okengine 0.20.0 → 0.21.0

package/src/console/ui-next/dist/assets/{vault-page-39KR__bc.js → vault-page-BwZ9YjTW.js}

@@ -1,2 +1,2 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{r as t}from"./react-dom-Ddte4I-Q.js";import{A as n}from"./xyflow-yApv7D4e.js";import{Ci as r,Cr as i,Dr as a,E as o,Er as s,Or as c,Ti as l,Tr as u,Vr as d,_ as f,_r as p,ar as m,b as h,bi as g,br as _,c as v,cr as y,d as b,dr as x,er as S,h as C,ha as ee,i as w,ir as te,l as T,lr as E,mr as D,nr as ne,o as O,p as re,pr as ie,rr as ae,s as k,tr as oe,u as A,ur as se,vr as j,wi as ce,wr as M,x as N,xi as le,xr as P,y as ue,yr as F}from"./shortcut-keys-3ILd8oGn.js";import{a as de,b as fe,c as pe,h as me,i as he,m as ge,n as _e,o as ve,r as ye,s as I,t as L,v as R,x as be}from"./element-icons-BI8cJgdh.js";import{a as z,i as xe,n as Se,o as Ce,r as we,s as B,t as Te}from"./collapsible-JWvpaiGY.js";import{t as Ee}from"./FileExportIcon-Ck-5od4R.js";import{t as De}from"./MoreHorizontalCircle01Icon-gMNGsE37.js";import{t as Oe}from"./PlusSignIcon-CwG3nxfu.js";import{t as ke}from"./UnavailableIcon-D9cvHVPr.js";import{a as V,d as Ae,i as je,l as Me,r as Ne,t as Pe}from"./dropdown-menu-4h2LOVXM.js";import{bt as Fe,lt as Ie,yt as Le}from"./index-yTCY4AcS.js";import{t as Re}from"./explorer-empty-CJs5A-wm.js";import{a as H,c as U,l as W,n as G,o as ze,s as Be,t as Ve}from"./detail-header-DVWNjWjg.js";import{n as He,t as Ue}from"./copy-inline-button-CAYD18cr.js";import{a as We,i as Ge,n as Ke,o as qe,r as Je,s as Ye,t as Xe}from"./use-vault-list-CT4-gajj.js";var Ze=[[`path`,{d:`M16 21C15.7668 18.0685 13.3422 15.7477 10.3085 15.5521L9.49999 15.5C9.21121 15.5076 8.94209 15.5178 8.68816 15.5298C5.68124 15.6723 3.23089 18.0974 3 21`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`0`}],[`path`,{d:`M12.75 9.75C12.75 11.5449 11.2949 13 9.5 13C7.70508 13 6.25 11.5449 6.25 9.75C6.25 7.95507 7.70508 6.5 9.5 6.5C11.2949 6.5 12.75 7.95507 12.75 9.75Z`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`1`}],[`path`,{d:`M21 17.501C20.7709 14.6314 18.4541 12.2748 15.5 11.9961`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`2`}],[`path`,{d:`M15.9877 9C16.8965 8.42434 17.5001 7.40788 17.5001 6.25C17.5001 4.45507 16.0496 3 14.2602 3C13.3811 3 12.5838 3.35121 12.0001 3.92139`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`3`}]],K=e(t(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:qe(n),command:tt(t),hint:Ge(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=n(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:me,"process.env":z,".env.local":R,"dev-fallback":ke},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:o,onQueryChange:s,leading:c}){let l=Qe(e.blastRadius),u=pt(e,n),d=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=u.unset,v=u.overdue&&q(e.rotate)&&!l.warn&&!u.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(Ve,{dataSlot:`vault-detail-header`,leading:c,icon:(0,Y.jsx)(a,{icon:L.vault.icon,className:`size-4`}),wellStyle:{color:J},title:d,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:We(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Ue,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(I,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(I,{label:l.warn?l.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:l.warn,onClick:o,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:u.unset,blastWarn:l.warn,blastSummary:l.summary,blastDetail:l.detail,overdue:u.overdue,onSet:i,onRotate:o}),(0,Y.jsxs)(`div`,{className:j,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?Ye(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:s?()=>s(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:s?()=>s(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:s&&e.readers[0]?()=>s(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:l.detail??(e.blastRadius.longestOutstandingMs==null?l.summary:$e(e.blastRadius.longestOutstandingMs)),warn:l.warn,onClick:s?()=>s(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:s?()=>s(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:s?e=>s(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(je,{children:t.slice(0,4).map(e=>(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Me,{}),(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:r,blastSummary:i,blastDetail:a,overdue:o,onSet:c,onRotate:l}){return r?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:s(j,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[i,a?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,a]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(Le,{to:`/overview`,search:{run:e},className:s(D,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(N,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):o&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:s(j,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:s(M,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:r=!1,won:i=!1,onClick:a}){let o=s(_,P,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:s(`font-mono tabular-nums text-foreground`,r&&`text-amber-800 dark:text-amber-400`,i&&bt),children:t})]});return a?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:a,className:o,children:c}):(0,Y.jsx)(`span`,{title:n,className:o,children:c})}function kt({steps:e,selected:t,fill:n,backend:r,onSelect:i}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,c)=>{let l=e.source===t.source,u=wt(e,c,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":l,onClick:()=>i(e.source),className:s(D,l&&`bg-muted/70 text-foreground`,o>=0&&c>o&&!l&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:s(ie,l&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(`relative z-10 size-2 shrink-0 rounded-full border`,u===`won`&&`border-emerald-500 bg-emerald-500`,u===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,u===`missed`&&`border-muted-foreground/50 bg-transparent`,u===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:yt[e.source],className:s(E,u===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:s(`min-w-0 flex-1 truncate font-mono`,u===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:We(r)}):null]}),(0,Y.jsx)(`span`,{className:s(`shrink-0 text-[10px]`,u===`won`?bt:`text-muted-foreground`),children:u})]}),l?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Ue,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:D,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Ue,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:s(D,`group/reader`),children:[(0,Y.jsx)(a,{icon:L.flow.icon,className:s(E,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:s(S,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(Le,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(Le,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:L.vault.icon,config:z},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:B,unset:ke,overdue:be,shared:Ze,dormant:ke,healthy:L.vault.icon,config:z},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:n=!1,matchCount:r,totalCount:i,now:o,onSelect:c}){let[l,d]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&d(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[n&&e.length===0?(0,Y.jsx)(`p`,{className:se,children:`Loading…`}):null,!n&&e.length===0?