okengine 0.14.1 → 0.16.0

package/src/console/ui-next/dist/assets/vault-page-B1dB9Ft0.js

@@ -0,0 +1,2 @@
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{$n as t,Bi as n,Cr as r,E as i,Fi as a,Fo as o,Jr as s,Mr as c,Qi as l,Qn as u,Sr as d,Ta as f,Wi as p,Wr as m,Zn as h,_ as g,_r as _,ao as v,ar as y,b,br as ee,c as x,co as te,cr as ne,d as re,dr as S,er as C,gr as ie,h as ae,hr as w,i as T,ia as oe,ii as se,io as ce,kr as le,l as E,la as ue,lo as de,mr as D,na as fe,nr as pe,o as O,oi as me,or as k,p as A,s as j,so as he,sr as M,tr as N,u as P,ur as F,vr as ge,wr as I,x as L,xi as _e,xr as ve,y as ye}from"./shortcut-keys-DKxNTe_m.js";import{t as be}from"./useMutation-B8EO02Ej.js";import{r as xe}from"./react-dom-Bph1y7z7.js";import{A as Se}from"./xyflow-D7n4g6go.js";import{t as R}from"./link-BX6Vqztd.js";import{a as z,d as Ce,i as we,l as Te,r as Ee,t as De}from"./dropdown-menu-_NjTEo5_.js";import{r as Oe}from"./index-CGoZkILK.js";import{a as ke,c as Ae,i as je,n as Me,o as Ne,r as Pe,s as B,t as V}from"./element-icons-BVXtRyd3.js";import{t as Fe}from"./explorer-empty-2uIhBu0_.js";import{a as H,c as U,l as W,n as G,o as Ie,s as Le,t as Re}from"./detail-header-DhHM1iaZ.js";import{n as ze,t as Be}from"./copy-inline-button-DBHhgHKP.js";import{i as Ve,n as He,r as Ue,t as We}from"./collapsible-DGnOM2ph.js";import{a as Ge,i as Ke,n as qe,o as Je,r as Ye,s as Xe,t as Ze}from"./use-vault-list-uk4WVboC.js";var K=e(xe(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:Je(n),command:tt(t),hint:Ke(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=Se(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:_e,"process.env":l,".env.local":se,"dev-fallback":oe},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:a,onQueryChange:o,leading:s}){let c=Qe(e.blastRadius),l=pt(e,n),u=e.description??e.name,d=jt(e,t),f=St(e),p=f.find(e=>e.won)??null,[m,h]=(0,K.useState)(()=>Ct(f)),g=l.unset,_=l.overdue&&q(e.rotate)&&!c.warn&&!l.unset;(0,K.useEffect)(()=>{h(Ct(St(e)))},[e.name]);let v=f.find(e=>e.source===m)??f[0],y=it(v.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(Re,{dataSlot:`vault-detail-header`,leading:s,icon:(0,Y.jsx)(I,{icon:V.vault.icon,className:`size-4`}),wellStyle:{color:J},title:u,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:Ge(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Be,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),g?null:(0,Y.jsx)(B,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(L,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),g||_?null:(0,Y.jsx)(B,{label:c.warn?c.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(L,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:c.warn,onClick:a,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:l.unset,blastWarn:c.warn,blastSummary:c.summary,blastDetail:c.detail,overdue:l.overdue,onSet:i,onRotate:a}),(0,Y.jsxs)(`div`,{className:w,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:p?e.winner===`driver`?Xe(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:o?()=>o(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:o?()=>o(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:o&&e.readers[0]?()=>o(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:c.detail??(e.blastRadius.longestOutstandingMs==null?c.summary:$e(e.blastRadius.longestOutstandingMs)),warn:c.warn,onClick:o?()=>o(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:o?()=>o(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:f,selected:v,fill:y,backend:r,onSelect:h}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${d.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:d,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:o?e=>o(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(De,{children:[(0,Y.jsx)(B,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Ce,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:y,children:(0,Y.jsx)(I,{icon:a,className:`size-3.5`})})})}),(0,Y.jsxs)(Ee,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(we,{children:t.slice(0,4).map(e=>(0,Y.jsx)(z,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Te,{}),(0,Y.jsx)(z,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:i,blastSummary:a,blastDetail:o,overdue:s,onSet:c,onRotate:l}){return i?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:r(w,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[a,o?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,o]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(R,{to:`/overview`,search:{run:e},className:r(S,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:r(w,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(L,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):s&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:r(w,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(L,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:r(w,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:r(ve,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:i=!1,won:a=!1,onClick:o}){let s=r(_,ge,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:r(`font-mono tabular-nums text-foreground`,i&&`text-amber-800 dark:text-amber-400`,a&&bt),children:t})]});return o?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:o,className:s,children:c}):(0,Y.jsx)(`span`,{title:n,className:s,children:c})}function kt({steps:e,selected:t,fill:n,backend:i,onSelect:a}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,s)=>{let c=e.source===t.source,l=wt(e,s,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":c,onClick:()=>a(e.source),className:r(S,c&&`bg-muted/70 text-foreground`,o>=0&&s>o&&!c&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:r(F,c&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(`relative z-10 size-2 shrink-0 rounded-full border`,l===`won`&&`border-emerald-500 bg-emerald-500`,l===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,l===`missed`&&`border-muted-foreground/50 bg-transparent`,l===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:yt[e.source],className:r(k,l===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:r(`min-w-0 flex-1 truncate font-mono`,l===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:Ge(i)}):null]}),(0,Y.jsx)(`span`,{className:r(`shrink-0 text-[10px]`,l===`won`?bt:`text-muted-foreground`),children:l})]}),c?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Be,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:S,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Be,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:r(S,`group/reader`),children:[(0,Y.jsx)(I,{icon:V.flow.icon,className:r(k,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:r(h,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(R,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(R,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Fe,{icon:V.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Fe,{icon:V.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:V.vault.icon,config:l},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:le,unset:oe,overdue:m,shared:ue,dormant:oe,healthy:V.vault.icon,config:l},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:n,loading:i=!1,matchCount:a,totalCount:o,now:s,onSelect:l}){let[f,p]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let t=e.find(e=>e.secrets.some(e=>e.name===n));t&&p(e=>e[t.kind]===!1?