okengine 0.21.0 → 0.21.1

package/src/console/ui-next/dist/assets/{vault-page-BwZ9YjTW.js → vault-page-CBYl0LW_.js}

@@ -1,2 +1,2 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{r as t}from"./react-dom-Ddte4I-Q.js";import{A as n}from"./xyflow-yApv7D4e.js";import{Ci as r,Cr as i,Dr as a,E as o,Er as s,Or as c,Ti as l,Tr as u,Vr as d,_ as f,_r as p,ar as m,b as h,bi as g,br as _,c as v,cr as y,d as b,dr as x,er as S,h as C,ha as ee,i as w,ir as te,l as T,lr as E,mr as D,nr as ne,o as O,p as re,pr as ie,rr as ae,s as k,tr as oe,u as A,ur as se,vr as j,wi as ce,wr as M,x as N,xi as le,xr as P,y as ue,yr as F}from"./shortcut-keys-3ILd8oGn.js";import{a as de,b as fe,c as pe,h as me,i as he,m as ge,n as _e,o as ve,r as ye,s as I,t as L,v as R,x as be}from"./element-icons-BI8cJgdh.js";import{a as z,i as xe,n as Se,o as Ce,r as we,s as B,t as Te}from"./collapsible-DC2xNaAb.js";import{t as Ee}from"./FileExportIcon-Ck-5od4R.js";import{t as De}from"./MoreHorizontalCircle01Icon-gMNGsE37.js";import{t as Oe}from"./PlusSignIcon-CwG3nxfu.js";import{t as ke}from"./UnavailableIcon-D9cvHVPr.js";import{a as V,d as Ae,i as je,l as Me,r as Ne,t as Pe}from"./dropdown-menu-4h2LOVXM.js";import{bt as Fe,lt as Ie,yt as Le}from"./index-Cul17AcV.js";import{t as Re}from"./explorer-empty-CJs5A-wm.js";import{a as H,c as U,l as W,n as G,o as ze,s as Be,t as Ve}from"./detail-header-DVWNjWjg.js";import{n as He,t as Ue}from"./copy-inline-button-CAYD18cr.js";import{a as We,i as Ge,n as Ke,o as qe,r as Je,s as Ye,t as Xe}from"./use-vault-list-CT4-gajj.js";var Ze=[[`path`,{d:`M16 21C15.7668 18.0685 13.3422 15.7477 10.3085 15.5521L9.49999 15.5C9.21121 15.5076 8.94209 15.5178 8.68816 15.5298C5.68124 15.6723 3.23089 18.0974 3 21`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`0`}],[`path`,{d:`M12.75 9.75C12.75 11.5449 11.2949 13 9.5 13C7.70508 13 6.25 11.5449 6.25 9.75C6.25 7.95507 7.70508 6.5 9.5 6.5C11.2949 6.5 12.75 7.95507 12.75 9.75Z`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`1`}],[`path`,{d:`M21 17.501C20.7709 14.6314 18.4541 12.2748 15.5 11.9961`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`2`}],[`path`,{d:`M15.9877 9C16.8965 8.42434 17.5001 7.40788 17.5001 6.25C17.5001 4.45507 16.0496 3 14.2602 3C13.3811 3 12.5838 3.35121 12.0001 3.92139`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`3`}]],K=e(t(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:qe(n),command:tt(t),hint:Ge(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=n(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:me,"process.env":z,".env.local":R,"dev-fallback":ke},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:o,onQueryChange:s,leading:c}){let l=Qe(e.blastRadius),u=pt(e,n),d=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=u.unset,v=u.overdue&&q(e.rotate)&&!l.warn&&!u.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(Ve,{dataSlot:`vault-detail-header`,leading:c,icon:(0,Y.jsx)(a,{icon:L.vault.icon,className:`size-4`}),wellStyle:{color:J},title:d,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:We(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Ue,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(I,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(I,{label:l.warn?l.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:l.warn,onClick:o,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:u.unset,blastWarn:l.warn,blastSummary:l.summary,blastDetail:l.detail,overdue:u.overdue,onSet:i,onRotate:o}),(0,Y.jsxs)(`div`,{className:j,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?Ye(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:s?()=>s(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:s?()=>s(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:s&&e.readers[0]?()=>s(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:l.detail??(e.blastRadius.longestOutstandingMs==null?l.summary:$e(e.blastRadius.longestOutstandingMs)),warn:l.warn,onClick:s?()=>s(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:s?()=>s(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:s?e=>s(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(je,{children:t.slice(0,4).map(e=>(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Me,{}),(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:r,blastSummary:i,blastDetail:a,overdue:o,onSet:c,onRotate:l}){return r?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:s(j,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[i,a?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,a]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(Le,{to:`/overview`,search:{run:e},className:s(D,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(N,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):o&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:s(j,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:s(M,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:r=!1,won:i=!1,onClick:a}){let o=s(_,P,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:s(`font-mono tabular-nums text-foreground`,r&&`text-amber-800 dark:text-amber-400`,i&&bt),children:t})]});return a?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:a,className:o,children:c}):(0,Y.jsx)(`span`,{title:n,className:o,children:c})}function kt({steps:e,selected:t,fill:n,backend:r,onSelect:i}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,c)=>{let l=e.source===t.source,u=wt(e,c,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":l,onClick:()=>i(e.source),className:s(D,l&&`bg-muted/70 text-foreground`,o>=0&&c>o&&!l&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:s(ie,l&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(`relative z-10 size-2 shrink-0 rounded-full border`,u===`won`&&`border-emerald-500 bg-emerald-500`,u===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,u===`missed`&&`border-muted-foreground/50 bg-transparent`,u===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:yt[e.source],className:s(E,u===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:s(`min-w-0 flex-1 truncate font-mono`,u===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:We(r)}):null]}),(0,Y.jsx)(`span`,{className:s(`shrink-0 text-[10px]`,u===`won`?bt:`text-muted-foreground`),children:u})]}),l?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Ue,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:D,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Ue,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:s(D,`group/reader`),children:[(0,Y.jsx)(a,{icon:L.flow.icon,className:s(E,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:s(S,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(Le,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(Le,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:L.vault.icon,config:z},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:B,unset:ke,overdue:be,shared:Ze,dormant:ke,healthy:L.vault.icon,config:z},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:n=!1,matchCount:r,totalCount:i,now:o,onSelect:c}){let[l,d]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&d(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[n&&e.length===0?(0,Y.jsx)(`p`,{className:se,children:`Loading…`}):null,!n&&e.length===0?(0,Y.jsxs)(`p`,{className:se,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let n=l[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:oe,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Te,{open:n,onOpenChange:t=>d(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(we,{nativeButton:!1,className:ne,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(a,{icon:Ce,className:s(te,!n&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:Ft[e.kind],className:s(E,u(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(ae,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:m,children:e.secrets.length})]})}),(0,Y.jsx)(Se,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:o,onSelect:c},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:r===i?`${i} contracts`:`${r} of ${i} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:r}){let i=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,c=o!==i,l=pt(e,n),d=l.primary!==`healthy`&&l.primary!==`config`,f=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,p=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${i}, ${o}, ${f}, ${gt(l.primary)}`,onClick:()=>r(e.name),className:s(D,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(ie,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(I,{label:_t(l.primary,e.rotate),children:(0,Y.jsx)(a,{icon:Rt[l.primary],className:s(E,`mt-0.5`,u(Lt[l.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:i}),d?(0,Y.jsx)(Ht,{posture:l}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[c?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,c?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:f}),p.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:s(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{r as t}from"./react-dom-Ddte4I-Q.js";import{A as n}from"./xyflow-yApv7D4e.js";import{Ci as r,Cr as i,Dr as a,E as o,Er as s,Or as c,Ti as l,Tr as u,Vr as d,_ as f,_r as p,ar as m,b as h,bi as g,br as _,c as v,cr as y,d as b,dr as x,er as S,h as C,ha as ee,i as w,ir as te,l as T,lr as E,mr as D,nr as ne,o as O,p as re,pr as ie,rr as ae,s as k,tr as oe,u as A,ur as se,vr as j,wi as ce,wr as M,x as N,xi as le,xr as P,y as ue,yr as F}from"./shortcut-keys-3ILd8oGn.js";import{a as de,b as fe,c as pe,h as me,i as he,m as ge,n as _e,o as ve,r as ye,s as I,t as L,v as R,x as be}from"./element-icons-BI8cJgdh.js";import{a as z,i as xe,n as Se,o as Ce,r as we,s as B,t as Te}from"./collapsible-DN7l6zmC.js";import{t as Ee}from"./FileExportIcon-Ck-5od4R.js";import{t as De}from"./MoreHorizontalCircle01Icon-gMNGsE37.js";import{t as Oe}from"./PlusSignIcon-CwG3nxfu.js";import{t as ke}from"./UnavailableIcon-D9cvHVPr.js";import{a as V,d as Ae,i as je,l as Me,r as Ne,t as Pe}from"./dropdown-menu-4h2LOVXM.js";import{bt as Fe,lt as Ie,yt as Le}from"./index-BKpaes3n.js";import{t as Re}from"./explorer-empty-CJs5A-wm.js";import{a as H,c as U,l as W,n as G,o as ze,s as Be,t as Ve}from"./detail-header-DVWNjWjg.js";import{n as He,t as Ue}from"./copy-inline-button-CAYD18cr.js";import{a as We,i as Ge,n as Ke,o as qe,r as Je,s as Ye,t as Xe}from"./use-vault-list-CT4-gajj.js";var Ze=[[`path`,{d:`M16 21C15.7668 18.0685 13.3422 15.7477 10.3085 15.5521L9.49999 15.5C9.21121 15.5076 8.94209 15.5178 8.68816 15.5298C5.68124 15.6723 3.23089 18.0974 3 21`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`0`}],[`path`,{d:`M12.75 9.75C12.75 11.5449 11.2949 13 9.5 13C7.70508 13 6.25 11.5449 6.25 9.75C6.25 7.95507 7.70508 6.5 9.5 6.5C11.2949 6.5 12.75 7.95507 12.75 9.75Z`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`1`}],[`path`,{d:`M21 17.501C20.7709 14.6314 18.4541 12.2748 15.5 11.9961`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`2`}],[`path`,{d:`M15.9877 9C16.8965 8.42434 17.5001 7.40788 17.5001 6.25C17.5001 4.45507 16.0496 3 14.2602 3C13.3811 3 12.5838 3.35121 12.0001 3.92139`,stroke:`currentColor`,strokeLinecap:`round`,strokeLinejoin:`round`,strokeWidth:`1.5`,key:`3`}]],K=e(t(),1);function Qe(e){if(e.count===0)return{summary:`No in-flight durable runs hold this secret`,detail:null,warn:!1};let t=e.longestOutstandingMs==null?null:$e(e.longestOutstandingMs);return{summary:`${e.count} in-flight durable run(s) will wake holding a new key`,detail:t?