(0,Y.jsxs)(`p`,{className:se,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let n=l[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:oe,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Te,{open:n,onOpenChange:t=>d(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(we,{nativeButton:!1,className:ne,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(a,{icon:Ce,className:s(te,!n&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:Ft[e.kind],className:s(E,u(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(ae,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:m,children:e.secrets.length})]})}),(0,Y.jsx)(Se,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:o,onSelect:c},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:r===i?`${i} contracts`:`${r} of ${i} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:r}){let i=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,c=o!==i,l=pt(e,n),d=l.primary!==`healthy`&&l.primary!==`config`,f=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,p=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${i}, ${o}, ${f}, ${gt(l.primary)}`,onClick:()=>r(e.name),className:s(D,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(ie,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(I,{label:_t(l.primary,e.rotate),children:(0,Y.jsx)(a,{icon:Rt[l.primary],className:s(E,`mt-0.5`,u(Lt[l.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:i}),d?(0,Y.jsx)(Ht,{posture:l}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[c?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,c?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:f}),p.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:s(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{r as t}from"./react-dom-Ddte4I-Q.js";import{A as n}from"./xyflow-yApv7D4e.js";import{Ci as r,Cr as i,Dr as a,E as o,Er as s,Or as c,Ti as l,Tr as u,Vr as d,_ as f,_r as p,ar as m,b as h,bi as g,br as _,c as v,cr as y,d as b,dr as x,er as S,h as C,ha as ee,i as w,ir as te,l as T,lr as E,mr as D,nr as ne,o as O,p as re,pr as ie,rr as ae,s as k,tr as oe,u as A,ur as se,vr as j,wi as ce,wr as M,x as N,xi as le,xr as P,y as ue,yr as F}from"./shortcut-keys-3ILd8oGn.js";import{a as de,b as fe,c as pe,h as me,i as he,m as ge,n as _e,o as ve,r as ye,s as I,t as L,v as R,x as be}from"./element-icons-BI8cJgdh.js";import{a as z,i as xe,n as Se,o as Ce,r as we,s as B,t as Te}from"./collapsible-DC2xNaAb.js";import{t as Ee}from"./FileExportIcon-Ck-5od4R.js";import{t as De}from"./MoreHorizontalCircle01Icon-gMNGsE37.js";import{t as Oe}from"./PlusSignIcon-CwG3nxfu.js";import{t as ke}from"./UnavailableIcon-D9cvHVPr.js";import{a as V,d as Ae,i as je,l as Me,r as Ne,t as Pe}from"./dropdown-menu-4h2LOVXM.js";import{bt as Fe,lt as Ie,yt as Le}from"./index-Cul17AcV.js";import{t as Re}from"./explorer-empty-CJs5A-wm.js";import{a as H,c as U,l as W,n as G,o as ze,s as Be,t as Ve}from"./detail-header-DVWNjWjg.js";import{n as He,t as Ue}from"./copy-inline-button-CAYD18cr.js";import{a as We,i as Ge,n as Ke,o as qe,r as Je,s as Ye,t as Xe}from"./use-vault-list-CT4-gajj.js";var Ze=[[`path`,{d:`M16 21C15.7668 18.0685 13.3422 15.7477 10.3085 15.5521L9.49999 15.5C9.21121 15.5076 8.94209 15.5178 8.68816 15.5298C5.68124 15.6723 3.23089 18.0974 3 21`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`0`}],[`path`,{d:`M12.75 9.75C12.75 11.5449 11.2949 13 9.5 13C7.70508 13 6.25 11.5449 6.25 9.75C6.25 7.95507 7.70508 6.5 9.5 6.5C11.2949 6.5 12.75 7.95507 12.75 9.75Z`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`1`}],[`path`,{d:`M21 17.501C20.7709 14.6314 18.4541 12.2748 15.5 11.9961`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`2`}],[`path`,{d:`M15.9877 9C16.8965 8.42434 17.5001 7.40788 17.5001 6.25C17.5001 4.45507 16.0496 3 14.2602 3C13.3811 3 12.5838 3.35121 12.0001 3.92139`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`3`}]],K=e(t(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:qe(n),command:tt(t),hint:Ge(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=n(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:me,"process.env":z,".env.local":R,"dev-fallback":ke},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:o,onQueryChange:s,leading:c}){let l=Qe(e.blastRadius),u=pt(e,n),d=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=u.unset,v=u.overdue&&q(e.rotate)&&!l.warn&&!u.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(Ve,{dataSlot:`vault-detail-header`,leading:c,icon:(0,Y.jsx)(a,{icon:L.vault.icon,className:`size-4`}),wellStyle:{color:J},title:d,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:We(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Ue,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(I,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(I,{label:l.warn?l.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:l.warn,onClick:o,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:u.unset,blastWarn:l.warn,blastSummary:l.summary,blastDetail:l.detail,overdue:u.overdue,onSet:i,onRotate:o}),(0,Y.jsxs)(`div`,{className:j,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?Ye(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:s?()=>s(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:s?()=>s(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:s&&e.readers[0]?()=>s(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:l.detail??(e.blastRadius.longestOutstandingMs==null?l.summary:$e(e.blastRadius.longestOutstandingMs)),warn:l.warn,onClick:s?()=>s(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:s?()=>s(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:s?e=>s(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(je,{children:t.slice(0,4).map(e=>(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Me,{}),(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:r,blastSummary:i,blastDetail:a,overdue:o,onSet:c,onRotate:l}){return r?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:s(j,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[i,a?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,a]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(Le,{to:`/overview`,search:{run:e},className:s(D,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(N,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):o&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:s(j,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:s(M,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:r=!1,won:i=!1,onClick:a}){let o=s(_,P,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:s(`font-mono tabular-nums text-foreground`,r&&`text-amber-800 dark:text-amber-400`,i&&bt),children:t})]});return a?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:a,className:o,children:c}):(0,Y.jsx)(`span`,{title:n,className:o,children:c})}function kt({steps:e,selected:t,fill:n,backend:r,onSelect:i}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,c)=>{let l=e.source===t.source,u=wt(e,c,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":l,onClick:()=>i(e.source),className:s(D,l&&`bg-muted/70 text-foreground`,o>=0&&c>o&&!l&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:s(ie,l&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(`relative z-10 size-2 shrink-0 rounded-full border`,u===`won`&&`border-emerald-500 bg-emerald-500`,u===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,u===`missed`&&`border-muted-foreground/50 bg-transparent`,u===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:yt[e.source],className:s(E,u===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:s(`min-w-0 flex-1 truncate font-mono`,u===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:We(r)}):null]}),(0,Y.jsx)(`span`,{className:s(`shrink-0 text-[10px]`,u===`won`?bt:`text-muted-foreground`),children:u})]}),l?