{...e,[t.kind]:!0}:e)},[e,n]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[i&&e.length===0?(0,Y.jsx)(`p`,{className:M,children:`Loading…`}):null,!i&&e.length===0?(0,Y.jsxs)(`p`,{className:M,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let i=f[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:u,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(We,{open:i,onOpenChange:t=>p(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(Ue,{nativeButton:!1,className:t,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(I,{icon:c,className:r(N,!i&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(I,{icon:Ft[e.kind],className:r(k,d(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:r(C,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:pe,children:e.secrets.length})]})}),(0,Y.jsx)(He,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===n,now:s,onSelect:l},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:a===o?`${o} contracts`:`${a} of ${o} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:i}){let a=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,s=o!==a,c=pt(e,n),l=c.primary!==`healthy`&&c.primary!==`config`,u=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,f=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${a}, ${o}, ${u}, ${gt(c.primary)}`,onClick:()=>i(e.name),className:r(S,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:r(F,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(B,{label:_t(c.primary,e.rotate),children:(0,Y.jsx)(I,{icon:Rt[c.primary],className:r(k,`mt-0.5`,d(Lt[c.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:a}),l?(0,Y.jsx)(Ht,{posture:c}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[s?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,s?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:u}),f.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:r(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
+`).toLowerCase()}function sn(e){return/\s/.test(e)}function cn(e){if(e.length===0||/\s$/.test(e))return null;let t=Jt(e);return t[t.length-1]??null}function Z(e,t){let n=t.toLowerCase();return e.filter(e=>e.token.toLowerCase().startsWith(n)||e.token.toLowerCase().includes(n))}function ln({card:e,env:t,summary:n,query:i,progress:a,verifyNote:o,onQueryChange:s,onOpenSecurity:c}){return(0,Y.jsxs)(`section`,{"aria-label":`Vault posture`,className:`shrink-0 border-b border-border/60`,"data-slot":`vault-posture-strip`,children:[(0,Y.jsxs)(`div`,{className:`flex min-h-10 flex-wrap items-stretch`,children:[(0,Y.jsx)(`button`,{type:`button`,onClick:c,"aria-label":`Open vault security`,className:`flex items-center px-2 text-left text-xs font-medium text-foreground hover:bg-muted/50`,children:e?.title??`Vault backend`}),(0,Y.jsx)(`span`,{className:`flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:t}),e?.badges.map(e=>(0,Y.jsxs)(`span`,{role:e.tone===`warn`?`alert`:`status`,className:r(`flex items-center gap-1.5 px-2 text-[10px]`,e.tone===`warn`?`text-amber-800 dark:text-amber-400`:`text-muted-foreground`,e.id===`rewrap`&&`text-[color:var(--vault-accent)]`),style:e.id===`rewrap`?{"--vault-accent":J}:void 0,children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:r(`size-1.5 shrink-0 rounded-full`,e.tone===`warn`?`bg-amber-500`:`bg-muted-foreground/50`,e.id===`rewrap`&&`bg-[var(--vault-accent)]`)}),e.label]},e.id)),st.map(e=>{let t=n[e.id],a=Qt(i,e.token);return t===0&&!a?null:(0,Y.jsx)(B,{label:_t(e.id),className:`flex self-stretch`,children:(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":a,onClick:()=>s(Zt(i,e.token)),className:r(_,a?ie:ge,e.tone===`danger`&&!a&&`text-destructive`,e.tone===`warn`&&!a&&`text-amber-800 dark:text-amber-400`),children:[e.label,(0,Y.jsx)(`span`,{className:`font-mono tabular-nums`,children:t})]})},e.id)}),(0,Y.jsx)(`span`,{className:`ml-auto flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:o??`${n.secrets}s · ${n.config}c`})]}),a?(0,Y.jsxs)(`p`,{className:`border-t border-border/60 px-2 py-1 font-mono text-[11px]`,style:{color:J},role:`status`,"data-slot":`vault-rewrap-progress`,"data-phase":a.phase,children:[a.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:a.detail})]}):null]})}function un({query:e,secrets:t,onQueryChange:n}){let i=(0,K.useId)(),a=(0,K.useRef)(null),[o,s]=(0,K.useState)(!1),[c,l]=(0,K.useState)(0),u=(0,K.useMemo)(()=>en(e,t),[e,t]);(0,K.useEffect)(()=>{l(0)},[e]),(0,K.useEffect)(()=>{let e=e=>{a.current?.contains(e.target)||s(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[]);let d=t=>{n(tn(e,t.token)),s(!0)};return(0,Y.jsxs)(`div`,{ref:a,className:`relative flex h-full min-w-0 flex-1`,"data-slot":`vault-search`,children:[(0,Y.jsx)(Ae,{"data-slot":`vault-search-input`,value:e,onChange:e=>{n(e.target.value),s(!0)},onFocus:()=>s(!0),onKeyDown:e=>{if(e.key===`Escape`){s(!1);return}if(!o||u.length===0){e.key===`ArrowDown`&&u.length>0&&(e.preventDefault(),s(!0));return}if(e.key===`ArrowDown`){e.preventDefault(),l(e=>(e+1)%u.length);return}if(e.key===`ArrowUp`){e.preventDefault(),l(e=>(e-1+u.length)%u.length);return}e.key===`Enter`&&u[c]&&(e.preventDefault(),d(u[c]))},placeholder:`Search vault…`,"aria-label":`Search vault`,"aria-autocomplete":`list`,"aria-expanded":o,"aria-controls":i,role:`combobox`,title:`name, fingerprint, reader…  is:unset  from:.env.local`}),o&&u.length>0?(0,Y.jsx)(`ul`,{id:i,role:`listbox`,className:`absolute top-full z-30 mt-1 max-h-72 w-[min(20rem,calc(100vw-4rem))] overflow-y-auto rounded-lg border border-border/70 bg-popover p-1 shadow-md`,children:u.map((e,t)=>(0,Y.jsx)(`li`,{role:`option`,"aria-selected":t===c,children:(0,Y.jsxs)(`button`,{type:`button`,onMouseEnter:()=>l(t),onClick:()=>d(e),className:r(`flex w-full items-baseline gap-2 rounded-md px-2 py-1.5 text-left`,t===c&&`bg-muted/70`),children:[(0,Y.jsx)(`span`,{className:`font-mono text-[11px] text-foreground`,children:e.token}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate text-[10px] text-muted-foreground`,children:e.label})]})},`${e.token}-${t}`))}):null]})}function dn(e,t=``,n=Date.now()){let r=Yt(t),i=e.filter(e=>$t(e,r,n)),a=[`secret`,`config`],o={secret:`Secrets`,config:`Config`};return a.map(e=>({kind:e,label:o[e],secrets:i.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function fn(e){let t=e.remaining,n=e.rewrapTargetKekVersion;if(!(t!==null&&t>0||n!==null))return t===0?{phase:2,headline:`KEK v${e.kekVersion} — rotation complete`,detail:`The previous master key no longer opens this vault.`}:null;let r=n??e.kekVersion,i=t??0;return{phase:1,headline:`kek v${e.kekVersion} → v${r}`,detail:i>0?`${i} DEK${i===1?``:`s`} still on the old key. Both master keys stay live.`:`Both master keys stay live until remaining is 0.`}}function pn({masterKey:e,onDismiss:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsx)(T,{open:e!==null,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-master-key-sheet`,children:[(0,Y.jsxs)(E,{children:[(0,Y.jsx)(P,{children:`New master key`}),(0,Y.jsx)(j,{children:`Shown once. Store it offline. This Console process does not keep it for you.