okengine 0.2.6 → 0.3.2

package/src/cli/doc-drift.ts

@@ -1,430 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Doc-drift checker — claimed TypeScript fences in markdown docs must be
- * contained (whitespace-normalized) under `examples/<app>/`.
- *
- * Claimed fences are those under a heading like `### \`path/to/file.ts\``
- * (relative, under an app section in four-applications.md) or
- * `### \`examples/<app>/path/to/file.ts\`` (absolute from repo root — used by
- * README.md). Unheaded fences are illustrations and are ignored.
- *
- * Also validates ```mermaid fences with Mermaid's own parser (happy-dom
- * provides the DOM surface Bun needs for sanitize hooks).
- *
- * Usage:
- *   bun src/cli/doc-drift.ts
- *   bun src/cli/doc-drift.ts docs/spec/four-applications.md README.md
- *   bun src/cli/doc-drift.ts site/content/docs/learn/notes.md
- *
- * Default paths: four-applications.md, README.md, and every markdown/MDX file
- * under site/content/docs (claimed fences only — prose-only pages skip).
- */
-
-import { resolve } from "node:path";
-import { Window } from "happy-dom";
-
-const ROOT = resolve(import.meta.dir, "../..");
-
-/**
- * Discover site content markdown that may contain claimed fences.
- *
- * @param root - Repo root
- */
-async function discoverSiteDocs(root: string): Promise<string[]> {
-  const docsDir = resolve(root, "site/content/docs");
-  const out: string[] = [];
-  try {
-    const glob = new Bun.Glob("**/*.{md,mdx}");
-    for await (const rel of glob.scan({ cwd: docsDir, onlyFiles: true })) {
-      out.push(resolve(docsDir, rel));
-    }
-  } catch {
-    // site/ not present yet — skip
-  }
-  return out.sort();
-}
-
-/** Core docs that must contain claimed fences. */
-const REQUIRED_DOCS: readonly string[] = [
-  resolve(ROOT, "docs/spec/four-applications.md"),
-  resolve(ROOT, "README.md"),
-];
-
-let mermaidReady: Promise<typeof import("mermaid").default> | undefined;
-
-/**
- * Install a minimal DOM so Mermaid's sanitize hooks can run under Bun.
- */
-function ensureDom(): void {
-  const g = globalThis as typeof globalThis & { document?: unknown };
-  if (g.document !== undefined) return;
-  const window = new Window({ url: "https://localhost/" });
-  Object.assign(g, {
-    window,
-    document: window.document,
-    HTMLElement: window.HTMLElement,
-    Element: window.Element,
-    Node: window.Node,
-    DOMParser: window.DOMParser,
-    navigator: window.navigator,
-    getComputedStyle: window.getComputedStyle.bind(window),
-  });
-}
-
-/**
- * Lazy-load Mermaid after the DOM polyfill is in place.
- */
-async function loadMermaid(): Promise<typeof import("mermaid").default> {
-  ensureDom();
-  mermaidReady ??= import("mermaid").then((m) => m.default);
-  return mermaidReady;
-}
-
-/** App section heading → example package directory name. */
-const APP_SECTIONS: ReadonlyArray<{ readonly re: RegExp; readonly app: string }> =
-  [
-    { re: /^# 1 · BASIC — Notes\b/m, app: "notes" },
-    { re: /^# 2 · INTERMEDIATE — Linkly\b/m, app: "linkly" },
-    { re: /^# 3 · ADVANCED — Provisions\b/m, app: "provisions" },
-    { re: /^# 4 · COMPLEX — Skyport\b/m, app: "skyport" },
-  ];
-
-/**
- * Normalize TypeScript source for containment comparison.
