@vibesdotdev/infra-cloudflare 0.0.1

package/dist/secrets/cloudflare-api.descriptor.js

@@ -0,0 +1,32 @@
+/**
+ * Cloudflare API Backend Descriptor
+ *
+ * Pushes secrets to Cloudflare Pages/Workers via the REST API.
+ * Write-only: CF does not expose secret values after setting.
+ */
+/**
+ * Cloudflare API secrets backend descriptor.
+ *
+ * @remarks
+ * Project names can be provided via descriptor.config.cfProjectNames.
+ * If not provided, the implementation will attempt to derive them from
+ * runtime-resolved infra/web-app descriptors (requires runtime context).
+ */
+const descriptor = {
+    id: 'cloudflare-api',
+    kind: 'secrets/store',
+    name: 'Cloudflare API',
+    description: 'Push secrets to Cloudflare Pages and Workers via REST API',
+    tags: ['remote', 'cloudflare'],
+    enabled: true,
+    backend: 'cloudflare-api',
+    tiers: ['staging', 'production'],
+    priority: 20,
+    config: {
+        apiTokenEnvVar: 'CLOUDFLARE_API_TOKEN',
+        accountIdEnvVar: 'CLOUDFLARE_ACCOUNT_ID'
+        // cfProjectNames: optional string[] - omitted to allow runtime resolution
+    }
+};
+export default descriptor;
+//# sourceMappingURL=cloudflare-api.descriptor.js.map

package/dist/secrets/cloudflare-api.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.descriptor.js","sourceRoot":"","sources":["../../src/secrets/cloudflare-api.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,2DAA2D;IACxE,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC9B,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE;QACP,cAAc,EAAE,sBAAsB;QACtC,eAAe,EAAE,uBAAuB;QACxC,0EAA0E;KAC1E;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/secrets/cloudflare-api.impl.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Cloudflare API Backend Implementation
+ *
+ * Manages secrets across CF Pages projects and Workers scripts.
+ * Maps infra/web-app descriptors to CF project names for push operations.
+ *
+ * Note: CF secrets are write-only. get() and getAll() return empty results.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+import type { SecretsStoreImplementation, SecretEntry } from '@vibesdotdev/secrets/kinds/store.interface';
+/** Function type for resolving CF project names from descriptors */
+type CFProjectNamesResolver = () => string[];
+declare class CloudflareApiStore implements SecretsStoreImplementation {
+    readonly id = "cloudflare-api";
+    readonly descriptor: SecretsStoreDescriptor;
+    private readonly cfProjectNamesResolver?;
+    private connector;
+    constructor(desc: SecretsStoreDescriptor, projectNamesResolver?: CFProjectNamesResolver);
+    private getConnector;
+    list(_environment: string): Promise<SecretEntry[]>;
+    get(_environment: string, _key: string): Promise<string | undefined>;
+    set(environment: string, key: string, value: string): Promise<void>;
+    unset(_environment: string, _key: string): Promise<void>;
+    getAll(_environment: string): Promise<Record<string, string>>;
+    setAll(_environment: string, secrets: Record<string, string>): Promise<void>;
+    private getCFProjectNames;
+}
+export declare function createCloudflareApiStore(projectNamesResolver?: CFProjectNamesResolver): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<CloudflareApiStore>;
+export {};
+//# sourceMappingURL=cloudflare-api.impl.d.ts.map

package/dist/secrets/cloudflare-api.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.impl.d.ts","sourceRoot":"","sources":["../../src/secrets/cloudflare-api.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAK1G,oEAAoE;AACpE,KAAK,sBAAsB,GAAG,MAAM,MAAM,EAAE,CAAC;AAE7C,cAAM,kBAAmB,YAAW,0BAA0B;IAC7D,QAAQ,CAAC,EAAE,oBAAoB;IAC/B,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAyB;IACjE,OAAO,CAAC,SAAS,CAAkD;gBAEvD,IAAI,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,EAAE,sBAAsB;YAKzE,YAAY;IAmBpB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAuBlD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIpE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI7D,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAalF,OAAO,CAAC,iBAAiB;CAmBzB;AAED,wBAAgB,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,sBAAsB,mFAQrF"}