`Longest outstanding wake in ${t}`:e.longestWakeAt==null?null:`Longest wake at ${new Date(e.longestWakeAt).toISOString()}`,warn:!0}}function $e(e){if(e<1e3)return`${e}ms`;let t=Math.floor(e/1e3);if(t<60)return`${t}s`;let n=Math.floor(t/60);if(n<60)return`${n}m`;let r=Math.floor(n/60);return r<48?`${r}h`:`${Math.floor(r/24)}d`}function et(e){return`await fx.vault.get(${e})`}function tt(e){return`oke vault set ${e}`}function nt(e){return`oke vault rotate ${e}`}function rt(e){return`${e}=`}function it(e,t,n){switch(e){case`process.env`:return{source:e,label:`env`,command:`export ${t}=`,hint:`Process environment for this Console process`};case`.env.local`:return{source:e,label:`local`,command:rt(t),hint:`Write to .env.local (gitignored)`};case`driver`:return{source:e,label:qe(n),command:tt(t),hint:Ge(n)};case`dev-fallback`:return{source:e,label:`fallback`,command:`dev: "…"`,hint:`Local-only option on the contract — never used in prod`}}}function at(e){return{name:e.name,kind:e.kind,sensitive:e.sensitive,description:e.description??null,rotate:e.rotate??null,fingerprints:{...e.fingerprints},fingerprint:e.fingerprint,cleartext:e.sensitive?null:e.cleartext,winner:e.winner,resolution:e.resolution.map(e=>({...e})),readers:[...e.readers],blastRadius:{count:e.blastRadius.count,longestWakeAt:e.blastRadius.longestWakeAt,longestOutstandingMs:e.blastRadius.longestOutstandingMs,runIds:[...e.blastRadius.runIds]},lastReadAt:e.lastReadAt,sharedFingerprintEnvs:[...e.sharedFingerprintEnvs]}}function ot(e){return JSON.stringify(e.map(e=>at(e)),null,2)}var st=[{id:`blast`,label:`Blast`,token:`blast`,tone:`danger`},{id:`unset`,label:`Unset`,token:`unset`,tone:`warn`},{id:`overdue`,label:`Overdue`,token:`overdue`,tone:`warn`},{id:`shared`,label:`Shared`,token:`shared`,tone:`warn`},{id:`dormant`,label:`Dormant`,token:`dormant`,tone:`neutral`}],ct=[`blast`,`unset`,`overdue`,`shared`,`dormant`];function lt(e){if(!e)return 0;let t=/^(\d+)(ms|s|m|h|d)$/.exec(e.trim());if(!t)return 0;let n=Number(t[1]);switch(t[2]){case`ms`:return n;case`s`:return n*1e3;case`m`:return n*6e4;case`h`:return n*36e5;case`d`:return n*864e5;default:return 0}}var ut=new Set([`never`,`none`,`off`]);function q(e){return lt(e)>0}function dt(e){if(q(e))return e.trim();let t=e?.trim().toLowerCase()??``;return t.length===0||ut.has(t)?`no rotate`:e.trim()}function ft(e){return e.sensitive?e.fingerprint!=null&&e.fingerprint.length>0:e.cleartext!=null&&e.cleartext.length>0}function pt(e,t){let n=ft(e),r=!n,i=e.blastRadius.count>0,a=e.sharedFingerprintEnvs.length>0,o=e.lastReadAt==null,s=e.kind===`secret`&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=7776e6),c=lt(e.rotate),l=e.kind===`secret`&&n&&c>0&&(o||e.lastReadAt!=null&&t-e.lastReadAt>=c),u=[];return i&&u.push(`blast`),r&&u.push(`unset`),l&&u.push(`overdue`),a&&u.push(`shared`),s&&u.push(`dormant`),{unset:r,set:n,blast:i,shared:a,dormant:s,overdue:l,unread:o,healthy:n&&!i&&!a&&!s&&!l,risks:u,primary:e.kind===`config`&&!r&&!i&&!a?`config`:ct.find(e=>u.includes(e))??`healthy`}}function mt(e,t){let n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0;for(let u of e){u.kind===`secret`?n+=1:r+=1;let e=pt(u,t);e.unset&&(i+=1),e.blast&&(a+=1),e.shared&&(o+=1),e.dormant&&(s+=1),e.overdue&&(c+=1),e.healthy&&(l+=1)}return{total:e.length,secrets:n,config:r,unset:i,blast:a,shared:o,dormant:s,overdue:c,healthy:l}}function ht(e,t){let n=Math.max(0,t-e);if(n<6e4)return`just now`;if(n<36e5)return`${Math.floor(n/6e4)}m ago`;if(n<864e5)return`${Math.floor(n/36e5)}h ago`;let r=Math.floor(n/864e5);return r<14?`${r}d ago`:r<60?`${Math.floor(r/7)}w ago`:`${Math.floor(r/30)}mo ago`}function gt(e){switch(e){case`blast`:return`blast`;case`unset`:return`unset`;case`overdue`:return`overdue`;case`shared`:return`shared`;case`dormant`:return`dormant`;case`config`:return`config`;case`healthy`:return`set`}}function _t(e,t){switch(e){case`blast`:return`In-flight durable runs hold this secret`;case`unset`:return`No value in this environment`;case`overdue`:return t?`Last read older than rotate ${t} — never-read counts`:`Last read older than the rotate hint — never-read counts`;case`shared`:return`Fingerprint matches another environment`;case`dormant`:return`Unread for 90 days, or never`;case`config`:return`vault.config — shown in the clear`;case`healthy`:return`Set, no blast, no shared, not dormant`}}var J=`#94A3B8`,Y=n(),vt={driver:`driver`,"process.env":`env`,".env.local":`local`,"dev-fallback":`fallback`},yt={driver:me,"process.env":z,".env.local":R,"dev-fallback":ke},bt=`text-emerald-700 dark:text-emerald-400`,xt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function St(e){let t=e.resolution.length>0?e.resolution:xt.map(t=>({source:t,present:!1,won:e.winner===t})),n=new Map(t.map(e=>[e.source,e]));return xt.map(t=>n.get(t)??{source:t,present:!1,won:e.winner===t})}function Ct(e){return e.find(e=>e.won)?.source??e.find(e=>!e.present)?.source??e[0].source}function wt(e,t,n){return e.won?`won`:n>=0&&t>n?e.present?`shadowed`:`skipped`:e.present?`shadowed`:`missed`}function Tt({row:e,env:t,now:n,backend:r=null,onSet:i,onRotate:o,onQueryChange:s,leading:c}){let l=Qe(e.blastRadius),u=pt(e,n),d=e.description??e.name,f=jt(e,t),p=St(e),m=p.find(e=>e.won)??null,[h,g]=(0,K.useState)(()=>Ct(p)),_=u.unset,v=u.overdue&&q(e.rotate)&&!l.warn&&!u.unset;(0,K.useEffect)(()=>{g(Ct(St(e)))},[e.name]);let y=p.find(e=>e.source===h)??p[0],b=it(y.source,e.name,r);return(0,Y.jsxs)(`div`,{className:`flex h-full min-h-0 flex-col overflow-y-auto`,"data-slot":`vault-detail`,"aria-label":`Vault detail`,"aria-live":`polite`,children:[(0,Y.jsx)(Ve,{dataSlot:`vault-detail-header`,leading:c,icon:(0,Y.jsx)(a,{icon:L.vault.icon,className:`size-4`}),wellStyle:{color:J},title:d,badge:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`font-mono text-[10px] font-medium tracking-[0.08em] text-muted-foreground uppercase`,children:e.kind}),e.kind===`secret`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:dt(e.rotate)}):null,e.origin===`console`?(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:`console`}):null,(0,Y.jsx)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:We(r)})]}),subtitle:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[11px] leading-none text-foreground/80`,children:e.name}),(0,Y.jsx)(Ue,{value:e.name,label:`Copy ${e.name}`})]}),actions:(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(Et,{row:e}),_?null:(0,Y.jsx)(I,{label:e.kind===`config`?`Updates this vault.config value. Console shows it in the clear.`:`Write-only. The new value is never shown again.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`sm`,className:`h-full rounded-none`,onClick:i,children:`Set`})}),_||v?null:(0,Y.jsx)(I,{label:l.warn?l.summary:`Re-encrypt with a new value. Review the fingerprint before it writes.`,className:`flex self-stretch`,children:(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,className:`h-full rounded-none`,disabled:l.warn,onClick:o,children:`Rotate`})})]})}),(0,Y.jsx)(Dt,{row:e,env:t,postureUnset:u.unset,blastWarn:l.warn,blastSummary:l.summary,blastDetail:l.detail,overdue:u.overdue,onSet:i,onRotate:o}),(0,Y.jsxs)(`div`,{className:j,"data-slot":`vault-briefing`,role:`group`,"aria-label":`Posture`,children:[(0,Y.jsx)(X,{label:`from`,value:e.winner?vt[e.winner]:`none`,hint:m?e.winner===`driver`?Ye(r):`First layer that had a value`:`No layer provided a value`,warn:!e.winner,won:!!e.winner,onClick:s?()=>s(e.winner?`from:${e.winner}`:`is:unset`):void 0}),(0,Y.jsx)(X,{label:`read`,value:e.lastReadAt==null?`never`:ht(e.lastReadAt,n),hint:e.lastReadAt==null?`Possible dead secret`:new Date(e.lastReadAt).toISOString(),warn:e.lastReadAt==null&&e.kind===`secret`,onClick:s?()=>s(`is:dormant`):void 0}),(0,Y.jsx)(X,{label:`readers`,value:String(e.readers.length),hint:e.readers.length===0?`No Flow declares a read`:e.readers.join(`, `),onClick:s&&e.readers[0]?()=>s(`reader:${e.readers[0]}`):void 0}),(0,Y.jsx)(X,{label:`blast`,value:e.blastRadius.count===0?`clear`:`${e.blastRadius.count} run${e.blastRadius.count===1?``:`s`}`,hint:l.detail??(e.blastRadius.longestOutstandingMs==null?l.summary:$e(e.blastRadius.longestOutstandingMs)),warn:l.warn,onClick:s?()=>s(`is:blast`):void 0}),e.sharedFingerprintEnvs.length>0?(0,Y.jsx)(X,{label:`shared`,value:e.sharedFingerprintEnvs.join(`, `),hint:`Same fingerprint in another environment`,warn:!0,onClick:s?()=>s(`is:shared`):void 0}):null]}),(0,Y.jsx)(kt,{steps:p,selected:y,fill:b,backend:r,onSelect:g}),(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Fingerprints by environment`,children:[(0,Y.jsx)(Ot,{title:e.sensitive?`Fingerprints`:`Value`,meta:e.sensitive?`${f.length} env`:t}),e.sensitive?(0,Y.jsx)(At,{slots:f,env:t}):(0,Y.jsx)(`p`,{className:`px-2 py-1.5 font-mono text-[12px]`,role:`status`,children:e.cleartext??`unset`})]}),(0,Y.jsx)(Mt,{readers:e.readers,name:e.name,onFilterReader:s?e=>s(`reader:${e}`):void 0})]})}function Et({row:e}){let t=[{id:`fx`,label:`Flow read`,value:et(e.name)},{id:`set`,label:`oke vault set`,value:tt(e.name)},{id:`rotate`,label:`oke vault rotate`,value:nt(e.name)},{id:`env`,label:`.env assignment`,value:rt(e.name)},{id:`json`,label:`Export fingerprints`,value:JSON.stringify(at(e),null,2)}];return(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Copy snippets (no secret values)`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Copy`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsx)(je,{children:t.slice(0,4).map(e=>(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(e.value)},children:e.label},e.id))}),(0,Y.jsx)(Me,{}),(0,Y.jsx)(V,{onClick:()=>{navigator.clipboard?.writeText(t[4].value)},children:`Export fingerprints`})]})]})}function Dt({row:e,env:t,postureUnset:n,blastWarn:r,blastSummary:i,blastDetail:a,overdue:o,onSet:c,onRotate:l}){return r?(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-destructive/25 bg-destructive/5`,"aria-label":`Rotation blast radius`,role:`alert`,children:[(0,Y.jsx)(`div`,{className:s(j,`border-b-0`),children:(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-destructive`,children:[i,a?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` · `,a]}):null]})}),e.blastRadius.runIds.length>0?(0,Y.jsx)(`ul`,{children:e.blastRadius.runIds.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsx)(Le,{to:`/overview`,search:{run:e},className:s(D,`text-destructive`),children:(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono text-[11px]`,children:e})})},e))}):null]}):n?