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(`p`,{className:`border-b border-border/50 px-4 py-3 font-mono text-[11px] break-all`,children:e}),(0,Y.jsx)(`p`,{className:`px-4 py-3 text-[11px] text-muted-foreground`,role:`status`,children:`Copying puts the key on the clipboard. Anyone with this device can read it until you clear it.`})]}),(0,Y.jsxs)(x,{children:[(0,Y.jsx)(W,{split:!0,disabled:!e,onClick:()=>{e&&(navigator.clipboard?.writeText(e),r(!0))},children:n?`Copied`:`Copy (clipboard warning)`}),(0,Y.jsx)(W,{variant:`destructive`,onClick:()=>{r(!1),t()},children:`I have stored this key`})]})]})})}function mn({open:e,onOpenChange:t,pending:n=!1,error:r,onConfirm:i}){return(0,Y.jsx)(ze,{open:e,onOpenChange:t,phrase:`ROTATE_MASTER`,title:`Rotate master key`,description:`Generates a new master key and rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`,pending:n,error:r,confirmLabel:`Confirm rotate master`,slot:`vault-rotate-master-sheet`,onConfirm:i})}var hn=[{id:`status`,cmd:`oke vault status`,label:`Backend seal + KEK`},{id:`audit`,cmd:`oke vault audit`,label:`Hash-chained audit log`},{id:`verify`,cmd:`oke vault audit verify`,label:`Verify the chain on disk`},{id:`backup`,cmd:`oke vault backup`,label:`Encrypted backup`},{id:`restore`,cmd:`oke vault restore`,label:`Restore from backup`}];function gn({open:e,onOpenChange:t,card:n,env:i,progress:a,verifyPending:o=!1,verifyNote:s,onVerify:c,onRotateMaster:l,onExport:u}){return(0,Y.jsx)(T,{open:e,onOpenChange:t,children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-security-sheet`,children:[(0,Y.jsxs)(E,{children:[(0,Y.jsx)(P,{children:`Vault security`}),(0,Y.jsx)(j,{children:`Fingerprints and backend status only. Backup, restore, and unseal stay on the CLI.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Backend`}),(0,Y.jsx)(`p`,{className:`text-[12px] font-medium`,children:n?.title??`Unresolved`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:n?.description??`The server could not resolve a vault backend.`}),(0,Y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[(0,Y.jsxs)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:[`env `,i]}),n?.badges.map(e=>(0,Y.jsx)(Ve,{variant:`outline`,role:e.tone===`warn`?`alert`:`status`,className:r(`h-5 rounded-md text-[10px]`,e.tone===`warn`&&`border-amber-500/35 bg-amber-500/10 text-amber-800 dark:text-amber-400`),children:e.label},e.id))]}),n?.facts.length?(0,Y.jsx)(`dl`,{className:`flex flex-col gap-1`,children:n.facts.map(e=>(0,Y.jsxs)(`div`,{className:`flex justify-between gap-3`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] tracking-[0.12em] text-muted-foreground uppercase`,children:e.label}),(0,Y.jsx)(`dd`,{className:`font-mono text-[11px]`,children:e.value})]},e.label))}):null,n?.hint?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:n.hint}):null,a?(0,Y.jsxs)(`p`,{className:`font-mono text-[11px]`,style:{color:J},role:`status`,children:[a.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:a.detail})]}):null]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Actions`}),(0,Y.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,Y.jsx)(L,{type:`button`,variant:`outline`,size:`sm`,disabled:o,onClick:c,children:`Verify audit chain`}),s?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:s}):null,(0,Y.jsx)(L,{type:`button`,variant:`outline`,size:`sm`,onClick:l,children:`Rotate master key`}),(0,Y.jsx)(L,{type:`button`,variant:`outline`,size:`sm`,onClick:u,children:`Export fingerprints`})]}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`Master rotation rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`})]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`CLI`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`The Console never accepts a master key in the HTTP body.`}),(0,Y.jsx)(`ul`,{className:`flex flex-col gap-1`,children:hn.map(e=>(0,Y.jsx)(_n,{cmd:e.cmd,label:e.label},e.id))})]})]})]})})}function _n({cmd:e,label:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsxs)(`li`,{className:`flex items-center gap-2`,children:[(0,Y.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,Y.jsx)(`p`,{className:`font-mono text-[11px]`,children:e}),(0,Y.jsx)(`p`,{className:`text-[10px] text-muted-foreground`,children:t})]}),(0,Y.jsx)(L,{type:`button`,variant:`ghost`,size:`icon-xs`,"aria-label":`Copy ${e}`,onClick:()=>{navigator.clipboard?.writeText(e),r(!0),window.setTimeout(()=>r(!1),1200)},children:(0,Y.jsx)(I,{icon:n?fe:s})})]})}function vn({result:e,onClose:t}){let n=e!==null&&e.ok===!1,r=e?.reason===`link`?`prev-hash does not match the previous row`:e?.reason===`payload`?`stored row hash does not match the payload`:`the chain failed verification`;return(0,Y.jsx)(T,{open:n,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-verify-sheet`,children:[(0,Y.jsxs)(E,{children:[(0,Y.jsx)(P,{children:`Chain broken`}),(0,Y.jsxs)(j,{children:[`The audit hash chain failed at`,` `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e?.brokenAt??`unknown`}),`.`]})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto text-[11px]`,children:[(0,Y.jsxs)(`p`,{className:`border-b border-border/50 px-4 py-3`,role:`alert`,children:[`Reason: `,r,`.`]}),e?.row?(0,Y.jsxs)(`dl`,{className:`divide-y divide-border/50`,children:[(0,Y.jsx)(Q,{label:`id`,value:e.row.id,mono:!0}),(0,Y.jsx)(Q,{label:`seq`,value:String(e.row.seq),mono:!0}),(0,Y.jsx)(Q,{label:`action`,value:e.row.action}),(0,Y.jsx)(Q,{label:`path`,value:e.row.path??`—`,mono:!0}),(0,Y.jsx)(Q,{label:`actor`,value:`${e.row.actorType} ${e.row.actorId??``}`}),(0,Y.jsx)(Q,{label:`time`,value:new Date(e.row.createdAt).toISOString(),mono:!0}),e.row.errorMessage?(0,Y.jsx)(Q,{label:`error`,value:e.row.errorMessage}):null]}):null]}),(0,Y.jsx)(x,{children:(0,Y.jsx)(W,{onClick:t,children:`Close`})})]})})}function Q({label:e,value:t,mono:n}){return(0,Y.jsxs)(`div`,{className:`px-4 py-2.5`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`font-mono text-[11px] break-all`:`text-[11px]`,children:t})]})}async function yn(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return`sha256:${[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,16)}`}async function bn(e){let t=e.name.trim(),n=e.value;if(t.length===0)return{error:`Name is required`};if(n.trim().length===0)return{error:`Value is required`};if(e.action!==`create`&&(e.reason?.trim()??``).length<3)return{error:`Reason is required`};let r=e.kind??(e.sensitive?`secret`:`config`),i=await yn(n),a=e.action===`create`?null:e.reason?.trim()??null;return{action:e.action,name:t,kind:r,fingerprint:i,preview:e.sensitive?null:n,reason:a,rotate:e.rotate??null,commit:{name:t,value:n,reason:a,kind:r,description:e.description?.trim()??``,rotate:e.rotate??(r===`secret`?