- *
- * @param text - Raw source
- */
-export function normalizeTs(text: string): string {
-  return text
-    .replace(/\r\n/g, "\n")
-    .split("\n")
-    .map((line) => line.replace(/[ \t]+$/g, ""))
-    .join("\n")
-    .trim();
-}
-
-/** One claimed fence extracted from a markdown document. */
-export interface ClaimedFence {
-  readonly app: string;
-  readonly relPath: string;
-  readonly body: string;
-  readonly headingLine: number;
-}
-
-/** One ```mermaid fence extracted from a markdown document. */
-export interface MermaidFence {
-  readonly body: string;
-  readonly startLine: number;
-}
-
-/**
- * Extract every fenced Mermaid diagram from a markdown document.
- *
- * @param markdown - Spec or README document
- */
-export function parseMermaidFences(markdown: string): MermaidFence[] {
-  const lines = markdown.replace(/\r\n/g, "\n").split("\n");
-  const fences: MermaidFence[] = [];
-
-  for (let i = 0; i < lines.length; i++) {
-    if (!/^```mermaid\s*$/.test(lines[i]!)) continue;
-    const startLine = i + 1;
-    i++;
-    const bodyLines: string[] = [];
-    while (i < lines.length && !lines[i]!.startsWith("```")) {
-      bodyLines.push(lines[i]!);
-      i++;
-    }
-    if (i >= lines.length || !lines[i]!.startsWith("```")) {
-      throw new Error(
-        `doc-drift: unclosed mermaid fence (line ${startLine})`,
-      );
-    }
-    fences.push({ body: bodyLines.join("\n").trim(), startLine });
-  }
-
-  return fences;
-}
-
-/**
- * Validate Mermaid fence bodies with Mermaid's parser.
- *
- * @param fences - Extracted mermaid fences
- */
-export async function checkMermaidSyntax(
-  fences: readonly MermaidFence[],
-): Promise<{ readonly ok: boolean; readonly failures: readonly string[] }> {
-  if (fences.length === 0) {
-    return { ok: true, failures: [] };
-  }
-
-  const mermaid = await loadMermaid();
-  const failures: string[] = [];
-
-  for (const fence of fences) {
-    try {
-      const result = await mermaid.parse(fence.body);
-      if (!result) {
-        failures.push(
-          `mermaid: parse returned false (line ${fence.startLine})`,
-        );
-      }
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      failures.push(
-        `mermaid: invalid syntax (line ${fence.startLine}): ${detail.split("\n")[0]}`,
-      );
-    }
-  }
-
-  return { ok: failures.length === 0, failures };
-}
-
-/**
- * Read the typescript/ts fence immediately after a heading line.
- *
- * @param lines - Document lines
- * @param headingIndex - Index of the `### \`…\`` heading
- * @param relPath - Path shown in the heading (for error messages)
- */
-function readFenceAfterHeading(
-  lines: readonly string[],
-  headingIndex: number,
-  relPath: string,
-): { readonly body: string; readonly endIndex: number } | undefined {
-  let j = headingIndex + 1;
-  while (j < lines.length && lines[j]!.trim() === "") j++;
-  const open = lines[j];
-  if (!open || !/^```(?:typescript|ts)\s*$/.test(open)) return undefined;
-
-  j++;
-  const bodyLines: string[] = [];
-  while (j < lines.length && !lines[j]!.startsWith("```")) {
-    bodyLines.push(lines[j]!);
-    j++;
-  }
-  if (j >= lines.length || !lines[j]!.startsWith("```")) {
-    throw new Error(
-      `doc-drift: unclosed fence after ### \`${relPath}\` (line ${headingIndex + 1})`,
-    );
-  }
-
-  return { body: bodyLines.join("\n"), endIndex: j };
-}
-
-/**
- * Parse claimed fences from a markdown document.
- *
- * Supports (1) app-section context + relative `### \`src/…\`` headings
- * (four-applications.md) and (2) absolute `### \`examples/<app>/…\`` headings
- * (README.md). Stops at `# REFERENCE` / `# 5 ·` as in the four-apps spec.
