okengine 0.12.0 → 0.14.1

package/src/console/ui-next/dist/assets/{vault-page-CSOYMHhO.js → vault-page-DuKzqwzW.js}

@@ -1,2 +1,2 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{$a as t,$n as n,Cr as r,Do as i,E as a,Hi as o,Mr as s,Ni as c,Qn as l,Ri as u,S as d,Sr as f,Ur as p,Xa as m,Xi as h,Za as g,Zn as _,_ as v,_a as y,_r as b,ar as x,b as S,br as ee,c as C,cr as te,d as ne,dr as w,ea as T,eo as re,er as ie,gr as ae,h as oe,hr as E,i as D,ii as se,kr as ce,l as O,mr as le,na as ue,ni as de,nr as fe,o as k,or as A,p as j,qr as pe,s as M,sa as me,sr as N,to as he,tr as ge,u as P,ur as _e,vr as F,wr as I,xr as ve,y as ye,yi as be}from"./shortcut-keys-DO4IsVqv.js";import{t as L,x as xe}from"./link-DF7SZ9Ek.js";import{r as Se}from"./react-dom-Bph1y7z7.js";import{A as Ce}from"./xyflow-D7n4g6go.js";import{A as we,C as Te,_ as R,a as z,c as B,g as Ee,h as De,i as V,o as Oe,p as ke,s as H,t as U,x as Ae}from"./sheet-form-D-ata7jy.js";import{n as je}from"./index-DX248G39.js";import{_ as W,d as G,f as Me,g as Ne,h as Pe,i as Fe,m as Ie,n as Le,p as Re,r as ze,t as Be,u as Ve}from"./collapsible-DYb0xU8C.js";import{a as He,i as Ue,n as We,o as Ge,r as Ke,s as qe,t as Je}from"./use-vault-list-Cl79j_ku.js";import{t as Ye}from"./explorer-empty-HjTnVQoR.js";import{n as Xe,t as Ze}from"./confirm-sheet-DDCRmG62.js";var K=e(Se(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:Ge(n),command:tt(t),hint:Ue(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=Ce(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:be,"process.env":h,".env.local":de,"dev-fallback":ue},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:a,onQueryChange:o,leading:s}){let c=Qe(e.blastRadius),l=pt(e,n),u=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=l.unset,v=l.overdue&&q(e.rotate)&&!c.warn&&!l.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(we,{dataSlot:`vault-detail-header`,leading:s,icon:(0,Y.jsx)(I,{icon:G.vault.icon,className:`size-4`}),wellStyle:{color:J},title:u,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:He(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Xe,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(W,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(d,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(W,{label:c.warn?c.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(d,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:c.warn,onClick:a,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:l.unset,blastWarn:c.warn,blastSummary:c.summary,blastDetail:c.detail,overdue:l.overdue,onSet:i,onRotate:a}),(0,Y.jsxs)(`div`,{className:E,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?qe(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:o?()=>o(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:o?()=>o(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:o&&e.readers[0]?()=>o(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:c.detail??(e.blastRadius.longestOutstandingMs==null?c.summary:$e(e.blastRadius.longestOutstandingMs)),warn:c.warn,onClick:o?()=>o(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:o?()=>o(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:o?e=>o(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(ke,{children:[(0,Y.jsx)(W,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Te,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:x,children:(0,Y.jsx)(I,{icon:c,className:`size-3.5`})})})}),(0,Y.jsxs)(De,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(Ee,{children:t.slice(0,4).map(e=>(0,Y.jsx)(R,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Ae,{}),(0,Y.jsx)(R,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:i,blastSummary:a,blastDetail:o,overdue:s,onSet:c,onRotate:l}){return i?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:r(E,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[a,o?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,o]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(L,{to:`/overview`,search:{run:e},className:r(w,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:r(E,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(d,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):s&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:r(E,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(d,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:r(E,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:r(ve,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:i=!1,won:a=!1,onClick:o}){let s=r(b,F,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:r(`font-mono tabular-nums text-foreground`,i&&`text-amber-800 dark:text-amber-400`,a&&bt),children:t})]});return o?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:o,className:s,children:c}):(0,Y.jsx)(`span`,{title:n,className:s,children:c})}function kt({steps:e,selected:t,fill:n,backend:i,onSelect:a}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,s)=>{let c=e.source===t.source,l=wt(e,s,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":c,onClick:()=>a(e.source),className:r(w,c&&`bg-muted/70 text-foreground`,o>=0&&s>o&&!c&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:r(_e,c&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(`relative z-10 size-2 shrink-0 rounded-full border`,l===`won`&&`border-emerald-500 bg-emerald-500`,l===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,l===`missed`&&`border-muted-foreground/50 bg-transparent`,l===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:yt[e.source],className:r(A,l===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:r(`min-w-0 flex-1 truncate font-mono`,l===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:He(i)}):null]}),(0,Y.jsx)(`span`,{className:r(`shrink-0 text-[10px]`,l===`won`?bt:`text-muted-foreground`),children:l})]}),c?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Xe,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:w,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Xe,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:r(w,`group/reader`),children:[(0,Y.jsx)(I,{icon:G.flow.icon,className:r(A,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:r(_,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(L,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(L,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Ye,{icon:G.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Ye,{icon:G.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:G.vault.icon,config:h},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:ce,unset:ue,overdue:p,shared:me,dormant:ue,healthy:G.vault.icon,config:h},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:i=!1,matchCount:a,totalCount:o,now:c,onSelect:u}){let[d,p]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&p(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[i&&e.length===0?(0,Y.jsx)(`p`,{className:N,children:`Loading…`}):null,!i&&e.length===0?(0,Y.jsxs)(`p`,{className:N,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let i=d[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:l,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Be,{open:i,onOpenChange:t=>p(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(ze,{nativeButton:!1,className:n,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(I,{icon:s,className:r(ge,!i&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:Ft[e.kind],className:r(A,f(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(ie,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:fe,children:e.secrets.length})]})}),(0,Y.jsx)(Le,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:c,onSelect:u},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:a===o?`${o} contracts`:`${a} of ${o} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:i}){let a=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,s=o!==a,c=pt(e,n),l=c.primary!==`healthy`&&c.primary!==`config`,u=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,d=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${a}, ${o}, ${u}, ${gt(c.primary)}`,onClick:()=>i(e.name),className:r(w,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:r(_e,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(W,{label:_t(c.primary,e.rotate),children:(0,Y.jsx)(I,{icon:Rt[c.primary],className:r(A,`mt-0.5`,f(Lt[c.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:a}),l?(0,Y.jsx)(Ht,{posture:c}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[s?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,s?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:u}),d.