`90d`:`never`)}}}function xn(e,t){return e===null?null:t(e)}function Sn(){return null}function Cn(e){return A(`alert-dialog`,e)}function wn({...e}){return(0,Y.jsx)(Cn,{"data-slot":`alert-dialog`,...e})}function Tn({...e}){return(0,Y.jsx)(ae,{"data-slot":`alert-dialog-portal`,...e})}function En({className:e,...t}){return(0,Y.jsx)(b,{"data-slot":`alert-dialog-overlay`,className:r(`fixed inset-0 z-50 bg-black/20 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-xs`,e),...t})}function Dn({className:e,children:t,...n}){return(0,Y.jsxs)(Tn,{children:[(0,Y.jsx)(En,{}),(0,Y.jsx)(g,{"data-slot":`alert-dialog-content`,className:r(`fixed top-1/2 left-1/2 z-50 w-[min(100%-2rem,24rem)] -translate-x-1/2 -translate-y-1/2 overflow-hidden rounded-none border border-border bg-popover text-sm text-popover-foreground shadow-lg outline-none transition duration-150 data-ending-style:scale-95 data-ending-style:opacity-0 data-starting-style:scale-95 data-starting-style:opacity-0`,e),...n,children:t})]})}function On({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-header`,className:r(`flex flex-col gap-1 border-b border-border/50 px-4 py-3`,e),...t})}function kn({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-footer`,className:r(`flex flex-row items-stretch border-t border-border/50 p-0`,e),...t})}function An({className:e,...t}){return(0,Y.jsx)(re,{"data-slot":`alert-dialog-title`,className:r(`text-sm font-medium text-foreground`,e),...t})}function jn({className:e,...t}){return(0,Y.jsx)(ye,{"data-slot":`alert-dialog-description`,className:r(`text-[11px] text-muted-foreground`,e),...t})}var Mn={create:`Confirm add`,set:`Confirm set`,rotate:`Confirm rotate`},Nn={create:`Add contract`,set:`Set value`,rotate:`Rotate`};function Pn({review:e,pending:t=!1,onCancel:n,onConfirm:r}){return(0,Y.jsx)(wn,{open:e!==null,onOpenChange:e=>{!e&&!t&&n()},children:(0,Y.jsxs)(Dn,{"data-slot":`vault-write-review`,children:[(0,Y.jsxs)(On,{children:[(0,Y.jsx)(An,{children:e?`${Mn[e.action]} ${e.name}`:`Confirm write`}),(0,Y.jsx)(jn,{children:e?.preview==null?`Write-only. The value is never shown again.`:`Config is shown in the clear after submit.`})]}),e?(0,Y.jsx)(Fn,{review:e}):null,(0,Y.jsxs)(kn,{children:[(0,Y.jsx)(W,{split:!0,onClick:n,disabled:t,"data-slot":`vault-write-review-cancel`,children:`Cancel`}),(0,Y.jsx)(W,{variant:e?.action===`rotate`?`destructive`:`default`,disabled:t||e===null,onClick:r,"data-slot":`vault-write-review-confirm`,children:t?`Working…`:e?Nn[e.action]:`Confirm`})]})]})})}function Fn({review:e}){return(0,Y.jsxs)(`dl`,{className:`flex flex-col`,"data-slot":`vault-write-review-facts`,children:[(0,Y.jsx)($,{label:`Name`,value:e.name,mono:!0}),e.action===`create`?(0,Y.jsx)($,{label:`Kind`,value:e.kind}):null,(0,Y.jsx)($,{label:`Fingerprint`,value:e.fingerprint,mono:!0}),e.preview==null?null:(0,Y.jsx)($,{label:`Value`,value:e.preview,mono:!0}),e.reason?(0,Y.jsx)($,{label:`Reason`,value:e.reason}):null,e.action===`create`&&e.rotate?(0,Y.jsx)($,{label:`Rotate`,value:e.rotate}):null]})}function $({label:e,value:t,mono:n=!1}){return(0,Y.jsxs)(`div`,{className:`flex items-baseline justify-between gap-3 border-b border-border/50 px-4 py-2 last:border-b-0`,children:[(0,Y.jsx)(`dt`,{className:`shrink-0 text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`min-w-0 truncate font-mono text-[11px]`:`min-w-0 truncate text-[12px]`,children:t})]})}function In({open:e,onOpenChange:t,pending:n=!1,error:a,onSubmit:o}){let[s,c]=(0,K.useState)(`secret`),[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(``),[p,m]=(0,K.useState)(`90d`),[h,g]=(0,K.useState)(``),[_,v]=(0,K.useState)(null),[y,b]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(c(`secret`),u(``),f(``),m(`90d`),g(``),v(null),b(null))},[e]);let ee=l.trim().length>0&&h.trim().length>0&&!n,te=async()=>{let e=await bn({action:`create`,name:l.trim(),value:h,sensitive:s===`secret`,kind:s,description:d.trim(),rotate:s===`secret`?p:`never`});if(`error`in e){v(e.error);return}v(null),b(e)};return(0,Y.jsxs)(T,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-create-sheet`,children:[(0,Y.jsxs)(E,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(P,{className:`text-sm`,children:`Add vault contract`}),(0,Y.jsx)(j,{className:`text-[11px]`,children:s===`secret`?`Writes the value and lists the contract here. Promote it to vault.secret in source when a Flow should read it.`:`vault.config — shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(Ie,{label:`Kind`,children:[(0,Y.jsx)(H,{active:s===`secret`,onClick:()=>c(`secret`),children:`secret`}),(0,Y.jsx)(H,{active:s===`config`,onClick:()=>c(`config`),children:`config`})]}),(0,Y.jsx)(U,{label:`Name`,children:(0,Y.jsx)(i,{value:l,onChange:e=>u(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g,``)),placeholder:`STRIPE_KEY`,autoComplete:`off`,"aria-label":`Contract name`,flat:!0,className:r(G,`font-mono`)})}),(0,Y.jsx)(U,{label:`Description`,children:(0,Y.jsx)(i,{value:d,onChange:e=>f(e.target.value),placeholder:`Optional title`,autoComplete:`off`,"aria-label":`Description`,flat:!0,className:G})}),s===`secret`?(0,Y.jsxs)(Ie,{label:`Rotate`,children:[(0,Y.jsx)(H,{active:p===`90d`,onClick:()=>m(`90d`),children:`90d`}),(0,Y.jsx)(H,{active:p===`never`,onClick:()=>m(`never`),children:`no rotate`})]}):null,(0,Y.jsx)(U,{label:`Value`,children:(0,Y.jsx)(i,{type:`password`,autoComplete:`off`,value:h,onChange:e=>g(e.target.value),placeholder:s===`secret`?`Paste the secret`:`Public value`,"aria-label":`New vault value`,flat:!0,className:G})}),_||a?(0,Y.jsx)(Le,{slot:`vault-create-error`,children:_??a}):null]}),(0,Y.jsxs)(x,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:n,children:`Cancel`}),(0,Y.jsx)(W,{variant:`default`,disabled:!ee,onClick:()=>{te()},"data-slot":`vault-create-submit`,children:s===`secret`?`Review secret`:`Review config`})]})]}),(0,Y.jsx)(Pn,{review:y,pending:n,onCancel:()=>b(Sn()),onConfirm:()=>{xn(y,e=>{o({name:e.commit.name,value:e.commit.value,kind:e.commit.kind,description:e.commit.description,rotate:e.commit.rotate})})}})]})}var Ln=[{id:`first`,label:`first`,text:`Initial value`},{id:`fix`,label:`fix`,text:`Correct a bad value`},{id:`provider`,label:`provider`,text:`Provider changed it`},{id:`other`,label:`other`,text:``}],Rn=[{id:`scheduled`,label:`scheduled`,text:`Scheduled rotation`},{id:`leak`,label:`leak`,text:`Key compromise`},{id:`provider`,label:`provider`,text:`Provider rotated`},{id:`other`,label:`other`,text:``}];function zn(e){return e===`rotate`?Rn:Ln}function Bn(e){return e===`rotate`?`scheduled`:`first`}function Vn(e,t,n){return t===`other`?n.trim():zn(e).find(e=>e.id===t)?.text??``}function Hn({open:e,onOpenChange:t,mode:n,name:r,sensitive:a=!0,pending:o=!1,error:s,onSubmit:c}){let[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(()=>Bn(n)),[p,m]=(0,K.useState)(``),[h,g]=(0,K.useState)(null),[_,v]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(u(``),f(Bn(n)),m(``),g(null),v(null))},[e,n]);let y=Vn(n,d,p),b=l.trim().length>0&&y.length>=3&&!o,ee=zn(n),te=async()=>{let e=await bn({action:n,name:r,value:l,sensitive:a,reason:y,kind:a?`secret`:`config`});if(`error`in e){g(e.error);return}g(null),v(e)};return(0,Y.jsxs)(T,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-write-sheet`,children:[(0,Y.jsxs)(E,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(P,{className:`text-sm`,children:n===`set`?`Set ${r}`:`Rotate ${r}`}),(0,Y.jsx)(j,{className:`text-[11px]`,children:a?`Write-only. The new value is never shown again after submit.