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Ue,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:D,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Ue,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:s(D,`group/reader`),children:[(0,Y.jsx)(a,{icon:L.flow.icon,className:s(E,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:s(S,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(Le,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(Le,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:L.vault.icon,config:z},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:B,unset:ke,overdue:be,shared:Ze,dormant:ke,healthy:L.vault.icon,config:z},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:n=!1,matchCount:r,totalCount:i,now:o,onSelect:c}){let[l,d]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&d(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[n&&e.length===0?(0,Y.jsx)(`p`,{className:se,children:`Loading…`}):null,!n&&e.length===0?(0,Y.jsxs)(`p`,{className:se,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let n=l[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:oe,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Te,{open:n,onOpenChange:t=>d(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(we,{nativeButton:!1,className:ne,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(a,{icon:Ce,className:s(te,!n&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:Ft[e.kind],className:s(E,u(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(ae,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:m,children:e.secrets.length})]})}),(0,Y.jsx)(Se,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:o,onSelect:c},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:r===i?`${i} contracts`:`${r} of ${i} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:r}){let i=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,c=o!==i,l=pt(e,n),d=l.primary!==`healthy`&&l.primary!==`config`,f=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,p=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${i}, ${o}, ${f}, ${gt(l.primary)}`,onClick:()=>r(e.name),className:s(D,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(ie,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(I,{label:_t(l.primary,e.rotate),children:(0,Y.jsx)(a,{icon:Rt[l.primary],className:s(E,`mt-0.5`,u(Lt[l.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:i}),d?(0,Y.jsx)(Ht,{posture:l}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[c?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,c?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:f}),p.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:s(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
 `).toLowerCase()}function sn(e){return/\s/.test(e)}function cn(e){if(e.length===0||/\s$/.test(e))return null;let t=Jt(e);return t[t.length-1]??null}function Z(e,t){let n=t.toLowerCase();return e.filter(e=>e.token.toLowerCase().startsWith(n)||e.token.toLowerCase().includes(n))}function ln({card:e,env:t,summary:n,query:r,progress:i,verifyNote:a,onQueryChange:o,onOpenSecurity:c}){return(0,Y.jsxs)(`section`,{"aria-label":`Vault posture`,className:`shrink-0 border-b border-border/60`,"data-slot":`vault-posture-strip`,children:[(0,Y.jsxs)(`div`,{className:`flex min-h-10 flex-wrap items-stretch`,children:[(0,Y.jsx)(`button`,{type:`button`,onClick:c,"aria-label":`Open vault security`,className:`flex items-center px-2 text-left text-xs font-medium text-foreground hover:bg-muted/50`,children:e?.title??`Vault backend`}),(0,Y.jsx)(`span`,{className:`flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:t}),e?.badges.map(e=>(0,Y.jsxs)(`span`,{role:e.tone===`warn`?`alert`:`status`,className:s(`flex items-center gap-1.5 px-2 text-[10px]`,e.tone===`warn`?`text-amber-800 dark:text-amber-400`:`text-muted-foreground`,e.id===`rewrap`&&`text-[color:var(--vault-accent)]`),style:e.id===`rewrap`?{"--vault-accent":J}:void 0,children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(`size-1.5 shrink-0 rounded-full`,e.tone===`warn`?`bg-amber-500`:`bg-muted-foreground/50`,e.id===`rewrap`&&`bg-[var(--vault-accent)]`)}),e.label]},e.id)),st.map(e=>{let t=n[e.id],i=Qt(r,e.token);return t===0&&!i?null:(0,Y.jsx)(I,{label:_t(e.id),className:`flex self-stretch`,children:(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":i,onClick:()=>o(Zt(r,e.token)),className:s(_,i?F:P,e.tone===`danger`&&!i&&`text-destructive`,e.tone===`warn`&&!i&&`text-amber-800 dark:text-amber-400`),children:[e.label,(0,Y.jsx)(`span`,{className:`font-mono tabular-nums`,children:t})]})},e.id)}),(0,Y.jsx)(`span`,{className:`ml-auto flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:a??`${n.secrets}s · ${n.config}c`})]}),i?(0,Y.jsxs)(`p`,{className:`border-t border-border/60 px-2 py-1 font-mono text-[11px]`,style:{color:J},role:`status`,"data-slot":`vault-rewrap-progress`,"data-phase":i.phase,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]})}function un({query:e,secrets:t,onQueryChange:n}){let r=(0,K.useId)(),i=(0,K.useRef)(null),[a,o]=(0,K.useState)(!1),[c,l]=(0,K.useState)(0),u=(0,K.useMemo)(()=>en(e,t),[e,t]);(0,K.useEffect)(()=>{l(0)},[e]),(0,K.useEffect)(()=>{let e=e=>{i.current?.contains(e.target)||o(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[]);let d=t=>{n(tn(e,t.token)),o(!0)};return(0,Y.jsxs)(`div`,{ref:i,className:`relative flex h-full min-w-0 flex-1`,"data-slot":`vault-search`,children:[(0,Y.jsx)(pe,{"data-slot":`vault-search-input`,value:e,onChange:e=>{n(e.target.value),o(!0)},onFocus:()=>o(!0),onKeyDown:e=>{if(e.key===`Escape`){o(!1);return}if(!a||u.length===0){e.key===`ArrowDown`&&u.length>0&&(e.preventDefault(),o(!0));return}if(e.key===`ArrowDown`){e.preventDefault(),l(e=>(e+1)%u.length);return}if(e.key===`ArrowUp`){e.preventDefault(),l(e=>(e-1+u.length)%u.length);return}e.key===`Enter`&&u[c]&&(e.preventDefault(),d(u[c]))},placeholder:`Search vault…`,"aria-label":`Search vault`,"aria-autocomplete":`list`,"aria-expanded":a,"aria-controls":r,role:`combobox`,title:`name, fingerprint, reader…  is:unset  from:.env.local`}),a&&u.length>0?(0,Y.jsx)(`ul`,{id:r,role:`listbox`,className:`absolute top-full z-30 mt-1 max-h-72 w-[min(20rem,calc(100vw-4rem))] overflow-y-auto rounded-lg border border-border/70 bg-popover p-1 shadow-md`,children:u.map((e,t)=>(0,Y.jsx)(`li`,{role:`option`,"aria-selected":t===c,children:(0,Y.jsxs)(`button`,{type:`button`,onMouseEnter:()=>l(t),onClick:()=>d(e),className:s(`flex w-full items-baseline gap-2 rounded-md px-2 py-1.5 text-left`,t===c&&`bg-muted/70`),children:[(0,Y.jsx)(`span`,{className:`font-mono text-[11px] text-foreground`,children:e.token}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate text-[10px] text-muted-foreground`,children:e.label})]})},`${e.token}-${t}`))}):null]})}function dn(e,t=``,n=Date.now()){let r=Yt(t),i=e.filter(e=>$t(e,r,n)),a=[`secret`,`config`],o={secret:`Secrets`,config:`Config`};return a.map(e=>({kind:e,label:o[e],secrets:i.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function fn(e){let t=e.remaining,n=e.rewrapTargetKekVersion;if(!(t!==null&&t>0||n!==null))return t===0?{phase:2,headline:`KEK v${e.kekVersion} — rotation complete`,detail:`The previous master key no longer opens this vault.`}:null;let r=n??e.kekVersion,i=t??0;return{phase:1,headline:`kek v${e.kekVersion} → v${r}`,detail:i>0?`${i} DEK${i===1?``:`s`} still on the old key. Both master keys stay live.`:`Both master keys stay live until remaining is 0.`}}function pn({masterKey:e,onDismiss:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsx)(w,{open:e!==null,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-master-key-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`New master key`}),(0,Y.jsx)(k,{children:`Shown once. Store it offline. This Console process does not keep it for you.