@burdenoff/cli-sdk 2026.522.1 → 2026.525.2

package/dist/modules/security/index.cjs

@@ -1,4 +1,4 @@
-'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var c=class extends Error{exitCode;hint;constructor(o,a){super(o),this.name="CliUserError",this.exitCode=a?.exitCode??1,this.hint=a?.hint;}},h=class extends c{constructor(o,a){super(o,{exitCode:2,hint:a?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},f=class extends Error{cause;constructor(o,a){super(o),this.name="CliInternalError",this.cause=a;}};var C=null;function S(n){C=n;}function d(){if(!C)throw new f("vibecontrols module helpers used before setHelpersContext was called");return C}function Z(){let n=d();if(!n.auth.isAuthenticated())throw new h(`Authentication required. Run \`${n.productName} auth login\`.`)}async function u(n,o){return Z(),d().gql.workspace.request(n,o)}function p(n){let o=n instanceof Error?n.message:String(n);throw new c(o)}function l(n,o,a){d().output.formatAndOutput(n,o,a);}function g(n){d().output.printSuccess(n);}function k(n){return d().output.formatStatus(n)}function y(n){return d().output.formatDate(n)}function x(n,o){return d().output.truncate(n,o)}function v(){return d()}var b=`
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var c=class extends Error{exitCode;hint;constructor(o,s){super(o),this.name="CliUserError",this.exitCode=s?.exitCode??1,this.hint=s?.hint;}},w=class extends c{constructor(o,s){super(o,{exitCode:2,hint:s?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},f=class extends Error{cause;constructor(o,s){super(o),this.name="CliInternalError",this.cause=s;}};var k=null;function v(r){k=r;}function g(){if(!k)throw new f("vibecontrols module helpers used before setHelpersContext was called");return k}function ee(){let r=g();if(!r.auth.isAuthenticated())throw new w(`Authentication required. Run \`${r.productName} auth login\`.`)}async function u(r,o){return ee(),g().gql.workspace.request(r,o)}function p(r){let o=r instanceof Error?r.message:String(r);throw new c(o)}function l(r,o,s){g().output.formatAndOutput(r,o,s);}function d(r){g().output.printSuccess(r);}function y(r){return g().output.formatStatus(r)}function C(r){return g().output.formatDate(r)}function x(r,o){return g().output.truncate(r,o)}function S(){return g()}var A=`
   query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
     getVaults(filter: $filter, pagination: $pagination) {
       items { id name description scope status createdAt }
@@ -11,28 +11,34 @@
       id name description scope scopeId status lockAfterMinutes createdAt updatedAt
     }
   }
-`,A=`
+`,b=`
   mutation CreateVault($input: CreateVaultInput!) {
     createVault(input: $input) {
       id name scope scopeId status
     }
   }
 `,R=`
+  mutation UpdateVault($id: ID!, $input: UpdateVaultInput!) {
+    updateVault(id: $id, input: $input) {
+      id name scope scopeId status
+    }
+  }
+`,$=`
   mutation DeleteVault($id: ID!) {
     deleteVault(id: $id)
   }
-`,$=`
+`,O=`
   mutation ArchiveVault($id: ID!) {
     archiveVault(id: $id) { id status }
   }
-`,O=`
+`,D=`
   query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
     getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
       items { id key name description type status isEphemeral createdAt }
       total hasMore
     }
   }
-`,D=`
+`,L=`
   query GetSecret($id: ID!) {
     getSecret(id: $id) {
       id key name description type status isEphemeral expiresAt createdAt updatedAt
@@ -44,7 +50,7 @@
       id key value
     }
   }
-`,L=`
+`,V=`
   mutation CreateSecret($input: CreateSecretInput!) {
     createSecret(input: $input) {
       id key name type status
@@ -56,14 +62,14 @@
       id key name status updatedAt
     }
   }
-`,V=`
+`,_=`
   mutation DeleteSecret($id: ID!) {
     deleteSecret(id: $id)
   }
-`,_=`