`:`This vault.config value is shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(U,{label:`New value`,children:(0,Y.jsx)(i,{type:`password`,autoComplete:`off`,value:l,onChange:e=>u(e.target.value),placeholder:a?`Paste the new secret`:`Paste the new value`,"aria-label":`New vault value`,flat:!0,className:G})}),(0,Y.jsx)(Ie,{label:`Reason`,children:ee.map(e=>(0,Y.jsx)(H,{active:d===e.id,onClick:()=>f(e.id),children:e.label},e.id))}),d===`other`?(0,Y.jsx)(U,{label:`Other`,children:(0,Y.jsx)(i,{value:p,onChange:e=>m(e.target.value),placeholder:`Why is this change needed?`,"aria-label":`Custom reason`,flat:!0,className:G})}):null,h||s?(0,Y.jsx)(Le,{slot:`vault-write-error`,children:h??s}):null]}),(0,Y.jsxs)(x,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:o,children:`Cancel`}),(0,Y.jsx)(W,{variant:n===`rotate`?`destructive`:`default`,disabled:!b,onClick:()=>{te()},"data-slot":`vault-write-submit`,children:n===`set`?`Review set`:`Review rotate`})]})]}),(0,Y.jsx)(Pn,{review:_,pending:o,onCancel:()=>v(Sn()),onConfirm:()=>{xn(_,e=>{c({value:e.commit.value,reason:e.commit.reason??y})})}})]})}function Un(){let e=qe(),t=o(),{query:i,selectedName:s,action:c,setQuery:l,setSelectedName:u,setAction:d}=Oe(),m=Me(),h=(0,Y.jsx)(Ne,{open:m.open,onToggle:m.toggle,noun:`vault`,controlsId:`vault-list`,dataSlot:`vault-list-toggle`}),[g]=(0,K.useState)(()=>Date.now()),[_,b]=(0,K.useState)(!1),[x,re]=(0,K.useState)(null),[S,C]=(0,K.useState)(null),[ie,ae]=(0,K.useState)(null),[w,T]=(0,K.useState)(null),[oe,se]=(0,K.useState)(null),[le,E]=(0,K.useState)(null),[ue,fe]=(0,K.useState)(null),[pe,O]=(0,K.useState)(null),k=e.data?.secrets??[],A=e.data?.env??`dev`,j=e.data?.backend??null,M=(0,K.useMemo)(()=>Ye(j),[j]),N=(0,K.useMemo)(()=>dn(k,i,g),[k,i,g]),P=(0,K.useMemo)(()=>mt(k,g),[k,g]),F=(0,K.useMemo)(()=>N.flatMap(e=>e.secrets),[N]),ge=F.length,L=F.find(e=>e.name===s)??F[0]??null,ve=fn({kekVersion:le??j?.status?.kekVersion??1,remaining:oe,rewrapTargetKekVersion:j?.status?.rewrapTargetKekVersion??null});(0,K.useEffect)(()=>{let e=e=>{if(e.key!==`/`||e.metaKey||e.ctrlKey||e.altKey)return;let t=e.target;if(t instanceof HTMLElement){let e=t.tagName;if(e===`INPUT`||e===`TEXTAREA`||t.isContentEditable)return}e.preventDefault(),document.querySelector(`[data-slot='vault-search-input']`)?.focus()};return window.addEventListener(`keydown`,e),()=>window.removeEventListener(`keydown`,e)},[]);let ye=async()=>{await t.invalidateQueries({queryKey:Ze})},xe=()=>{let e=ot(k);navigator.clipboard?.writeText(e),re(`Exported fingerprints only (no secret values)`)},Se=be({mutationFn:async e=>{if(e.value.trim().length===0)throw Error(`New value is required`);let t=await(e.mode===`set`?de:he)({name:e.name,value:e.value,reason:e.reason});if(t.error)throw Error(f(t.error));return t.data},onSuccess:async()=>{C(null),d(null),await ye()},onError:e=>{C(e.message)}}),R=be({mutationFn:async e=>{if(e.name.trim().length===0)throw Error(`Name is required`);if(e.value.trim().length===0)throw Error(`Value is required`);let t=await v({name:e.name,value:e.value,kind:e.kind,...e.description.length>0?{description:e.description}:{},...e.rotate.length>0?{rotate:e.rotate}:{}});if(t.error)throw Error(f(t.error));return t.data},onSuccess:async e=>{C(null),d(null),e?.name&&u(e.name),await ye()},onError:e=>{C(e.message)}}),Ae=be({mutationFn:async e=>{let t=0,n=j?.status?.kekVersion??1;for(;;){let r=await te(e);if(r.error)throw Error(f(r.error));if(!r.data)throw Error(`Empty rotate-master response`);if(t=r.data.remaining,n=r.data.kekVersion,se(r.data.remaining),E(r.data.kekVersion),r.data.masterKey&&T(r.data.masterKey),await ye(),r.data.remaining===0)break}return{remaining:t,kekVersion:n}},onSuccess:()=>{ae(null),d(null)},onError:e=>{ae(e.message)}}),V=be({mutationFn:async()=>{let e=await ce();if(e.error)throw Error(f(e.error));if(!e.data)throw Error(`Empty verify response`);return e.data},onSuccess:e=>{e.ok?(O(null),fe(`chain intact`)):(fe(null),O(e))}});return(0,Y.jsxs)(`div`,{className:ne,"data-slot":`vault-page`,children:[(0,Y.jsxs)(ke,{orientation:`horizontal`,className:`min-h-0 flex-1`,children:[(0,Y.jsx)(je,{panelRef:m.panelRef,collapsible:!0,collapsedSize:0,defaultSize:D.start.defaultSize,minSize:D.start.minSize,onResize:m.onResize,className:`min-h-0 overflow-hidden`,children:(0,Y.jsxs)(`div`,{id:`vault-list`,className:`flex h-full min-h-0 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:r(ee,`relative z-20 pr-1.5`),children:[(0,Y.jsx)(un,{query:i,secrets:k,onQueryChange:l}),(0,Y.jsx)(B,{label:`Add secret or config`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Add secret or config`,onClick:()=>d(`create`),className:y,children:(0,Y.jsx)(I,{icon:n,className:`size-3.5`})})}),x?(0,Y.jsx)(`span`,{className:`sr-only`,role:`status`,children:x}):null,(0,Y.jsx)(B,{label:`Verify the audit hash chain`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Verify chain`,disabled:V.isPending,onClick:()=>V.mutate(),className:y,children:(0,Y.jsx)(I,{icon:p,className:`size-3.5`})})}),(0,Y.jsxs)(De,{children:[(0,Y.jsx)(B,{label:`Vault security`,className:`flex self-stretch`,children:(0,Y.jsx)(Ce,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Vault security`,className:y,children:(0,Y.jsx)(I,{icon:a,className:`size-3.5`})})})}),(0,Y.jsxs)(Ee,{align:`end`,className:`min-w-52`,children:[(0,Y.jsxs)(we,{children:[(0,Y.jsx)(z,{onClick:()=>b(!0),children:`Security`}),(0,Y.jsxs)(z,{onClick:()=>d(`rotate-master`),children:[(0,Y.jsx)(I,{icon:_e,"data-icon":`inline-start`}),`Rotate master key`]}),(0,Y.jsxs)(z,{onClick:xe,children:[(0,Y.jsx)(I,{icon:me,"data-icon":`inline-start`}),`Export fingerprints`]})]}),(0,Y.jsx)(Te,{}),(0,Y.jsxs)(z,{disabled:V.isPending,onClick:()=>V.mutate(),children:[(0,Y.jsx)(I,{icon:p,"data-icon":`inline-start`}),`Verify audit chain`]})]})]})]}),(0,Y.jsx)(ln,{card:M,env:A,summary:P,query:i,progress:ve,verifyNote:ue,onQueryChange:l,onOpenSecurity:()=>b(!0)}),(0,Y.jsx)(Bt,{groups:N,selectedName:L?.name??s,loading:e.isLoading,matchCount:ge,totalCount:k.length,now:g,onSelect:u})]})}),m.open?(0,Y.jsx)(Pe,{withHandle:!0}):null,(0,Y.jsx)(je,{defaultSize:D.end.defaultSize,minSize:D.end.minSize,className:`min-h-0 overflow-hidden`,children:L?(0,Y.jsx)(Tt,{row:L,env:A,now:g,backend:j,onSet:()=>d(`set`),onRotate:()=>d(`rotate`),onQueryChange:l,leading:h}):(0,Y.jsx)(Nt,{loading:e.isLoading,hasContracts:k.length>0,query:i,onClearQuery:()=>l(``),leading:h})})]}),(0,Y.jsx)(In,{open:c===`create`,onOpenChange:e=>{e||(C(null),d(null))},pending:R.isPending,error:c===`create`?S:null,onSubmit:e=>R.mutate(e)}),(0,Y.jsx)(Hn,{open:c===`set`||c===`rotate`,onOpenChange:e=>{e||(C(null),d(null))},mode:c===`rotate`?`rotate`:`set`,name:L?.name??``,sensitive:L?.sensitive??!0,pending:Se.isPending,error:S,onSubmit:e=>{L&&Se.mutate({mode:c===`rotate`?`rotate`:`set`,name:L.name,...e})}}),(0,Y.jsx)(mn,{open:c===`rotate-master`,onOpenChange:e=>{e||(ae(null),d(null))},pending:Ae.isPending,error:ie,onConfirm:e=>Ae.mutate(e)}),(0,Y.jsx)(gn,{open:_,onOpenChange:b,card:M,env:A,progress:ve,verifyPending:V.isPending,verifyNote:ue,onVerify:()=>V.mutate(),onRotateMaster:()=>{b(!1),d(`rotate-master`)},onExport:xe}),(0,Y.jsx)(pn,{masterKey:w,onDismiss:()=>T(null)}),(0,Y.jsx)(vn,{result:pe,onClose:()=>O(null)})]})}export{Un as VaultPage};