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Unset contract`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`No value in `,t,e.readers[0]?(0,Y.jsxs)(`span`,{className:`text-muted-foreground`,children:[` `,`· `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e.readers[0]}),` will fail boot`]}):(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · boot gap until a layer provides one`})]}),(0,Y.jsx)(N,{type:`button`,size:`sm`,onClick:c,className:`h-full shrink-0 rounded-none`,children:`Set`})]}):o&&q(e.rotate)?(0,Y.jsxs)(`section`,{className:s(j,`border-amber-500/25 bg-amber-500/5`),"aria-label":`Rotation overdue`,role:`status`,children:[(0,Y.jsxs)(`p`,{className:`flex min-w-0 flex-1 items-center px-2 text-[12px] text-amber-900 dark:text-amber-300`,children:[`Past rotate `,e.rotate,(0,Y.jsx)(`span`,{className:`text-muted-foreground`,children:` · blast is clear`})]}),(0,Y.jsx)(N,{type:`button`,variant:`destructive`,size:`sm`,onClick:l,className:`h-full shrink-0 rounded-none`,children:`Rotate`})]}):null}function Ot({title:e,meta:t,children:n}){return(0,Y.jsxs)(`header`,{className:s(j,`items-center gap-2 px-2`),children:[(0,Y.jsx)(`h3`,{className:s(M,`shrink-0 leading-none`),children:e}),n,t?(0,Y.jsx)(`span`,{className:`ml-auto shrink-0 font-mono text-[10px] leading-none tabular-nums text-muted-foreground`,children:t}):null]})}function X({label:e,value:t,hint:n,warn:r=!1,won:i=!1,onClick:a}){let o=s(_,P,`gap-1.5`),c=(0,Y.jsxs)(Y.Fragment,{children:[(0,Y.jsx)(`span`,{className:`tracking-[0.08em] uppercase`,children:e}),(0,Y.jsx)(`span`,{className:s(`font-mono tabular-nums text-foreground`,r&&`text-amber-800 dark:text-amber-400`,i&&bt),children:t})]});return a?(0,Y.jsx)(`button`,{type:`button`,title:n,onClick:a,className:o,children:c}):(0,Y.jsx)(`span`,{title:n,className:o,children:c})}function kt({steps:e,selected:t,fill:n,backend:r,onSelect:i}){let o=e.findIndex(e=>e.won);return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Resolution chain`,children:[(0,Y.jsx)(Ot,{title:`Resolution`,meta:`first hit wins`}),(0,Y.jsxs)(`ol`,{className:`relative`,"data-slot":`vault-lock-path`,children:[(0,Y.jsx)(`span`,{className:`pointer-events-none absolute top-3 bottom-3 left-[15px] w-px bg-border/60`,"aria-hidden":!0}),e.map((e,c)=>{let l=e.source===t.source,u=wt(e,c,o);return(0,Y.jsxs)(`li`,{children:[(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":l,onClick:()=>i(e.source),className:s(D,l&&`bg-muted/70 text-foreground`,o>=0&&c>o&&!l&&`opacity-50`),children:[(0,Y.jsx)(`span`,{className:s(ie,l&&`bg-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(`relative z-10 size-2 shrink-0 rounded-full border`,u===`won`&&`border-emerald-500 bg-emerald-500`,u===`shadowed`&&`border-muted-foreground/50 bg-muted-foreground/40`,u===`missed`&&`border-muted-foreground/50 bg-transparent`,u===`skipped`&&`border-border bg-transparent`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:yt[e.source],className:s(E,u===`won`?bt:`text-muted-foreground`),"aria-hidden":!0}),(0,Y.jsxs)(`span`,{className:s(`min-w-0 flex-1 truncate font-mono`,u===`won`?bt:`text-foreground`),children:[vt[e.source],e.source===`driver`?(0,Y.jsx)(`span`,{className:`ml-1.5 font-sans text-[10px] text-muted-foreground`,children:We(r)}):null]}),(0,Y.jsx)(`span`,{className:s(`shrink-0 text-[10px]`,u===`won`?bt:`text-muted-foreground`),children:u})]}),l?(0,Y.jsxs)(`div`,{className:`flex items-center gap-2 border-b border-border/60 py-1.5 pr-2 pl-8`,children:[(0,Y.jsx)(`p`,{className:`min-w-0 flex-1 truncate font-mono text-[11px] text-muted-foreground`,children:n.command}),(0,Y.jsx)(`span`,{className:`hidden min-w-0 truncate text-[10px] text-muted-foreground sm:inline`,children:n.hint}),(0,Y.jsx)(Ue,{value:n.command,label:`Copy ${e.source} fill`})]}):null]},e.source)})]}),(0,Y.jsxs)(`p`,{className:`sr-only`,children:[`Winner: `,e.find(e=>e.won)?.source??`none`,`. `,n.hint]})]})}function At({slots:e,env:t}){return(0,Y.jsx)(`ul`,{"data-slot":`vault-fingerprints`,children:e.map(e=>(0,Y.jsxs)(`li`,{className:D,children:[(0,Y.jsxs)(`span`,{className:`shrink-0 font-mono text-[11px] text-muted-foreground`,children:[e.env,e.env===t?(0,Y.jsx)(`span`,{className:`ml-1 text-[10px] text-muted-foreground`,children:`this`}):null]}),e.fp?(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-[11px]`,children:e.fp}):(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 text-[11px] text-muted-foreground`,children:`—`}),e.shared?(0,Y.jsxs)(`span`,{role:`status`,className:`shrink-0 text-[10px] text-amber-800 dark:text-amber-400`,children:[`matches `,t]}):null,e.fp?(0,Y.jsx)(Ue,{value:e.fp,label:`Copy ${e.env} fingerprint`}):null]},e.env))})}function jt(e,t){let n=new Set,r=[],i=(t,i)=>{n.has(t)||(n.add(t),r.push({env:t,fp:i,shared:i!=null&&e.sharedFingerprintEnvs.includes(t)}))};i(t,e.fingerprint);for(let[t,n]of Object.entries(e.fingerprints))i(t,n);return r}function Mt({readers:e,name:t,onFilterReader:n}){return(0,Y.jsxs)(`section`,{className:`shrink-0 border-b border-border/60`,"aria-label":`Readers`,children:[(0,Y.jsx)(Ot,{title:`Readers`,meta:String(e.length),children:(0,Y.jsx)(`code`,{className:`min-w-0 truncate font-mono text-[10px] leading-none text-muted-foreground`,children:et(t)})}),e.length===0?(0,Y.jsx)(`p`,{className:`px-2 py-1.5 text-[11px] text-muted-foreground`,children:`None declared.`}):(0,Y.jsx)(`ul`,{children:e.map(e=>(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`div`,{className:s(D,`group/reader`),children:[(0,Y.jsx)(a,{icon:L.flow.icon,className:s(E,`text-sky-500`),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-mono text-xs`,children:e}),(0,Y.jsxs)(`div`,{className:s(S,`group-hover/reader:opacity-100 group-focus-within/reader:opacity-100`),children:[n?(0,Y.jsx)(`button`,{type:`button`,className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,onClick:()=>n(e),children:`filter`}):null,(0,Y.jsx)(Le,{to:`/flows`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Flows`}),(0,Y.jsx)(Le,{to:`/overview`,search:{flow:e},className:`shrink-0 text-[10px] text-muted-foreground hover:text-foreground`,children:`Graph`})]})]})},e))})]})}function Nt({loading:e=!1,hasContracts:t,query:n,onClearQuery:r,leading:i}){return e?(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:`Loading vault…`,description:`Reading contracts and posture.`,leading:i})}):(0,Y.jsx)(`div`,{"data-slot":`vault-overview`,className:`h-full`,children:(0,Y.jsx)(Re,{icon:L.vault.icon,iconClassName:`border-border/70`,title:t?`No contracts match`:`No contracts`,leading:i,description:t?(0,Y.jsxs)(Y.Fragment,{children:[`Nothing matches `,(0,Y.jsx)(`span`,{className:`font-mono`,children:n}),`.`,` `,(0,Y.jsx)(`button`,{type:`button`,className:`underline underline-offset-2 hover:text-foreground`,onClick:r,children:`Clear search`})]}):`Declare vault.secret (fingerprinted) or vault.config (shown in the Config band) in the Manifest.`})})}var Pt={secret:`border-indigo-500/40 bg-indigo-500/12 text-indigo-600 dark:text-indigo-300`,config:`border-emerald-500/40 bg-emerald-500/10 text-emerald-700 dark:text-emerald-400`},Ft={secret:L.vault.icon,config:z},It={secret:`fingerprints only`,config:`vault.config · shown in clear`},Lt={blast:`border-destructive/40 bg-destructive/10 text-destructive`,unset:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,overdue:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,shared:`border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-400`,dormant:`border-zinc-500/35 bg-zinc-500/10 text-zinc-500 dark:text-zinc-400`,healthy:Pt.secret,config:Pt.config},Rt={blast:B,unset:ke,overdue:be,shared:Ze,dormant:ke,healthy:L.vault.icon,config:z},zt={blast:`text-destructive`,unset:`text-amber-800 dark:text-amber-400`,overdue:`text-amber-800 dark:text-amber-400`,shared:`text-amber-800 dark:text-amber-400`,dormant:`text-muted-foreground`,healthy:`text-indigo-600 dark:text-indigo-300`,config:`text-emerald-700 dark:text-emerald-400`};function Bt({groups:e,selectedName:t,loading:n=!1,matchCount:r,totalCount:i,now:o,onSelect:c}){let[l,d]=(0,K.useState)({secret:!0,config:!0});return(0,K.useEffect)(()=>{let n=e.find(e=>e.secrets.some(e=>e.name===t));n&&d(e=>e[n.kind]===!1?{...e,[n.kind]:!0}:e)},[e,t]),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:`min-h-0 flex-1 overflow-y-auto`,children:[n&&e.length===0?(0,Y.jsx)(`p`,{className:se,children:`Loading…`}):null,!n&&e.length===0?(0,Y.jsxs)(`p`,{className:se,children:[`No contracts match. Try `,(0,Y.jsx)(`span`,{className:`font-mono`,children:`is:unset`}),` or clear the search.`]}):null,e.map(e=>{let n=l[e.kind]!==!1;return(0,Y.jsx)(`section`,{"aria-label":e.label,className:oe,"data-slot":`vault-kind-band`,"data-kind":e.kind,children:(0,Y.jsxs)(Te,{open:n,onOpenChange:t=>d(n=>({...n,[e.kind]:t})),children:[(0,Y.jsx)(we,{nativeButton:!1,className:ne,"data-slot":`vault-kind-band-toggle`,render:t=>(0,Y.jsxs)(`div`,{...t,children:[(0,Y.jsx)(a,{icon:Ce,className:s(te,!n&&`-rotate-90`),"aria-hidden":!0}),(0,Y.jsx)(a,{icon:Ft[e.kind],className:s(E,u(Pt[e.kind])),"aria-hidden":!0}),(0,Y.jsx)(`span`,{className:s(ae,`flex-1`),title:It[e.kind],children:e.label}),(0,Y.jsx)(`span`,{className:m,children:e.secrets.length})]})}),(0,Y.jsx)(Se,{children:(0,Y.jsx)(`ul`,{className:`flex flex-col`,children:e.secrets.map(e=>(0,Y.jsx)(Vt,{row:e,selected:e.name===t,now:o,onSelect:c},e.name))})})]})},e.kind)})]}),e.length>0?(0,Y.jsx)(`p`,{className:`sr-only`,children:r===i?`${i} contracts`:`${r} of ${i} contracts`}):null]})}function Vt({row:e,selected:t,now:n,onSelect:r}){let i=e.description?.trim()||e.name,o=e.kind===`config`?e.cleartext??`unset`:e.name,c=o!==i,l=pt(e,n),d=l.primary!==`healthy`&&l.primary!==`config`,f=e.readers.length===0?`no readers`:`${e.readers.length} reader${e.readers.length===1?``:`s`}`,p=[e.origin===`console`?`console`:null,e.kind===`secret`&&!q(e.rotate)?`no rotate`:null].filter(e=>e!==null);return(0,Y.jsx)(`li`,{children:(0,Y.jsxs)(`button`,{type:`button`,"aria-current":t?`true`:void 0,"aria-label":`${i}, ${o}, ${f}, ${gt(l.primary)}`,onClick:()=>r(e.name),className:s(D,`items-start py-2`,t&&`bg-muted/70 text-foreground`),children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(ie,t&&`bg-[var(--vault-accent)]`),style:{"--vault-accent":J}}),(0,Y.jsx)(I,{label:_t(l.primary,e.rotate),children:(0,Y.jsx)(a,{icon:Rt[l.primary],className:s(E,`mt-0.5`,u(Lt[l.primary])),"aria-hidden":!0})}),(0,Y.jsxs)(`span`,{className:`min-w-0 flex-1`,children:[(0,Y.jsxs)(`span`,{className:`flex items-center gap-2`,children:[(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate font-medium text-foreground`,children:i}),d?(0,Y.jsx)(Ht,{posture:l}):null]}),(0,Y.jsxs)(`span`,{className:`mt-0.5 flex min-w-0 items-center gap-1.5 text-[10px] text-muted-foreground`,children:[c?(0,Y.jsx)(`span`,{className:`min-w-0 truncate font-mono`,children:o}):null,c?