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(`p`,{className:`border-b border-border/50 px-4 py-3 font-mono text-[11px] break-all`,children:e}),(0,Y.jsx)(`p`,{className:`px-4 py-3 text-[11px] text-muted-foreground`,role:`status`,children:`Copying puts the key on the clipboard. Anyone with this device can read it until you clear it.`})]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,disabled:!e,onClick:()=>{e&&(navigator.clipboard?.writeText(e),r(!0))},children:n?`Copied`:`Copy (clipboard warning)`}),(0,Y.jsx)(W,{variant:`destructive`,onClick:()=>{r(!1),t()},children:`I have stored this key`})]})]})})}function mn({open:e,onOpenChange:t,pending:n=!1,error:r,onConfirm:i}){return(0,Y.jsx)(He,{open:e,onOpenChange:t,phrase:`ROTATE_MASTER`,title:`Rotate master key`,description:`Generates a new master key and rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`,pending:n,error:r,confirmLabel:`Confirm rotate master`,slot:`vault-rotate-master-sheet`,onConfirm:i})}var hn=[{id:`status`,cmd:`oke vault status`,label:`Backend seal + KEK`},{id:`audit`,cmd:`oke vault audit`,label:`Hash-chained audit log`},{id:`verify`,cmd:`oke vault audit verify`,label:`Verify the chain on disk`},{id:`backup`,cmd:`oke vault backup`,label:`Encrypted backup`},{id:`restore`,cmd:`oke vault restore`,label:`Restore from backup`}];function gn({open:e,onOpenChange:t,card:n,env:r,progress:i,verifyPending:a=!1,verifyNote:o,onVerify:c,onRotateMaster:l,onExport:u}){return(0,Y.jsx)(w,{open:e,onOpenChange:t,children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-security-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`Vault security`}),(0,Y.jsx)(k,{children:`Fingerprints and backend status only. Backup, restore, and unseal stay on the CLI.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Backend`}),(0,Y.jsx)(`p`,{className:`text-[12px] font-medium`,children:n?.title??`Unresolved`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:n?.description??`The server could not resolve a vault backend.`}),(0,Y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[(0,Y.jsxs)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:[`env `,r]}),n?.badges.map(e=>(0,Y.jsx)(xe,{variant:`outline`,role:e.tone===`warn`?`alert`:`status`,className:s(`h-5 rounded-md text-[10px]`,e.tone===`warn`&&`border-amber-500/35 bg-amber-500/10 text-amber-800 dark:text-amber-400`),children:e.label},e.id))]}),n?.facts.length?(0,Y.jsx)(`dl`,{className:`flex flex-col gap-1`,children:n.facts.map(e=>(0,Y.jsxs)(`div`,{className:`flex justify-between gap-3`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] tracking-[0.12em] text-muted-foreground uppercase`,children:e.label}),(0,Y.jsx)(`dd`,{className:`font-mono text-[11px]`,children:e.value})]},e.label))}):null,n?.hint?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:n.hint}):null,i?(0,Y.jsxs)(`p`,{className:`font-mono text-[11px]`,style:{color:J},role:`status`,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Actions`}),(0,Y.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,disabled:a,onClick:c,children:`Verify audit chain`}),o?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:o}):null,(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,onClick:l,children:`Rotate master key`}),(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,onClick:u,children:`Export fingerprints`})]}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`Master rotation rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`})]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`CLI`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`The Console never accepts a master key in the HTTP body.`}),(0,Y.jsx)(`ul`,{className:`flex flex-col gap-1`,children:hn.map(e=>(0,Y.jsx)(_n,{cmd:e.cmd,label:e.label},e.id))})]})]})]})})}function _n({cmd:e,label:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsxs)(`li`,{className:`flex items-center gap-2`,children:[(0,Y.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,Y.jsx)(`p`,{className:`font-mono text-[11px]`,children:e}),(0,Y.jsx)(`p`,{className:`text-[10px] text-muted-foreground`,children:t})]}),(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`icon-xs`,"aria-label":`Copy ${e}`,onClick:()=>{navigator.clipboard?.writeText(e),r(!0),window.setTimeout(()=>r(!1),1200)},children:(0,Y.jsx)(a,{icon:n?c:fe})})]})}function vn({result:e,onClose:t}){let n=e!==null&&e.ok===!1,r=e?.reason===`link`?`prev-hash does not match the previous row`:e?.reason===`payload`?`stored row hash does not match the payload`:`the chain failed verification`;return(0,Y.jsx)(w,{open:n,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-verify-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`Chain broken`}),(0,Y.jsxs)(k,{children:[`The audit hash chain failed at`,` `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e?.brokenAt??`unknown`}),`.`]})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto text-[11px]`,children:[(0,Y.jsxs)(`p`,{className:`border-b border-border/50 px-4 py-3`,role:`alert`,children:[`Reason: `,r,`.`]}),e?.row?(0,Y.jsxs)(`dl`,{className:`divide-y divide-border/50`,children:[(0,Y.jsx)(Q,{label:`id`,value:e.row.id,mono:!0}),(0,Y.jsx)(Q,{label:`seq`,value:String(e.row.seq),mono:!0}),(0,Y.jsx)(Q,{label:`action`,value:e.row.action}),(0,Y.jsx)(Q,{label:`path`,value:e.row.path??`—`,mono:!0}),(0,Y.jsx)(Q,{label:`actor`,value:`${e.row.actorType} ${e.row.actorId??``}`}),(0,Y.jsx)(Q,{label:`time`,value:new Date(e.row.createdAt).toISOString(),mono:!0}),e.row.errorMessage?(0,Y.jsx)(Q,{label:`error`,value:e.row.errorMessage}):null]}):null]}),(0,Y.jsx)(v,{children:(0,Y.jsx)(W,{onClick:t,children:`Close`})})]})})}function Q({label:e,value:t,mono:n}){return(0,Y.jsxs)(`div`,{className:`px-4 py-2.5`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`font-mono text-[11px] break-all`:`text-[11px]`,children:t})]})}async function yn(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return`sha256:${[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,16)}`}async function bn(e){let t=e.name.trim(),n=e.value;if(t.length===0)return{error:`Name is required`};if(n.trim().length===0)return{error:`Value is required`};if(e.action!==`create`&&(e.reason?.trim()??``).length<3)return{error:`Reason is required`};let r=e.kind??(e.sensitive?`secret`:`config`),i=await yn(n),a=e.action===`create`?null:e.reason?.trim()??null;return{action:e.action,name:t,kind:r,fingerprint:i,preview:e.sensitive?null:n,reason:a,rotate:e.rotate??null,commit:{name:t,value:n,reason:a,kind:r,description:e.description?.trim()??``,rotate:e.rotate??(r===`secret`?