+`,N=`
   mutation RotateSecret($id: ID!, $newValue: String!) {
     rotateSecret(id: $id, newValue: $newValue) {
       id key updatedAt
     }
   }
-`;function w(){let n=v().auth.read();if(!n?.workspaceId)throw new c("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:n.workspaceId}}async function N(){if(process.stdin.isTTY)throw new c('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let n=[];for await(let o of process.stdin)n.push(Buffer.isBuffer(o)?o:Buffer.from(o));return Buffer.concat(n).toString("utf8")}function G(n){let o=n.command("security").description("Security: vaults & secrets"),a=o.command("vaults").description("Vault management");a.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={context:w()};e.scope&&(t.scope=e.scope.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let r=await u(b,{filter:t,pagination:{limit:e.limit,offset:0}});l(e,r.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:r.getVaults.items.map(i=>[x(i.id,12),i.name,i.scope??"-",k(i.status),y(i.createdAt)])});}catch(t){p(t);}}),a.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(I,{id:e});if(!r.getVault)throw new c(`Vault ${e} not found`);l(t,r.getVault);}catch(r){p(r);}}),a.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",e=>parseInt(e,10)).option("-f, --format <format>").action(async e=>{try{let t=w(),r={context:t,name:e.name,description:e.description,scope:(e.scope??"WORKSPACE").toUpperCase(),scopeId:e.scopeId??t.workspaceId,lockAfterMinutes:e.lockAfter},i=await u(A,{input:r});g(`Vault created: ${i.createVault.name}`),l(e,i.createVault);}catch(t){p(t);}}),a.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(e,t)=>{try{t.archive?(await u($,{id:e}),g("Vault archived")):(await u(R,{id:e}),g("Vault deleted"));}catch(r){p(r);}});let m=o.command("secrets").description("Secret management");m.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={context:w()};e.type&&(t.type=e.type.toUpperCase()),e.search&&(t.search=e.search);let r=await u(O,{vaultId:e.vault,filter:t,pagination:{limit:e.limit,offset:0}});l(e,r.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:r.getSecrets.items.map(i=>[x(i.id,12),i.key,i.name,i.type??"-",k(i.status),y(i.createdAt)])});}catch(t){p(t);}}),m.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let r=await u(D,{id:e});if(!r.getSecret)throw new c(`Secret ${e} not found`);l(t,r.getSecret);}catch(r){p(r);}}),m.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async e=>{try{let t=await u(q,{id:e});process.stdout.write(t.decryptSecret.value);}catch(t){p(t);}}),m.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t=await N(),r={context:w(),vaultId:e.vault,key:e.key,name:e.name,description:e.description,type:(e.type??"OTHER").toUpperCase(),isEphemeral:!!e.ephemeral,expiresAt:e.expires,value:t},i=await u(L,{input:r});g(`Secret created: ${i.createSecret.key}`),l(e,i.createSecret);}catch(t){p(t);}}),m.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{if(t.rotate){let F=await N(),U=await u(_,{id:e,newValue:F});g("Secret rotated"),l(t,U.rotateSecret);return}let r={context:w()};if(t.name&&(r.name=t.name),t.description!==void 0&&(r.description=t.description),t.status&&(r.status=t.status.toUpperCase()),Object.keys(r).length===1)throw new c("No updates specified (use --rotate to change value)");let i=await u(P,{id:e,input:r});g("Secret updated"),l(t,i.updateSecret);}catch(r){p(r);}}),m.command("delete").description("Delete a secret").argument("<id>").action(async e=>{try{await u(V,{id:e}),g("Secret deleted");}catch(t){p(t);}});}var te={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(n,o){S(o),G(n);}},lt=te;module.exports=lt;