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:r(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{$a as t,$n as n,Cr as r,Do as i,E as a,Hi as o,Mr as s,Ni as c,Qn as l,Ri as u,S as d,Sr as f,Ur as p,Xa as m,Xi as h,Za as g,Zn as _,_ as v,_a as y,_r as b,ar as x,b as S,br as ee,c as C,cr as te,d as ne,dr as w,ea as T,eo as re,er as ie,gr as ae,h as oe,hr as E,i as D,ii as se,kr as ce,l as O,mr as le,na as ue,ni as de,nr as fe,o as k,or as A,p as j,qr as pe,s as M,sa as me,sr as N,to as he,tr as ge,u as P,ur as _e,vr as F,wr as I,xr as ve,y as ye,yi as be}from"./shortcut-keys-DO4IsVqv.js";import{t as L,x as xe}from"./link-DF7SZ9Ek.js";import{r as Se}from"./react-dom-Bph1y7z7.js";import{A as Ce}from"./xyflow-D7n4g6go.js";import{A as we,C as Te,_ as R,a as z,c as B,g as Ee,h as De,i as V,o as Oe,p as ke,s as H,t as U,x as Ae}from"./sheet-form-D-ata7jy.js";import{n as je}from"./index-Ce6WKWKM.js";import{_ as W,d as G,f as Me,g as Ne,h as Pe,i as Fe,m as Ie,n as Le,p as Re,r as ze,t as Be,u as Ve}from"./collapsible-DYb0xU8C.js";import{a as He,i as Ue,n as We,o as Ge,r as Ke,s as qe,t as Je}from"./use-vault-list-Cl79j_ku.js";import{t as Ye}from"./explorer-empty-HjTnVQoR.js";import{n as Xe,t as Ze}from"./confirm-sheet-DDCRmG62.js";var K=e(Se(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:Ge(n),command:tt(t),hint:Ue(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=Ce(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:be,"process.env":h,".env.local":de,"dev-fallback":ue},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:a,onQueryChange:o,leading:s}){let c=Qe(e.blastRadius),l=pt(e,n),u=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=l.unset,v=l.overdue&&q(e.rotate)&&!c.warn&&!l.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(we,{dataSlot:`vault-detail-header`,leading:s,icon:(0,Y.jsx)(I,{icon:G.vault.icon,className:`size-4`}),wellStyle:{color:J},title:u,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:He(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Xe,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(W,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(d,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(W,{label:c.warn?c.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(d,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:c.warn,onClick:a,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:l.unset,blastWarn:c.warn,blastSummary:c.summary,blastDetail:c.detail,overdue:l.overdue,onSet:i,onRotate:a}),(0,Y.jsxs)(`div`,{className:E,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?qe(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:o?()=>o(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:o?()=>o(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:o&&e.readers[0]?()=>o(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:c.detail??(e.blastRadius.longestOutstandingMs==null?c.summary:$e(e.blastRadius.longestOutstandingMs)),warn:c.warn,onClick:o?()=>o(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:o?()=>o(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:o?e=>o(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(ke,{children:[(0,Y.jsx)(W,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Te,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:x,children:(0,Y.jsx)(I,{icon:c,className:`size-3.5`})})})}),(0,Y.jsxs)(De,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(Ee,{children:t.slice(0,4).map(e=>(0,Y.jsx)(R,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Ae,{}),(0,Y.jsx)(R,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:i,blastSummary:a,blastDetail:o,overdue:s,onSet:c,onRotate:l}){return i?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:r(E,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[a,o?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,o]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(L,{to:`/overview`,search:{run:e},className:r(w,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:r(E,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(d,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):s&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:r(E,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(d,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:r(E,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:r(ve,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:i=!1,won:a=!1,onClick:o}){let s=r(b,F,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:r(`font-mono tabular-nums text-foreground`,i&&`text-amber-800 dark:text-amber-400`,a&&bt),children:t})]});return o?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:o,className:s,children:c}):(0,Y.jsx)(`span`,{title:n,className:s,children:c})}function kt({steps:e,selected:t,fill:n,backend:i,onSelect:a}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,s)=>{let c=e.source===t.source,l=wt(e,s,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":c,onClick:()=>a(e.source),className:r(w,c&&`bg-muted/70 text-foreground`,o>=0&&s>o&&!c&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:r(_e,c&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(`relative z-10 size-2 shrink-0 rounded-full border`,l===`won`&&`border-emerald-500 bg-emerald-500`,l===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,l===`missed`&&`border-muted-foreground/50 bg-transparent`,l===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:yt[e.source],className:r(A,l===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:r(`min-w-0 flex-1 truncate font-mono`,l===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:He(i)}):null]}),(0,Y.jsx)(`span`,{className:r(`shrink-0 text-[10px]`,l===`won`?bt:`text-muted-foreground`),children:l})]}),c?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Xe,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:w,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Xe,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:r(w,`group/reader`),children:[(0,Y.jsx)(I,{icon:G.flow.icon,className:r(A,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:r(_,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(L,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(L,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Ye,{icon:G.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Ye,{icon:G.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:G.vault.icon,config:h},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:ce,unset:ue,overdue:p,shared:me,dormant:ue,healthy:G.vault.icon,config:h},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:i=!1,matchCount:a,totalCount:o,now:c,onSelect:u}){let[d,p]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&p(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[i&&e.length===0?(0,Y.jsx)(`p`,{className:N,children:`Loading…`}):null,!i&&e.length===0?(0,Y.jsxs)(`p`,{className:N,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let i=d[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:l,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Be,{open:i,onOpenChange:t=>p(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(ze,{nativeButton:!1,className:n,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(I,{icon:s,className:r(ge,!i&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:Ft[e.kind],className:r(A,f(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(ie,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:fe,children:e.secrets.length})]})}),(0,Y.jsx)(Le,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:c,onSelect:u},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:a===o?`${o} contracts`:`${a} of ${o} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:i}){let a=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,s=o!==a,c=pt(e,n),l=c.primary!==`healthy`&&c.primary!==`config`,u=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,d=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${a}, ${o}, ${u}, ${gt(c.primary)}`,onClick:()=>i(e.name),className:r(w,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:r(_e,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(W,{label:_t(c.primary,e.rotate),children:(0,Y.jsx)(I,{icon:Rt[c.primary],className:r(A,`mt-0.5`,f(Lt[c.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:a}),l?(0,Y.jsx)(Ht,{posture:c}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[s?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,s?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:u}),d.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:r(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