(0,Y.jsx)(`span`,{"aria-hidden":!0,children:`·`}):null,(0,Y.jsx)(`span`,{className:`shrink-0 tabular-nums`,children:f}),p.map(e=>(0,Y.jsxs)(`span`,{className:`shrink-0`,children:[`· `,e]},e))]})]})]})})}function Ht({posture:e}){return(0,Y.jsx)(`span`,{role:`status`,className:s(`shrink-0 text-[10px] font-medium`,zt[e.primary]),children:gt(e.primary)})}var Ut=new Set([`unset`,`set`,`dormant`,`blast`,`shared`,`overdue`,`unread`,`healthy`]),Wt=new Set([`secret`,`config`]),Gt=new Set([`readers`,`rotate`,`blast`,`shared`]),Kt=[{token:`is:unset`,label:`No value in this environment`},{token:`is:set`,label:`Has a fingerprint or config value`},{token:`is:blast`,label:`In-flight durable runs hold this secret`},{token:`is:shared`,label:`Fingerprint matches another environment`},{token:`is:dormant`,label:`Unread for 90 days, or never`},{token:`is:overdue`,label:`Last read older than rotate — never-read counts`},{token:`is:healthy`,label:`Set, no blast, no shared, not dormant`},{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`},{token:`from:.env.local`,label:`Winner is .env.local`},{token:`from:driver`,label:`Winner is the vault backend (built-in / managed / memory)`},{token:`has:readers`,label:`At least one Flow declares a read`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`},{token:`reader:`,label:`Flow id contains…`},{token:`fp:`,label:`Fingerprint contains…`}],qt=[`driver`,`process.env`,`.env.local`,`dev-fallback`];function Jt(e){let t=[],n=/"([^"]+)"|(\S+)/g,r;for(;(r=n.exec(e))!==null;){let e=r[1]??r[2]??``;e.length>0&&t.push(e)}return t}function Yt(e){let t=[];for(let n of Jt(e)){let e=nn(n);e?t.push(e):t.push({kind:`text`,value:n})}return{tokens:t,raw:e}}function Xt(e){let t=[],n=[];for(let r of e){if(r.kind===`text`){n.push(sn(r.value)?`"${r.value}"`:r.value);continue}t.push(`${r.kind}:${r.value}`)}return[...t,...n].join(` `).trim()}function Zt(e,t){let n=Yt(e);return Xt(n.tokens.some(e=>e.kind===`is`&&e.value===t)?n.tokens.filter(e=>e.kind!==`is`||e.value!==t):[...n.tokens,{kind:`is`,value:t}])}function Qt(e,t){return Yt(e).tokens.some(e=>e.kind===`is`&&e.value===t)}function $t(e,t,n){if(t.tokens.length===0)return!0;let r=pt(e,n);for(let n of t.tokens)if(!rn(e,n,r))return!1;return!0}function en(e,t){let n=cn(e);if(n===null)return Kt;let r=n.toLowerCase();if(r.startsWith(`is:`)||r===`is`)return Z(Kt.filter(e=>e.token.startsWith(`is:`)),n);if(r.startsWith(`kind:`)||r===`kind`)return Z([{token:`kind:secret`,label:`Sensitive contracts only`},{token:`kind:config`,label:`Non-sensitive config only`}],n);if(r.startsWith(`from:`)||r===`from`)return Z(qt.map(e=>({token:`from:${e}`,label:e===`driver`?`Winner is the vault backend (built-in / managed / memory)`:`Winner is ${e}`})),n);if(r.startsWith(`has:`)||r===`has`)return Z(Kt.filter(e=>e.token.startsWith(`has:`)),n);if(r.startsWith(`reader:`)||r===`reader`){let e=r.startsWith(`reader:`)?r.slice(7):``,n=new Set;for(let r of t)for(let t of r.readers)(e.length===0||t.toLowerCase().includes(e))&&n.add(t);return[...n].slice(0,8).map(e=>({token:`reader:${e}`,label:`Flow that reads this contract`}))}if(r.startsWith(`fp:`)||r===`fp`){let e=r.startsWith(`fp:`)?r.slice(3):``,n=new Set;for(let r of t){for(let t of Object.values(r.fingerprints))(e.length===0||t.toLowerCase().includes(e))&&n.add(t);r.fingerprint&&(e.length===0||r.fingerprint.toLowerCase().includes(e))&&n.add(r.fingerprint)}return[...n].slice(0,8).map(e=>({token:`fp:${e}`,label:`Exact fingerprint`}))}if(r.startsWith(`rotate:`)||r===`rotate`)return Z([{token:`rotate:due`,label:`Last read older than rotate — never-read counts`},{token:`has:rotate`,label:`Contract declares a rotate cadence`},{token:`rotate:never`,label:`No rotate cadence (stable secret)`}],n);let i=r;return Kt.filter(e=>e.token.includes(i)||e.label.toLowerCase().includes(i))}function tn(e,t){if(e.length===0||/\s$/.test(e))return`${e}${t} `.replace(/^\s+/,``);let n=e.lastIndexOf(` `);return n<0?`${t} `:`${e.slice(0,n+1)}${t} `}function nn(e){if(e.startsWith(`"`))return null;let t=e.indexOf(`:`);if(t<=0)return null;let n=e.slice(0,t).toLowerCase(),r=e.slice(t+1);if(r.length===0)return null;if(n===`is`){let e=r.toLowerCase();return Ut.has(e)?{kind:`is`,value:e}:Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`kind`){let e=r.toLowerCase();return Wt.has(e)?{kind:`kind`,value:e}:null}if(n===`from`)return{kind:`from`,value:r.toLowerCase()};if(n===`reader`)return{kind:`reader`,value:r.toLowerCase()};if(n===`fp`)return{kind:`fp`,value:r.toLowerCase()};if(n===`has`){let e=r.toLowerCase();return Gt.has(e)?{kind:`has`,value:e}:null}if(n===`rotate`){let e=r.toLowerCase();return e===`due`?{kind:`is`,value:`overdue`}:{kind:`rotate`,value:e}}return null}function rn(e,t,n){switch(t.kind){case`is`:return n[t.value];case`kind`:return e.kind===t.value;case`from`:return(e.winner??``).toLowerCase()===t.value;case`reader`:return e.readers.some(e=>e.toLowerCase().includes(t.value));case`fp`:return an(e).some(e=>e.includes(t.value));case`has`:return t.value===`readers`?e.readers.length>0:t.value===`rotate`?q(e.rotate):t.value===`blast`?e.blastRadius.count>0:e.sharedFingerprintEnvs.length>0;case`rotate`:return t.value===`never`?e.kind===`secret`&&!q(e.rotate):(e.rotate??``).toLowerCase()===t.value;case`text`:return on(e).includes(t.value.toLowerCase())}}function an(e){let t=Object.values(e.fingerprints).map(e=>e.toLowerCase());return e.fingerprint&&t.push(e.fingerprint.toLowerCase()),t}function on(e){return[e.name,e.description??``,e.winner??``,e.kind,...e.readers,...Object.keys(e.fingerprints),...Object.values(e.fingerprints),e.fingerprint??``,e.sensitive?``:e.cleartext??``].join(`
 `).toLowerCase()}function sn(e){return/\s/.test(e)}function cn(e){if(e.length===0||/\s$/.test(e))return null;let t=Jt(e);return t[t.length-1]??null}function Z(e,t){let n=t.toLowerCase();return e.filter(e=>e.token.toLowerCase().startsWith(n)||e.token.toLowerCase().includes(n))}function ln({card:e,env:t,summary:n,query:r,progress:i,verifyNote:a,onQueryChange:o,onOpenSecurity:c}){return(0,Y.jsxs)(`section`,{"aria-label":`Vault posture`,className:`shrink-0 border-b border-border/60`,"data-slot":`vault-posture-strip`,children:[(0,Y.jsxs)(`div`,{className:`flex min-h-10 flex-wrap items-stretch`,children:[(0,Y.jsx)(`button`,{type:`button`,onClick:c,"aria-label":`Open vault security`,className:`flex items-center px-2 text-left text-xs font-medium text-foreground hover:bg-muted/50`,children:e?.title??`Vault backend`}),(0,Y.jsx)(`span`,{className:`flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:t}),e?.badges.map(e=>(0,Y.jsxs)(`span`,{role:e.tone===`warn`?`alert`:`status`,className:s(`flex items-center gap-1.5 px-2 text-[10px]`,e.tone===`warn`?`text-amber-800 dark:text-amber-400`:`text-muted-foreground`,e.id===`rewrap`&&`text-[color:var(--vault-accent)]`),style:e.id===`rewrap`?{"--vault-accent":J}:void 0,children:[(0,Y.jsx)(`span`,{"aria-hidden":!0,className:s(`size-1.5 shrink-0 rounded-full`,e.tone===`warn`?`bg-amber-500`:`bg-muted-foreground/50`,e.id===`rewrap`&&`bg-[var(--vault-accent)]`)}),e.label]},e.id)),st.map(e=>{let t=n[e.id],i=Qt(r,e.token);return t===0&&!i?null:(0,Y.jsx)(I,{label:_t(e.id),className:`flex self-stretch`,children:(0,Y.jsxs)(`button`,{type:`button`,"aria-pressed":i,onClick:()=>o(Zt(r,e.token)),className:s(_,i?F:P,e.tone===`danger`&&!i&&`text-destructive`,e.tone===`warn`&&!i&&`text-amber-800 dark:text-amber-400`),children:[e.label,(0,Y.jsx)(`span`,{className:`font-mono tabular-nums`,children:t})]})},e.id)}),(0,Y.jsx)(`span`,{className:`ml-auto flex items-center px-2 font-mono text-[10px] text-muted-foreground`,children:a??`${n.secrets}s · ${n.config}c`})]}),i?(0,Y.jsxs)(`p`,{className:`border-t border-border/60 px-2 py-1 font-mono text-[11px]`,style:{color:J},role:`status`,"data-slot":`vault-rewrap-progress`,"data-phase":i.phase,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]})}function un({query:e,secrets:t,onQueryChange:n}){let r=(0,K.useId)(),i=(0,K.useRef)(null),[a,o]=(0,K.useState)(!1),[c,l]=(0,K.useState)(0),u=(0,K.useMemo)(()=>en(e,t),[e,t]);(0,K.useEffect)(()=>{l(0)},[e]),(0,K.useEffect)(()=>{let e=e=>{i.current?.contains(e.target)||o(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[]);let d=t=>{n(tn(e,t.token)),o(!0)};return(0,Y.jsxs)(`div`,{ref:i,className:`relative flex h-full min-w-0 flex-1`,"data-slot":`vault-search`,children:[(0,Y.jsx)(pe,{"data-slot":`vault-search-input`,value:e,onChange:e=>{n(e.target.value),o(!0)},onFocus:()=>o(!0),onKeyDown:e=>{if(e.key===`Escape`){o(!1);return}if(!a||u.length===0){e.key===`ArrowDown`&&u.length>0&&(e.preventDefault(),o(!0));return}if(e.key===`ArrowDown`){e.preventDefault(),l(e=>(e+1)%u.length);return}if(e.key===`ArrowUp`){e.preventDefault(),l(e=>(e-1+u.length)%u.length);return}e.key===`Enter`&&u[c]&&(e.preventDefault(),d(u[c]))},placeholder:`Search vault…`,"aria-label":`Search vault`,"aria-autocomplete":`list`,"aria-expanded":a,"aria-controls":r,role:`combobox`,title:`name, fingerprint, reader…  is:unset  from:.env.local`}),a&&u.length>0?(0,Y.jsx)(`ul`,{id:r,role:`listbox`,className:`absolute top-full z-30 mt-1 max-h-72 w-[min(20rem,calc(100vw-4rem))] overflow-y-auto rounded-lg border border-border/70 bg-popover p-1 shadow-md`,children:u.map((e,t)=>(0,Y.jsx)(`li`,{role:`option`,"aria-selected":t===c,children:(0,Y.jsxs)(`button`,{type:`button`,onMouseEnter:()=>l(t),onClick:()=>d(e),className:s(`flex w-full items-baseline gap-2 rounded-md px-2 py-1.5 text-left`,t===c&&`bg-muted/70`),children:[(0,Y.jsx)(`span`,{className:`font-mono text-[11px] text-foreground`,children:e.token}),(0,Y.jsx)(`span`,{className:`min-w-0 flex-1 truncate text-[10px] text-muted-foreground`,children:e.label})]})},`${e.token}-${t}`))}):null]})}function dn(e,t=``,n=Date.now()){let r=Yt(t),i=e.filter(e=>$t(e,r,n)),a=[`secret`,`config`],o={secret:`Secrets`,config:`Config`};return a.map(e=>({kind:e,label:o[e],secrets:i.filter(t=>t.kind===e)})).filter(e=>e.secrets.length>0)}function fn(e){let t=e.remaining,n=e.rewrapTargetKekVersion;if(!(t!==null&&t>0||n!==null))return t===0?{phase:2,headline:`KEK v${e.kekVersion} — rotation complete`,detail:`The previous master key no longer opens this vault.`}:null;let r=n??e.kekVersion,i=t??0;return{phase:1,headline:`kek v${e.kekVersion} → v${r}`,detail:i>0?`${i} DEK${i===1?``:`s`} still on the old key. Both master keys stay live.`:`Both master keys stay live until remaining is 0.`}}function pn({masterKey:e,onDismiss:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsx)(w,{open:e!==null,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-master-key-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`New master key`}),(0,Y.jsx)(k,{children:`Shown once. Store it offline. This Console process does not keep it for you.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(`p`,{className:`border-b border-border/50 px-4 py-3 font-mono text-[11px] break-all`,children:e}),(0,Y.jsx)(`p`,{className:`px-4 py-3 text-[11px] text-muted-foreground`,role:`status`,children:`Copying puts the key on the clipboard. Anyone with this device can read it until you clear it.