+`;function h(){let r=S().auth.read();if(!r?.workspaceId)throw new c("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:r.workspaceId}}async function U(){if(process.stdin.isTTY)throw new c('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let r=[];for await(let o of process.stdin)r.push(Buffer.isBuffer(o)?o:Buffer.from(o));return Buffer.concat(r).toString("utf8")}function G(r){let o=r.command("security").description("Security: vaults & secrets"),s=o.command("vaults").description("Vault management");s.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={context:h()};e.scope&&(t.scope=e.scope.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let n=await u(A,{filter:t,pagination:{limit:e.limit,offset:0}});l(e,n.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:n.getVaults.items.map(i=>[x(i.id,12),i.name,i.scope??"-",y(i.status),C(i.createdAt)])});}catch(t){p(t);}}),s.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await u(I,{id:e});if(!n.getVault)throw new c(`Vault ${e} not found`);l(t,n.getVault);}catch(n){p(n);}}),s.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",e=>parseInt(e,10)).option("-f, --format <format>").action(async e=>{try{let t=h(),n={context:t,name:e.name,description:e.description,scope:(e.scope??"WORKSPACE").toUpperCase(),scopeId:e.scopeId??t.workspaceId,lockAfterMinutes:e.lockAfter},i=await u(b,{input:n});d(`Vault created: ${i.createVault.name}`),l(e,i.createVault);}catch(t){p(t);}}),s.command("update").description("Update a vault").argument("<id>").option("--name <s>").option("--description <s>").option("--lock-after <minutes>","Auto-lock after N minutes",e=>parseInt(e,10)).option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.name&&(n.name=t.name),t.description!==void 0&&(n.description=t.description),t.lockAfter!==void 0&&(n.lockAfterMinutes=t.lockAfter),!Object.keys(n).length)throw new c("No updates specified");let i=await u(R,{id:e,input:n});d("Vault updated"),l(t,i.updateVault);}catch(n){p(n);}}),s.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(e,t)=>{try{t.archive?(await u(O,{id:e}),d("Vault archived")):(await u($,{id:e}),d("Vault deleted"));}catch(n){p(n);}});let m=o.command("secrets").description("Secret management");m.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",e=>parseInt(e,10),100).option("-f, --format <format>").action(async e=>{try{let t={context:h()};e.type&&(t.type=e.type.toUpperCase()),e.search&&(t.search=e.search);let n=await u(D,{vaultId:e.vault,filter:t,pagination:{limit:e.limit,offset:0}});l(e,n.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:n.getSecrets.items.map(i=>[x(i.id,12),i.key,i.name,i.type??"-",y(i.status),C(i.createdAt)])});}catch(t){p(t);}}),m.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await u(L,{id:e});if(!n.getSecret)throw new c(`Secret ${e} not found`);l(t,n.getSecret);}catch(n){p(n);}}),m.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async e=>{try{let t=await u(q,{id:e});process.stdout.write(t.decryptSecret.value);}catch(t){p(t);}}),m.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t=await U(),n={context:h(),vaultId:e.vault,key:e.key,name:e.name,description:e.description,type:(e.type??"OTHER").toUpperCase(),isEphemeral:!!e.ephemeral,expiresAt:e.expires,value:t},i=await u(V,{input:n});d(`Secret created: ${i.createSecret.key}`),l(e,i.createSecret);}catch(t){p(t);}}),m.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{if(t.rotate){let F=await U(),W=await u(N,{id:e,newValue:F});d("Secret rotated"),l(t,W.rotateSecret);return}let n={context:h()};if(t.name&&(n.name=t.name),t.description!==void 0&&(n.description=t.description),t.status&&(n.status=t.status.toUpperCase()),Object.keys(n).length===1)throw new c("No updates specified (use --rotate to change value)");let i=await u(P,{id:e,input:n});d("Secret updated"),l(t,i.updateSecret);}catch(n){p(n);}}),m.command("delete").description("Delete a secret").argument("<id>").action(async e=>{try{await u(_,{id:e}),d("Secret deleted");}catch(t){p(t);}});}var ne={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(r,o){v(o),G(r);}},dt=ne;module.exports=dt;