- *
- * @param markdown - Spec or README document
- */
-export function parseClaimedFences(markdown: string): ClaimedFence[] {
-  const lines = markdown.replace(/\r\n/g, "\n").split("\n");
-  const fences: ClaimedFence[] = [];
-  let app: string | undefined;
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]!;
-
-    if (/^# REFERENCE\b/.test(line) || /^# 5 ·/.test(line)) {
-      break;
-    }
-
-    for (const section of APP_SECTIONS) {
-      if (section.re.test(line)) {
-        app = section.app;
-        break;
-      }
-    }
-
-    const heading = /^### `([^`]+)`/.exec(line);
-    if (!heading) continue;
-
-    const claimedPath = heading[1]!;
-    const examplesMatch = /^examples\/([^/]+)\/(.+)$/.exec(claimedPath);
-
-    let fenceApp: string | undefined;
-    let relPath: string;
-
-    if (examplesMatch) {
-      fenceApp = examplesMatch[1]!;
-      relPath = examplesMatch[2]!;
-    } else if (app) {
-      fenceApp = app;
-      relPath = claimedPath;
-    } else {
-      continue;
-    }
-
-    const fence = readFenceAfterHeading(lines, i, claimedPath);
-    if (!fence) continue;
-
-    fences.push({
-      app: fenceApp,
-      relPath,
-      body: fence.body,
-      headingLine: i + 1,
-    });
-    i = fence.endIndex;
-  }
-
-  return fences;
-}
-
-/**
- * Whether `expected` is contained in a file, or any file under a directory path.
- *
- * @param targetPath - File or directory (`tests/`)
- * @param expected - Normalized fence body
- */
-async function containsFence(
-  targetPath: string,
-  expected: string,
-): Promise<boolean> {
-  const direct = Bun.file(targetPath);
-  if (await direct.exists()) {
-    const st = await direct.stat();
-    if (st.isFile()) {
-      return normalizeTs(await direct.text()).includes(expected);
-    }
-  }
-
-  // Directory claim (`### \`tests/\``) — any nested file may contain the fence.
-  const dirPath = targetPath.endsWith("/")
-    ? targetPath.slice(0, -1)
-    : targetPath;
-  try {
-    const glob = new Bun.Glob("**/*.{ts,tsx,js,jsx}");
-    for await (const rel of glob.scan({ cwd: dirPath, onlyFiles: true })) {
-      const text = await Bun.file(resolve(dirPath, rel)).text();
-      if (normalizeTs(text).includes(expected)) return true;
-    }
-  } catch {
-    return false;
-  }
-  return false;
-}
-
-/**
- * Check that every claimed fence is contained in its example file.
- *
- * @param fences - Claimed fences
- * @param root - Repo root
- */
-export async function checkDocDrift(
-  fences: readonly ClaimedFence[],
-  root = ROOT,
-): Promise<{ readonly ok: boolean; readonly failures: readonly string[] }> {
-  const failures: string[] = [];
-
-  for (const fence of fences) {
-    const targetPath = resolve(root, "examples", fence.app, fence.relPath);
-    const expected = normalizeTs(fence.body);
-    const contained = await containsFence(targetPath, expected);
-    if (!contained) {
-      const kind = fence.relPath.endsWith("/") ? "directory" : "file";
-      failures.push(
-        `${fence.app}: ${kind} ${fence.relPath} does not contain claimed fence (spec line ${fence.headingLine})`,
-      );
-    }
-  }
-
-  return { ok: failures.length === 0, failures };
-}
-
-/**
- * Run doc-drift over one or more markdown files.
- *
- * Site content under `site/` may have zero claimed fences (prose-only pages);
- * only `docs/spec/four-applications.md` and `README.md` require at least one.