 `).toLowerCase()}function sn(e){return/\s/.test(e)}function cn(e){if(e.length===0||/\s$/.test(e))return null;let t=Jt(e);return t[t.length-1]??null}function Z(e,t){let n=t.toLowerCase();return e.filter(e=>e.token.toLowerCase().startsWith(n)||e.token.toLowerCase().includes(n))}function ln({card:e,env:t,summary:n,query:i,progress:a,verifyNote:o,onQueryChange:s,onOpenSecurity:c}){return(0,Y.jsxs)(`section`,{"aria-label":`Vault posture`,className:`shrink-0 border-b border-border/60`,"data-slot":`vault-posture-strip`,children:[(0,Y.jsxs)(`div`,{className:`flex min-h-10 flex-wrap items-stretch`,children:[(0,Y.jsx)(`button`,{type:`button`,onClick:c,"aria-label":`Open vault security`,className:`flex items-center px-2 text-left text-xs font-medium text-foreground hover:bg-muted/50`,children:e?.title??`Vault backend`}),(0,Y.jsx)(`span`,{className:`flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:t}),e?.badges.map(e=>(0,Y.jsxs)(`span`,{role:e.tone===`warn`?`alert`:`status`,className:r(`flex items-center gap-1.5 px-2 text-[10px]`,e.tone===`warn`?`text-amber-800 dark:text-amber-400`:`text-muted-foreground`,e.id===`rewrap`&&`text-[color:var(--vault-accent)]`),style:e.id===`rewrap`?{"--vault-accent":J}:void 0,children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:r(`size-1.5 shrink-0 rounded-full`,e.tone===`warn`?`bg-amber-500`:`bg-muted-foreground/50`,e.id===`rewrap`&&`bg-[var(--vault-accent)]`)}),e.label]},e.id)),st.map(e=>{let t=n[e.id],a=Qt(i,e.token);return t===0&&!a?null:(0,Y.jsx)(W,{label:_t(e.id),className:`flex self-stretch`,children:(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":a,onClick:()=>s(Zt(i,e.token)),className:r(b,a?ae:F,e.tone===`danger`&&!a&&`text-destructive`,e.tone===`warn`&&!a&&`text-amber-800 dark:text-amber-400`),children:[e.label,(0,Y.jsx)(`span`,{className:`font-mono tabular-nums`,children:t})]})},e.id)}),(0,Y.jsx)(`span`,{className:`ml-auto flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:o??`${n.secrets}s · ${n.config}c`})]}),a?(0,Y.jsxs)(`p`,{className:`border-t border-border/60 px-2 py-1 font-mono text-[11px]`,style:{color:J},role:`status`,"data-slot":`vault-rewrap-progress`,"data-phase":a.phase,children:[a.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:a.detail})]}):null]})}function un({query:e,secrets:t,onQueryChange:n}){let i=(0,K.useId)(),a=(0,K.useRef)(null),[o,s]=(0,K.useState)(!1),[c,l]=(0,K.useState)(0),u=(0,K.useMemo)(()=>en(e,t),[e,t]);(0,K.useEffect)(()=>{l(0)},[e]),(0,K.useEffect)(()=>{let e=e=>{a.current?.contains(e.target)||s(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[]);let d=t=>{n(tn(e,t.token)),s(!0)};return(0,Y.jsxs)(`div`,{ref:a,className:`relative flex h-full min-w-0 flex-1`,"data-slot":`vault-search`,children:[(0,Y.jsx)(Ve,{"data-slot":`vault-search-input`,value:e,onChange:e=>{n(e.target.value),s(!0)},onFocus:()=>s(!0),onKeyDown:e=>{if(e.key===`Escape`){s(!1);return}if(!o||u.length===0){e.key===`ArrowDown`&&u.length>0&&(e.preventDefault(),s(!0));return}if(e.key===`ArrowDown`){e.preventDefault(),l(e=>(e+1)%u.length);return}if(e.key===`ArrowUp`){e.preventDefault(),l(e=>(e-1+u.length)%u.length);return}e.key===`Enter`&&u[c]&&(e.preventDefault(),d(u[c]))},placeholder:`Search vault…`,"aria-label":`Search vault`,"aria-autocomplete":`list`,"aria-expanded":o,"aria-controls":i,role:`combobox`,title:`name, fingerprint, reader…  is:unset  from:.env.local`}),o&&u.length>0?(0,Y.jsx)(`ul`,{id:i,role:`listbox`,className:`absolute top-full z-30 mt-1 max-h-72 w-[min(20rem,calc(100vw-4rem))] overflow-y-auto rounded-lg border border-border/70 bg-popover p-1 shadow-md`,children:u.map((e,t)=>(0,Y.jsx)(`li`,{role:`option`,"aria-selected":t===c,children:(0,Y.jsxs)(`button`,{type:`button`,onMouseEnter:()=>l(t),onClick:()=>d(e),className:r(`flex w-full items-baseline gap-2 rounded-md px-2 py-1.5 text-left`,t===c&&`bg-muted/70`),children:[(0,Y.jsx)(`span`,{className:`font-mono text-[11px] text-foreground`,children:e.token}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate text-[10px] text-muted-foreground`,children:e.label})]})},`${e.token}-${t}`))}):null]})}function dn(e,t=``,n=Date.now()){let r=Yt(t),i=e.filter(e=>$t(e,r,n)),a=[`secret`,`config`],o={secret:`Secrets`,config:`Config`};return a.map(e=>({kind:e,label:o[e],secrets:i.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function fn(e){let t=e.remaining,n=e.rewrapTargetKekVersion;if(!(t!==null&&t>0||n!==null))return t===0?{phase:2,headline:`KEK v${e.kekVersion} — rotation complete`,detail:`The previous master key no longer opens this vault.`}:null;let r=n??e.kekVersion,i=t??0;return{phase:1,headline:`kek v${e.kekVersion} → v${r}`,detail:i>0?`${i} DEK${i===1?``:`s`} still on the old key. Both master keys stay live.`:`Both master keys stay live until remaining is 0.`}}function pn({masterKey:e,onDismiss:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsx)(D,{open:e!==null,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(k,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-master-key-sheet`,children:[(0,Y.jsxs)(O,{children:[(0,Y.jsx)(P,{children:`New master key`}),(0,Y.jsx)(M,{children:`Shown once. Store it offline. This Console process does not keep it for you.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(`p`,{className:`border-b border-border/50 px-4 py-3 font-mono text-[11px] break-all`,children:e}),(0,Y.jsx)(`p`,{className:`px-4 py-3 text-[11px] text-muted-foreground`,role:`status`,children:`Copying puts the key on the clipboard. Anyone with this device can read it until you clear it.`})]}),(0,Y.jsxs)(C,{children:[(0,Y.jsx)(B,{split:!0,disabled:!e,onClick:()=>{e&&(navigator.clipboard?.writeText(e),r(!0))},children:n?`Copied`:`Copy (clipboard warning)`}),(0,Y.jsx)(B,{variant:`destructive`,onClick:()=>{r(!1),t()},children:`I have stored this key`})]})]})})}function mn({open:e,onOpenChange:t,pending:n=!1,error:r,onConfirm:i}){return(0,Y.jsx)(Ze,{open:e,onOpenChange:t,phrase:`ROTATE_MASTER`,title:`Rotate master key`,description:`Generates a new master key and rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`,pending:n,error:r,confirmLabel:`Confirm rotate master`,slot:`vault-rotate-master-sheet`,onConfirm:i})}var hn=[{id:`status`,cmd:`oke vault status`,label:`Backend seal + KEK`},{id:`audit`,cmd:`oke vault audit`,label:`Hash-chained audit log`},{id:`verify`,cmd:`oke vault audit verify`,label:`Verify the chain on disk`},{id:`backup`,cmd:`oke vault backup`,label:`Encrypted backup`},{id:`restore`,cmd:`oke vault restore`,label:`Restore from backup`}];function gn({open:e,onOpenChange:t,card:n,env:i,progress:a,verifyPending:o=!1,verifyNote:s,onVerify:c,onRotateMaster:l,onExport:u}){return(0,Y.jsx)(D,{open:e,onOpenChange:t,children:(0,Y.jsxs)(k,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-security-sheet`,children:[(0,Y.jsxs)(O,{children:[(0,Y.jsx)(P,{children:`Vault security`}),(0,Y.jsx)(M,{children:`Fingerprints and backend status only. Backup, restore, and unseal stay on the CLI.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Backend`}),(0,Y.jsx)(`p`,{className:`text-[12px] font-medium`,children:n?.title??`Unresolved`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:n?.description??`The server could not resolve a vault backend.`}),(0,Y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[(0,Y.jsxs)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:[`env `,i]}),n?.badges.map(e=>(0,Y.jsx)(Fe,{variant:`outline`,role:e.tone===`warn`?`alert`:`status`,className:r(`h-5 rounded-md text-[10px]`,e.tone===`warn`&&`border-amber-500/35 bg-amber-500/10 text-amber-800 dark:text-amber-400`),children:e.label},e.id))]}),n?.facts.length?(0,Y.jsx)(`dl`,{className:`flex flex-col gap-1`,children:n.facts.map(e=>(0,Y.jsxs)(`div`,{className:`flex justify-between gap-3`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] tracking-[0.12em] text-muted-foreground uppercase`,children:e.label}),(0,Y.jsx)(`dd`,{className:`font-mono text-[11px]`,children:e.value})]},e.label))}):null,n?.hint?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:n.hint}):null,a?(0,Y.jsxs)(`p`,{className:`font-mono text-[11px]`,style:{color:J},role:`status`,children:[a.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:a.detail})]}):null]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Actions`}),(0,Y.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,Y.jsx)(d,{type:`button`,variant:`outline`,size:`sm`,disabled:o,onClick:c,children:`Verify audit chain`}),s?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:s}):null,(0,Y.jsx)(d,{type:`button`,variant:`outline`,size:`sm`,onClick:l,children:`Rotate master key`}),(0,Y.jsx)(d,{type:`button`,variant:`outline`,size:`sm`,onClick:u,children:`Export fingerprints`})]}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`Master rotation rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`})]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`CLI`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`The Console never accepts a master key in the HTTP body.`}),(0,Y.jsx)(`ul`,{className:`flex flex-col gap-1`,children:hn.map(e=>(0,Y.jsx)(_n,{cmd:e.cmd,label:e.label},e.id))})]})]})]})})}function _n({cmd:e,label:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsxs)(`li`,{className:`flex items-center gap-2`,children:[(0,Y.