package/src/console/ui-next/dist/index.html

@@ -6,7 +6,7 @@
     <title>okengine Console</title>
     <meta
       name="description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <meta name="application-name" content="okengine Console" />
     <meta name="theme-color" content="#0D0D0D" />
@@ -14,14 +14,14 @@
     <meta property="og:title" content="okengine Console" />
     <meta
       property="og:description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <meta property="og:type" content="website" />
     <meta name="twitter:card" content="summary" />
     <meta name="twitter:title" content="okengine Console" />
     <meta
       name="twitter:description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
@@ -37,18 +37,20 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-Ce6WKWKM.js"></script>
+    <script type="module" crossorigin src="/assets/index-CGoZkILK.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Bph1y7z7.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-D7n4g6go.js">
-    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-DO4IsVqv.js">
-    <link rel="modulepreload" crossorigin href="/assets/link-DF7SZ9Ek.js">
-    <link rel="modulepreload" crossorigin href="/assets/skeleton-CL_X0GCj.js">
-    <link rel="modulepreload" crossorigin href="/assets/react-B1ML8gxg.js">
+    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-DKxNTe_m.js">
+    <link rel="modulepreload" crossorigin href="/assets/useMutation-B8EO02Ej.js">
+    <link rel="modulepreload" crossorigin href="/assets/link-BX6Vqztd.js">
+    <link rel="modulepreload" crossorigin href="/assets/skeleton-D-czQJT6.js">
+    <link rel="modulepreload" crossorigin href="/assets/react-D8E3mtu1.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-oH4irX4C.js">
-    <link rel="modulepreload" crossorigin href="/assets/shortcut-Cgzuv4k1.js">
+    <link rel="modulepreload" crossorigin href="/assets/useRender-BE2A9BWC.js">
+    <link rel="modulepreload" crossorigin href="/assets/shortcut-JQIZlWfm.js">
     <link rel="stylesheet" crossorigin href="/assets/xyflow-DZ0Ws1xk.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-D4Ldtj79.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-Ck88Jmv8.css">
   </head>
   <body>
     <div id="root"></div>

package/src/console/ui-next/index.html

@@ -6,7 +6,7 @@
     <title>okengine Console</title>
     <meta
       name="description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <meta name="application-name" content="okengine Console" />
     <meta name="theme-color" content="#0D0D0D" />
@@ -14,14 +14,14 @@
     <meta property="og:title" content="okengine Console" />
     <meta
       property="og:description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <meta property="og:type" content="website" />
     <meta name="twitter:card" content="summary" />
     <meta name="twitter:title" content="okengine Console" />
     <meta
       name="twitter:description"
-      content="Operator Console for okengine — Flows, Store, Observability, and Vault."
+      content="Operator Console for okengine — Flows, Store, Observability, Vault, and Access."
     />
     <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
     <link rel="apple-touch-icon" href="/favicon.svg" />

package/src/console/ui-next/src/client.ts

@@ -446,7 +446,7 @@ export type TracesReplayResult = {
   readonly ok: true;
   readonly rootId: string;
   readonly dryRun: boolean;
-  readonly at: number;
+  readonly at: string;
   readonly flow: string;
 };
 