`90d`:`never`)}}}function xn(e,t){return e===null?null:t(e)}function Sn(){return null}function Cn(e){return re(`alert-dialog`,e)}function wn({...e}){return(0,Y.jsx)(Cn,{"data-slot":`alert-dialog`,...e})}function Tn({...e}){return(0,Y.jsx)(C,{"data-slot":`alert-dialog-portal`,...e})}function En({className:e,...t}){return(0,Y.jsx)(h,{"data-slot":`alert-dialog-overlay`,className:s(`fixed inset-0 z-50 bg-black/20 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-xs`,e),...t})}function Dn({className:e,children:t,...n}){return(0,Y.jsxs)(Tn,{children:[(0,Y.jsx)(En,{}),(0,Y.jsx)(f,{"data-slot":`alert-dialog-content`,className:s(`fixed top-1/2 left-1/2 z-50 w-[min(100%-2rem,24rem)] -translate-x-1/2 -translate-y-1/2 overflow-hidden rounded-none border border-border bg-popover text-sm text-popover-foreground shadow-lg outline-none transition duration-150 data-ending-style:scale-95 data-ending-style:opacity-0 data-starting-style:scale-95 data-starting-style:opacity-0`,e),...n,children:t})]})}function On({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-header`,className:s(`flex flex-col gap-1 border-b border-border/50 px-4 py-3`,e),...t})}function kn({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-footer`,className:s(`flex flex-row items-stretch border-t border-border/50 p-0`,e),...t})}function An({className:e,...t}){return(0,Y.jsx)(b,{"data-slot":`alert-dialog-title`,className:s(`text-sm font-medium text-foreground`,e),...t})}function jn({className:e,...t}){return(0,Y.jsx)(ue,{"data-slot":`alert-dialog-description`,className:s(`text-[11px] text-muted-foreground`,e),...t})}var Mn={create:`Confirm add`,set:`Confirm set`,rotate:`Confirm rotate`},Nn={create:`Add contract`,set:`Set value`,rotate:`Rotate`};function Pn({review:e,pending:t=!1,onCancel:n,onConfirm:r}){return(0,Y.jsx)(wn,{open:e!==null,onOpenChange:e=>{!e&&!t&&n()},children:(0,Y.jsxs)(Dn,{"data-slot":`vault-write-review`,children:[(0,Y.jsxs)(On,{children:[(0,Y.jsx)(An,{children:e?`${Mn[e.action]} ${e.name}`:`Confirm write`}),(0,Y.jsx)(jn,{children:e?.preview==null?`Write-only. The value is never shown again.`:`Config is shown in the clear after submit.`})]}),e?(0,Y.jsx)(Fn,{review:e}):null,(0,Y.jsxs)(kn,{children:[(0,Y.jsx)(W,{split:!0,onClick:n,disabled:t,"data-slot":`vault-write-review-cancel`,children:`Cancel`}),(0,Y.jsx)(W,{variant:e?.action===`rotate`?`destructive`:`default`,disabled:t||e===null,onClick:r,"data-slot":`vault-write-review-confirm`,children:t?`Working…`:e?Nn[e.action]:`Confirm`})]})]})})}function Fn({review:e}){return(0,Y.jsxs)(`dl`,{className:`flex flex-col`,"data-slot":`vault-write-review-facts`,children:[(0,Y.jsx)($,{label:`Name`,value:e.name,mono:!0}),e.action===`create`?(0,Y.jsx)($,{label:`Kind`,value:e.kind}):null,(0,Y.jsx)($,{label:`Fingerprint`,value:e.fingerprint,mono:!0}),e.preview==null?null:(0,Y.jsx)($,{label:`Value`,value:e.preview,mono:!0}),e.reason?(0,Y.jsx)($,{label:`Reason`,value:e.reason}):null,e.action===`create`&&e.rotate?(0,Y.jsx)($,{label:`Rotate`,value:e.rotate}):null]})}function $({label:e,value:t,mono:n=!1}){return(0,Y.jsxs)(`div`,{className:`flex items-baseline justify-between gap-3 border-b border-border/50 px-4 py-2 last:border-b-0`,children:[(0,Y.jsx)(`dt`,{className:`shrink-0 text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`min-w-0 truncate font-mono text-[11px]`:`min-w-0 truncate text-[12px]`,children:t})]})}function In({open:e,onOpenChange:t,pending:n=!1,error:r,onSubmit:i}){let[a,c]=(0,K.useState)(`secret`),[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(``),[p,m]=(0,K.useState)(`90d`),[h,g]=(0,K.useState)(``),[_,y]=(0,K.useState)(null),[b,x]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(c(`secret`),u(``),f(``),m(`90d`),g(``),y(null),x(null))},[e]);let S=l.trim().length>0&&h.trim().length>0&&!n,C=async()=>{let e=await bn({action:`create`,name:l.trim(),value:h,sensitive:a===`secret`,kind:a,description:d.trim(),rotate:a===`secret`?p:`never`});if(`error`in e){y(e.error);return}y(null),x(e)};return(0,Y.jsxs)(w,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-create-sheet`,children:[(0,Y.jsxs)(T,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(A,{className:`text-sm`,children:`Add vault contract`}),(0,Y.jsx)(k,{className:`text-[11px]`,children:a===`secret`?`Writes the value and lists the contract here. Promote it to vault.secret in source when a Flow should read it.`:`vault.config — shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(ze,{label:`Kind`,children:[(0,Y.jsx)(H,{active:a===`secret`,onClick:()=>c(`secret`),children:`secret`}),(0,Y.jsx)(H,{active:a===`config`,onClick:()=>c(`config`),children:`config`})]}),(0,Y.jsx)(U,{label:`Name`,children:(0,Y.jsx)(o,{value:l,onChange:e=>u(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g,``)),placeholder:`STRIPE_KEY`,autoComplete:`off`,"aria-label":`Contract name`,flat:!0,className:s(G,`font-mono`)})}),(0,Y.jsx)(U,{label:`Description`,children:(0,Y.jsx)(o,{value:d,onChange:e=>f(e.target.value),placeholder:`Optional title`,autoComplete:`off`,"aria-label":`Description`,flat:!0,className:G})}),a===`secret`?(0,Y.jsxs)(ze,{label:`Rotate`,children:[(0,Y.jsx)(H,{active:p===`90d`,onClick:()=>m(`90d`),children:`90d`}),(0,Y.jsx)(H,{active:p===`never`,onClick:()=>m(`never`),children:`no rotate`})]}):null,(0,Y.jsx)(U,{label:`Value`,children:(0,Y.jsx)(o,{type:`password`,autoComplete:`off`,value:h,onChange:e=>g(e.target.value),placeholder:a===`secret`?`Paste the secret`:`Public value`,"aria-label":`New vault value`,flat:!0,className:G})}),_||r?(0,Y.jsx)(Be,{slot:`vault-create-error`,children:_??r}):null]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:n,children:`Cancel`}),(0,Y.jsx)(W,{variant:`default`,disabled:!S,onClick:()=>{C()},"data-slot":`vault-create-submit`,children:a===`secret`?`Review secret`:`Review config`})]})]}),(0,Y.jsx)(Pn,{review:b,pending:n,onCancel:()=>x(Sn()),onConfirm:()=>{xn(b,e=>{i({name:e.commit.name,value:e.commit.value,kind:e.commit.kind,description:e.commit.description,rotate:e.commit.rotate})})}})]})}var Ln=[{id:`first`,label:`first`,text:`Initial value`},{id:`fix`,label:`fix`,text:`Correct a bad value`},{id:`provider`,label:`provider`,text:`Provider changed it`},{id:`other`,label:`other`,text:``}],Rn=[{id:`scheduled`,label:`scheduled`,text:`Scheduled rotation`},{id:`leak`,label:`leak`,text:`Key compromise`},{id:`provider`,label:`provider`,text:`Provider rotated`},{id:`other`,label:`other`,text:``}];function zn(e){return e===`rotate`?Rn:Ln}function Bn(e){return e===`rotate`?`scheduled`:`first`}function Vn(e,t,n){return t===`other`?n.trim():zn(e).find(e=>e.id===t)?.text??``}function Hn({open:e,onOpenChange:t,mode:n,name:r,sensitive:i=!0,pending:a=!1,error:s,onSubmit:c}){let[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(()=>Bn(n)),[p,m]=(0,K.useState)(``),[h,g]=(0,K.useState)(null),[_,y]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(u(``),f(Bn(n)),m(``),g(null),y(null))},[e,n]);let b=Vn(n,d,p),x=l.trim().length>0&&b.length>=3&&!a,S=zn(n),C=async()=>{let e=await bn({action:n,name:r,value:l,sensitive:i,reason:b,kind:i?`secret`:`config`});if(`error`in e){g(e.error);return}g(null),y(e)};return(0,Y.jsxs)(w,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-write-sheet`,children:[(0,Y.jsxs)(T,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(A,{className:`text-sm`,children:n===`set`?`Set ${r}`:`Rotate ${r}`}),(0,Y.jsx)(k,{className:`text-[11px]`,children:i?`Write-only. The new value is never shown again after submit.`:`This vault.config value is shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(U,{label:`New value`,children:(0,Y.jsx)(o,{type:`password`,autoComplete:`off`,value:l,onChange:e=>u(e.target.value),placeholder:i?`Paste the new secret`:`Paste the new value`,"aria-label":`New vault value`,flat:!0,className:G})}),(0,Y.jsx)(ze,{label:`Reason`,children:S.map(e=>(0,Y.jsx)(H,{active:d===e.id,onClick:()=>f(e.id),children:e.label},e.id))}),d===`other`?(0,Y.jsx)(U,{label:`Other`,children:(0,Y.jsx)(o,{value:p,onChange:e=>m(e.target.value),placeholder:`Why is this change needed?`,"aria-label":`Custom reason`,flat:!0,className:G})}):null,h||s?(0,Y.jsx)(Be,{slot:`vault-write-error`,children:h??s}):null]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:a,children:`Cancel`}),(0,Y.jsx)(W,{variant:n===`rotate`?`destructive`:`default`,disabled:!x,onClick:()=>{C()},"data-slot":`vault-write-submit`,children:n===`set`?