- *
- * @param paths - Absolute or repo-relative markdown paths
- */
-export async function runDocDrift(
-  paths: readonly string[],
-): Promise<{ readonly ok: boolean; readonly messages: readonly string[] }> {
-  const messages: string[] = [];
-  let ok = true;
-  let total = 0;
-  let mermaidTotal = 0;
-  let checkedFiles = 0;
-
-  for (const path of paths) {
-    const abs = resolve(ROOT, path);
-    const label = abs.startsWith(ROOT + "/")
-      ? abs.slice(ROOT.length + 1)
-      : abs;
-    const requireClaimed = !label.startsWith("site/");
-    const markdown = await Bun.file(abs).text();
-    const fences = parseClaimedFences(markdown);
-    if (fences.length === 0) {
-      if (requireClaimed) {
-        messages.push(`doc-drift: no claimed fences found in ${label}`);
-        ok = false;
-      }
-    } else {
-      checkedFiles++;
-      const result = await checkDocDrift(fences);
-      total += fences.length;
-      if (!result.ok) {
-        ok = false;
-        messages.push(
-          `doc-drift: ${result.failures.length} failure(s) in ${label}`,
-        );
-        for (const f of result.failures) messages.push(`  · ${f}`);
-      } else {
-        messages.push(
-          `doc-drift: ok — ${fences.length} claimed fence(s) in ${label}`,
-        );
-      }
-    }
-
-    const mermaidFences = parseMermaidFences(markdown);
-    if (mermaidFences.length > 0) {
-      mermaidTotal += mermaidFences.length;
-      const mermaidResult = await checkMermaidSyntax(mermaidFences);
-      if (!mermaidResult.ok) {
-        ok = false;
-        messages.push(
-          `doc-drift: ${mermaidResult.failures.length} mermaid failure(s) in ${label}`,
-        );
-        for (const f of mermaidResult.failures) messages.push(`  · ${f}`);
-      } else {
-        messages.push(
-          `doc-drift: ok — ${mermaidFences.length} mermaid fence(s) in ${label}`,
-        );
-      }
-    }
-  }
-
-  if (ok && checkedFiles > 1) {
-    const mermaidNote =
-      mermaidTotal > 0 ? ` · ${mermaidTotal} mermaid fence(s)` : "";
-    messages.push(
-      `doc-drift: ok — ${total} claimed fence(s) across ${checkedFiles} file(s)${mermaidNote}`,
-    );
-  }
-
-  return { ok, messages };
-}
-
-async function main(): Promise<number> {
-  const args = process.argv.slice(2);
-  const paths =
-    args.length > 0
-      ? args
-      : [...REQUIRED_DOCS, ...(await discoverSiteDocs(ROOT))];
-  const { ok, messages } = await runDocDrift(paths);
-  for (const m of messages) {
-    if (ok) console.log(m);
-    else console.error(m);
-  }
-  return ok ? 0 : 1;
-}
-
-if (import.meta.main) {
-  process.exit(await main());
-}

package/src/cli/doctor-diff-examples.ts

@@ -1,92 +0,0 @@
-#!/usr/bin/env bun
-/**
- * CI gate: `oke doctor --diff` across the four reference apps.
- *
- * Extracts Manifests from working-tree sources and from the git merge-base,
- * then fails on undeclared contract breaks.
- */
-
-import { resolve } from "node:path";
-import { extractManifest, type SourceFile } from "../compiler/extract.ts";
-import { undeclaredContractBreaks } from "../manifest/undeclared.ts";
-import { gitMergeBase, gitShow } from "./doctor-diff.ts";
-
-const ROOT = resolve(import.meta.dir, "../..");
-const APPS = ["notes", "linkly", "provisions", "skyport"] as const;
-
-/**
- * Run undeclared-break checks for every example app.
- *
- * @returns Exit code
- */
-export async function runDoctorDiffExamples(): Promise<number> {
-  const mergeBase = await gitMergeBase(ROOT);
-  let failed = 0;
-
-  for (const app of APPS) {
-    const rootDir = resolve(ROOT, `examples/${app}`);
-    const after = await extractManifest({ rootDir });
-    const extracted = mergeBase
-      ? await extractAtRevision(ROOT, mergeBase, `examples/${app}`)
-      : after;
-    // No sources at merge-base → empty baseline (additions are no-impact).