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,Y.jsx)(`p`,{className:`font-mono text-[11px]`,children:e}),(0,Y.jsx)(`p`,{className:`text-[10px] text-muted-foreground`,children:t})]}),(0,Y.jsx)(d,{type:`button`,variant:`ghost`,size:`icon-xs`,"aria-label":`Copy ${e}`,onClick:()=>{navigator.clipboard?.writeText(e),r(!0),window.setTimeout(()=>r(!1),1200)},children:(0,Y.jsx)(I,{icon:n?T:pe})})]})}function vn({result:e,onClose:t}){let n=e!==null&&e.ok===!1,r=e?.reason===`link`?`prev-hash does not match the previous row`:e?.reason===`payload`?`stored row hash does not match the payload`:`the chain failed verification`;return(0,Y.jsx)(D,{open:n,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(k,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-verify-sheet`,children:[(0,Y.jsxs)(O,{children:[(0,Y.jsx)(P,{children:`Chain broken`}),(0,Y.jsxs)(M,{children:[`The audit hash chain failed at`,` `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e?.brokenAt??`unknown`}),`.`]})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto text-[11px]`,children:[(0,Y.jsxs)(`p`,{className:`border-b border-border/50 px-4 py-3`,role:`alert`,children:[`Reason: `,r,`.`]}),e?.row?(0,Y.jsxs)(`dl`,{className:`divide-y divide-border/50`,children:[(0,Y.jsx)(Q,{label:`id`,value:e.row.id,mono:!0}),(0,Y.jsx)(Q,{label:`seq`,value:String(e.row.seq),mono:!0}),(0,Y.jsx)(Q,{label:`action`,value:e.row.action}),(0,Y.jsx)(Q,{label:`path`,value:e.row.path??`—`,mono:!0}),(0,Y.jsx)(Q,{label:`actor`,value:`${e.row.actorType} ${e.row.actorId??``}`}),(0,Y.jsx)(Q,{label:`time`,value:new Date(e.row.createdAt).toISOString(),mono:!0}),e.row.errorMessage?(0,Y.jsx)(Q,{label:`error`,value:e.row.errorMessage}):null]}):null]}),(0,Y.jsx)(C,{children:(0,Y.jsx)(B,{onClick:t,children:`Close`})})]})})}function Q({label:e,value:t,mono:n}){return(0,Y.jsxs)(`div`,{className:`px-4 py-2.5`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`font-mono text-[11px] break-all`:`text-[11px]`,children:t})]})}async function yn(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return`sha256:${[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,16)}`}async function bn(e){let t=e.name.trim(),n=e.value;if(t.length===0)return{error:`Name is required`};if(n.trim().length===0)return{error:`Value is required`};if(e.action!==`create`&&(e.reason?.trim()??``).length<3)return{error:`Reason is required`};let r=e.kind??(e.sensitive?`secret`:`config`),i=await yn(n),a=e.action===`create`?null:e.reason?.trim()??null;return{action:e.action,name:t,kind:r,fingerprint:i,preview:e.sensitive?null:n,reason:a,rotate:e.rotate??null,commit:{name:t,value:n,reason:a,kind:r,description:e.description?.trim()??``,rotate:e.rotate??(r===`secret`?`90d`:`never`)}}}function xn(e,t){return e===null?null:t(e)}function Sn(){return null}function Cn(e){return j(e,`alert-dialog`)}function wn({...e}){return(0,Y.jsx)(Cn,{"data-slot":`alert-dialog`,...e})}function Tn({...e}){return(0,Y.jsx)(oe,{"data-slot":`alert-dialog-portal`,...e})}function En({className:e,...t}){return(0,Y.jsx)(S,{"data-slot":`alert-dialog-overlay`,className:r(`fixed inset-0 z-50 bg-black/20 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-xs`,e),...t})}function Dn({className:e,children:t,...n}){return(0,Y.jsxs)(Tn,{children:[(0,Y.jsx)(En,{}),(0,Y.jsx)(v,{"data-slot":`alert-dialog-content`,className:r(`fixed top-1/2 left-1/2 z-50 w-[min(100%-2rem,24rem)] -translate-x-1/2 -translate-y-1/2 overflow-hidden rounded-none border border-border bg-popover text-sm text-popover-foreground shadow-lg outline-none transition duration-150 data-ending-style:scale-95 data-ending-style:opacity-0 data-starting-style:scale-95 data-starting-style:opacity-0`,e),...n,children:t})]})}function On({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-header`,className:r(`flex flex-col gap-1 border-b border-border/50 px-4 py-3`,e),...t})}function kn({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-footer`,className:r(`flex flex-row items-stretch border-t border-border/50 p-0`,e),...t})}function An({className:e,...t}){return(0,Y.jsx)(ne,{"data-slot":`alert-dialog-title`,className:r(`text-sm font-medium text-foreground`,e),...t})}function jn({className:e,...t}){return(0,Y.jsx)(ye,{"data-slot":`alert-dialog-description`,className:r(`text-[11px] text-muted-foreground`,e),...t})}var Mn={create:`Confirm add`,set:`Confirm set`,rotate:`Confirm rotate`},Nn={create:`Add contract`,set:`Set value`,rotate:`Rotate`};function Pn({review:e,pending:t=!1,onCancel:n,onConfirm:r}){return(0,Y.jsx)(wn,{open:e!==null,onOpenChange:e=>{!e&&!t&&n()},children:(0,Y.jsxs)(Dn,{"data-slot":`vault-write-review`,children:[(0,Y.jsxs)(On,{children:[(0,Y.jsx)(An,{children:e?`${Mn[e.action]} ${e.name}`:`Confirm write`}),(0,Y.jsx)(jn,{children:e?.preview==null?`Write-only. The value is never shown again.`:`Config is shown in the clear after submit.`})]}),e?(0,Y.jsx)(Fn,{review:e}):null,(0,Y.jsxs)(kn,{children:[(0,Y.jsx)(B,{split:!0,onClick:n,disabled:t,"data-slot":`vault-write-review-cancel`,children:`Cancel`}),(0,Y.jsx)(B,{variant:e?.action===`rotate`?`destructive`:`default`,disabled:t||e===null,onClick:r,"data-slot":`vault-write-review-confirm`,children:t?`Working…`:e?Nn[e.action]:`Confirm`})]})]})})}function Fn({review:e}){return(0,Y.jsxs)(`dl`,{className:`flex flex-col`,"data-slot":`vault-write-review-facts`,children:[(0,Y.jsx)($,{label:`Name`,value:e.name,mono:!0}),e.action===`create`?(0,Y.jsx)($,{label:`Kind`,value:e.kind}):null,(0,Y.jsx)($,{label:`Fingerprint`,value:e.fingerprint,mono:!0}),e.preview==null?null:(0,Y.jsx)($,{label:`Value`,value:e.preview,mono:!0}),e.reason?(0,Y.jsx)($,{label:`Reason`,value:e.reason}):null,e.action===`create`&&e.rotate?(0,Y.jsx)($,{label:`Rotate`,value:e.rotate}):null]})}function $({label:e,value:t,mono:n=!1}){return(0,Y.jsxs)(`div`,{className:`flex items-baseline justify-between gap-3 border-b border-border/50 px-4 py-2 last:border-b-0`,children:[(0,Y.jsx)(`dt`,{className:`shrink-0 text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`min-w-0 truncate font-mono text-[11px]`:`min-w-0 truncate text-[12px]`,children:t})]})}function In({open:e,onOpenChange:t,pending:n=!1,error:i,onSubmit:o}){let[s,c]=(0,K.useState)(`secret`),[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(``),[p,m]=(0,K.useState)(`90d`),[h,g]=(0,K.useState)(``),[_,v]=(0,K.useState)(null),[y,b]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(c(`secret`),u(``),f(``),m(`90d`),g(``),v(null),b(null))},[e]);let x=l.trim().length>0&&h.trim().length>0&&!n,S=async()=>{let e=await bn({action:`create`,name:l.trim(),value:h,sensitive:s===`secret`,kind:s,description:d.trim(),rotate:s===`secret`?p:`never`});if(`error`in e){v(e.error);return}v(null),b(e)};return(0,Y.jsxs)(D,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(k,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-create-sheet`,children:[(0,Y.jsxs)(O,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(P,{className:`text-sm`,children:`Add vault contract`}),(0,Y.jsx)(M,{className:`text-[11px]`,children:s===`secret`?`Writes the value and lists the contract here. Promote it to vault.secret in source when a Flow should read it.`:`vault.config — shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(z,{label:`Kind`,children:[(0,Y.jsx)(V,{active:s===`secret`,onClick:()=>c(`secret`),children:`secret`}),(0,Y.jsx)(V,{active:s===`config`,onClick:()=>c(`config`),children:`config`})]}),(0,Y.jsx)(H,{label:`Name`,children:(0,Y.jsx)(a,{value:l,onChange:e=>u(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g,``)),placeholder:`STRIPE_KEY`,autoComplete:`off`,"aria-label":`Contract name`,flat:!0,className:r(U,`font-mono`)})}),(0,Y.jsx)(H,{label:`Description`,children:(0,Y.jsx)(a,{value:d,onChange:e=>f(e.target.value),placeholder:`Optional title`,autoComplete:`off`,"aria-label":`Description`,flat:!0,className:U})}),s===`secret`?(0,Y.jsxs)(z,{label:`Rotate`,children:[(0,Y.jsx)(V,{active:p===`90d`,onClick:()=>m(`90d`),children:`90d`}),(0,Y.jsx)(V,{active:p===`never`,onClick:()=>m(`never`),children:`no rotate`})]}):null,(0,Y.jsx)(H,{label:`Value`,children:(0,Y.jsx)(a,{type:`password`,autoComplete:`off`,value:h,onChange:e=>g(e.target.value),placeholder:s===`secret`?`Paste the secret`:`Public value`,"aria-label":`New vault value`,flat:!0,className:U})}),_||i?(0,Y.jsx)(Oe,{slot:`vault-create-error`,children:_??i}):null]}),(0,Y.jsxs)(C,{children:[(0,Y.jsx)(B,{split:!0,onClick:()=>t(!1),disabled:n,children:`Cancel`}),(0,Y.jsx)(B,{variant:`default`,disabled:!x,onClick:()=>{S()},"data-slot":`vault-create-submit`,children:s===`secret`?