package/dist/secrets/cloudflare-api.impl.js

@@ -0,0 +1,111 @@
+/**
+ * Cloudflare API Backend Implementation
+ *
+ * Manages secrets across CF Pages projects and Workers scripts.
+ * Maps infra/web-app descriptors to CF project names for push operations.
+ *
+ * Note: CF secrets are write-only. get() and getAll() return empty results.
+ */
+import { createRuntimeImplementation } from '@vibesdotdev/runtime/factory/implementation';
+import { CloudflareSecretsManagerConnector } from '@vibesdotdev/connector-cloudflare';
+import descriptor from './cloudflare-api.descriptor';
+import { resolveCfCredentialKeys } from './resolve-cf-credentials';
+class CloudflareApiStore {
+    id = 'cloudflare-api';
+    descriptor;
+    cfProjectNamesResolver;
+    connector = null;
+    constructor(desc, projectNamesResolver) {
+        this.descriptor = desc;
+        this.cfProjectNamesResolver = projectNamesResolver;
+    }
+    async getConnector() {
+        if (this.connector)
+            return this.connector;
+        const tokenVar = this.descriptor.config?.apiTokenEnvVar ?? 'CLOUDFLARE_API_TOKEN';
+        const accountVar = this.descriptor.config?.accountIdEnvVar ?? 'CLOUDFLARE_ACCOUNT_ID';
+        const envReader = await resolveCfCredentialKeys([tokenVar, accountVar]);
+        this.connector = await CloudflareSecretsManagerConnector.create({
+            accountId: { source: 'env', key: accountVar },
+            apiToken: { source: 'env', key: tokenVar }
+        }, {
+            environment: 'production',
+            envReader
+        });
+        return this.connector;
+    }
+    async list(_environment) {
+        const connector = await this.getConnector();
+        const entries = [];
+        try {
+            const projectNames = this.getCFProjectNames();
+            for (const projectName of projectNames) {
+                try {
+                    const names = await connector.list(projectName);
+                    for (const key of names) {
+                        entries.push({ key, hasValue: true, source: this.id });
+                    }
+                }
+                catch {
+                    // skip unreachable projects
+                }
+            }
+        }
+        catch (e) {
+            console.warn(`[cloudflare-api] Failed to list secrets: ${e}`);
+        }
+        return entries;
+    }
+    async get(_environment, _key) {
+        return undefined; // CF does not return secret values
+    }
+    async set(environment, key, value) {
+        await this.setAll(environment, { [key]: value });
+    }
+    async unset(_environment, _key) {
+        console.warn('[cloudflare-api] CF does not support deleting individual secrets. Re-push all secrets to update.');
+    }
+    async getAll(_environment) {
+        return {}; // CF does not return secret values
+    }
+    async setAll(_environment, secrets) {
+        const connector = await this.getConnector();
+        const projectNames = this.getCFProjectNames();
+        for (const projectName of projectNames) {
+            try {
+                await connector.set(secrets, projectName);
+            }
+            catch (e) {
+                console.warn(`[cloudflare-api] Failed to push to ${projectName}: ${e}`);
+            }
+        }
+    }
+    getCFProjectNames() {
+        // First priority: explicit project names from descriptor config
+        const explicitNames = this.descriptor.config?.cfProjectNames;
+        if (explicitNames && explicitNames.length > 0) {
+            return explicitNames;
+        }
+        // Second priority: runtime-resolved project names via injected resolver
+        if (this.cfProjectNamesResolver) {
+            try {
+                return this.cfProjectNamesResolver();
+            }
+            catch {
+                // Resolver failed, fall through to empty
+            }
+        }
+        // No project names available
+        return [];
+    }
+}
+export function createCloudflareApiStore(projectNamesResolver) {
+    const store = new CloudflareApiStore(descriptor, projectNamesResolver);
+    return createRuntimeImplementation({
+        id: 'cloudflare-api',
+        kind: 'secrets/store',
+        priority: 20,
+        implementation: store
+    });
+}
+//# sourceMappingURL=cloudflare-api.impl.js.map

