instanceof Error ? error : new Error(String(error));
+}
+
 /**
  * Convert an adapter {@link VaultStatus} into the JSON-safe Console shape.
  *
@@ -351,6 +648,69 @@ export interface VaultWriteInput {
   readonly value: string;
 }
 
+/** Input for Console Add (new contract + value). */
+export interface VaultCreateInput {
+  readonly name: string;
+  readonly value: string;
+  readonly kind: "secret" | "config";
+  readonly description?: string;
+  readonly rotate?: string;
+}
+
+/**
+ * Declare a contract from Console and write its value.
+ *
+ * Persists metadata under `.oke/vault-contracts.json`. The value goes
+ * through {@link VaultRuntime.put} (same as Set). Does not invent
+ * undeclared `process.env` names.
+ *
+ * @param runtime - Bound vault runtime
+ * @param cwd - Project root
+ * @param manifest - Manifest (rejects names already declared in source)
+ * @param input - Name + kind + value
+ */
+export async function createVaultContract(
+  runtime: VaultRuntime,
+  cwd: string,
+  manifest: Manifest | null,
+  input: VaultCreateInput,
+): Promise<{ readonly name: string; readonly fingerprint: string | null }> {
+  const name = input.name.trim();
+  if (!isVaultContractName(name)) {
+    throw new Error(`vault: invalid contract name "${input.name}"`);
+  }
+  if (manifest?.vault?.[name] || runtime.contracts.has(name)) {
+    throw new Error(`vault: "${name}" is already declared — use Set`);
+  }
+  const overlay = await loadVaultOverlay(cwd);
+  if (overlay.some((c) => c.name === name)) {
+    throw new Error(`vault: "${name}" is already declared — use Set`);
+  }
+  const rotate = input.rotate?.trim();
+  const description = input.description?.trim();
+  const contract: VaultOverlayContract = {
+    name,
+    kind: input.kind,
+    ...(description !== undefined && description.length > 0 ? { description } : {}),
+    ...(rotate !== undefined && rotate.length > 0 ? { rotate } : {}),
+  };
+  await upsertVaultOverlay(cwd, contract);
+  const decl: VaultSecretDecl =
+    input.kind === "config"
+      ? declareVault.config(name, {
+          ...(description !== undefined && description.length > 0 ? { description } : {}),
+          ...(rotate !== undefined && rotate.length > 0 ? { rotate } : {}),
+          sensitive: false,
+        })
+      : declareVault.secret(name, {
+          ...(description !== undefined && description.length > 0 ? { description } : {}),
+          ...(rotate !== undefined && rotate.length > 0 ? { rotate } : {}),
+          sensitive: true,
+        });
+  (runtime.contracts as Map<string, VaultSecretDecl>).set(name, decl);
+  return setVaultValue(runtime, { name, value: input.value });
+}
+
 /**
  * Set a vault value via the runtime (write-only — never returns the value).
  *
@@ -384,19 +744,28 @@ export function rotateVaultValue(
 /**
  * Build a VaultRuntime from Manifest contracts when no host runtime is attached.
  *
- * Uses the standard resolution chain: process.env → .env.local → .env.docker
- * → memory driver → (optional) dev fallback. Does not parse dotenv in the UI.
+ * Uses the standard resolution chain: driver → process.env → .env.local →
+ * (optional) dev fallback. Does not parse dotenv in the UI.
  *
- * @param manifest - Manifest snapshot
- * @param options - cwd / env / allowDevFallbacks / seed
+ * @param manifest - Manifest snapshot (null when only Console overlay exists)
+ * @param options - cwd / env / allowDevFallbacks / seed / overlays
  */
 export async function createManifestVaultRuntime(
-  manifest: Manifest,
+  manifest: Manifest | null,
   options: {
     readonly cwd?: string;
     readonly env?: ConfigEnv;
     readonly allowDevFallbacks?: boolean;
     readonly seed?: Readonly<Record<string, string>>;
+    /**
+     * Memory bags inserted at the spec source (seeded Console). Does not
+     * write `.env.local` on disk.
+     */
+    readonly overlays?: Partial<
+      Record<(typeof VAULT_OVERLAY_SOURCES)[number], Readonly<Record<string, string>>>
+    >;
+    /** `dev` fallbacks for `vault.config` contracts (dev-fallback layer). */
+    readonly devFallbacks?: Readonly<Record<string, string>>;
     readonly now?: () => number;
     /**
      * Backend driver for the terminal layer. Defaults to the built-in
@@ -405,18 +774,23 @@ export async function createManifestVaultRuntime(
     readonly driverId?: VaultDriverId;
   } = {},
 ): Promise<VaultRuntime | null> {
-  const entries = Object.entries(manifest.vault ?? {});
-  if (entries.length === 0) return null;
-
   const cwd = options.cwd ?? process.cwd();
+  const overlay = await loadVaultOverlay(cwd);
+  const entries = Object.entries(manifest?.vault ?? {});
+  if (entries.length === 0 && overlay.length === 0) return null;
+
+  const seen = new Set<string>();
   const secrets: VaultSecretDecl[] = entries.map(([name, c]) => {
+    seen.add(name);
     const sensitive = c.sensitive !== false;
+    const dev = options.devFallbacks?.[name];
     if (sensitive) {
       return declareVault.secret(name, {
         description: c.description,
         rotate: c.rotate,
         schema: c.schema,
         sensitive: true,
+        ...(dev !== undefined ? { dev } : {}),
       });
     }
     return declareVault.config(name, {
@@ -424,8 +798,28 @@ export async function createManifestVaultRuntime(
       rotate: c.rotate,
       schema: c.schema,
       sensitive: false,
+      ...(dev !== undefined ? { dev } : {}),
     });
   });
+  for (const row of overlay) {
+    if (seen.has(row.name)) continue;
+    const dev = options.devFallbacks?.[row.name];
+    secrets.push(
+      row.kind === "config"
+        ? declareVault.config(row.name, {
+            description: row.description,
+            rotate: row.rotate,
+            sensitive: false,
+            ...(dev !== undefined ? { dev } : {}),
+          })
+        : declareVault.secret(row.name, {
+            description: row.description,
+            rotate: row.rotate,
+            sensitive: true,
+            ...(dev !== undefined ? { dev } : {}),
+          }),
+    );
+  }
 