`Review secret`:`Review config`})]})]}),(0,Y.jsx)(Pn,{review:y,pending:n,onCancel:()=>b(Sn()),onConfirm:()=>{xn(y,e=>{o({name:e.commit.name,value:e.commit.value,kind:e.commit.kind,description:e.commit.description,rotate:e.commit.rotate})})}})]})}var Ln=[{id:`first`,label:`first`,text:`Initial value`},{id:`fix`,label:`fix`,text:`Correct a bad value`},{id:`provider`,label:`provider`,text:`Provider changed it`},{id:`other`,label:`other`,text:``}],Rn=[{id:`scheduled`,label:`scheduled`,text:`Scheduled rotation`},{id:`leak`,label:`leak`,text:`Key compromise`},{id:`provider`,label:`provider`,text:`Provider rotated`},{id:`other`,label:`other`,text:``}];function zn(e){return e===`rotate`?Rn:Ln}function Bn(e){return e===`rotate`?`scheduled`:`first`}function Vn(e,t,n){return t===`other`?n.trim():zn(e).find(e=>e.id===t)?.text??``}function Hn({open:e,onOpenChange:t,mode:n,name:r,sensitive:i=!0,pending:o=!1,error:s,onSubmit:c}){let[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(()=>Bn(n)),[p,m]=(0,K.useState)(``),[h,g]=(0,K.useState)(null),[_,v]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(u(``),f(Bn(n)),m(``),g(null),v(null))},[e,n]);let y=Vn(n,d,p),b=l.trim().length>0&&y.length>=3&&!o,x=zn(n),S=async()=>{let e=await bn({action:n,name:r,value:l,sensitive:i,reason:y,kind:i?`secret`:`config`});if(`error`in e){g(e.error);return}g(null),v(e)};return(0,Y.jsxs)(D,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(k,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-write-sheet`,children:[(0,Y.jsxs)(O,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(P,{className:`text-sm`,children:n===`set`?`Set ${r}`:`Rotate ${r}`}),(0,Y.jsx)(M,{className:`text-[11px]`,children:i?`Write-only. The new value is never shown again after submit.`:`This vault.config value is shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(H,{label:`New value`,children:(0,Y.jsx)(a,{type:`password`,autoComplete:`off`,value:l,onChange:e=>u(e.target.value),placeholder:i?`Paste the new secret`:`Paste the new value`,"aria-label":`New vault value`,flat:!0,className:U})}),(0,Y.jsx)(z,{label:`Reason`,children:x.map(e=>(0,Y.jsx)(V,{active:d===e.id,onClick:()=>f(e.id),children:e.label},e.id))}),d===`other`?(0,Y.jsx)(H,{label:`Other`,children:(0,Y.jsx)(a,{value:p,onChange:e=>m(e.target.value),placeholder:`Why is this change needed?`,"aria-label":`Custom reason`,flat:!0,className:U})}):null,h||s?(0,Y.jsx)(Oe,{slot:`vault-write-error`,children:h??s}):null]}),(0,Y.jsxs)(C,{children:[(0,Y.jsx)(B,{split:!0,onClick:()=>t(!1),disabled:o,children:`Cancel`}),(0,Y.jsx)(B,{variant:n===`rotate`?`destructive`:`default`,disabled:!b,onClick:()=>{S()},"data-slot":`vault-write-submit`,children:n===`set`?`Review set`:`Review rotate`})]})]}),(0,Y.jsx)(Pn,{review:_,pending:o,onCancel:()=>v(Sn()),onConfirm:()=>{xn(_,e=>{c({value:e.commit.value,reason:e.commit.reason??y})})}})]})}function Un(){let e=We(),n=i(),{query:a,selectedName:s,action:l,setQuery:d,setSelectedName:f,setAction:p}=je(),h=Me(),_=(0,Y.jsx)(Ne,{open:h.open,onToggle:h.toggle,noun:`vault`,controlsId:`vault-list`,dataSlot:`vault-list-toggle`}),[v]=(0,K.useState)(()=>Date.now()),[b,S]=(0,K.useState)(!1),[C,ne]=(0,K.useState)(null),[w,T]=(0,K.useState)(null),[ie,ae]=(0,K.useState)(null),[oe,E]=(0,K.useState)(null),[D,ce]=(0,K.useState)(null),[O,ue]=(0,K.useState)(null),[de,fe]=(0,K.useState)(null),[k,A]=(0,K.useState)(null),j=e.data?.secrets??[],pe=e.data?.env??`dev`,M=e.data?.backend??null,me=(0,K.useMemo)(()=>Ke(M),[M]),N=(0,K.useMemo)(()=>dn(j,a,v),[j,a,v]),ge=(0,K.useMemo)(()=>mt(j,v),[j,v]),P=(0,K.useMemo)(()=>N.flatMap(e=>e.secrets),[N]),_e=P.length,F=P.find(e=>e.name===s)??P[0]??null,ve=fn({kekVersion:O??M?.status?.kekVersion??1,remaining:D,rewrapTargetKekVersion:M?.status?.rewrapTargetKekVersion??null});(0,K.useEffect)(()=>{let e=e=>{if(e.key!==`/`||e.metaKey||e.ctrlKey||e.altKey)return;let t=e.target;if(t instanceof HTMLElement){let e=t.tagName;if(e===`INPUT`||e===`TEXTAREA`||t.isContentEditable)return}e.preventDefault(),document.querySelector(`[data-slot='vault-search-input']`)?.focus()};return window.addEventListener(`keydown`,e),()=>window.removeEventListener(`keydown`,e)},[]);let ye=async()=>{await n.invalidateQueries({queryKey:Je})},L=()=>{let e=ot(j);navigator.clipboard?.writeText(e),ne(`Exported fingerprints only (no secret values)`)},Se=xe({mutationFn:async e=>{if(e.value.trim().length===0)throw Error(`New value is required`);let n=await(e.mode===`set`?he:t)({name:e.name,value:e.value,reason:e.reason});if(n.error)throw Error(y(n.error));return n.data},onSuccess:async()=>{T(null),p(null),await ye()},onError:e=>{T(e.message)}}),Ce=xe({mutationFn:async e=>{if(e.name.trim().length===0)throw Error(`Name is required`);if(e.value.trim().length===0)throw Error(`Value is required`);let t=await g({name:e.name,value:e.value,kind:e.kind,...e.description.length>0?{description:e.description}:{},...e.rotate.length>0?{rotate:e.rotate}:{}});if(t.error)throw Error(y(t.error));return t.data},onSuccess:async e=>{T(null),p(null),e?.name&&f(e.name),await ye()},onError:e=>{T(e.message)}}),we=xe({mutationFn:async e=>{let t=0,n=M?.status?.kekVersion??1;for(;;){let r=await re(e);if(r.error)throw Error(y(r.error));if(!r.data)throw Error(`Empty rotate-master response`);if(t=r.data.remaining,n=r.data.kekVersion,ce(r.data.remaining),ue(r.data.kekVersion),r.data.masterKey&&E(r.data.masterKey),await ye(),r.data.remaining===0)break}return{remaining:t,kekVersion:n}},onSuccess:()=>{ae(null),p(null)},onError:e=>{ae(e.message)}}),z=xe({mutationFn:async()=>{let e=await m();if(e.error)throw Error(y(e.error));if(!e.data)throw Error(`Empty verify response`);return e.data},onSuccess:e=>{e.ok?(A(null),fe(`chain intact`)):(fe(null),A(e))}});return(0,Y.jsxs)(`div`,{className:te,"data-slot":`vault-page`,children:[(0,Y.jsxs)(Pe,{orientation:`horizontal`,className:`min-h-0 flex-1`,children:[(0,Y.jsx)(Ie,{panelRef:h.panelRef,collapsible:!0,collapsedSize:0,defaultSize:le.start.defaultSize,minSize:le.start.minSize,onResize:h.onResize,className:`min-h-0 overflow-hidden`,children:(0,Y.jsxs)(`div`,{id:`vault-list`,className:`flex h-full min-h-0 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:r(ee,`relative z-20 pr-1.5`),children:[(0,Y.jsx)(un,{query:a,secrets:j,onQueryChange:d}),(0,Y.jsx)(W,{label:`Add secret or config`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Add secret or config`,onClick:()=>p(`create`),className:x,children:(0,Y.jsx)(I,{icon:u,className:`size-3.5`})})}),C?(0,Y.jsx)(`span`,{className:`sr-only`,role:`status`,children:C}):null,(0,Y.jsx)(W,{label:`Verify the audit hash chain`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Verify chain`,disabled:z.isPending,onClick:()=>z.mutate(),className:x,children:(0,Y.jsx)(I,{icon:o,className:`size-3.5`})})}),(0,Y.jsxs)(ke,{children:[(0,Y.jsx)(W,{label:`Vault security`,className:`flex self-stretch`,children:(0,Y.jsx)(Te,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Vault security`,className:x,children:(0,Y.jsx)(I,{icon:c,className:`size-3.5`})})})}),(0,Y.jsxs)(De,{align:`end`,className:`min-w-52`,children:[(0,Y.jsxs)(Ee,{children:[(0,Y.jsx)(R,{onClick:()=>S(!0),children:`Security`}),(0,Y.jsxs)(R,{onClick:()=>p(`rotate-master`),children:[(0,Y.jsx)(I,{icon:be,"data-icon":`inline-start`}),`Rotate master key`]}),(0,Y.jsxs)(R,{onClick:L,children:[(0,Y.jsx)(I,{icon:se,"data-icon":`inline-start`}),`Export fingerprints`]})]}),(0,Y.jsx)(Ae,{}),(0,Y.jsxs)(R,{disabled:z.isPending,onClick:()=>z.mutate(),children:[(0,Y.jsx)(I,{icon:o,"data-icon":`inline-start`}),`Verify audit chain`]})]})]})]}),(0,Y.jsx)(ln,{card:me,env:pe,summary:ge,query:a,progress:ve,verifyNote:de,onQueryChange:d,onOpenSecurity:()=>S(!0)}),(0,Y.jsx)(Bt,{groups:N,selectedName:F?.name??s,loading:e.isLoading,matchCount:_e,totalCount:j.length,now:v,onSelect:f})]})}),h.open?(0,Y.jsx)(Re,{withHandle:!0}):null,(0,Y.jsx)(Ie,{defaultSize:le.end.defaultSize,minSize:le.end.minSize,className:`min-h-0 overflow-hidden`,children:F?(0,Y.jsx)(Tt,{row:F,env:pe,now:v,backend:M,onSet:()=>p(`set`),onRotate:()=>p(`rotate`),onQueryChange:d,leading:_}):(0,Y.jsx)(Nt,{loading:e.isLoading,hasContracts:j.length>0,query:a,onClearQuery:()=>d(``),leading:_})})]}),(0,Y.jsx)(In,{open:l===`create`,onOpenChange:e=>{e||(T(null),p(null))},pending:Ce.isPending,error:l===`create`?w:null,onSubmit:e=>Ce.mutate(e)}),(0,Y.jsx)(Hn,{open:l===`set`||l===`rotate`,onOpenChange:e=>{e||(T(null),p(null))},mode:l===`rotate`?`rotate`:`set`,name:F?.name??``,sensitive:F?.sensitive??!0,pending:Se.isPending,error:w,onSubmit:e=>{F&&Se.mutate({mode:l===`rotate`?`rotate`:`set`,name:F.name,...e})}}),(0,Y.jsx)(mn,{open:l===`rotate-master`,onOpenChange:e=>{e||(ae(null),p(null))},pending:we.isPending,error:ie,onConfirm:e=>we.mutate(e)}),(0,Y.jsx)(gn,{open:b,onOpenChange:S,card:me,env:pe,progress:ve,verifyPending:z.isPending,verifyNote:de,onVerify:()=>z.mutate(),onRotateMaster:()=>{S(!1),p(`rotate-master`)},onExport:L}),(0,Y.jsx)(pn,{masterKey:oe,onDismiss:()=>E(null)}),(0,Y.jsx)(vn,{result:k,onClose:()=>A(null)})]})}export{Un as VaultPage};