package/dist/secrets/cloudflare-api.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.impl.js","sourceRoot":"","sources":["../../src/secrets/cloudflare-api.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAG1F,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,UAAU,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,MAAM,kBAAkB;IACd,EAAE,GAAG,gBAAgB,CAAC;IACtB,UAAU,CAAyB;IAC3B,sBAAsB,CAA0B;IACzD,SAAS,GAA6C,IAAI,CAAC;IAEnE,YAAY,IAA4B,EAAE,oBAA6C;QACtF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,sBAAsB,GAAG,oBAAoB,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY;QACzB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,IAAI,sBAAsB,CAAC;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,IAAI,uBAAuB,CAAC;QAEtF,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,IAAI,CAAC,SAAS,GAAG,MAAM,iCAAiC,CAAC,MAAM,CAAC;YAC/D,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAC7C,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE;SAC1C,EAAE;YACF,WAAW,EAAE,YAAY;YACzB,SAAS;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAoB;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,IAAI,CAAC;YACJ,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAChD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;wBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC;gBACF,CAAC;gBAAC,MAAM,CAAC;oBACR,4BAA4B;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,YAAoB,EAAE,IAAY;QAC3C,OAAO,SAAS,CAAC,CAAC,mCAAmC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACxD,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,IAAY;QAC7C,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IAClH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAChC,OAAO,EAAE,CAAC,CAAC,mCAAmC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,OAA+B;QACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE9C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,sCAAsC,WAAW,KAAK,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;IACF,CAAC;IAEO,iBAAiB;QACxB,gEAAgE;QAChE,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,cAAsC,CAAC;QACrF,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC;QACtB,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,IAAI,CAAC;gBACJ,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACR,yCAAyC;YAC1C,CAAC;QACF,CAAC;QAED,6BAA6B;QAC7B,OAAO,EAAE,CAAC;IACX,CAAC;CACD;AAED,MAAM,UAAU,wBAAwB,CAAC,oBAA6C;IACrF,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IACvE,OAAO,2BAA2B,CAAC;QAClC,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,KAAK;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/secrets/cloudflare-secrets-store.descriptor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Cloudflare Secrets Store Backend Descriptor
+ *
+ * Account-level secrets, bound to Workers via wrangler `secrets_store_secrets`.
+ * Distinct from `cloudflare-api`, which writes per-Worker / per-Pages secrets.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=cloudflare-secrets-store.descriptor.d.ts.map

package/dist/secrets/cloudflare-secrets-store.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-secrets-store.descriptor.d.ts","sourceRoot":"","sources":["../../src/secrets/cloudflare-secrets-store.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,QAAA,MAAM,UAAU,EAAE,sBAejB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/secrets/cloudflare-secrets-store.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * Cloudflare Secrets Store Backend Descriptor
+ *
+ * Account-level secrets, bound to Workers via wrangler `secrets_store_secrets`.
+ * Distinct from `cloudflare-api`, which writes per-Worker / per-Pages secrets.
+ */
+const descriptor = {
+    id: 'cloudflare-secrets-store',
+    kind: 'secrets/store',
+    name: 'Cloudflare Secrets Store',
+    description: 'Account-level Cloudflare Secrets Store; bound to Workers via secrets_store_secrets',
+    tags: ['remote', 'cloudflare', 'shared'],
+    enabled: true,
+    backend: 'cloudflare-secrets-store',
+    tiers: ['staging', 'production'],
+    priority: 30,
+    config: {
+        apiTokenEnvVar: 'CLOUDFLARE_API_TOKEN',
+        accountIdEnvVar: 'CLOUDFLARE_ACCOUNT_ID',
+        storeIdEnvVar: 'CLOUDFLARE_SECRETS_STORE_ID'
+    }
+};
+export default descriptor;
+//# sourceMappingURL=cloudflare-secrets-store.descriptor.js.map

package/dist/secrets/cloudflare-secrets-store.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-secrets-store.descriptor.js","sourceRoot":"","sources":["../../src/secrets/cloudflare-secrets-store.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,oFAAoF;IACjG,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;IACxC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE;QACP,cAAc,EAAE,sBAAsB;QACtC,eAAe,EAAE,uBAAuB;QACxC,aAAa,EAAE,6BAA6B;KAC5C;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/secrets/cloudflare-secrets-store.impl.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cloudflare Secrets Store Backend Implementation
+ *
+ * Manages secrets at the Cloudflare account level. Workers consume them via
+ * wrangler `secrets_store_secrets` bindings, generated by pages.impl.ts.
+ *
+ * Like the per-Worker secrets API, store secrets are write-only — get() / getAll()
+ * always return empty results. List() returns names only.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+import type { SecretsStoreImplementation, SecretEntry } from '@vibesdotdev/secrets/kinds/store.interface';
+declare class CloudflareSecretsStore implements SecretsStoreImplementation {
+    readonly id = "cloudflare-secrets-store";
+    readonly descriptor: SecretsStoreDescriptor;
+    private connector;
+    constructor(desc: SecretsStoreDescriptor);
+    private getConnector;
+    list(_environment: string): Promise<SecretEntry[]>;
+    get(_environment: string, _key: string): Promise<string | undefined>;
+    set(environment: string, key: string, value: string): Promise<void>;
+    unset(_environment: string, key: string): Promise<void>;
+    getAll(_environment: string): Promise<Record<string, string>>;
+    setAll(environment: string, secrets: Record<string, string>): Promise<void>;
+}
+export declare function createCloudflareSecretsStore(): import("@vibesdotdev/runtime").RuntimeImplementationWrapper<CloudflareSecretsStore>;
+export {};
+//# sourceMappingURL=cloudflare-secrets-store.impl.d.ts.map