-    const before = extracted ?? { oke: after.oke, app: after.app };
-
-    const undeclared = undeclaredContractBreaks(before, after);
-    if (undeclared.length === 0) {
-      console.log(`oke doctor --diff examples/${app}: ok`);
-      continue;
-    }
-    failed++;
-    console.log(
-      `oke doctor --diff examples/${app}: ${undeclared.length} undeclared contract-breaking change(s)`,
-    );
-    for (const c of undeclared) {
-      console.log(`  [contract-breaking] ${c.path}: ${c.summary}`);
-    }
-  }
-
-  if (failed > 0) {
-    console.log(
-      "Acknowledge intentional breaks with `breaking: true` on the owning flow.",
-    );
-  }
-  return failed > 0 ? 1 : 0;
-}
-
-/**
- * Extract a Manifest from sources as they existed at a git revision.
- *
- * @param repoRoot - Repository root
- * @param rev - Commit-ish
- * @param appRel - App directory relative to repo root (e.g. `examples/notes`)
- */
-async function extractAtRevision(
-  repoRoot: string,
-  rev: string,
-  appRel: string,
-): Promise<Awaited<ReturnType<typeof extractManifest>> | null> {
-  const workingRoot = resolve(repoRoot, appRel);
-  // Bun.Glob (global) — bare `import … from "bun"` is rejected by JSR.
-  const glob = new Bun.Glob("**/*.{ts,tsx}");
-  const files: SourceFile[] = [];
-
-  for await (const rel of glob.scan({
-    cwd: workingRoot,
-    onlyFiles: true,
-  })) {
-    if (rel.includes("node_modules/") || rel.endsWith(".test.ts")) continue;
-    const repoPath = `${appRel}/${rel}`;
-    const source = await gitShow(repoRoot, rev, repoPath);
-    if (source === null) continue;
-    files.push({ path: rel, source });
-  }
-
-  if (files.length === 0) return null;
-  files.sort((a, b) => a.path.localeCompare(b.path));
-  return extractManifest({ files });
-}
-
-if (import.meta.main) {
-  process.exit(await runDoctorDiffExamples());
-}

package/src/console/ui/dist/assets/panel-vault-BbfWdox0.js

@@ -1 +0,0 @@
-import{a as e,r as t}from"./rolldown-runtime-CNC7AqOf.js";import{C as n,Q as r,Z as i,a,b as o,c as s,d as c,et as l,g as u,nt as d,o as f,tt as p,u as m,w as h,y as g}from"./panel-access-Dd37LU2c.js";var _=g({q:o().optional(),name:o().optional(),action:u([`set`,`rotate`]).optional()});function v(e){let t=_.safeParse(e);return t.success?t.data:{}}function y(e){let t={};return e.q&&(t.q=e.q),e.name&&(t.name=e.name),e.action&&(t.action=e.action),t}function b(e,t){return{...e,name:t,action:void 0}}function x(e,t=``){let n=t.trim().toLowerCase(),r=n?e.filter(e=>e.name.toLowerCase().includes(n)||(e.description?.toLowerCase().includes(n)??!1)):e,i=[`secret`,`config`],a={secret:`Secrets`,config:`Config`};return i.map(e=>({kind:e,label:a[e],secrets:r.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function S(e={production:!0}){return e.production?