package/src/console/ui-next/dist/index.html

@@ -37,7 +37,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DX248G39.js"></script>
+    <script type="module" crossorigin src="/assets/index-Ce6WKWKM.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Bph1y7z7.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-D7n4g6go.js">

package/src/console/ui-next/seed-invoke-host.ts

@@ -17,6 +17,7 @@ import type { Manifest } from "../../manifest/types.ts";
 import {
   aiAgentRegistry,
   aiEmbedRegistry,
+  aiMcpServerRegistry,
   aiModelRegistry,
   aiPromptRegistry,
   channelTemplateRegistry,
@@ -92,6 +93,7 @@ function clearElementRegistries(): void {
   aiPromptRegistry.length = 0;
   aiEmbedRegistry.length = 0;
   aiAgentRegistry.length = 0;
+  aiMcpServerRegistry.length = 0;
 }
 
 const SeedIn = z.record(z.string(), z.unknown()).optional();

package/src/console/ui-next/src/features/flows/graph/build-flow-graph.test.ts

@@ -150,6 +150,24 @@ describe("buildFlowGraph", () => {
     expect(callersOfFlow(GRAPH_MANIFEST, "payments.chargeBooking")).toEqual([]);
   });
 
+  test("mcp: calls become one AI node per server with a call edge", () => {
+    const manifest: Manifest = {
+      ...GRAPH_MANIFEST,
+      flows: {
+        "support.triage": {
+          effects: { calls: ["mcp:github/create_issue"], asks: ["ticket-triage"] },
+        },
+      },
+    };
+    const { nodes, edges } = buildFlowGraph(manifest);
+    const byId = new Map(nodes.map((n) => [n.id, n]));
+    expect(byId.get("mcp:github")?.data).toMatchObject({ kind: "ai", label: "github" });
+    const edge = edges.find((e) => e.id === "e:flow:support.triage->mcp:github");
+    expect(edge?.data?.kind).toBe("calls");
+    expect(edge?.animated).toBe(true);
+    expect(nodes.some((n) => n.id === "flow:mcp:github/create_issue")).toBe(false);
+  });
+
   test("unit groups hug content bounds instead of a fixed dead-space box", () => {
     const unit = nodes.find((n) => n.id === "unit:fulfillment");
     const flow = nodes.find((n) => n.id === "flow:fulfillment.onOrder");