`})]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,disabled:!e,onClick:()=>{e&&(navigator.clipboard?.writeText(e),r(!0))},children:n?`Copied`:`Copy (clipboard warning)`}),(0,Y.jsx)(W,{variant:`destructive`,onClick:()=>{r(!1),t()},children:`I have stored this key`})]})]})})}function mn({open:e,onOpenChange:t,pending:n=!1,error:r,onConfirm:i}){return(0,Y.jsx)(He,{open:e,onOpenChange:t,phrase:`ROTATE_MASTER`,title:`Rotate master key`,description:`Generates a new master key and rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`,pending:n,error:r,confirmLabel:`Confirm rotate master`,slot:`vault-rotate-master-sheet`,onConfirm:i})}var hn=[{id:`status`,cmd:`oke vault status`,label:`Backend seal + KEK`},{id:`audit`,cmd:`oke vault audit`,label:`Hash-chained audit log`},{id:`verify`,cmd:`oke vault audit verify`,label:`Verify the chain on disk`},{id:`backup`,cmd:`oke vault backup`,label:`Encrypted backup`},{id:`restore`,cmd:`oke vault restore`,label:`Restore from backup`}];function gn({open:e,onOpenChange:t,card:n,env:r,progress:i,verifyPending:a=!1,verifyNote:o,onVerify:c,onRotateMaster:l,onExport:u}){return(0,Y.jsx)(w,{open:e,onOpenChange:t,children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-security-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`Vault security`}),(0,Y.jsx)(k,{children:`Fingerprints and backend status only. Backup, restore, and unseal stay on the CLI.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Backend`}),(0,Y.jsx)(`p`,{className:`text-[12px] font-medium`,children:n?.title??`Unresolved`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:n?.description??`The server could not resolve a vault backend.`}),(0,Y.jsxs)(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[(0,Y.jsxs)(`span`,{className:`font-mono text-[10px] text-muted-foreground`,children:[`env `,r]}),n?.badges.map(e=>(0,Y.jsx)(xe,{variant:`outline`,role:e.tone===`warn`?`alert`:`status`,className:s(`h-5 rounded-md text-[10px]`,e.tone===`warn`&&`border-amber-500/35 bg-amber-500/10 text-amber-800 dark:text-amber-400`),children:e.label},e.id))]}),n?.facts.length?(0,Y.jsx)(`dl`,{className:`flex flex-col gap-1`,children:n.facts.map(e=>(0,Y.jsxs)(`div`,{className:`flex justify-between gap-3`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] tracking-[0.12em] text-muted-foreground uppercase`,children:e.label}),(0,Y.jsx)(`dd`,{className:`font-mono text-[11px]`,children:e.value})]},e.label))}):null,n?.hint?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:n.hint}):null,i?(0,Y.jsxs)(`p`,{className:`font-mono text-[11px]`,style:{color:J},role:`status`,children:[i.headline,(0,Y.jsx)(`span`,{className:`ml-2 font-sans text-muted-foreground`,children:i.detail})]}):null]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 border-b border-border/50 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`Actions`}),(0,Y.jsxs)(`div`,{className:`flex flex-col gap-1.5`,children:[(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,disabled:a,onClick:c,children:`Verify audit chain`}),o?(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,role:`status`,children:o}):null,(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,onClick:l,children:`Rotate master key`}),(0,Y.jsx)(N,{type:`button`,variant:`outline`,size:`sm`,onClick:u,children:`Export fingerprints`})]}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`Master rotation rewraps DEKs in batches. Both keys stay live until remaining is 0. The new key is shown once.`})]}),(0,Y.jsxs)(`section`,{className:`flex flex-col gap-2 px-4 py-3`,children:[(0,Y.jsx)(`h3`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:`CLI`}),(0,Y.jsx)(`p`,{className:`text-[11px] text-muted-foreground`,children:`The Console never accepts a master key in the HTTP body.`}),(0,Y.jsx)(`ul`,{className:`flex flex-col gap-1`,children:hn.map(e=>(0,Y.jsx)(_n,{cmd:e.cmd,label:e.label},e.id))})]})]})]})})}function _n({cmd:e,label:t}){let[n,r]=(0,K.useState)(!1);return(0,Y.jsxs)(`li`,{className:`flex items-center gap-2`,children:[(0,Y.jsxs)(`div`,{className:`min-w-0 flex-1`,children:[(0,Y.jsx)(`p`,{className:`font-mono text-[11px]`,children:e}),(0,Y.jsx)(`p`,{className:`text-[10px] text-muted-foreground`,children:t})]}),(0,Y.jsx)(N,{type:`button`,variant:`ghost`,size:`icon-xs`,"aria-label":`Copy ${e}`,onClick:()=>{navigator.clipboard?.writeText(e),r(!0),window.setTimeout(()=>r(!1),1200)},children:(0,Y.jsx)(a,{icon:n?c:fe})})]})}function vn({result:e,onClose:t}){let n=e!==null&&e.ok===!1,r=e?.reason===`link`?`prev-hash does not match the previous row`:e?.reason===`payload`?`stored row hash does not match the payload`:`the chain failed verification`;return(0,Y.jsx)(w,{open:n,onOpenChange:e=>{e||t()},children:(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`sm:max-w-md`,"data-slot":`vault-verify-sheet`,children:[(0,Y.jsxs)(T,{children:[(0,Y.jsx)(A,{children:`Chain broken`}),(0,Y.jsxs)(k,{children:[`The audit hash chain failed at`,` `,(0,Y.jsx)(`span`,{className:`font-mono`,children:e?.brokenAt??`unknown`}),`.`]})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto text-[11px]`,children:[(0,Y.jsxs)(`p`,{className:`border-b border-border/50 px-4 py-3`,role:`alert`,children:[`Reason: `,r,`.`]}),e?.row?(0,Y.jsxs)(`dl`,{className:`divide-y divide-border/50`,children:[(0,Y.jsx)(Q,{label:`id`,value:e.row.id,mono:!0}),(0,Y.jsx)(Q,{label:`seq`,value:String(e.row.seq),mono:!0}),(0,Y.jsx)(Q,{label:`action`,value:e.row.action}),(0,Y.jsx)(Q,{label:`path`,value:e.row.path??`—`,mono:!0}),(0,Y.jsx)(Q,{label:`actor`,value:`${e.row.actorType} ${e.row.actorId??``}`}),(0,Y.jsx)(Q,{label:`time`,value:new Date(e.row.createdAt).toISOString(),mono:!0}),e.row.errorMessage?(0,Y.jsx)(Q,{label:`error`,value:e.row.errorMessage}):null]}):null]}),(0,Y.jsx)(v,{children:(0,Y.jsx)(W,{onClick:t,children:`Close`})})]})})}function Q({label:e,value:t,mono:n}){return(0,Y.jsxs)(`div`,{className:`px-4 py-2.5`,children:[(0,Y.jsx)(`dt`,{className:`text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`font-mono text-[11px] break-all`:`text-[11px]`,children:t})]})}async function yn(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return`sha256:${[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,16)}`}async function bn(e){let t=e.name.trim(),n=e.value;if(t.length===0)return{error:`Name is required`};if(n.trim().length===0)return{error:`Value is required`};if(e.action!==`create`&&(e.reason?.trim()??``).length<3)return{error:`Reason is required`};let r=e.kind??(e.sensitive?`secret`:`config`),i=await yn(n),a=e.action===`create`?null:e.reason?.trim()??null;return{action:e.action,name:t,kind:r,fingerprint:i,preview:e.sensitive?null:n,reason:a,rotate:e.rotate??null,commit:{name:t,value:n,reason:a,kind:r,description:e.description?.trim()??``,rotate:e.rotate??(r===`secret`?`90d`:`never`)}}}function xn(e,t){return e===null?null:t(e)}function Sn(){return null}function Cn(e){return re(`alert-dialog`,e)}function wn({...e}){return(0,Y.jsx)(Cn,{"data-slot":`alert-dialog`,...e})}function Tn({...e}){return(0,Y.jsx)(C,{"data-slot":`alert-dialog-portal`,...e})}function En({className:e,...t}){return(0,Y.jsx)(h,{"data-slot":`alert-dialog-overlay`,className:s(`fixed inset-0 z-50 bg-black/20 transition-opacity duration-150 data-ending-style:opacity-0 data-starting-style:opacity-0 supports-backdrop-filter:backdrop-blur-xs`,e),...t})}function Dn({className:e,children:t,...n}){return(0,Y.jsxs)(Tn,{children:[(0,Y.jsx)(En,{}),(0,Y.jsx)(f,{"data-slot":`alert-dialog-content`,className:s(`fixed top-1/2 left-1/2 z-50 w-[min(100%-2rem,24rem)] -translate-x-1/2 -translate-y-1/2 overflow-hidden rounded-none border border-border bg-popover text-sm text-popover-foreground shadow-lg outline-none transition duration-150 data-ending-style:scale-95 data-ending-style:opacity-0 data-starting-style:scale-95 data-starting-style:opacity-0`,e),...n,children:t})]})}function On({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-header`,className:s(`flex flex-col gap-1 border-b border-border/50 px-4 py-3`,e),...t})}function kn({className:e,...t}){return(0,Y.jsx)(`div`,{"data-slot":`alert-dialog-footer`,className:s(`flex flex-row items-stretch border-t border-border/50 p-0`,e),...t})}function An({className:e,...t}){return(0,Y.jsx)(b,{"data-slot":`alert-dialog-title`,className:s(`text-sm font-medium text-foreground`,e),...t})}function jn({className:e,...t}){return(0,Y.jsx)(ue,{"data-slot":`alert-dialog-description`,className:s(`text-[11px] text-muted-foreground`,e),...t})}var Mn={create:`Confirm add`,set:`Confirm set`,rotate:`Confirm rotate`},Nn={create:`Add contract`,set:`Set value`,rotate:`Rotate`};function Pn({review:e,pending:t=!1,onCancel:n,onConfirm:r}){return(0,Y.jsx)(wn,{open:e!==null,onOpenChange:e=>{!e&&!t&&n()},children:(0,Y.jsxs)(Dn,{"data-slot":`vault-write-review`,children:[(0,Y.jsxs)(On,{children:[(0,Y.jsx)(An,{children:e?`${Mn[e.action]} ${e.name}`:`Confirm write`}),(0,Y.jsx)(jn,{children:e?.preview==null?`Write-only. The value is never shown again.`:`Config is shown in the clear after submit.`})]}),e?(0,Y.jsx)(Fn,{review:e}):null,(0,Y.jsxs)(kn,{children:[(0,Y.jsx)(W,{split:!0,onClick:n,disabled:t,"data-slot":`vault-write-review-cancel`,children:`Cancel`}),(0,Y.jsx)(W,{variant:e?.action===`rotate`?`destructive`:`default`,disabled:t||e===null,onClick:r,"data-slot":`vault-write-review-confirm`,children:t?`Working…`:e?Nn[e.action]:`Confirm`})]})]})})}function Fn({review:e}){return(0,Y.jsxs)(`dl`,{className:`flex flex-col`,"data-slot":`vault-write-review-facts`,children:[(0,Y.jsx)($,{label:`Name`,value:e.name,mono:!0}),e.action===`create`?(0,Y.jsx)($,{label:`Kind`,value:e.kind}):null,(0,Y.jsx)($,{label:`Fingerprint`,value:e.fingerprint,mono:!0}),e.preview==null?null:(0,Y.jsx)($,{label:`Value`,value:e.preview,mono:!0}),e.reason?(0,Y.jsx)($,{label:`Reason`,value:e.reason}):null,e.action===`create`&&e.rotate?(0,Y.jsx)($,{label:`Rotate`,value:e.rotate}):null]})}function $({label:e,value:t,mono:n=!1}){return(0,Y.jsxs)(`div`,{className:`flex items-baseline justify-between gap-3 border-b border-border/50 px-4 py-2 last:border-b-0`,children:[(0,Y.jsx)(`dt`,{className:`shrink-0 text-[10px] font-semibold tracking-[0.12em] text-muted-foreground uppercase`,children:e}),(0,Y.jsx)(`dd`,{className:n?`min-w-0 truncate font-mono text-[11px]`:`min-w-0 truncate text-[12px]`,children:t})]})}function In({open:e,onOpenChange:t,pending:n=!1,error:r,onSubmit:i}){let[a,c]=(0,K.useState)(`secret`),[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(``),[p,m]=(0,K.useState)(`90d`),[h,g]=(0,K.useState)(``),[_,y]=(0,K.useState)(null),[b,x]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(c(`secret`),u(``),f(``),m(`90d`),g(``),y(null),x(null))},[e]);let S=l.trim().length>0&&h.trim().length>0&&!n,C=async()=>{let e=await bn({action:`create`,name:l.trim(),value:h,sensitive:a===`secret`,kind:a,description:d.trim(),rotate:a===`secret`?p:`never`});if(`error`in e){y(e.error);return}y(null),x(e)};return(0,Y.jsxs)(w,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-create-sheet`,children:[(0,Y.jsxs)(T,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(A,{className:`text-sm`,children:`Add vault contract`}),(0,Y.jsx)(k,{className:`text-[11px]`,children:a===`secret`?