package/dist/secrets/cloudflare-secrets-store.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-secrets-store.impl.d.ts","sourceRoot":"","sources":["../../src/secrets/cloudflare-secrets-store.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAK1G,cAAM,sBAAuB,YAAW,0BAA0B;IACjE,QAAQ,CAAC,EAAE,8BAA8B;IACzC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,OAAO,CAAC,SAAS,CAAkD;gBAEvD,IAAI,EAAE,sBAAsB;YAI1B,YAAY;IAqBpB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAMlD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIpE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI7D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAIjF;AAED,wBAAgB,4BAA4B,wFAQ3C"}

package/dist/secrets/cloudflare-secrets-store.impl.js

@@ -0,0 +1,72 @@
+/**
+ * Cloudflare Secrets Store Backend Implementation
+ *
+ * Manages secrets at the Cloudflare account level. Workers consume them via
+ * wrangler `secrets_store_secrets` bindings, generated by pages.impl.ts.
+ *
+ * Like the per-Worker secrets API, store secrets are write-only — get() / getAll()
+ * always return empty results. List() returns names only.
+ */
+import { createRuntimeImplementation } from '@vibesdotdev/runtime/factory/implementation';
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+import { CloudflareSecretsManagerConnector } from '@vibesdotdev/connector-cloudflare';
+import descriptor from './cloudflare-secrets-store.descriptor';
+import { resolveCfCredentialKeys } from './resolve-cf-credentials';
+class CloudflareSecretsStore {
+    id = 'cloudflare-secrets-store';
+    descriptor;
+    connector = null;
+    constructor(desc) {
+        this.descriptor = desc;
+    }
+    async getConnector() {
+        if (this.connector)
+            return this.connector;
+        const tokenVar = this.descriptor.config?.apiTokenEnvVar ?? 'CLOUDFLARE_API_TOKEN';
+        const accountVar = this.descriptor.config?.accountIdEnvVar ?? 'CLOUDFLARE_ACCOUNT_ID';
+        const storeVar = this.descriptor.config?.storeIdEnvVar ?? 'CLOUDFLARE_SECRETS_STORE_ID';
+        const envReader = await resolveCfCredentialKeys([tokenVar, accountVar, storeVar]);
+        this.connector = await CloudflareSecretsManagerConnector.create({
+            accountId: { source: 'env', key: accountVar },
+            apiToken: { source: 'env', key: tokenVar },
+            storeId: { source: 'env', key: storeVar }
+        }, {
+            environment: 'production',
+            envReader
+        });
+        return this.connector;
+    }
+    async list(_environment) {
+        const connector = await this.getConnector();
+        const names = await connector.listStore();
+        return names.map((key) => ({ key, hasValue: true, source: this.id }));
+    }
+    async get(_environment, _key) {
+        return undefined;
+    }
+    async set(environment, key, value) {
+        const connector = await this.getConnector();
+        await connector.setStore({ [key]: value });
+    }
+    async unset(_environment, key) {
+        const connector = await this.getConnector();
+        await connector.unsetStore(key);
+    }
+    async getAll(_environment) {
+        return {};
+    }
+    async setAll(environment, secrets) {
+        const connector = await this.getConnector();
+        await connector.setStore(secrets);
+    }
+}
+export function createCloudflareSecretsStore() {
+    const store = new CloudflareSecretsStore(descriptor);
+    return createRuntimeImplementation({
+        id: 'cloudflare-secrets-store',
+        kind: 'secrets/store',
+        priority: 30,
+        implementation: store
+    });
+}
+//# sourceMappingURL=cloudflare-secrets-store.impl.js.map