package/src/console/ui-next/src/features/flows/graph/build-flow-graph.ts

@@ -10,6 +10,7 @@
 import dagre from "@dagrejs/dagre";
 import { MarkerType, type Edge, type Node } from "@xyflow/react";
 import type { Flow, Manifest } from "../../../../../../manifest/types.ts";
+import { mcpServerNodeId, parseMcpToolRef } from "../../../../../../manifest/mcp-ref.ts";
 import type { OkeElement } from "@/lib/element-icons.ts";
 import {
   EDGE_STROKE,
@@ -270,6 +271,14 @@ export function buildFlowGraph(manifest: Manifest | null | undefined): {
         edges.push(styledEdge(`e:flow:${flowId}->${ref}`, `flow:${flowId}`, ref, "secrets"));
       }
       for (const callee of e.calls ?? []) {
+        const mcp = parseMcpToolRef(callee);
+        if (mcp) {
+          const id = mcpServerNodeId(mcp.server);
+          targets.set(id, { id, kind: "ai", label: mcp.server });
+          effectCount.set(id, (effectCount.get(id) ?? 0) + 1);
+          edges.push(styledEdge(`e:flow:${flowId}->${id}`, `flow:${flowId}`, id, "calls", true));
+          continue;
+        }
         edges.push(
           styledEdge(
             `e:flow:${flowId}->flow:${callee}`,
@@ -349,7 +358,11 @@ function layoutWithDagre(
       for (const a of e.asks ?? []) link(`flow:${flowId}`, `ai:${a}`);
       for (const s of e.sends ?? []) link(`flow:${flowId}`, `channel:${s}`);
       for (const s of e.secrets ?? []) link(`flow:${flowId}`, `vault:${s}`);
-      for (const callee of e.calls ?? []) link(`flow:${flowId}`, `flow:${callee}`);
+      for (const callee of e.calls ?? []) {
+        const mcp = parseMcpToolRef(callee);
+        if (mcp) link(`flow:${flowId}`, mcpServerNodeId(mcp.server));
+        else link(`flow:${flowId}`, `flow:${callee}`);
+      }
     }
   }
 

package/src/console/ui-next/src/features/flows/graph/neighborhood.test.ts

@@ -52,6 +52,23 @@ describe("sliceManifestForFocus", () => {
     expect(Object.keys(sliced.flows ?? {})).toEqual(["fulfillment.onOrder"]);
   });
 
+  test("mcp: callees are not treated as flow ids", () => {
+    const manifest = {
+      ...FLOWS_TEST_MANIFEST,
+      flows: {
+        ...FLOWS_TEST_MANIFEST.flows,
+        "support.triage": {
+          effects: { calls: ["mcp:github/create_issue"] },
+        },
+      },
+    };
+    const sliced = sliceManifestForFocus(manifest, { kind: "unit", unit: "support" });
+    expect(Object.keys(sliced.flows ?? {})).toEqual(["support.triage"]);
+    expect(
+      flowTouchesNode(manifest.flows!["support.triage"]!, "support.triage", "mcp:github"),
+    ).toBe(true);
+  });
+
   test("sliced Manifest lays out a small graph", () => {
     const sliced = sliceManifestForFocus(FLOWS_TEST_MANIFEST, {
       kind: "unit",

package/src/console/ui-next/src/features/flows/graph/neighborhood.ts

@@ -4,6 +4,7 @@
  */
 
 import type { Flow, Manifest } from "../../../../../../manifest/types.ts";
+import { mcpServerNodeId, parseMcpToolRef } from "../../../../../../manifest/mcp-ref.ts";
 import { unitOfFlowId } from "./build-flow-graph.ts";
 
 /** Focus that expands the detailed graph (not the bipartite map). */
@@ -29,13 +30,17 @@ export function sliceManifestForFocus(manifest: Manifest, focus: NeighborhoodFoc
     }
     const callees: string[] = [];
     for (const flowId of keep) {
-      for (const callee of flows[flowId]?.effects?.calls ?? []) callees.push(callee);
+      for (const callee of flows[flowId]?.effects?.calls ?? []) {
+        if (!parseMcpToolRef(callee)) callees.push(callee);
+      }
     }
     for (const callee of callees) keep.add(callee);
   } else if (focus.kind === "flow") {
     keep.add(focus.flowId);
     const flow = flows[focus.flowId];
-    for (const callee of flow?.effects?.calls ?? []) keep.add(callee);
+    for (const callee of flow?.effects?.calls ?? []) {
+      if (!parseMcpToolRef(callee)) keep.add(callee);
+    }
     for (const [id, other] of Object.entries(flows)) {
       if (other.effects?.calls?.includes(focus.flowId)) keep.add(id);
     }
@@ -77,6 +82,14 @@ export function flowTouchesNode(flow: Flow, flowId: string, nodeId: string): boo
   if (effects.sends?.some((name) => nodeId === `channel:${name}`)) return true;
   if (effects.asks?.some((name) => nodeId === `ai:${name}`)) return true;
   if (effects.secrets?.some((name) => nodeId === `vault:${name}`)) return true;
-  if (effects.calls?.some((callee) => nodeId === `flow:${callee}`)) return true;
+  if (
+    effects.calls?.some((callee) => {
+      const mcp = parseMcpToolRef(callee);
+      if (mcp) return nodeId === mcpServerNodeId(mcp.server);
+      return nodeId === `flow:${callee}`;
+    })
+  ) {
+    return true;
+  }
   return false;
 }

package/src/console/ui-next/src/features/flows/traces/effect-kind.ts

@@ -9,6 +9,7 @@
  */
 
 import type { RunEffect } from "@/client.ts";
+import { parseMcpToolRef } from "../../../../../../manifest/mcp-ref.ts";
 import { ELEMENT_ICONS, type ElementHugeIcon } from "@/lib/element-icons.ts";
 import { EDGE_STROKE } from "../graph/flow-graph-theme.ts";
 
@@ -87,7 +88,8 @@ export function effectBarColor(kind: RunEffectKind): string {
  *
  * @param kind - Effect kind
  */
-export function effectKindIcon(kind: RunEffectKind): ElementHugeIcon {
+export function effectKindIcon(kind: RunEffectKind, resource?: string): ElementHugeIcon {
+  if (resource && parseMcpToolRef(resource)) return ELEMENT_ICONS.ai.icon;
   switch (kind) {
     case "read":
     case "write":

package/src/console/ui-next/src/features/flows/traces/effect-summary.ts

@@ -8,6 +8,7 @@
  */
 
 import type { RunEffect, RunRow } from "@/client.ts";
+import { parseMcpToolRef } from "../../../../../../manifest/mcp-ref.ts";
 import { formatDuration } from "./format-duration.ts";
 import { effectKindSummaryLabel, type RunEffectKind } from "./effect-kind.ts";
 
@@ -164,6 +165,26 @@ export function effectSummaryChips(
  *
  * @param effect - Ledger entry
  */
+/**
+ * Units / graph chip label for an `mcp:<server>/<tool>` call.
+ *
+ * @param ref - Effect resource
+ */
+export function mcpCallChipLabel(ref: string): string | null {
+  const mcp = parseMcpToolRef(ref);
+  if (!mcp) return null;
+  return `Call ${mcp.server} → ${mcp.tool}`;
+}
+
+/**
+ * True when an effect targets an MCP tool (`mcp:…`).
+ *
+ * @param resource - Effect resource ref
+ */
+export function isMcpResource(resource: string): boolean {
+  return parseMcpToolRef(resource) !== null;
+}
+
 export function effectEventLabel(effect: Pick<RunEffect, "kind" | "resource">): string {
   if (isComputedCacheKey(effect.resource)) {
     return "Cache read";
@@ -171,6 +192,9 @@ export function effectEventLabel(effect: Pick<RunEffect, "kind" | "resource">):
   if (isSqlResource(effect.resource)) {
     return effect.kind === "write" ? "DB write" : "DB query";
   }
+  if (effect.kind === "call" && isMcpResource(effect.resource)) {
+    return "MCP call";
+  }
   const labels: Record<RunEffectKind, string> = {
     read: "Read",
     write: "Write",

package/src/console/ui-next/src/features/flows/traces/trace-detail-sheet.tsx

@@ -504,7 +504,7 @@ export function TraceDetailSheet({
                               )}
                             />
                             <div className="flex items-center gap-2">
-                              <EffectKindGlyph kind={effect.kind} />
+                              <EffectKindGlyph kind={effect.kind} resource={effect.resource} />
                               <span className="w-[4.5rem] shrink-0 font-medium text-foreground/90">
                                 {effectEventLabel(effect)}
                               </span>
@@ -565,11 +565,17 @@ export function TraceDetailSheet({
  *
  * @param props - Effect kind
  */
-function EffectKindGlyph({ kind }: { readonly kind: RunEffectKind }): JSX.Element {
+function EffectKindGlyph({
+  kind,
+  resource,
+}: {
+  readonly kind: RunEffectKind;
+  readonly resource?: string;
+}): JSX.Element {
   const color = effectBarColor(kind);
   return (
     <span className={EXPLORER_ICON_CLASS} style={{ color }} aria-hidden>
-      <HugeiconsIcon icon={effectKindIcon(kind)} className="size-3.5" />
+      <HugeiconsIcon icon={effectKindIcon(kind, resource)} className="size-3.5" />
     </span>
   );
 }

package/src/console/ui-next/src/features/flows/traces/trace-detail.test.ts

@@ -2,7 +2,7 @@
  * Unit tests for effect summary chips and request metadata helpers.
  */
 