@@ -506,6 +506,11 @@ export type FlowsInvokeResult = {
   readonly flowId: string;
   readonly asUserId: string;
   readonly asGate?: string | null;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
   readonly trigger: string;
   readonly response: unknown;
   /** True when classified PII keys were redacted. */
@@ -674,7 +679,7 @@ export type ClockRunNowResult = {
   readonly ok: true;
   readonly name: string;
   readonly ran: boolean;
-  readonly at: number;
+  readonly at: string;
 };
 
 /**
@@ -721,6 +726,8 @@ export type StoreListChild = {
   readonly columnDescriptions: Readonly<Record<string, string>>;
   /** Live RLS when the engine reported `pg_class.relrowsecurity`. */
   readonly rls?: boolean;
+  /** Live + declared RLS policy count when the child is a SQL table. */
+  readonly rlsPolicyCount?: number;
 };
 
 /** One store row from `GET /console/store` (matches server `StoreListOut`). */
@@ -772,6 +779,8 @@ export type StoreQueryInput = {
   readonly topK?: number;
   /** When true, SQL browse returns PII cleartext (audited). Default masks. */
   readonly revealPii?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
 };
 
 /** Success payload from `QUERY /console/store/query` (matches server `StoreQueryOut`). */
@@ -793,6 +802,11 @@ export type StoreQueryResult = {
   }>;
   readonly masked: boolean;
   readonly routedRole?: "primary" | "replica";
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 
 /**
@@ -822,7 +836,7 @@ export type StoreRevealInput = {
 export type StoreRevealResult = {
   readonly ok: true;
   readonly value: unknown;
-  readonly at: number;
+  readonly at: string;
 };
 
 /**
@@ -851,6 +865,8 @@ export type StoreEditInput = {
   readonly confirmation?: string;
   readonly reason?: string;
   readonly commit?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
 };
 
 /** Success payload from `POST /console/store/edit` (matches server). */
@@ -863,7 +879,12 @@ export type StoreEditResult = {
     readonly kind: "send" | "ask";
     readonly resource: string;
   }>;
-  readonly at: number;
+  readonly at: string;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 
 /**
@@ -907,7 +928,7 @@ export type StoreDeleteInput = {
 export type StoreDeleteResult = {
   readonly ok: true;
   readonly deleted: number;
-  readonly at: number;
+  readonly at: string;
 };
 
 /**
@@ -934,6 +955,7 @@ export type StoreSqlInput = {
   readonly revealPii?: boolean;
   /** View rows as this Gate (`oke.gate` on postgres / pglite). */
   readonly asGate?: string;
+  readonly asUserId?: string;
 };
 
 /** Success payload from `POST /console/store/sql` (matches server `StoreSqlOut`). */
@@ -942,7 +964,13 @@ export type StoreSqlResult = {
   readonly masked: boolean;
   readonly routedRole: "primary" | "replica";
   readonly asGate: string | null;
+  readonly asUserId: string | null;
   readonly gateApplied: boolean;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 
 /**
@@ -1267,7 +1295,7 @@ export type VaultWriteResult = {
   readonly ok: true;
   readonly name: string;
   readonly fingerprint: string | null;
-  readonly at: number;
+  readonly at: string;
 };
 
 /**
@@ -1331,7 +1359,7 @@ export type VaultRotateMasterResult = {
   readonly kekVersion: number;
   readonly remaining: number;
   readonly masterKey: string | null;
-  readonly at: number;
+  readonly at: string;
 };
 
 /**
@@ -1377,3 +1405,170 @@ export type VaultAuditVerifyResult = {
 export async function vaultAuditVerify(): Promise<ConsoleApiResult<VaultAuditVerifyResult>> {
   return consoleFetch<VaultAuditVerifyResult>("/console/vault/audit/verify");
 }
+
+/** One Access API key row (`GET /console/access`). */
+export type AccessKeyRow = {
+  readonly id: string;
+  readonly name: string;
+  readonly plane: "user" | "operator";
+  /** Stored issuer — user id or operator id. Frozen after mint. */
+  readonly creatorId: string;
+  /** Issuer ceiling stored on the key. */
+  readonly creatorScopes: readonly string[];
+  readonly scopes: readonly string[];
+  readonly createdAt: number;
+  readonly lastUsedAt: number | null;
+  readonly expiresAt: number | null;
+  readonly revokedAt: number | null;
+  readonly rateLimit: { max: number; per: string } | null;
+  readonly ipAllowlist: readonly string[];
+  readonly unused90d: boolean;
+};
+
+/** One Access user row. */
+export type AccessUserRow = {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  readonly status: "active" | "disabled";
+  readonly roles: readonly string[];
+  readonly scopes: readonly string[];
+};
+
+/** One Access operator row. */
+export type AccessOperatorRow = {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  readonly status: "active" | "suspended" | "invited";
+  readonly roles: readonly string[];
+  readonly scopes: readonly string[];
+};
+
+/** Access plane section. */
+export type AccessPlaneSection = {
+  readonly keys: readonly AccessKeyRow[];
+  readonly users?: readonly AccessUserRow[];
+  readonly operators?: readonly AccessOperatorRow[];
+  readonly grantableScopes: readonly string[];
+};
+
+/** Access list payload (`GET /console/access`). */
+export type AccessListPayload = {
+  readonly operatorPlane: AccessPlaneSection;
+  readonly userPlane: AccessPlaneSection;
+  readonly catalog: readonly string[];
+  readonly accessTtlMs: number;
+};
+
+/**
+ * GET /console/access — keys, users, grantable scopes.
+ */
+export async function accessList(): Promise<ConsoleApiResult<AccessListPayload>> {
+  return consoleFetch<AccessListPayload>("/console/access");
+}
+
+/** Blast radius for one key. */
+export type AccessKeyBlastPayload = {
+  readonly callVolume: number;
+  readonly lastUsedAt: number | null;
+  readonly sourceAddresses: readonly string[];
+  readonly accessTtlMs: number;
+  readonly residualAccessNote: string;
+};
+
+/**
+ * POST /console/access/key-blast — usage from Runs.
+ *
+ * @param keyId - Key id
+ */
+export async function accessKeyBlast(
+  keyId: string,
+): Promise<ConsoleApiResult<AccessKeyBlastPayload>> {
+  return consoleFetch<AccessKeyBlastPayload>("/console/access/key-blast", {
+    method: "POST",
+    body: JSON.stringify({ keyId }),
+  });
+}
+
+/** Create-key request. */
+export type AccessCreateKeyInput = {
+  readonly plane: "user" | "operator";
+  readonly name: string;
+  readonly scopes: readonly string[];
+  readonly creatorUserId?: string;
+  readonly expiresAt?: number | null;
+  readonly rateLimit?: { max: number; per: string } | null;
+  readonly ipAllowlist?: readonly string[];
+};
+
+/** Create / rotate success — secret once. */
+export type AccessSecretOnceResult = {
+  readonly key: AccessKeyRow;
+  readonly secret: string;
+};
+
+/**
+ * POST /console/access/keys — mint an attenuated key (secret once).
+ *
+ * @param body - Create payload
+ */
+export async function accessCreateKey(
+  body: AccessCreateKeyInput,
+): Promise<ConsoleApiResult<AccessSecretOnceResult>> {
+  return consoleFetch<AccessSecretOnceResult>("/console/access/keys", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+/**
+ * POST /console/access/keys/rotate — new secret once.
+ *
+ * @param body - Key id + ROTATE confirm
+ */
+export async function accessRotateKey(body: {
+  readonly keyId: string;
+  readonly confirmation: "ROTATE";
+  readonly reason: string;
+}): Promise<ConsoleApiResult<AccessSecretOnceResult>> {
+  return consoleFetch<AccessSecretOnceResult>("/console/access/keys/rotate", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+/**
+ * POST /console/access/keys/revoke — irreversible.
+ *
+ * @param body - Key id + REVOKE confirm
+ */
+export async function accessRevokeKey(body: {
+  readonly keyId: string;
+  readonly confirmation: "REVOKE";
+  readonly reason: string;
+}): Promise<ConsoleApiResult<{ readonly key: AccessKeyRow }>> {
+  return consoleFetch<{ readonly key: AccessKeyRow }>("/console/access/keys/revoke", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+/**
+ * POST /console/access/keys/update — metadata + scopes.
+ *
+ * @param body - Patch
+ */
+export async function accessUpdateKey(body: {
+  readonly keyId: string;
+  readonly name?: string;
+  readonly scopes?: readonly string[];
+  readonly expiresAt?: number | null;
+  readonly rateLimit?: { max: number; per: string } | null;
+  readonly ipAllowlist?: readonly string[];
+}): Promise<ConsoleApiResult<{ readonly key: AccessKeyRow }>> {
+  return consoleFetch<{ readonly key: AccessKeyRow }>("/console/access/keys/update", {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}