package/dist/modules/security/index.js

@@ -1,31 +1,37 @@
-import {a,b as b$1,g,o,m as m$1,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var C=`
+import {a,b,g,o,m,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o as o$1}from'../../chunk-RNWXATAC.js';var T=`
   query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
     getVaults(filter: $filter, pagination: $pagination) {
       items { id name description scope status createdAt }
       total hasMore
     }
   }
-`,T=`
+`,A=`
   query GetVault($id: ID!) {
     getVault(id: $id) {
       id name description scope scopeId status lockAfterMinutes createdAt updatedAt
     }
   }
-`,R=`
+`,C=`
   mutation CreateVault($input: CreateVaultInput!) {
     createVault(input: $input) {
       id name scope scopeId status
     }
   }
-`,A=`
+`,V=`
+  mutation UpdateVault($id: ID!, $input: UpdateVaultInput!) {
+    updateVault(id: $id, input: $input) {
+      id name scope scopeId status
+    }
+  }
+`,R=`
   mutation DeleteVault($id: ID!) {
     deleteVault(id: $id)
   }
-`,V=`
+`,I=`
   mutation ArchiveVault($id: ID!) {
     archiveVault(id: $id) { id status }
   }
-`,I=`
+`,k=`
   query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
     getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
       items { id key name description type status isEphemeral createdAt }
@@ -38,25 +44,25 @@ import {a,b as b$1,g,o,m as m$1,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o
       id key name description type status isEphemeral expiresAt createdAt updatedAt
     }
   }
-`,k=`
+`,$=`
   query DecryptSecret($id: ID!) {
     decryptSecret(id: $id) {
       id key value
     }
   }
-`,$=`
+`,x=`
   mutation CreateSecret($input: CreateSecretInput!) {
     createSecret(input: $input) {
       id key name type status
     }
   }
-`,x=`
+`,D=`
   mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {
     updateSecret(id: $id, input: $input) {
       id key name status updatedAt
     }
   }
-`,D=`
+`,U=`
   mutation DeleteSecret($id: ID!) {
     deleteSecret(id: $id)
   }
@@ -66,4 +72,4 @@ import {a,b as b$1,g,o,m as m$1,n,f,h,r}from'../../chunk-KTKHJORN.js';import {o
       id key updatedAt
     }
   }
-`;function m(){let s=r().auth.read();if(!s?.workspaceId)throw new o$1("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:s.workspaceId}}async function L(){if(process.stdin.isTTY)throw new o$1('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let s=[];for await(let c of process.stdin)s.push(Buffer.isBuffer(c)?c:Buffer.from(c));return Buffer.concat(s).toString("utf8")}function O(s){let c=s.command("security").description("Security: vaults & secrets"),l=c.command("vaults").description("Vault management");l.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={context:m()};t.scope&&(e.scope=t.scope.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let r=await b$1(C,{filter:e,pagination:{limit:t.limit,offset:0}});g(t,r.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:r.getVaults.items.map(a=>[o(a.id,12),a.name,a.scope??"-",m$1(a.status),n(a.createdAt)])});}catch(e){f(e);}}),l.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let r=await b$1(T,{id:t});if(!r.getVault)throw new o$1(`Vault ${t} not found`);g(e,r.getVault);}catch(r){f(r);}}),l.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",t=>parseInt(t,10)).option("-f, --format <format>").action(async t=>{try{let e=m(),r={context:e,name:t.name,description:t.description,scope:(t.scope??"WORKSPACE").toUpperCase(),scopeId:t.scopeId??e.workspaceId,lockAfterMinutes:t.lockAfter},a=await b$1(R,{input:r});h(`Vault created: ${a.createVault.name}`),g(t,a.createVault);}catch(e){f(e);}}),l.