package/dist/secrets/cloudflare-secrets-store.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-secrets-store.impl.js","sourceRoot":"","sources":["../../src/secrets/cloudflare-secrets-store.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,UAAU,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,sBAAsB;IAClB,EAAE,GAAG,0BAA0B,CAAC;IAChC,UAAU,CAAyB;IACpC,SAAS,GAA6C,IAAI,CAAC;IAEnE,YAAY,IAA4B;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,YAAY;QACzB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,IAAI,sBAAsB,CAAC;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,IAAI,uBAAuB,CAAC;QACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,6BAA6B,CAAC;QAExF,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAElF,IAAI,CAAC,SAAS,GAAG,MAAM,iCAAiC,CAAC,MAAM,CAAC;YAC/D,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAC7C,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE;YAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE;SACzC,EAAE;YACF,WAAW,EAAE,YAAY;YACzB,SAAS;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAoB;QAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,YAAoB,EAAE,IAAY;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,GAAW;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAChC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,OAA+B;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACD;AAED,MAAM,UAAU,4BAA4B;IAC3C,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACrD,OAAO,2BAA2B,CAAC;QAClC,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,KAAK;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/secrets/index.d.ts

@@ -0,0 +1,6 @@
+export { default as cloudflareApiDescriptor } from './cloudflare-api.descriptor';
+export { createCloudflareApiStore } from './cloudflare-api.impl';
+export { default as cloudflareSecretsStoreDescriptor } from './cloudflare-secrets-store.descriptor';
+export { createCloudflareSecretsStore } from './cloudflare-secrets-store.impl';
+export { type CFClientConfig, listPagesSecrets, setPagesSecrets, listWorkerSecrets, setWorkerSecrets } from '@vibesdotdev/connector-cloudflare/api';
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAE,OAAO,IAAI,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EACN,KAAK,cAAc,EACnB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,uCAAuC,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,6 @@
+export { default as cloudflareApiDescriptor } from './cloudflare-api.descriptor.js';
+export { createCloudflareApiStore } from './cloudflare-api.impl.js';
+export { default as cloudflareSecretsStoreDescriptor } from './cloudflare-secrets-store.descriptor.js';
+export { createCloudflareSecretsStore } from './cloudflare-secrets-store.impl.js';
+export { listPagesSecrets, setPagesSecrets, listWorkerSecrets, setWorkerSecrets } from '@vibesdotdev/connector-cloudflare/api';
+//# sourceMappingURL=index.js.map

package/dist/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAE,OAAO,IAAI,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,OAAO,EAEN,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,MAAM,uCAAuC,CAAC"}

package/dist/secrets/resolve-cf-credentials.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CF credential resolver shared by the `cloudflare-api` and
+ * `cloudflare-secrets-store` backends.
+ *
+ * `CloudflareSecretsManagerConnector.create({ source: 'env', ... })` only
+ * reads `process.env` (or an `envReader` override) — it doesn't know how to
+ * peek at the runtime's secret backends. That's painful for the secrets CLI:
+ * a user who already ran `vibes secrets set CLOUDFLARE_API_TOKEN ...` still
+ * has to manually re-export the same values in their shell before
+ * `vibes secrets push --to cloudflare-secrets-store` will succeed.
+ *
+ * `resolveCfCredentialKeys` builds an `envReader` map that prefers
+ * `process.env` (so CI / explicit overrides still win) and falls back to
+ * the first available local-tier `secrets/store` backend. Pass the returned
+ * map to the connector via `opts.envReader`.
+ */
+export declare function resolveCfCredentialKeys(keys: string[], environment?: string): Promise<Record<string, string | undefined>>;
+//# sourceMappingURL=resolve-cf-credentials.d.ts.map

package/dist/secrets/resolve-cf-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-cf-credentials.d.ts","sourceRoot":"","sources":["../../src/secrets/resolve-cf-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,wBAAsB,uBAAuB,CAC5C,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,GAAE,MAAgB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAsC7C"}