{kind:`typed`,phrase:`SET`,requireReason:!0}:{kind:`undo`,windowMs:15e3}}function C(e={production:!0}){return{kind:`typed`,phrase:`ROTATE`,requireReason:!0}}function w(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:T(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function T(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function E(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function D(e){return JSON.stringify(e.map(e=>E(e)),null,2)}var O=e(d(),1),k=p();function A(){let e=h({from:`/vault`}),t=n({from:`/vault`}),o=l(),[u,d]=(0,O.useState)(``),[p,g]=(0,O.useState)(``),[_,v]=(0,O.useState)(``),[T,E]=(0,O.useState)(null),A=e=>{t({search:y(e),replace:!0})},j=r({queryKey:[`console.vault.list`],queryFn:async()=>{let e=await c.vaultList();if(e.error)throw Error(e.error.code);return e.data},refetchInterval:1e4}),M=j.data?.secrets??[],N=j.data?.env??`dev`,P=(0,O.useMemo)(()=>x(M,e.q??``),[M,e.q]),F=M.find(t=>t.name===e.name),I=F?w(F.blastRadius):null,L=S({production:!0}),R=C({production:!0}),z=e.action;(0,O.useEffect)(()=>{d(``),g(``),v(``),E(null)},[F?.name,z]);let B=i({mutationFn:async()=>{if(!F)throw Error(`no secret`);if(L.kind===`typed`){let e=a({typed:u,reason:p,phrase:L.phrase});if(e)throw Error(e.typed??e.reason??`confirm`)}let e=await c.vaultSet({name:F.name,value:_,confirmation:L.kind===`typed`?u:void 0,reason:p||void 0});if(e.error)throw Error(e.error.code);return e.data},onSuccess:async()=>{v(``),d(``),g(``),A({...e,action:void 0}),await o.invalidateQueries({queryKey:[`console.vault.list`]})}}),V=i({mutationFn:async()=>{if(!F)throw Error(`no secret`);let e=a({typed:u,reason:p,phrase:R.kind===`typed`?R.phrase:`ROTATE`});if(e)throw Error(e.typed??e.reason??`confirm`);let t=await c.vaultRotate({name:F.name,value:_,confirmation:u,reason:p});if(t.error)throw Error(t.error.code);return t.data},onSuccess:async()=>{v(``),d(``),g(``),A({...e,action:void 0}),await o.invalidateQueries({queryKey:[`console.vault.list`]})}});return(0,k.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col`,children:[(0,k.jsxs)(`header`,{className:`flex shrink-0 flex-wrap items-end gap-3 border-b border-[var(--oke-line)] px-4 py-3`,children:[(0,k.jsxs)(`div`,{children:[(0,k.jsx)(`h1`,{className:`text-lg font-medium text-[var(--oke-fg)]`,children:`Vault`}),(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Fingerprints only — secrets are write-only`})]}),(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,role:`status`,children:[`Environment `,N]}),(0,k.jsxs)(`label`,{className:`ml-auto flex min-w-[12rem] flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{className:`text-[var(--oke-muted)]`,children:`Filter vault`}),(0,k.jsx)(s,{"aria-label":`Filter vault`,value:e.q??``,onChange:t=>A({...e,q:t.currentTarget.value||void 0})})]}),(0,k.jsx)(f,{type:`button`,variant:`ghost`,onClick:()=>{let e=D(M);navigator.clipboard?.writeText(e),E(`Exported fingerprints only (no secret values)`)},children:`Export`})]}),T?(0,k.jsx)(`p`,{className:`px-4 py-2 text-sm text-[var(--oke-muted)]`,role:`status`,children:T}):null,(0,k.jsxs)(`div`,{className:`flex min-h-0 flex-1`,children:[(0,k.jsxs)(`section`,{"aria-label":`Vault list`,className:`w-80 shrink-0 overflow-y-auto border-r border-[var(--oke-line)]`,children:[(0,k.jsx)(`h2`,{className:`sr-only`,children:`Contracts`}),j.isLoading?