`Writes the value and lists the contract here. Promote it to vault.secret in source when a Flow should read it.`:`vault.config — shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsxs)(ze,{label:`Kind`,children:[(0,Y.jsx)(H,{active:a===`secret`,onClick:()=>c(`secret`),children:`secret`}),(0,Y.jsx)(H,{active:a===`config`,onClick:()=>c(`config`),children:`config`})]}),(0,Y.jsx)(U,{label:`Name`,children:(0,Y.jsx)(o,{value:l,onChange:e=>u(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g,``)),placeholder:`STRIPE_KEY`,autoComplete:`off`,"aria-label":`Contract name`,flat:!0,className:s(G,`font-mono`)})}),(0,Y.jsx)(U,{label:`Description`,children:(0,Y.jsx)(o,{value:d,onChange:e=>f(e.target.value),placeholder:`Optional title`,autoComplete:`off`,"aria-label":`Description`,flat:!0,className:G})}),a===`secret`?(0,Y.jsxs)(ze,{label:`Rotate`,children:[(0,Y.jsx)(H,{active:p===`90d`,onClick:()=>m(`90d`),children:`90d`}),(0,Y.jsx)(H,{active:p===`never`,onClick:()=>m(`never`),children:`no rotate`})]}):null,(0,Y.jsx)(U,{label:`Value`,children:(0,Y.jsx)(o,{type:`password`,autoComplete:`off`,value:h,onChange:e=>g(e.target.value),placeholder:a===`secret`?`Paste the secret`:`Public value`,"aria-label":`New vault value`,flat:!0,className:G})}),_||r?(0,Y.jsx)(Be,{slot:`vault-create-error`,children:_??r}):null]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:n,children:`Cancel`}),(0,Y.jsx)(W,{variant:`default`,disabled:!S,onClick:()=>{C()},"data-slot":`vault-create-submit`,children:a===`secret`?`Review secret`:`Review config`})]})]}),(0,Y.jsx)(Pn,{review:b,pending:n,onCancel:()=>x(Sn()),onConfirm:()=>{xn(b,e=>{i({name:e.commit.name,value:e.commit.value,kind:e.commit.kind,description:e.commit.description,rotate:e.commit.rotate})})}})]})}var Ln=[{id:`first`,label:`first`,text:`Initial value`},{id:`fix`,label:`fix`,text:`Correct a bad value`},{id:`provider`,label:`provider`,text:`Provider changed it`},{id:`other`,label:`other`,text:``}],Rn=[{id:`scheduled`,label:`scheduled`,text:`Scheduled rotation`},{id:`leak`,label:`leak`,text:`Key compromise`},{id:`provider`,label:`provider`,text:`Provider rotated`},{id:`other`,label:`other`,text:``}];function zn(e){return e===`rotate`?Rn:Ln}function Bn(e){return e===`rotate`?`scheduled`:`first`}function Vn(e,t,n){return t===`other`?n.trim():zn(e).find(e=>e.id===t)?.text??``}function Hn({open:e,onOpenChange:t,mode:n,name:r,sensitive:i=!0,pending:a=!1,error:s,onSubmit:c}){let[l,u]=(0,K.useState)(``),[d,f]=(0,K.useState)(()=>Bn(n)),[p,m]=(0,K.useState)(``),[h,g]=(0,K.useState)(null),[_,y]=(0,K.useState)(null);(0,K.useEffect)(()=>{e||(u(``),f(Bn(n)),m(``),g(null),y(null))},[e,n]);let b=Vn(n,d,p),x=l.trim().length>0&&b.length>=3&&!a,S=zn(n),C=async()=>{let e=await bn({action:n,name:r,value:l,sensitive:i,reason:b,kind:i?`secret`:`config`});if(`error`in e){g(e.error);return}g(null),y(e)};return(0,Y.jsxs)(w,{open:e,onOpenChange:t,children:[(0,Y.jsxs)(O,{side:`right`,showOverlay:!1,className:`gap-0 p-0 data-[side=right]:sm:max-w-md`,"data-slot":`vault-write-sheet`,children:[(0,Y.jsxs)(T,{className:`gap-1 border-b border-border/50`,children:[(0,Y.jsx)(A,{className:`text-sm`,children:n===`set`?`Set ${r}`:`Rotate ${r}`}),(0,Y.jsx)(k,{className:`text-[11px]`,children:i?`Write-only. The new value is never shown again after submit.`:`This vault.config value is shown in the clear on the Config band after submit.`})]}),(0,Y.jsxs)(`div`,{className:`flex min-h-0 flex-1 flex-col overflow-y-auto`,children:[(0,Y.jsx)(U,{label:`New value`,children:(0,Y.jsx)(o,{type:`password`,autoComplete:`off`,value:l,onChange:e=>u(e.target.value),placeholder:i?`Paste the new secret`:`Paste the new value`,"aria-label":`New vault value`,flat:!0,className:G})}),(0,Y.jsx)(ze,{label:`Reason`,children:S.map(e=>(0,Y.jsx)(H,{active:d===e.id,onClick:()=>f(e.id),children:e.label},e.id))}),d===`other`?(0,Y.jsx)(U,{label:`Other`,children:(0,Y.jsx)(o,{value:p,onChange:e=>m(e.target.value),placeholder:`Why is this change needed?`,"aria-label":`Custom reason`,flat:!0,className:G})}):null,h||s?(0,Y.jsx)(Be,{slot:`vault-write-error`,children:h??s}):null]}),(0,Y.jsxs)(v,{children:[(0,Y.jsx)(W,{split:!0,onClick:()=>t(!1),disabled:a,children:`Cancel`}),(0,Y.jsx)(W,{variant:n===`rotate`?`destructive`:`default`,disabled:!x,onClick:()=>{C()},"data-slot":`vault-write-submit`,children:n===`set`?`Review set`:`Review rotate`})]})]}),(0,Y.jsx)(Pn,{review:_,pending:a,onCancel:()=>y(Sn()),onConfirm:()=>{xn(_,e=>{c({value:e.commit.value,reason:e.commit.reason??b})})}})]})}function Un(){let e=Ke(),t=ee(),{query:n,selectedName:o,action:c,setQuery:u,setSelectedName:f,setAction:m}=Ie(),h=_e(),_=(0,Y.jsx)(ve,{open:h.open,onToggle:h.toggle,noun:`vault`,controlsId:`vault-list`,dataSlot:`vault-list-toggle`}),[v]=(0,K.useState)(()=>Date.now()),[b,S]=(0,K.useState)(!1),[C,w]=(0,K.useState)(null),[te,T]=(0,K.useState)(null),[E,D]=(0,K.useState)(null),[ne,O]=(0,K.useState)(null),[re,ie]=(0,K.useState)(null),[ae,k]=(0,K.useState)(null),[oe,A]=(0,K.useState)(null),[se,j]=(0,K.useState)(null),M=e.data?.secrets??[],N=e.data?.env??`dev`,P=e.data?.backend??null,ue=(0,K.useMemo)(()=>Je(P),[P]),F=(0,K.useMemo)(()=>dn(M,n,v),[M,n,v]),fe=(0,K.useMemo)(()=>mt(M,v),[M,v]),pe=(0,K.useMemo)(()=>F.flatMap(e=>e.secrets),[F]),L=pe.length,R=pe.find(e=>e.name===o)??pe[0]??null,be=fn({kekVersion:ae??P?.status?.kekVersion??1,remaining:re,rewrapTargetKekVersion:P?.status?.rewrapTargetKekVersion??null});(0,K.useEffect)(()=>{let e=e=>{if(e.key!==`/`||e.metaKey||e.ctrlKey||e.altKey)return;let t=e.target;if(t instanceof HTMLElement){let e=t.tagName;if(e===`INPUT`||e===`TEXTAREA`||t.isContentEditable)return}e.preventDefault(),document.querySelector(`[data-slot='vault-search-input']`)?.focus()};return window.addEventListener(`keydown`,e),()=>window.removeEventListener(`keydown`,e)},[]);let z=async()=>{await t.invalidateQueries({queryKey:Xe})},xe=()=>{let e=ot(M);navigator.clipboard?.writeText(e),w(`Exported fingerprints only (no secret values)`)},Se=Fe({mutationFn:async e=>{if(e.value.trim().length===0)throw Error(`New value is required`);let t=await(e.mode===`set`?l:r)({name:e.name,value:e.value,reason:e.reason});if(t.error)throw Error(d(t.error));return t.data},onSuccess:async()=>{T(null),m(null),await z()},onError:e=>{T(e.message)}}),Ce=Fe({mutationFn:async e=>{if(e.name.trim().length===0)throw Error(`Name is required`);if(e.value.trim().length===0)throw Error(`Value is required`);let t=await le({name:e.name,value:e.value,kind:e.kind,...e.description.length>0?{description:e.description}:{},...e.rotate.length>0?{rotate:e.rotate}:{}});if(t.error)throw Error(d(t.error));return t.data},onSuccess:async e=>{T(null),m(null),e?.name&&f(e.name),await z()},onError:e=>{T(e.message)}}),we=Fe({mutationFn:async e=>{let t=0,n=P?.status?.kekVersion??1;for(;;){let r=await ce(e);if(r.error)throw Error(d(r.error));if(!r.data)throw Error(`Empty rotate-master response`);if(t=r.data.remaining,n=r.data.kekVersion,ie(r.data.remaining),k(r.data.kekVersion),r.data.masterKey&&O(r.data.masterKey),await z(),r.data.remaining===0)break}return{remaining:t,kekVersion:n}},onSuccess:()=>{D(null),m(null)},onError:e=>{D(e.message)}}),B=Fe({mutationFn:async()=>{let e=await g();if(e.error)throw Error(d(e.error));if(!e.data)throw Error(`Empty verify response`);return e.data},onSuccess:e=>{e.ok?(j(null),A(`chain intact`)):(A(null),j(e))}});return(0,Y.jsxs)(`div`,{className:x,"data-slot":`vault-page`,children:[(0,Y.jsxs)(de,{orientation:`horizontal`,className:`min-h-0 flex-1`,children:[(0,Y.jsx)(he,{panelRef:h.panelRef,collapsible:!0,collapsedSize:0,defaultSize:p.start.defaultSize,minSize:p.start.minSize,onResize:h.onResize,className:`min-h-0 overflow-hidden`,children:(0,Y.jsxs)(`div`,{id:`vault-list`,className:`flex h-full min-h-0 flex-col overflow-hidden`,"data-slot":`vault-list`,children:[(0,Y.jsxs)(`div`,{className:s(i,`relative z-20 pr-1.5`),children:[(0,Y.jsx)(un,{query:n,secrets:M,onQueryChange:u}),(0,Y.jsx)(I,{label:`Add secret or config`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Add secret or config`,onClick:()=>m(`create`),className:y,children:(0,Y.jsx)(a,{icon:Oe,className:`size-3.5`})})}),C?(0,Y.jsx)(`span`,{className:`sr-only`,role:`status`,children:C}):null,(0,Y.jsx)(I,{label:`Verify the audit hash chain`,className:`flex self-stretch`,children:(0,Y.jsx)(`button`,{type:`button`,"aria-label":`Verify chain`,disabled:B.isPending,onClick:()=>B.mutate(),className:y,children:(0,Y.jsx)(a,{icon:ge,className:`size-3.5`})})}),(0,Y.jsxs)(Pe,{children:[(0,Y.jsx)(I,{label:`Vault security`,className:`flex self-stretch`,children:(0,Y.jsx)(Ae,{render:e=>(0,Y.jsx)(`button`,{...e,type:`button`,"aria-label":`Vault security`,className:y,children:(0,Y.jsx)(a,{icon:De,className:`size-3.5`})})})}),(0,Y.jsxs)(Ne,{align:`end`,className:`min-w-52`,children:[(0,Y.jsxs)(je,{children:[(0,Y.jsx)(V,{onClick:()=>S(!0),children:`Security`}),(0,Y.jsxs)(V,{onClick:()=>m(`rotate-master`),children:[(0,Y.jsx)(a,{icon:me,"data-icon":`inline-start`}),`Rotate master key`]}),(0,Y.jsxs)(V,{onClick:xe,children:[(0,Y.jsx)(a,{icon:Ee,"data-icon":`inline-start`}),`Export fingerprints`]})]}),(0,Y.jsx)(Me,{}),(0,Y.jsxs)(V,{disabled:B.isPending,onClick:()=>B.mutate(),children:[(0,Y.jsx)(a,{icon:ge,"data-icon":`inline-start`}),`Verify audit chain`]})]})]})]}),(0,Y.jsx)(ln,{card:ue,env:N,summary:fe,query:n,progress:be,verifyNote:oe,onQueryChange:u,onOpenSecurity:()=>S(!0)}),(0,Y.jsx)(Bt,{groups:F,selectedName:R?.name??o,loading:e.isLoading,matchCount:L,totalCount:M.length,now:v,onSelect:f})]})}),h.open?(0,Y.jsx)(ye,{withHandle:!0}):null,(0,Y.jsx)(he,{defaultSize:p.end.defaultSize,minSize:p.end.minSize,className:`min-h-0 overflow-hidden`,children:R?(0,Y.jsx)(Tt,{row:R,env:N,now:v,backend:P,onSet:()=>m(`set`),onRotate:()=>m(`rotate`),onQueryChange:u,leading:_}):(0,Y.jsx)(Nt,{loading:e.isLoading,hasContracts:M.length>0,query:n,onClearQuery:()=>u(``),leading:_})})]}),(0,Y.jsx)(In,{open:c===`create`,onOpenChange:e=>{e||(T(null),m(null))},pending:Ce.isPending,error:c===`create`?te:null,onSubmit:e=>Ce.mutate(e)}),(0,Y.jsx)(Hn,{open:c===`set`||c===`rotate`,onOpenChange:e=>{e||(T(null),m(null))},mode:c===`rotate`?`rotate`:`set`,name:R?.name??``,sensitive:R?.sensitive??!0,pending:Se.isPending,error:te,onSubmit:e=>{R&&Se.mutate({mode:c===`rotate`?`rotate`:`set`,name:R.name,...e})}}),(0,Y.jsx)(mn,{open:c===`rotate-master`,onOpenChange:e=>{e||(D(null),m(null))},pending:we.isPending,error:E,onConfirm:e=>we.mutate(e)}),(0,Y.jsx)(gn,{open:b,onOpenChange:S,card:ue,env:N,progress:be,verifyPending:B.isPending,verifyNote:oe,onVerify:()=>B.mutate(),onRotateMaster:()=>{S(!1),m(`rotate-master`)},onExport:xe}),(0,Y.jsx)(pn,{masterKey:ne,onDismiss:()=>O(null)}),(0,Y.jsx)(vn,{result:se,onClose:()=>j(null)})]})}export{Un as VaultPage};