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(t,e)=>{try{e.archive?(await b$1(V,{id:t}),h("Vault archived")):(await b$1(A,{id:t}),h("Vault deleted"));}catch(r){f(r);}});let d=c.command("secrets").description("Secret management");d.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={context:m()};t.type&&(e.type=t.type.toUpperCase()),t.search&&(e.search=t.search);let r=await b$1(I,{vaultId:t.vault,filter:e,pagination:{limit:t.limit,offset:0}});g(t,r.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:r.getSecrets.items.map(a=>[o(a.id,12),a.key,a.name,a.type??"-",m$1(a.status),n(a.createdAt)])});}catch(e){f(e);}}),d.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let r=await b$1(v,{id:t});if(!r.getSecret)throw new o$1(`Secret ${t} not found`);g(e,r.getSecret);}catch(r){f(r);}}),d.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async t=>{try{let e=await b$1(k,{id:t});process.stdout.write(e.decryptSecret.value);}catch(e){f(e);}}),d.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e=await L(),r={context:m(),vaultId:t.vault,key:t.key,name:t.name,description:t.description,type:(t.type??"OTHER").toUpperCase(),isEphemeral:!!t.ephemeral,expiresAt:t.expires,value:e},a=await b$1($,{input:r});h(`Secret created: ${a.createSecret.key}`),g(t,a.createSecret);}catch(e){f(e);}}),d.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{if(e.rotate){let U=await L(),P=await b$1(_,{id:t,newValue:U});h("Secret rotated"),g(e,P.rotateSecret);return}let r={context:m()};if(e.name&&(r.name=e.name),e.description!==void 0&&(r.description=e.description),e.status&&(r.status=e.status.toUpperCase()),Object.keys(r).length===1)throw new o$1("No updates specified (use --rotate to change value)");let a=await b$1(x,{id:t,input:r});h("Secret updated"),g(e,a.updateSecret);}catch(r){f(r);}}),d.command("delete").description("Delete a secret").argument("<id>").action(async t=>{try{await b$1(D,{id:t}),h("Secret deleted");}catch(e){f(e);}});}var b={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(s,c){a(c),O(s);}},W=b;export{W as default};
+`;function l(){let o=r().auth.read();if(!o?.workspaceId)throw new o$1("No workspace set. Run: vibecontrols workspace set <id>");return {workspaceId:o.workspaceId}}async function L(){if(process.stdin.isTTY)throw new o$1('Pipe the secret value via stdin (e.g. `echo -n "value" | vibecontrols security secrets set ...`).');let o=[];for await(let p of process.stdin)o.push(Buffer.isBuffer(p)?p:Buffer.from(p));return Buffer.concat(o).toString("utf8")}function O(o$2){let p=o$2.command("security").description("Security: vaults & secrets"),m$1=p.command("vaults").description("Vault management");m$1.command("list").description("List vaults").option("--scope <s>","WORKSPACE|GLOBAL|VIBE").option("--status <s>").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={context:l()};t.scope&&(e.scope=t.scope.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let a=await b(T,{filter:e,pagination:{limit:t.limit,offset:0}});g(t,a.getVaults.items,{headers:["ID","Name","Scope","Status","Created"],rows:a.getVaults.items.map(r=>[o(r.id,12),r.name,r.scope??"-",m(r.status),n(r.createdAt)])});}catch(e){f(e);}}),m$1.command("get").description("Get a vault").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let a=await b(A,{id:t});if(!a.getVault)throw new o$1(`Vault ${t} not found`);g(e,a.getVault);}catch(a){f(a);}}),m$1.command("create").description("Create a vault").requiredOption("--name <name>").option("--description <s>").option("--scope <s>","WORKSPACE|GLOBAL|VIBE","WORKSPACE").option("--scope-id <id>","Scope id (defaults to current workspace)").option("--lock-after <minutes>","Auto-lock after N minutes",t=>parseInt(t,10)).option("-f, --format <format>").action(async t=>{try{let e=l(),a={context:e,name:t.name,description:t.description,scope:(t.scope??"WORKSPACE").toUpperCase(),scopeId:t.scopeId??e.workspaceId,lockAfterMinutes:t.lockAfter},r=await b(C,{input:a});h(`Vault created: ${r.createVault.name}`),g(t,r.createVault);}catch(e){f(e);}}),m$1.command("update").description("Update a vault").argument("<id>").option("--name <s>").option("--description <s>").option("--lock-after <minutes>","Auto-lock after N minutes",t=>parseInt(t,10)).option("-f, --format <format>").action(async(t,e)=>{try{let a={};if(e.name&&(a.name=e.name),e.description!