(0,k.jsx)(`p`,{className:`p-4 text-sm text-[var(--oke-muted)]`,children:`Loading…`}):null,P.map(t=>(0,k.jsxs)(`section`,{"aria-label":t.label,className:`py-2`,children:[(0,k.jsx)(`h3`,{className:`px-4 py-1 text-xs uppercase tracking-wide text-[var(--oke-muted)]`,children:t.label}),(0,k.jsx)(`ul`,{children:t.secrets.map(t=>(0,k.jsx)(`li`,{children:(0,k.jsxs)(`button`,{type:`button`,"aria-pressed":t.name===F?.name,className:m(`flex min-h-10 w-full flex-col items-start px-4 py-2 text-left text-sm`,t.name===F?.name?`bg-[var(--oke-line)] text-[var(--oke-fg)]`:`text-[var(--oke-muted)] hover:text-[var(--oke-fg)]`),onClick:()=>A(b(e,t.name)),children:[(0,k.jsx)(`span`,{className:`font-mono`,children:t.name}),(0,k.jsx)(`span`,{className:`truncate text-xs`,children:t.sensitive?t.fingerprint??`unset`:t.cleartext??`unset`}),t.blastRadius.count>0?(0,k.jsxs)(`span`,{role:`status`,className:`text-xs text-[var(--oke-danger)]`,children:[`blast `,t.blastRadius.count]}):null,t.sharedFingerprintEnvs.length>0?(0,k.jsx)(`span`,{role:`status`,className:`text-xs`,children:`shared fingerprint`}):null]})},t.name))})]},t.kind))]}),(0,k.jsx)(`section`,{"aria-label":`Vault detail`,"aria-live":`polite`,className:`min-w-0 flex-1 overflow-y-auto p-4`,children:F?(0,k.jsxs)(`div`,{className:`flex max-w-2xl flex-col gap-6`,children:[(0,k.jsxs)(`div`,{children:[(0,k.jsx)(`h2`,{className:`font-mono text-lg text-[var(--oke-fg)]`,children:F.name}),F.description?(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:F.description}):null,F.rotate?(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:[`Rotate hint: `,F.rotate]}):null]}),(0,k.jsxs)(`section`,{"aria-label":`Fingerprints by environment`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Fingerprints`}),F.sensitive?(0,k.jsxs)(`ul`,{className:`space-y-1 font-mono text-sm`,children:[Object.entries(F.fingerprints).map(([e,t])=>(0,k.jsxs)(`li`,{children:[(0,k.jsxs)(`span`,{className:`text-[var(--oke-muted)]`,children:[e,`:`]}),` `,t,F.sharedFingerprintEnvs.includes(e)?(0,k.jsxs)(`span`,{role:`status`,className:`ml-2 text-[var(--oke-warn,var(--oke-muted))]`,children:[`(matches `,N,` — warning, may be deliberate)`]}):null]},e)),Object.keys(F.fingerprints).length===0?(0,k.jsx)(`li`,{className:`text-[var(--oke-muted)]`,children:`Unset`}):null]}):(0,k.jsx)(`p`,{className:`font-mono text-sm`,role:`status`,children:F.cleartext??`unset`})]}),(0,k.jsxs)(`section`,{"aria-label":`Resolution chain`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Resolution chain`}),(0,k.jsx)(`ol`,{className:`list-decimal space-y-1 pl-5 text-sm`,children:F.resolution.map(e=>(0,k.jsxs)(`li`,{className:e.won?`text-[var(--oke-fg)]`:`text-[var(--oke-muted)]`,children:[(0,k.jsx)(`span`,{className:`font-mono`,children:e.source}),e.won?` — won`:e.present?` — present (lost)`:` — absent`]},e.source))}),(0,k.jsxs)(`p`,{className:`mt-2 text-sm`,role:`status`,children:[`Winner:`,` `,(0,k.jsx)(`span`,{className:`font-mono`,children:F.winner??`none`})]})]}),(0,k.jsxs)(`section`,{"aria-label":`Readers`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Readers`}),(0,k.jsxs)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:[`Flows that declare`,` `,(0,k.jsxs)(`code`,{className:`font-mono`,children:[`fx.vault(`,F.name,`)`]})]}),(0,k.jsx)(`ul`,{className:`mt-1 list-disc pl-5 font-mono text-sm`,children:F.readers.length===0?