-import { effectSummaryChips, effectEventLabel } from "./effect-summary.ts";
+import { effectSummaryChips, effectEventLabel, mcpCallChipLabel } from "./effect-summary.ts";
 import { effectBarColor, effectKindIcon, effectKindSummaryLabel } from "./effect-kind.ts";
 import { ELEMENT_ICONS } from "@/lib/element-icons.ts";
 import { EDGE_STROKE } from "../graph/flow-graph-theme.ts";
@@ -305,6 +305,15 @@ describe("effectEventLabel", () => {
     expect(effectEventLabel({ kind: "read", resource: "sql:bookings" })).toBe("DB query");
     expect(effectEventLabel({ kind: "write", resource: "sql:bookings" })).toBe("DB write");
     expect(effectEventLabel({ kind: "emit", resource: "order-placed" })).toBe("Emit");
+    expect(effectEventLabel({ kind: "call", resource: "mcp:github/create_issue" })).toBe(
+      "MCP call",
+    );
+  });
+
+  test("mcp call chips and glyphs", () => {
+    expect(mcpCallChipLabel("mcp:github/create_issue")).toBe("Call github → create_issue");
+    expect(effectKindIcon("call", "mcp:github/create_issue")).toBe(ELEMENT_ICONS.ai.icon);
+    expect(effectKindIcon("call")).toBe(ELEMENT_ICONS.flow.icon);
   });
 
   test("labels computed: cache keys as Cache read, not DB query", () => {

package/src/console/ui-next/src/features/observability/lib/ask-count.test.ts

@@ -44,4 +44,29 @@ describe("askCountInWindow", () => {
       windowMs: 60_000,
     });
   });
+
+  test("counts MCP call effects next to asks", () => {
+    const now = 1_000;
+    const runs = [
+      monitoringRun({
+        id: "a",
+        flow: "x",
+        startedAt: now - 10,
+        effects: [
+          {
+            kind: "call",
+            resource: "mcp:github/create_issue",
+            timestamp: now - 10,
+            duration: 8,
+            reversibility: "irreversible",
+          },
+        ],
+      }),
+    ];
+    expect(askCountInWindow(runs, now, 60_000)).toEqual({
+      kind: "summary",
+      asks: 1,
+      windowMs: 60_000,
+    });
+  });
 });

package/src/console/ui-next/src/features/observability/lib/ask-count.ts

@@ -3,6 +3,7 @@
  */
 
 import type { RunRow } from "@/client.ts";
+import { parseMcpToolRef } from "../../../../../../manifest/mcp-ref.ts";
 import { runsInWindow } from "./window-stats.ts";
 
 /** Honest empty — no ask effects in the window. */
@@ -36,7 +37,9 @@ export function askCountInWindow(
   let asks = 0;
   for (const run of inWindow) {
     for (const effect of run.effects) {
-      if (effect.kind === "ask") asks += 1;
+      if (effect.kind === "ask" || (effect.kind === "call" && parseMcpToolRef(effect.resource))) {
+        asks += 1;
+      }
     }
   }
   if (asks === 0) return { kind: "empty" };

package/src/console/ui-next/src/features/units/detail/effects-summary.tsx

@@ -6,6 +6,7 @@ import { HugeiconsIcon } from "@hugeicons/react";
 import type { JSX } from "react";
 import type { Effects } from "../../../../../../manifest/types.ts";
 import { SectionHead } from "@/components/explorer/section-head.tsx";
+import { mcpCallChipLabel } from "@/features/flows/traces/effect-summary.ts";
 import {
   effectBarColor,
   effectKindIcon,
@@ -38,17 +39,24 @@ export function EffectsSummary({ effects }: EffectsSummaryProps): JSX.Element |
       <ul className="flex flex-wrap gap-1.5">
         {chips.map((c) => {
           const color = effectBarColor(c.kind);
-          const Icon = effectKindIcon(c.kind);
+          const Icon = effectKindIcon(c.kind, c.ref);
+          const mcpLabel = c.kind === "call" ? mcpCallChipLabel(c.ref) : null;
           return (
             <li
               key={`${c.kind}:${c.ref}`}
               className="inline-flex items-center gap-1 rounded-md border px-1.5 py-0.5 font-mono text-[10px]"
               style={{ borderColor: `${color}55`, color }}
-              title={`${EFFECT_KIND_LABEL[c.kind]} ${c.ref}`}
+              title={mcpLabel ?? `${EFFECT_KIND_LABEL[c.kind]} ${c.ref}`}
             >
               <HugeiconsIcon icon={Icon} className="size-3" />
-              <span className="text-muted-foreground">{EFFECT_KIND_LABEL[c.kind]}</span>
-              <span className="text-foreground/90">{c.ref}</span>
+              {mcpLabel ? (
+                <span className="text-foreground/90">{mcpLabel}</span>
+              ) : (
+                <>
+                  <span className="text-muted-foreground">{EFFECT_KIND_LABEL[c.kind]}</span>
+                  <span className="text-foreground/90">{c.ref}</span>
+                </>
+              )}
             </li>
           );
         })}

package/src/docker/docker.test.ts

@@ -957,7 +957,7 @@ describe("deriveInfrastructure", () => {
   test("Dockerfile CMD is oke start", () => {
     const df = emitDockerfile();
     expect(df).toContain('CMD ["oke", "start"]');
-    expect(df).toContain("oven/bun:1.3");
+    expect(df).toContain("oven/bun:1.4");
   });
 
   test("writeDerivedFiles never writes compose.override.yml", async () => {

package/src/docker/dockerfile.ts

@@ -19,7 +19,7 @@ export interface DockerfileOptions {
  */
 export function emitDockerfile(options: DockerfileOptions = {}): string {
   const port = options.appPort ?? APP_PORT;
-  const base = options.baseImage ?? "oven/bun:1.3";
+  const base = options.baseImage ?? "oven/bun:1.4";
   return `# generated by oke docker — do not edit
 FROM ${base} AS deps
 WORKDIR /app

package/src/docker/helpers.ts

@@ -109,6 +109,34 @@ export function envPrefix(role: string): string {
   return `OKE_${role.replaceAll(".", "_").toUpperCase()}`;
 }
 
+/**
+ * `redis-server` / `valkey-server` command — role-prefixed password.
+ *
+ * @param spec - Service
+ * @param binary - Server binary
+ */
+export function kvServerCommand(
+  spec: ServiceSpec,
+  binary: "redis-server" | "valkey-server",
+): string {
+  const p = envPrefix(spec.role);
+  const pass = `$$${p}_PASSWORD`;
+  const memory = `--maxmemory "$$\{${p}_MAXMEMORY:-0}" --maxmemory-policy "$$\{${p}_MAXMEMORY_POLICY:-noeviction}"`;
+  return `exec ${binary} --requirepass "${pass}" ${memory}`;
+}
+
+/**
+ * Dragonfly command — Redis-wire, role-prefixed password.
+ *
+ * @param spec - Service
+ */
+export function dragonflyServerCommand(spec: ServiceSpec): string {
+  const p = envPrefix(spec.role);
+  const pass = `$$${p}_PASSWORD`;
+  const memory = `--maxmemory "$$\{${p}_MAXMEMORY:-0}"`;
+  return `exec dragonfly --requirepass "${pass}" ${memory}`;
+}
+
 /**
  * Default host port for well-known roles.
  *