package/src/console/ui-next/dist/index.html

@@ -37,7 +37,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-Cul17AcV.js"></script>
+    <script type="module" crossorigin src="/assets/index-BKpaes3n.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Ddte4I-Q.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-yApv7D4e.js">

package/src/elements/store/sql-session.ts

@@ -15,6 +15,7 @@ import {
 } from "../../drivers/pg-rls.ts";
 import { throwOke } from "../../kernel/errors.ts";
 import { isFlowFailure } from "../../kernel/hooks.ts";
+import { lazyRequire } from "../../kernel/lazy-require.ts";
 import { isRetryableSqlError, sqlErrorToFailure } from "./sql-errors.ts";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { maskRows, tableFromSql } from "./classify.ts";
@@ -36,9 +37,8 @@ import {
   resolveTableName,
   type TableHandle,
 } from "./table.ts";
-import { isSchemaTableDecl } from "./schema-decl.ts";
 import { SearchConfigError } from "./search-errors.ts";
-import { runSqlSearch, type SearchColumnMeta, type SqlSearchOptions } from "./search-runtime.ts";
+import type { SearchColumnMeta, SqlSearchOptions } from "./search-runtime.ts";
 
 export type { WhereMap } from "./sql-condition.ts";
 
@@ -1212,7 +1212,7 @@ export function createSqlStoreHandle(
       await ensureFromMeta(table);
       const columns = searchColumnsFromTable(table);
       const pk = resolvePkColumn(table);
-      return runSqlSearch({
+      return loadSearchRuntime().runSqlSearch({
         conn: connection,
         table,
         columns,
@@ -1257,13 +1257,29 @@ export function resolvePkColumn(table: unknown): string {
   return "id";
 }
 