(0,k.jsx)(`li`,{className:`text-[var(--oke-muted)]`,children:`none`}):F.readers.map(e=>(0,k.jsx)(`li`,{children:e},e))})]}),(0,k.jsxs)(`section`,{"aria-label":`Rotation blast radius`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Rotation blast radius`}),I?(0,k.jsxs)(k.Fragment,{children:[(0,k.jsx)(`p`,{className:`text-sm`,role:I.warn?`alert`:`status`,children:I.summary}),I.detail?(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:I.detail}):null,F.blastRadius.runIds.length>0?(0,k.jsx)(`p`,{className:`mt-1 font-mono text-xs text-[var(--oke-muted)]`,children:F.blastRadius.runIds.join(`, `)}):null]}):null]}),(0,k.jsxs)(`section`,{"aria-label":`Last read`,children:[(0,k.jsx)(`h3`,{className:`mb-2 text-sm font-medium`,children:`Last read`}),(0,k.jsx)(`p`,{className:`text-sm`,role:`status`,children:F.lastReadAt==null?`Never read — possible dead secret`:new Date(F.lastReadAt).toISOString()})]}),(0,k.jsxs)(`section`,{"aria-label":`Set or rotate`,className:`space-y-3`,children:[(0,k.jsx)(`h3`,{className:`text-sm font-medium`,children:`Set / rotate`}),(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Write-only. Values are never revealed after submit. No preview.`}),(0,k.jsxs)(`div`,{className:`flex gap-2`,children:[(0,k.jsx)(f,{type:`button`,variant:z===`set`?`primary`:`ghost`,"aria-pressed":z===`set`,onClick:()=>A({...e,action:`set`}),children:`Set`}),(0,k.jsx)(f,{type:`button`,variant:z===`rotate`?`danger`:`ghost`,"aria-pressed":z===`rotate`,onClick:()=>A({...e,action:`rotate`}),children:`Rotate`})]}),z?(0,k.jsxs)(`div`,{className:`space-y-3 border border-[var(--oke-line)] p-3`,children:[(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{children:`New value`}),(0,k.jsx)(s,{"aria-label":`New vault value`,type:`password`,autoComplete:`off`,value:_,onChange:e=>v(e.currentTarget.value)})]}),(z===`rotate`||L.kind===`typed`)&&(0,k.jsxs)(k.Fragment,{children:[(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsxs)(`span`,{children:[`Type`,` `,z===`rotate`?R.kind===`typed`?R.phrase:`ROTATE`:L.kind===`typed`?L.phrase:`SET`,` `,`to confirm`]}),(0,k.jsx)(s,{"aria-label":`Confirmation phrase`,value:u,onChange:e=>d(e.currentTarget.value)})]}),(0,k.jsxs)(`label`,{className:`flex flex-col gap-1 text-sm`,children:[(0,k.jsx)(`span`,{children:`Reason`}),(0,k.jsx)(s,{"aria-label":`Reason for vault write`,value:p,onChange:e=>g(e.currentTarget.value)})]})]}),(0,k.jsx)(f,{type:`button`,variant:z===`rotate`?`danger`:`primary`,disabled:!_||(z===`set`?B.isPending:V.isPending),onClick:()=>{z===`set`?B.mutate():V.mutate()},children:z===`set`?`Commit set`:`Commit rotate`}),(B.isError||V.isError)&&(0,k.jsx)(`p`,{role:`alert`,className:`text-sm text-[var(--oke-danger)]`,children:(B.error??V.error)?.message??`Failed`})]}):null]})]}):(0,k.jsx)(`p`,{className:`text-sm text-[var(--oke-muted)]`,children:`Select a contract to inspect fingerprints, resolution, and readers.`})})]})]})}var j=t({default:()=>A});export{v as n,j as t};