==void 0&&(a.description=e.description),e.lockAfter!==void 0&&(a.lockAfterMinutes=e.lockAfter),!Object.keys(a).length)throw new o$1("No updates specified");let r=await b(V,{id:t,input:a});h("Vault updated"),g(e,r.updateVault);}catch(a){f(a);}}),m$1.command("delete").description("Delete a vault").argument("<id>").option("--archive","Archive instead of hard delete",false).action(async(t,e)=>{try{e.archive?(await b(I,{id:t}),h("Vault archived")):(await b(R,{id:t}),h("Vault deleted"));}catch(a){f(a);}});let u=p.command("secrets").description("Secret management");u.command("list").description("List secrets in a vault").requiredOption("--vault <id>").option("--type <t>","Filter by secret type").option("--search <q>").option("--limit <n>","Page size",t=>parseInt(t,10),100).option("-f, --format <format>").action(async t=>{try{let e={context:l()};t.type&&(e.type=t.type.toUpperCase()),t.search&&(e.search=t.search);let a=await b(k,{vaultId:t.vault,filter:e,pagination:{limit:t.limit,offset:0}});g(t,a.getSecrets.items,{headers:["ID","Key","Name","Type","Status","Created"],rows:a.getSecrets.items.map(r=>[o(r.id,12),r.key,r.name,r.type??"-",m(r.status),n(r.createdAt)])});}catch(e){f(e);}}),u.command("get").description("Get secret metadata (does NOT decrypt)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let a=await b(v,{id:t});if(!a.getSecret)throw new o$1(`Secret ${t} not found`);g(e,a.getSecret);}catch(a){f(a);}}),u.command("show").description("Decrypt and print a secret value (audited)").argument("<id>").action(async t=>{try{let e=await b($,{id:t});process.stdout.write(e.decryptSecret.value);}catch(e){f(e);}}),u.command("set").description("Create a secret. Reads the value from stdin.").requiredOption("--vault <id>").requiredOption("--key <key>","Secret key (unique within vault)").requiredOption("--name <name>").option("--description <s>").option("--type <t>","API_KEY|PASSWORD|CERTIFICATE|TOKEN|OTHER","OTHER").option("--ephemeral","Mark as ephemeral").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e=await L(),a={context:l(),vaultId:t.vault,key:t.key,name:t.name,description:t.description,type:(t.type??"OTHER").toUpperCase(),isEphemeral:!!t.ephemeral,expiresAt:t.expires,value:e},r=await b(x,{input:a});h(`Secret created: ${r.createSecret.key}`),g(t,r.createSecret);}catch(e){f(e);}}),u.command("update").description("Update a secret. Pass --value via stdin to rotate.").argument("<id>").option("--name <s>").option("--description <s>").option("--rotate","Rotate value (reads new value from stdin)").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{if(e.rotate){let P=await L(),b$1=await b(_,{id:t,newValue:P});h("Secret rotated"),g(e,b$1.rotateSecret);return}let a={context:l()};if(e.name&&(a.name=e.name),e.description!==void 0&&(a.description=e.description),e.status&&(a.status=e.status.toUpperCase()),Object.keys(a).length===1)throw new o$1("No updates specified (use --rotate to change value)");let r=await b(D,{id:t,input:a});h("Secret updated"),g(e,r.updateSecret);}catch(a){f(a);}}),u.command("delete").description("Delete a secret").argument("<id>").action(async t=>{try{await b(U,{id:t}),h("Secret deleted");}catch(e){f(e);}});}var q={id:"security",version:"1.0.0",displayName:"Security",dependsOn:["auth","workspaces"],register(o,p){a(p),O(o);}},j=q;export{j as default};