+/**
+ * Hybrid search (BM25 / LSH / fusion). First `search()` loads it.
+ * A static import pins that graph on every HTTP cold start.
+ */
+function loadSearchRuntime(): typeof import("./search-runtime.ts") {
+  return lazyRequire(import.meta.dir, ["search", "runtime"].join("-"));
+}
+
+/**
+ * Schema-table predicate. Only `search()` needs it.
+ * `schema-decl` is the declare-site module and stays off the HTTP import graph.
+ */
+function loadSchemaDecl(): typeof import("./schema-decl.ts") {
+  return lazyRequire(import.meta.dir, ["schema", "decl"].join("-"));
+}
+
 /**
  * Collect `.searchable()` / `.embed()` column meta from a schema table.
  *
  * @param table - Table handle
  */
 function searchColumnsFromTable(table: unknown): SearchColumnMeta[] {
-  if (!isSchemaTableDecl(table)) {
+  if (!loadSchemaDecl().isSchemaTableDecl(table)) {
     throw new Error(
       "search(): table must be a store.schema.table() declaration with .searchable() columns",
     );

package/src/kernel/app.ts

@@ -17,7 +17,6 @@ import {
   type RoutesFromNamespace,
   type RuntimeRouteMap,
 } from "./adopt-routes.ts";
-import { buildClientDescriptor } from "./client-descriptor.ts";
 import { liveExposureKey, liveGatesKey, liveMatchKeyFromPath } from "./live-http.ts";
 // `./boot.ts` pulls in every element + driver module (vault, store, signal,
 // clock, gate, channel, ai, runs) — a type-only import here keeps that whole
@@ -203,6 +202,14 @@ function loadJsonCodeBlock(): typeof import("../runtime/json-code-block.ts") {
   return lazyRequire(`${import.meta.dir}/../runtime`, ["json", "code", "block"].join("-"));
 }
 
+/**
+ * Route descriptor for `GET /_oke/client.json`.
+ * A static import evaluates Zod on every HTTP cold start; load it on first fetch.
+ */
+function loadClientDescriptor(): typeof import("./client-descriptor.ts") {
+  return lazyRequire(import.meta.dir, ["client", "descriptor"].join("-"));
+}
+
 /** Options for {@link oke}. */
 export interface OkeOptions {
   /** Application name (Manifest `app`). */
@@ -2381,7 +2388,7 @@ export function oke(options: OkeOptions): OkeApp {
       }
 
       if (method === "GET" && url.pathname === "/_oke/client.json") {
-        const descriptor = buildClientDescriptor(routes, flowsByName);
+        const descriptor = loadClientDescriptor().buildClientDescriptor(routes, flowsByName);
         return respond(
           new Response(JSON.stringify(descriptor), {
             headers: { "content-type": "application/json" },

package/src/kernel/client-descriptor.test.ts

@@ -0,0 +1,78 @@
+/**
+ * Client descriptor printing — schema type strings are cached per object.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { z } from "zod";
+import type { AnyFlowDef } from "./flow.ts";
+import type { RuntimeRouteMap } from "./adopt-routes.ts";
+import { buildClientDescriptor } from "./client-descriptor.ts";
+
+const FLOW_COUNT = 64;
+
+function fieldSchema() {
+  return z.object({
+    id: z.string().uuid(),
+    title: z.string().min(1).max(120),
+    tags: z.array(z.string()),
+    count: z.number().int().nonnegative(),
+  });
+}
+
+function fixture(): {
+  routes: RuntimeRouteMap;
+  flows: Map<string, AnyFlowDef>;
+} {
+  const routes: RuntimeRouteMap = { app: {} };
+  const flows = new Map<string, AnyFlowDef>();
+  for (let i = 0; i < FLOW_COUNT; i++) {
+    const name = `flow${i}`;
+    routes.app![name] = { method: "GET", path: `/${name}` };
+    flows.set(`app.${name}`, {
+      in: fieldSchema(),
+      out: z.object({
+        id: z.string(),
+        title: z.string(),
+        createdAt: z.iso.datetime(),
+      }),
+    } as AnyFlowDef);
+  }
+  return { routes, flows };
+}
+
+describe("schemaToTsString cache", () => {
+  test("a second pass over the same schema objects skips reprinting them", () => {
+    const { routes, flows } = fixture();
+
+    const coldStart = performance.now();
+    const cold = buildClientDescriptor(routes, flows);
+    const coldMs = performance.now() - coldStart;
+
+    const warmStart = performance.now();
+    const warm = buildClientDescriptor(routes, flows);
+    const warmMs = performance.now() - warmStart;
+
+    expect(warm).toEqual(cold);
+    expect(cold.routes.app?.flow0?.in).toContain("title");
+    // Uncached toJSONSchema is the whole map. A cache hit is the map lookup.
+    expect(warmMs).toBeLessThan(coldMs / 4);
+    console.log(
+      `client descriptor ${FLOW_COUNT} flows cold=${coldMs.toFixed(1)}ms warm=${warmMs.toFixed(1)}ms`,
+    );
+
+    const previous = flows.get("app.flow0");
+    flows.set("app.flow0", {
+      in: z.object({ id: z.string(), extra: z.boolean() }),
+      out: previous?.out,
+    } as AnyFlowDef);
+
+    const touchedStart = performance.now();
+    const touched = buildClientDescriptor(routes, flows);
+    const touchedMs = performance.now() - touchedStart;
+
+    expect(touched.routes.app?.flow0?.in).toContain("extra");
+    expect(touched.routes.app?.flow1?.in).toBe(warm.routes.app?.flow1?.in);
+    expect(touchedMs).toBeLessThan(coldMs / 4);
+    console.log(`client descriptor one schema replaced=${touchedMs.toFixed(1)}ms`);
+  });
+});

package/src/kernel/client-descriptor.ts

@@ -9,6 +9,15 @@ import type { AnyFlowDef } from "./flow.ts";
 import type { RuntimeRouteMap } from "./adopt-routes.ts";
 import { z } from "zod";
 
+/**
+ * Printed type string per schema object.
+ *
+ * A flows-tree reload replaces the schema objects of the modules that
+ * actually changed. Every other flow keeps the same reference and hits
+ * this map instead of running `toJSONSchema` again.
+ */
+const schemaTsCache = new WeakMap<object, string>();
+
 /**
  * Build a client descriptor from runtime routes + flow defs (type strings + stamps).
  *
@@ -62,6 +71,20 @@ export function buildClientDescriptor(
  */
 export function schemaToTsString(schema: unknown): string {
   if (schema === undefined || schema === null) return "unknown";
+  if (typeof schema !== "object" && typeof schema !== "function") return "unknown";
+  const cached = schemaTsCache.get(schema);
+  if (cached !== undefined) return cached;
+  const printed = printSchemaToTs(schema);
+  schemaTsCache.set(schema, printed);
+  return printed;
+}
+
+/**
+ * Convert one schema object to a TypeScript type string. Uncached.
+ *
+ * @param schema - Object or function schema
+ */
+function printSchemaToTs(schema: object): string {
   try {
     if (hasToJSONSchema(schema)) {
       return jsonSchemaToTs(schema.toJSONSchema());

package/src/kernel/errors-text.ts

@@ -0,0 +1,99 @@
+/**
+ * English cause/fix templates for {@link OKE_ERRORS}.
+ *
+ * Loaded on first read so the kernel edge profile does not carry the
+ * strings. Localization still prefers the i18n catalogs when a locale
+ * overrides `oke.{code}.cause` / `oke.{code}.fix`.
+ */
+
+/** One registry template pair. */
+export interface OkeErrorText {
+  /** One-line cause template. */
+  readonly cause: string;
+  /** Suggested fix template. */
+  readonly fix: string;
+}
+
+/** Keyed by {@link OKE_ERRORS} property name. */
+export const OKE_ERROR_TEXT: Readonly<Record<string, OkeErrorText>> = {
+  UNDECLARED_READ: {
+    cause: 'Flow "{flow}" reads "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.reads.',
+  },
+  UNDECLARED_WRITE: {
+    cause: 'Flow "{flow}" writes "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.writes.',
+  },
+  UNDECLARED_EMIT: {
+    cause: 'Flow "{flow}" emits "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.emits.',
+  },
+  UNDECLARED_SEND: {
+    cause: 'Flow "{flow}" sends "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.sends.',
+  },
+  UNDECLARED_ASK: {
+    cause: 'Flow "{flow}" asks "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.asks.',
+  },
+  UNDECLARED_SECRET: {
+    cause: 'Flow "{flow}" reads secret "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.secrets.',
+  },
+  UNDECLARED_CALL: {
+    cause: 'Flow "{flow}" calls "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.calls.',
+  },
+  UNDECLARED_FETCH: {
+    cause: 'Flow "{flow}" fetches "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.fetches.',
+  },
+  UNDECLARED_EMBED: {
+    cause: 'Flow "{flow}" embeds with "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.embeds.',
+  },
+  NO_EFFECTS_DECLARED: {
+    cause: 'Flow "{flow}" has no declared effects and no Manifest to derive them from.{extract}',
+    fix:
+      "Add explicit `effects` to this flow, or boot with a Manifest (`oke build`) / " +
+      "`rootDir` so effects can be derived. If extract failed, ensure `oxc-parser` is " +
+      "installed (okengine dependency). dev+compose/prod refuse an open capability token.",
+  },
+  ADOPT_BARREL_STALE: {
+    cause: "src/flows/{unit} exists on disk but adopted no flows — the .adopt() barrel is stale.",
+    fix: "Run `oke dev` or `oke build` to regenerate `src/flows/index.ts`.",
+  },
+  HTTP_PATH_UNRESOLVED: {
+    cause: 'Flow "{flow}" bound {method} with no path — the file-tree stamp never ran.',
+    fix: 'Put the file under `src/flows/<unit>/` and import `@/flows`, or pass an explicit path to `http.{method}("/…")`.',
+  },
+  HTTP_ROUTE_DUPLICATE: {
+    cause: '{method} {path} is bound twice (flow "{flow}").',
+    fix: "Give each HTTP flow a unique method + path.",
+  },
+  HTTP_FLOW_UNNAMED: {
+    cause: "An HTTP flow on {method} {path} has no name.",
+    fix: 'Use `flow("unit.export", {…})` or export it from a `src/flows/<unit>/` file so the tree can stamp `unit.export`.',
+  },
+  LIVE_EXPOSURE_DUPLICATE: {
+    cause:
+      'Live signal "{signal}" is exposed twice with the same gates ({gates}) and match ({match}).',
+    fix: "Use a different gate or path-param filter, or drop the extra route.",
+  },
+  MCP_TOOL_DUPLICATE: {
+    cause: 'MCP tool "{tool}" is bound twice (flow "{flow}").',
+    fix: "Give each MCP tool exposure a unique tool name.",
+  },
+  ORPHAN_EMIT: {
+    cause: 'Flow "{flow}" emits signal "{resource}" with no subscriber.',
+    fix: "Add `on({resource}, …)` or mark the signal `{ optional: true }`.",
+  },
+  SIGNAL_SCHEMA: {
+    cause: '"{resource}": {detail}',
+    fix: "Fix schema payload.",
+  },
+  DOMAIN_SCHEMA_MISSING: {
+    cause: "domain table not found — migrations have not been applied.",
+    fix: "run `oke db migrate` against this environment.",
+  },
+};