`Review set`:`Review rotate`})]})]}),(0,Y.jsx)(Pn,{review:_,pending:a,onCancel:()=>y(Sn()),onConfirm:()=>{xn(_,e=>{c({value:e.commit.value,reason:e.commit.reason??b})})}})]})}function Un(){let e=Ke(),t=ee(),{query:n,selectedName:o,action:c,setQuery:u,setSelectedName:f,setAction:m}=Ie(),h=_e(),_=(0,Y.jsx)(ve,{open:h.open,onToggle:h.toggle,noun:`vault`,controlsId:`vault-list`,dataSlot:`vault-list-toggle`}),[v]=(0,K.useState)(()=>Date.now()),[b,S]=(0,K.useState)(!1),[C,w]=(0,K.useState)(null),[te,T]=(0,K.useState)(null),[E,D]=(0,K.useState)(null),[ne,O]=(0,K.useState)(null),[re,ie]=(0,K.useState)(null),[ae,k]=(0,K.useState)(null),[oe,A]=(0,K.useState)(null),[se,j]=(0,K.useState)(null),M=e.data?.secrets??[],N=e.data?.env??`dev`,P=e.data?.backend??null,ue=(0,K.useMemo)(()=>Je(P),[P]),F=(0,K.useMemo)(()=>dn(M,n,v),[M,n,v]),fe=(0,K.useMemo)(()=>mt(M,v),[M,v]),pe=(0,K.useMemo)(()=>F.flatMap(e=>e.secrets),[F]),L=pe.length,R=pe.find(e=>e.name===o)??pe[0]??null,be=fn({kekVersion:ae??P?.status?.kekVersion??1,remaining:re,rewrapTargetKekVersion:P?.status?.rewrapTargetKekVersion??null});(0,K.useEffect)(()=>{let e=e=>{if(e.key!==`/`||e.metaKey||e.ctrlKey||e.altKey)return;let t=e.target;if(t instanceof HTMLElement){let e=t.tagName;if(e===`INPUT`||e===`TEXTAREA`||t.isContentEditable)return}e.preventDefault(),document.querySelector(`[data-slot='vault-search-input']`)?.focus()};return window.addEventListener(`keydown`,e),()=>window.removeEventListener(`keydown`,e)},[]);let z=async()=>{await t.invalidateQueries({queryKey:Xe})},xe=()=>{let e=ot(M);navigator.clipboard?.writeText(e),w(`Exported fingerprints only (no secret values)`)},Se=Fe({mutationFn:async e=>{if(e.value.trim().length===0)throw Error(`New value is required`);let t=await(e.mode===`set`?l:r)({name:e.name,value:e.value,reason:e.reason});if(t.error)throw Error(d(t.error));return t.data},onSuccess:async()=>{T(null),m(null),await z()},onError:e=>{T(e.message)}}),Ce=Fe({mutationFn:async e=>{if(e.name.trim().length===0)throw Error(`Name is required`);if(e.value.trim().length===0)throw Error(`Value is required`);let t=await le({name:e.name,value:e.value,kind:e.kind,...e.description.length>0?{description:e.description}:{},...e.rotate.length>0?{rotate:e.rotate}:{}});if(t.error)throw Error(d(t.error));return t.data},onSuccess:async e=>{T(null),m(null),e?.name&&f(e.name),await z()},onError:e=>{T(e.message)}}),we=Fe({mutationFn:async e=>{let t=0,n=P?.status?.kekVersion??1;for(;;){let r=await ce(e);if(r.error)throw Error(d(r.error));if(!r.data)throw Error(`Empty rotate-master response`);if(t=r.data.remaining,n=r.data.kekVersion,ie(r.data.remaining),k(r.data.kekVersion),r.data.masterKey&&O(r.data.masterKey),await z(),r.data.remaining===0)break}return{remaining:t,kekVersion:n}},onSuccess:()=>{D(null),m(null)},onError:e=>{D(e.message)}}),B=Fe({mutationFn:async()=>{let e=await g();if(e.error)throw Error(d(e.error));if(!e.data)throw Error(`Empty verify response`);return e.data},onSuccess:e=>{e.ok?(j(null),A(`chain intact`)):(A(null),j(e))}});return(0,Y.jsxs)(`div`,{className:x,"data-slot":`vault-page`,children:[(0,Y.jsxs)(de,{orientation:`horizontal`,className:`min-h-0 flex-1`,children:[(0,Y.jsx)(he,{panelRef:h.panelRef,collapsible:!0,collapsedSize:0,defaultSize:p.start.defaultSize,minSize:p.start.minSize,onResize:h.onResize,className:`min-h-0 overflow-hidden`,children:(0,Y.jsxs)(`div`,{id:`vault-list`,className:`flex h-full min-h-0 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:s(i,`relative z-20 pr-1.5`),children:[(0,Y.jsx)(un,{query:n,secrets:M,onQueryChange:u}),(0,Y.jsx)(I,{label:`Add secret or config`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Add secret or config`,onClick:()=>m(`create`),className:y,children:(0,Y.jsx)(a,{icon:Oe,className:`size-3.5`})})}),C?(0,Y.jsx)(`span`,{className:`sr-only`,role:`status`,children:C}):null,(0,Y.jsx)(I,{label:`Verify the audit hash chain`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Verify chain`,disabled:B.isPending,onClick:()=>B.mutate(),className:y,children:(0,Y.jsx)(a,{icon:ge,className:`size-3.5`})})}),(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Vault security`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Vault security`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsxs)(je,{children:[(0,Y.jsx)(V,{onClick:()=>S(!0),children:`Security`}),(0,Y.jsxs)(V,{onClick:()=>m(`rotate-master`),children:[(0,Y.jsx)(a,{icon:me,"data-icon":`inline-start`}),`Rotate master key`]}),(0,Y.jsxs)(V,{onClick:xe,children:[(0,Y.jsx)(a,{icon:Ee,"data-icon":`inline-start`}),`Export fingerprints`]})]}),(0,Y.jsx)(Me,{}),(0,Y.jsxs)(V,{disabled:B.isPending,onClick:()=>B.mutate(),children:[(0,Y.jsx)(a,{icon:ge,"data-icon":`inline-start`}),`Verify audit chain`]})]})]})]}),(0,Y.jsx)(ln,{card:ue,env:N,summary:fe,query:n,progress:be,verifyNote:oe,onQueryChange:u,onOpenSecurity:()=>S(!0)}),(0,Y.jsx)(Bt,{groups:F,selectedName:R?.name??o,loading:e.isLoading,matchCount:L,totalCount:M.length,now:v,onSelect:f})]})}),h.open?(0,Y.jsx)(ye,{withHandle:!0}):null,(0,Y.jsx)(he,{defaultSize:p.end.defaultSize,minSize:p.end.minSize,className:`min-h-0 overflow-hidden`,children:R?(0,Y.jsx)(Tt,{row:R,env:N,now:v,backend:P,onSet:()=>m(`set`),onRotate:()=>m(`rotate`),onQueryChange:u,leading:_}):(0,Y.jsx)(Nt,{loading:e.isLoading,hasContracts:M.length>0,query:n,onClearQuery:()=>u(``),leading:_})})]}),(0,Y.jsx)(In,{open:c===`create`,onOpenChange:e=>{e||(T(null),m(null))},pending:Ce.isPending,error:c===`create`?te:null,onSubmit:e=>Ce.mutate(e)}),(0,Y.jsx)(Hn,{open:c===`set`||c===`rotate`,onOpenChange:e=>{e||(T(null),m(null))},mode:c===`rotate`?`rotate`:`set`,name:R?.name??``,sensitive:R?.sensitive??!0,pending:Se.isPending,error:te,onSubmit:e=>{R&&Se.mutate({mode:c===`rotate`?`rotate`:`set`,name:R.name,...e})}}),(0,Y.jsx)(mn,{open:c===`rotate-master`,onOpenChange:e=>{e||(D(null),m(null))},pending:we.isPending,error:E,onConfirm:e=>we.mutate(e)}),(0,Y.jsx)(gn,{open:b,onOpenChange:S,card:ue,env:N,progress:be,verifyPending:B.isPending,verifyNote:oe,onVerify:()=>B.mutate(),onRotateMaster:()=>{S(!1),m(`rotate-master`)},onExport:xe}),(0,Y.jsx)(pn,{masterKey:ne,onDismiss:()=>O(null)}),(0,Y.jsx)(vn,{result:se,onClose:()=>j(null)})]})}export{Un as VaultPage};

package/src/console/ui-next/dist/index.html

@@ -37,7 +37,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-yTCY4AcS.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cul17AcV.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Ddte4I-Q.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-yApv7D4e.js">

package/src/docker/docker.test.ts

@@ -830,7 +830,7 @@ describe("deriveInfrastructure", () => {
       images: {
         "store.sql": "postgres:18-alpine",
         "store.kv": "redis:8-alpine",
-        "store.files": "rustfs/rustfs:1.0.0-rc.5",
+        "store.files": "rustfs/rustfs:1.0.0",
         "channel.email": "axllent/mailpit:v1.31.1",
       },
       credentials: {
@@ -875,7 +875,7 @@ describe("deriveInfrastructure", () => {
     const result = deriveInfrastructure({
       images: {
         "channel.email": "axllent/mailpit:v1.31.1",
-        "store.files": "rustfs/rustfs:1.0.0-rc.5",
+        "store.files": "rustfs/rustfs:1.0.0",
       },
       instanceId: id,
       credentials: {
@@ -914,7 +914,7 @@ describe("deriveInfrastructure", () => {
     const rows = resolveStack({
       images: {
         "channel.email": "axllent/mailpit:v1.31.1",
-        "store.files": "rustfs/rustfs:1.0.0-rc.5",
+        "store.files": "rustfs/rustfs:1.0.0",
       },
       instanceId: id,
       credentials: {

package/src/docker/images-config.test.ts