package/src/console/ui-next/src/components/motion/table/index.tsx

@@ -61,6 +61,8 @@ export function Table<T>({
   onInsertColumn,
   onDeleteColumn,
   onRowDoubleClick,
+  onRowContextMenu,
+  onViewportContextMenu,
   cellRange = null,
   onCellRangeChange,
   onCellActivate,
@@ -192,6 +194,13 @@ export function Table<T>({
         onPointerMove={cellSelect.onScrollerPointerMove}
         onPointerUp={cellSelect.onPointerUp}
         onPointerCancel={cellSelect.onPointerUp}
+        onContextMenu={(event) => {
+          if (!onViewportContextMenu) return;
+          const target = event.target;
+          if (target instanceof Element && target.closest("[data-slot='table-row']")) return;
+          event.preventDefault();
+          onViewportContextMenu();
+        }}
         className={cn("overflow-auto", onCellRangeChange ? "select-none" : undefined)}
         style={{ height }}
       >
@@ -273,12 +282,19 @@ export function Table<T>({
                       ref={(el) => {
                         rowRefs.current[entry.id] = el;
                       }}
+                      data-slot="table-row"
                       data-selected={isSelected}
                       style={{ height: rowHeight }}
                       onPointerEnter={
                         hasRowMenu ? () => activateRow(entry.id, vItem.index) : undefined
                       }
                       onPointerLeave={hasRowMenu ? deactivateRow : undefined}
+                      onContextMenu={(event) => {
+                        if (!onRowContextMenu) return;
+                        event.preventDefault();
+                        event.stopPropagation();
+                        onRowContextMenu(entry.row, entry.id);
+                      }}
                       onDoubleClick={(e) => {
                         if (!onRowDoubleClick) return;
                         const target = e.target;

package/src/console/ui-next/src/components/motion/table/types.ts

@@ -78,6 +78,10 @@ export interface TableProps<T> {
   readonly onDeleteColumn?: (columnKey: string, index: number) => void;
   /** Double-click a body row. */
   readonly onRowDoubleClick?: (row: T, id: string) => void;
+  /** Two-finger / right-click a body row (caller should `preventDefault`). */
+  readonly onRowContextMenu?: (row: T, id: string) => void;
+  /** Two-finger / right-click empty viewport (not a row). */
+  readonly onViewportContextMenu?: () => void;
   /** Controlled cell range (visible row index × column index). */
   readonly cellRange?: CellRange | null;
   /** Enables drag / Shift+click cell-range selection. */

package/src/console/ui-next/src/components/shell/app-sidebar.tsx

@@ -5,6 +5,7 @@
 import {
   AccessIcon,
   Archive02Icon,
+  BiometricAccessIcon,
   ChartAnalysisIcon,
   Shapes01Icon,
   WorkflowSquare08Icon,
@@ -49,6 +50,7 @@ const navItems: ReadonlyArray<{
     shortcut: "observability",
   },
   { title: "Vault", to: "/vault", icon: AccessIcon, shortcut: "vault" },
+  { title: "Access", to: "/access", icon: BiometricAccessIcon, shortcut: "access" },
 ];
 
 /**

package/src/console/ui-next/src/components/shell/command-items.test.ts

@@ -20,6 +20,7 @@ describe("consoleCommandItems", () => {
       "go:/store",
       "go:/observability",
       "go:/vault",
+      "go:/access",
       "theme:light",
       "theme:dark",
       "theme:system",

package/src/console/ui-next/src/components/shell/command-items.ts

@@ -5,6 +5,7 @@
 import {
   AccessIcon,
   Archive02Icon,
+  BiometricAccessIcon,
   ChartAnalysisIcon,
   ComputerIcon,
   Logout03Icon,
@@ -65,6 +66,13 @@ const MODULES: ReadonlyArray<{
     keywords: ["secrets", "contracts"],
     shortcut: "vault",
   },
+  {
+    title: "Access",
+    to: "/access",
+    icon: BiometricAccessIcon,
+    keywords: ["keys", "api", "scopes"],
+    shortcut: "access",
+  },
 ];
 
 /** Inputs for {@link consoleCommandItems}. */

package/src/console/ui-next/src/components/shell/shell-layout.tsx

@@ -20,7 +20,7 @@ import { cn } from "@/lib/utils";
 /**
  * Shell chrome around authenticated panel routes.
  *
- * `/overview`, `/flows`, `/store`, `/vault`, and `/observability` render full-bleed
+ * `/overview`, `/flows`, `/store`, `/vault`, `/access`, and `/observability` render full-bleed
  * (no padding / gap); other sections keep the padded inset. Desktop sidebar
  * stays icon-collapsed; mobile still uses the sheet trigger.
  *
@@ -38,6 +38,7 @@ export function ShellLayout({ operator }: { readonly operator: SessionOperator }
     pathname === "/flows" ||
     pathname === "/store" ||
     pathname === "/vault" ||
+    pathname === "/access" ||
     pathname === "/observability";
 
   const logout = useCallback(() => {