   const seed = options.seed ?? {};
   const env = options.env ?? "dev";
@@ -434,13 +828,18 @@ export async function createManifestVaultRuntime(
   const runtime = createVaultRuntime({
     secrets,
     allowDevFallbacks: options.allowDevFallbacks ?? env !== "prod",
+    // Console Set writes the first value — boot must not refuse unset contracts.
+    allowGaps: true,
     now: options.now,
-    chain: buildVaultBootChain({
-      cwd,
-      driverId: options.driverId ?? "vault",
-      env: env === "dev" || env === "test" || env === "prod" ? env : "dev",
-      seed,
-    }),
+    chain: overlayVaultLayers(
+      buildVaultBootChain({
+        cwd,
+        driverId: options.driverId ?? "vault",
+        env: env === "dev" || env === "test" || env === "prod" ? env : "dev",
+        seed,
+      }),
+      options.overlays ?? {},
+    ),
   });
   await runtime.boot();
   return runtime;
@@ -503,13 +902,17 @@ export function readersOf(manifest: Manifest | null, name: string): readonly str
  * @param manifest - Manifest
  * @param runtime - Runtime
  */
-function collectNames(manifest: Manifest | null, runtime: VaultRuntime | null): readonly string[] {
+function collectNames(
+  manifest: Manifest | null,
+  runtime: VaultRuntime | null,
+  overlay: readonly VaultOverlayContract[] = [],
+): readonly string[] {
   const set = new Set<string>();
   for (const name of Object.keys(manifest?.vault ?? {})) set.add(name);
   if (runtime) {
     for (const name of runtime.contracts.keys()) set.add(name);
-    for (const name of runtime.names()) set.add(name);
   }
+  for (const row of overlay) set.add(row.name);
   return [...set].sort();
 }
 
@@ -522,6 +925,7 @@ function contractOf(
   name: string,
   manifest: Manifest | null,
   runtime: VaultRuntime | null,
+  overlay: readonly VaultOverlayContract[] = [],
 ): {
   readonly kind: "secret" | "config";
   readonly sensitive: boolean;
@@ -538,13 +942,25 @@ function contractOf(
     };
   }
   const fromManifest = manifest?.vault?.[name];
-  const sensitive = fromManifest?.sensitive !== false;
-  return {
-    kind: sensitive ? "secret" : "config",
-    sensitive,
-    ...(fromManifest?.description !== undefined ? { description: fromManifest.description } : {}),
-    ...(fromManifest?.rotate !== undefined ? { rotate: fromManifest.rotate } : {}),
-  };
+  if (fromManifest) {
+    const sensitive = fromManifest.sensitive !== false;
+    return {
+      kind: sensitive ? "secret" : "config",
+      sensitive,
+      ...(fromManifest.description !== undefined ? { description: fromManifest.description } : {}),
+      ...(fromManifest.rotate !== undefined ? { rotate: fromManifest.rotate } : {}),
+    };
+  }
+  const fromOverlay = overlay.find((c) => c.name === name);
+  if (fromOverlay) {
+    return {
+      kind: fromOverlay.kind,
+      sensitive: fromOverlay.kind === "secret",
+      ...(fromOverlay.description !== undefined ? { description: fromOverlay.description } : {}),
+      ...(fromOverlay.rotate !== undefined ? { rotate: fromOverlay.rotate } : {}),
+    };
+  }
+  return { kind: "secret", sensitive: true };
 }
 
 /**

package/src/console/ui-next/components.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "base-lyra",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/styles.css",
+    "baseColor": "zinc",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "hugeicons",
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "menuColor": "default",
+  "menuAccent": "subtle",
+  "registries": {
+    "@bklit": "https://ui.bklit.com/r/{name}.json"
+  }
+}