@@ -66,9 +66,9 @@ describe("ImagesConfig nesting — recipe coverage", () => {
       },
       // store.files / store.index
       {
-        images: { store: { files: "rustfs/rustfs:1.0.0-rc.5" } },
+        images: { store: { files: "rustfs/rustfs:1.0.0" } },
         role: "store.files",
-        image: "rustfs/rustfs:1.0.0-rc.5",
+        image: "rustfs/rustfs:1.0.0",
       },
       {
         images: { store: { index: "getmeili/meilisearch:v1.53" } },
@@ -110,7 +110,7 @@ describe("ImagesConfig nesting — compose output parity", () => {
       "store.sql": "postgres:18-alpine",
       pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.57",
       "store.kv": "redis:8-alpine",
-      "store.files": "rustfs/rustfs:1.0.0-rc.5",
+      "store.files": "rustfs/rustfs:1.0.0",
       "store.index": "getmeili/meilisearch:v1.53",
       "channel.email": "axllent/mailpit:v1.31.1",
     };
@@ -119,7 +119,7 @@ describe("ImagesConfig nesting — compose output parity", () => {
       store: {
         sql: "postgres:18-alpine",
         kv: "redis:8-alpine",
-        files: "rustfs/rustfs:1.0.0-rc.5",
+        files: "rustfs/rustfs:1.0.0",
         index: "getmeili/meilisearch:v1.53",
       },
       channel: { email: "axllent/mailpit:v1.31.1" },

package/src/docker/stack-id.test.ts

@@ -164,7 +164,7 @@ describe("deriveInfrastructure instanceId", () => {
     const result = deriveInfrastructure({
       images: {
         "channel.email": "axllent/mailpit:v1.31.1",
-        "store.files": "rustfs/rustfs:1.0.0-rc.5",
+        "store.files": "rustfs/rustfs:1.0.0",
       },
       app: `dev-${id}`,
       instanceId: id,

package/src/elements/store/files-errors.test.ts

@@ -0,0 +1,149 @@
+/**
+ * `fs` / `s3` files errors → Forbidden / ServiceUnavailable.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { isFlowFailure } from "../../kernel/hooks.ts";
+import { createS3FakeClient, s3Driver } from "../../drivers/s3.ts";
+import { fsDriver } from "../../drivers/fs.ts";
+import { memoryDrivers } from "../../drivers/memory.ts";
+import { store } from "./declare.ts";
+import { filesErrorToFailure, isRetryableFilesError } from "./files-errors.ts";
+import { createStoreRuntime, type FilesStoreFxHandle } from "./runtime.ts";
+
+describe("filesErrorToFailure", () => {
+  test("AccessDenied / EACCES → Forbidden without copying message", () => {
+    const denied = filesErrorToFailure(
+      Object.assign(new Error("Access Denied"), { code: "AccessDenied", status: 403 }),
+    );
+    expect(denied?.error.code).toBe("Forbidden");
+    expect(JSON.stringify(denied)).not.toContain("Access Denied");
+
+    expect(
+      filesErrorToFailure(Object.assign(new Error("permission denied"), { code: "EACCES" }))?.error
+        .code,
+    ).toBe("Forbidden");
+    expect(isFlowFailure(denied)).toBe(true);
+  });
+
+  test("Invalid object key → Forbidden without copying the key", () => {
+    const mapped = filesErrorToFailure(new Error("Invalid object key: ../secret"));
+    expect(mapped?.error.code).toBe("Forbidden");
+    expect(mapped?.error.data).toMatchObject({ reason: "invalid_key" });
+    expect(JSON.stringify(mapped)).not.toContain("../secret");
+  });
+
+  test("NoSuchBucket / ENOSPC / connection → ServiceUnavailable", () => {
+    expect(filesErrorToFailure(new Error("The specified bucket does not exist"))?.error.code).toBe(
+      "ServiceUnavailable",
+    );
+    expect(
+      filesErrorToFailure(Object.assign(new Error("No space left on device"), { code: "ENOSPC" }))
+        ?.error.code,
+    ).toBe("ServiceUnavailable");
+    expect(
+      filesErrorToFailure(
+        Object.assign(new Error("connect ECONNREFUSED"), { code: "ECONNREFUSED" }),
+      )?.error.code,
+    ).toBe("ServiceUnavailable");
+    expect(
+      JSON.stringify(filesErrorToFailure(new Error("The specified bucket does not exist"))),
+    ).not.toContain("specified bucket");
+  });
+
+  test("SlowDown / EBUSY left thrown until retryable: unavailable", () => {
+    const slow = Object.assign(new Error("Please reduce your request rate"), { code: "SlowDown" });
+    expect(isRetryableFilesError(slow)).toBe(true);
+    expect(filesErrorToFailure(slow, { retryable: "leave" })).toBeUndefined();
+    expect(filesErrorToFailure(slow, { retryable: "unavailable" })?.error.code).toBe(
+      "ServiceUnavailable",
+    );
+    expect(
+      filesErrorToFailure(Object.assign(new Error("resource busy"), { code: "EBUSY" }), {
+        retryable: "leave",
+      }),
+    ).toBeUndefined();
+  });
+
+  test("NoSuchKey and generic throws stay unmapped", () => {
+    expect(
+      filesErrorToFailure(
+        Object.assign(new Error("The specified key does not exist"), { code: "NoSuchKey" }),
+      ),
+    ).toBeUndefined();
+    expect(filesErrorToFailure(new Error("boom"))).toBeUndefined();
+  });
+
+  test("walks .cause and S3 XML Code", () => {
+    const wrapped = {
+      message: "put failed",
+      cause: new Error("<?xml><Error><Code>AccessDenied</Code></Error>"),
+    };
+    expect(filesErrorToFailure(wrapped)?.error.code).toBe("Forbidden");
+    expect(JSON.stringify(filesErrorToFailure(wrapped))).not.toContain("put failed");
+  });
+});
+
+describe("openFiles maps S3 throws", () => {
+  test("AccessDenied on put becomes Forbidden", async () => {
+    const fake = createS3FakeClient();
+    const inner = fake.file.bind(fake);
+    fake.file = (key: string) => {
+      const file = inner(key);
+      return {
+        ...file,
+        write: async () => {
+          throw Object.assign(new Error("Access Denied"), { code: "AccessDenied", status: 403 });
+        },
+      };
+    };
+    const uploads = store.files("uploads");
+    const runtime = createStoreRuntime({
+      drivers: {
+        files: s3Driver,
+        kv: memoryDrivers.kv,
+        index: memoryDrivers.index,
+      },
+      files: { uploads: { client: fake } },
+    });
+    runtime.register(uploads);
+    const handle = (await runtime.open(uploads, { effects: {} })) as FilesStoreFxHandle;
+    try {
+      await handle.put("a.bin", new Uint8Array([1]));
+      throw new Error("expected mapped failure");
+    } catch (err) {
+      expect(isFlowFailure(err)).toBe(true);
+      expect((err as { error: { code: string } }).error.code).toBe("Forbidden");
+      expect(JSON.stringify(err)).not.toContain("Access Denied");
+    }
+    await runtime.close();
+  });
+
+  test("fs path-escape key becomes Forbidden", async () => {
+    const uploads = store.files("escapes");
+    const runtime = createStoreRuntime({
+      drivers: {
+        files: fsDriver,
+        kv: memoryDrivers.kv,
+        index: memoryDrivers.index,
+      },
+      files: { escapes: { root: `${process.env.TMPDIR ?? "/tmp"}/oke-files-escape` } },
+    });
+    runtime.register(uploads);
+    const handle = (await runtime.open(uploads, { effects: {} })) as FilesStoreFxHandle;
+    try {
+      await handle.put("../secret", "x");
+      throw new Error("expected mapped failure");
+    } catch (err) {
+      expect(isFlowFailure(err)).toBe(true);
+      expect((err as { error: { code: string; data?: { reason?: string } } }).error.code).toBe(
+        "Forbidden",
+      );
+      expect((err as { error: { data?: { reason?: string } } }).error.data?.reason).toBe(
+        "invalid_key",
+      );
+      expect(JSON.stringify(err)).not.toContain("../secret");
+    }
+    await runtime.close();
+  });
+});

package/src/elements/store/files-errors.ts

@@ -0,0 +1,189 @@
+/**
+ * Map `fs` / `s3` files-driver errors to typed {@link FlowFailure} values.