package/dist/secrets/resolve-cf-credentials.js

@@ -0,0 +1,57 @@
+/**
+ * CF credential resolver shared by the `cloudflare-api` and
+ * `cloudflare-secrets-store` backends.
+ *
+ * `CloudflareSecretsManagerConnector.create({ source: 'env', ... })` only
+ * reads `process.env` (or an `envReader` override) — it doesn't know how to
+ * peek at the runtime's secret backends. That's painful for the secrets CLI:
+ * a user who already ran `vibes secrets set CLOUDFLARE_API_TOKEN ...` still
+ * has to manually re-export the same values in their shell before
+ * `vibes secrets push --to cloudflare-secrets-store` will succeed.
+ *
+ * `resolveCfCredentialKeys` builds an `envReader` map that prefers
+ * `process.env` (so CI / explicit overrides still win) and falls back to
+ * the first available local-tier `secrets/store` backend. Pass the returned
+ * map to the connector via `opts.envReader`.
+ */
+import { getVibesRuntime } from '@vibesdotdev/runtime';
+const LOCAL_BACKEND_IDS = ['encrypted-local', 'env-file'];
+export async function resolveCfCredentialKeys(keys, environment = 'local') {
+    const resolved = {};
+    const runtime = getVibesRuntime();
+    let localStore = null;
+    if (runtime.hasKind('secrets/store')) {
+        for (const id of LOCAL_BACKEND_IDS) {
+            try {
+                const impl = (await runtime
+                    .query('secrets/store')
+                    .withId(id)
+                    .resolve());
+                if (impl && typeof impl.get === 'function') {
+                    localStore = { get: impl.get.bind(impl) };
+                    break;
+                }
+            }
+            catch {
+                // next candidate
+            }
+        }
+    }
+    for (const key of keys) {
+        const envValue = process.env[key];
+        if (envValue && envValue !== '') {
+            resolved[key] = envValue;
+            continue;
+        }
+        if (localStore) {
+            try {
+                resolved[key] = await localStore.get(environment, key);
+            }
+            catch {
+                resolved[key] = undefined;
+            }
+        }
+    }
+    return resolved;
+}
+//# sourceMappingURL=resolve-cf-credentials.js.map

package/dist/secrets/resolve-cf-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-cf-credentials.js","sourceRoot":"","sources":["../../src/secrets/resolve-cf-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAU,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,IAAc,EACd,cAAsB,OAAO;IAE7B,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,UAAU,GAA0E,IAAI,CAAC;IAE7F,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO;qBACzB,KAAK,CAAC,eAAe,CAAC;qBACtB,MAAM,CAAC,EAAE,CAAC;qBACV,OAAO,EAAE,CAAwE,CAAC;gBACpF,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;oBAC5C,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM;gBACP,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,iBAAiB;YAClB,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACjC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACzB,SAAS;QACV,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC;gBACJ,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/web-app.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Cloudflare Workers + Static Assets Web App Deployment Module
+ *
+ * Public entrypoint for the canonical Vibes deploy target: Cloudflare Workers
+ * with a Static Assets binding (the @sveltejs/adapter-cloudflare shape).
+ * Pages-targeting consumers should import from `./pages` instead.
+ */
+export { createCloudflareWebAppDeployment, generateCloudflareWebAppDescriptor, CloudflareWebAppDescriptorSchema, SHARED_BANDWIDTH_TELEMETRY_DATASET, type CloudflareWebAppDeployment, type CloudflareWebAppDescriptor, type CloudflareWebAppDescriptorInput, type WranglerWebAppConfig, type WranglerWebAppRoute, type WranglerWebAppAssets, type WranglerSecretsStoreBinding, type WranglerAnalyticsEngineBinding } from './implementations/web-app.impl';
+export { renderWranglerJson } from './implementations/pages.impl';
+export { WEB_APP_HEADER_LINES, isCloudflareWebAppDeployment, renderManagedWranglerJsonc, renderWranglerJsoncFromDefaultExport, type WranglerRenderResult } from './regen.ts';
+//# sourceMappingURL=web-app.d.ts.map

package/dist/web-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-app.d.ts","sourceRoot":"","sources":["../src/web-app.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,kCAAkC,EAClC,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,8BAA8B,EACnC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,EAC1B,oCAAoC,EACpC,KAAK,oBAAoB,EACzB,MAAM,YAAY,CAAC"}

package/dist/web-app.js

@@ -0,0 +1,11 @@
+/**
+ * Cloudflare Workers + Static Assets Web App Deployment Module
+ *
+ * Public entrypoint for the canonical Vibes deploy target: Cloudflare Workers
+ * with a Static Assets binding (the @sveltejs/adapter-cloudflare shape).
+ * Pages-targeting consumers should import from `./pages` instead.
+ */
+export { createCloudflareWebAppDeployment, generateCloudflareWebAppDescriptor, CloudflareWebAppDescriptorSchema, SHARED_BANDWIDTH_TELEMETRY_DATASET } from './implementations/web-app.impl';
+export { renderWranglerJson } from './implementations/pages.impl';
+export { WEB_APP_HEADER_LINES, isCloudflareWebAppDeployment, renderManagedWranglerJsonc, renderWranglerJsoncFromDefaultExport } from "./regen.js";
+//# sourceMappingURL=web-app.js.map

package/dist/web-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-app.js","sourceRoot":"","sources":["../src/web-app.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,kCAAkC,EASlC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,EAC1B,oCAAoC,EAEpC,MAAM,YAAY,CAAC"}