+ *
+ * Lives on the store path — not the kernel edge graph. Availability and
+ * throttle replies become `ServiceUnavailable`; access / path-escape become
+ * `Forbidden`. Missing `get` (`null`) is not auto-`NotFound`.
+ */
+
+import { fail } from "../../kernel/fail-helpers.ts";
+import type { FlowFailure } from "../../kernel/errors.ts";
+import type { BuiltinErrorMap } from "../../kernel/builtin-errors.ts";
+
+/** How to treat SlowDown / EBUSY / AWS `InternalError`. */
+export type FilesRetryableMode = "leave" | "unavailable";
+
+/** Options for {@link filesErrorToFailure}. */
+export interface FilesErrorToFailureOptions {
+  /**
+   * `leave` — return `undefined` so {@link flow.retry} can rethrow.
+   * `unavailable` — map to `ServiceUnavailable` after retries exhaust.
+   */
+  readonly retryable?: FilesRetryableMode;
+}
+
+type FilesFailure = FlowFailure<
+  BuiltinErrorMap["Forbidden"] | BuiltinErrorMap["ServiceUnavailable"]
+>;
+
+type FilesErrShape = {
+  readonly name?: unknown;
+  readonly code?: unknown;
+  readonly errno?: unknown;
+  readonly status?: unknown;
+  readonly statusCode?: unknown;
+  readonly message?: unknown;
+  readonly cause?: unknown;
+};
+
+const RETRY_TOKEN = new Set([
+  "SLOWDOWN",
+  "REQUESTTIMEOUT",
+  "INTERNALERROR",
+  "REDUCEYOURREQUESTRATE",
+  "PRIORREQUESTNOTCOMPLETE",
+  "OPERATIONABORTED",
+  "EBUSY",
+  "EAGAIN",
+  "EWOULDBLOCK",
+  "EIO",
+]);
+const UNAVAILABLE_TOKEN = new Set([
+  "NOSUCHBUCKET",
+  "SERVICEUNAVAILABLE",
+  "ENOSPC",
+  "EDQUOT",
+  "EMFILE",
+  "ENFILE",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENOTFOUND",
+  "EPIPE",
+  "ENETUNREACH",
+  "EAI_AGAIN",
+  "ECONNABORTED",
+]);
+const FORBIDDEN_TOKEN = new Set([
+  "ACCESSDENIED",
+  "ACCESSFORBIDDEN",
+  "ALLACCESSDISABLED",
+  "INVALIDACCESSKEYID",
+  "SIGNATUREDOESNOTMATCH",
+  "INVALIDSECURITY",
+  "EXPIREDTOKEN",
+  "TOKENREFRESHREQUIRED",
+  "ACCOUNTPROBLEM",
+  "EACCES",
+  "EPERM",
+  "EROFS",
+]);
+
+/**
+ * True when `err` is a throttle / busy files failure.
+ *
+ * Left thrown during retries; mapped to `ServiceUnavailable` after exhaust.
+ *
+ * @param err - Caught driver error
+ */
+export function isRetryableFilesError(err: unknown): boolean {
+  return walk(err, (node) => retrySignal(node));
+}
+
+/**
+ * Map an `fs` / `s3` driver throw to `Forbidden` or `ServiceUnavailable`,
+ * or `undefined` when it is not a known files failure.
+ *
+ * @param err - Caught value from `fx.store` files ops
+ * @param options - Retryable handling
+ */
+export function filesErrorToFailure(
+  err: unknown,
+  options: FilesErrorToFailureOptions = {},
+): FilesFailure | undefined {
+  const retryable = options.retryable ?? "leave";
+  let current: unknown = err;
+  for (let i = 0; i < 4; i++) {
+    if (!current || typeof current !== "object") break;
+    if (isInvalidObjectKey(current)) return fail.forbidden({ reason: "invalid_key" });
+    if (retrySignal(current)) {
+      if (retryable === "leave") return undefined;
+      return fail.serviceUnavailable();
+    }
+    if (isForbidden(current)) return fail.forbidden();
+    if (isUnavailable(current)) return fail.serviceUnavailable();
+    current = causeOf(current);
+  }
+  return undefined;
+}
+
+function retrySignal(err: unknown): boolean {
+  if (RETRY_TOKEN.has(filesToken(err))) return true;
+  return httpStatus(err) === 429;
+}
+
+function isForbidden(err: unknown): boolean {
+  if (FORBIDDEN_TOKEN.has(filesToken(err))) return true;
+  if (httpStatus(err) === 403) return true;
+  const message = errMessage(err);
+  return /access denied|not authorized to perform/i.test(message);
+}
+
+function isUnavailable(err: unknown): boolean {
+  const token = filesToken(err);
+  if (UNAVAILABLE_TOKEN.has(token)) return true;
+  const status = httpStatus(err);
+  if (status === 502 || status === 503 || status === 504) return true;
+  const message = errMessage(err);
+  if (/specified bucket does not exist|NoSuchBucket/i.test(message)) return true;
+  if (/connection (closed|refused|reset|timed out)/i.test(message)) return true;
+  if (/socket hang up|connect econn|read econn/i.test(message)) return true;
+  if (/ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOSPC|EMFILE/i.test(message)) return true;
+  return false;
+}
+
+function isInvalidObjectKey(err: unknown): boolean {
+  return /^Invalid object key:/i.test(errMessage(err));
+}
+
+function filesToken(err: unknown): string {
+  if (!err || typeof err !== "object") return "";
+  const e = err as FilesErrShape;
+  if (typeof e.code === "string" && e.code.length > 0) {
+    return e.code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+  }
+  const xml = /<Code>([A-Za-z][A-Za-z0-9]+)<\/Code>/i.exec(errMessage(err));
+  if (xml?.[1]) return xml[1].toUpperCase();
+  const message = errMessage(err).trim();
+  const first = /^([A-Za-z][A-Za-z0-9_]+)/.exec(message)?.[1];
+  return first ? first.toUpperCase().replace(/[^A-Z0-9]/g, "") : "";
+}
+
+function httpStatus(err: unknown): number | undefined {
+  if (!err || typeof err !== "object") return undefined;
+  const e = err as FilesErrShape;
+  if (typeof e.status === "number") return e.status;
+  if (typeof e.statusCode === "number") return e.statusCode;
+  return undefined;
+}
+
+function errMessage(err: unknown): string {
+  if (!err || typeof err !== "object") return "";
+  const message = (err as FilesErrShape).message;
+  return typeof message === "string" ? message : "";
+}
+
+function causeOf(err: unknown): unknown {
+  if (!err || typeof err !== "object") return undefined;
+  return (err as FilesErrShape).cause;
+}
+
+function walk(err: unknown, pred: (node: unknown) => boolean): boolean {
+  let current: unknown = err;
+  for (let i = 0; i < 4; i++) {
+    if (pred(current)) return true;
+    current = causeOf(current);
+    if (current === undefined) break;
+  }
+  return false;
+}