@vibesdotdev/integrations-digitalocean 0.0.0-stage → 1.0.0-rc.2

package/dist/secrets/app-platform/app-credentials.impl.js

@@ -0,0 +1,237 @@
+/**
+ * DigitalOcean App credential use builds reference bindings and sends each
+ * bound mutation through Secrets authenticated-request. Caller-owned values
+ * live only in an operation-scoped by-id store registered for that mutation.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { SecretsStoreDescriptorSchema } from '@vibesdotdev/secrets';
+import { CredentialUseBindingSchema } from '@vibesdotdev/secrets/schemas';
+import { DigitalOceanControlPlaneClient } from "../../client/control-plane.js";
+import { requireApiToken } from "../../credentials/index.js";
+import { buildDigitalOceanAppSpec } from "../../apps/build-spec.js";
+import { AppDeploymentResourceResponseSchema, CreateAppDeploymentResponseSchema } from "../../schemas/http.js";
+import { DigitalOceanSecretCredentialReferenceSchema, DigitalOceanTokenCredentialCandidatesSchema } from "../../schemas/control-plane.js";
+import { DIGITALOCEAN_APP_CREDENTIALS_CLIENT_ID, DigitalOceanAppCredentialMutationRequestSchema, DigitalOceanAppCredentialMutationOutcomeSchema, DigitalOceanAppDeploymentPhaseSchema } from "../../schemas/app-deployment.js";
+const silentLog = { info() { } };
+function operationStoreReadOnly() {
+    return new CapabilityError('Operation-scoped App credentials permit reference reads only.', 'UNAVAILABLE', { reason: 'digitalocean-app-operation-store-read-only', retryable: false });
+}
+function createOperationSecretReference(storeId, values, value) {
+    const key = storeId + '-value-' + values.size;
+    values.set(key, value);
+    return DigitalOceanSecretCredentialReferenceSchema.parse({
+        source: 'secret',
+        store: storeId,
+        key
+    });
+}
+function registerOperationSecretStore(runtime, storeId, values) {
+    const descriptor = SecretsStoreDescriptorSchema.parse({
+        id: storeId,
+        kind: 'secrets/store',
+        backend: 'digitalocean-app-operation',
+        selection: 'by-id',
+        priority: 100,
+        tiers: ['local', 'dev', 'staging', 'production'],
+        enabled: true
+    });
+    return runtime.registerDynamicAsset('secrets/store', descriptor, async () => ({
+        impl: {
+            id: descriptor.id,
+            descriptor,
+            async list() {
+                return [];
+            },
+            async get(_tier, key) {
+                return values.get(key);
+            },
+            async getAll() {
+                throw operationStoreReadOnly();
+            },
+            async set() {
+                throw operationStoreReadOnly();
+            },
+            async unset() {
+                throw operationStoreReadOnly();
+            },
+            async setAll() {
+                throw operationStoreReadOnly();
+            }
+        }
+    }));
+}
+function appCredentialBinding(key, path, required, store) {
+    const reference = store === undefined
+        ? DigitalOceanSecretCredentialReferenceSchema.parse({ source: 'secret', key })
+        : DigitalOceanSecretCredentialReferenceSchema.parse({ source: 'secret', key, store });
+    return CredentialUseBindingSchema.parse({
+        kind: 'json-field',
+        candidates: [reference],
+        path,
+        required
+    });
+}
+function appCredentialBindings(deployment, appConfig, spec, storeId, operationValues) {
+    const bindings = [];
+    const groups = [
+        { path: 'services', specs: spec.services ?? [], configs: appConfig?.services ?? [] },
+        { path: 'workers', specs: spec.workers ?? [], configs: appConfig?.workers ?? [] },
+        {
+            path: 'jobs',
+            specs: spec.jobs ?? [],
+            configs: [...(appConfig?.jobs ?? []), ...(appConfig?.cronJobs ?? [])]
+        },
+        { path: 'static_sites', specs: spec.static_sites ?? [], configs: appConfig?.staticSites ?? [] }
+    ];
+    for (const group of groups) {
+        for (const [componentIndex, component] of group.specs.entries()) {
+            const configuredComponent = group.configs.find(({ name }) => name === component.name);
+            for (const [envIndex, env] of (component.envs ?? []).entries()) {
+                if (env.type !== 'SECRET')
+                    continue;
+                const configuredEnv = configuredComponent?.envs.find(({ key, type }) => key === env.key && type === 'SECRET');
+                const requirement = deployment.env.find(({ name, secret }) => name === env.key && secret === true);
+                const source = configuredEnv ?? requirement;
+                if (source === undefined)
+                    continue;
+                let key;
+                let store;
+                if (source.value !== undefined) {
+                    const reference = createOperationSecretReference(storeId, operationValues, source.value);
+                    key = reference.key;
+                    store = reference.store;
+                }
+                else {
+                    key = source.storeKey ?? ('key' in source ? source.key : source.name);
+                }
+                bindings.push(appCredentialBinding(key, ['spec', group.path, String(componentIndex), 'envs', String(envIndex), 'value'], requirement === undefined ? false : requirement.required !== false, store));
+            }
+        }
+    }
+    for (const [destinationIndex, destination] of (appConfig?.logDestinations ?? []).entries()) {
+        const endpoint = destination.endpoint;
+        switch (endpoint.kind) {
+            case 'datadog':
+                bindings.push(appCredentialBinding(endpoint.apiKeyStoreKey, ['spec', 'log_destinations', String(destinationIndex), 'datadog', 'api_key'], false));
+                break;
+            case 'logtail':
+                bindings.push(appCredentialBinding(endpoint.tokenStoreKey, ['spec', 'log_destinations', String(destinationIndex), 'logtail', 'token'], false));
+                break;
+            case 'opensearch':
+                if (endpoint.basicAuthUserStoreKey) {
+                    bindings.push(appCredentialBinding(endpoint.basicAuthUserStoreKey, ['spec', 'log_destinations', String(destinationIndex), 'open_search', 'basic_auth', 'user'], false));
+                }
+                if (endpoint.basicAuthPasswordStoreKey) {
+                    bindings.push(appCredentialBinding(endpoint.basicAuthPasswordStoreKey, ['spec', 'log_destinations', String(destinationIndex), 'open_search', 'basic_auth', 'password'], false));
+                }
+                break;
+            case 'papertrail':
+                break;
+        }
+    }
+    return bindings;
+}
+function mutationPhase(app) {
+    return app.in_progress_deployment?.phase ?? app.active_deployment?.phase;
+}
+/** Registered owner for DigitalOcean App secret use and mutation. */
+export class DigitalOceanAppCredentialsClient extends BaseRuntimeClient {
+    async deploy(input, options = {}) {
+        const request = DigitalOceanAppCredentialMutationRequestSchema.parse(input);
+        const log = options.credentialLog ?? silentLog;
+        const operationStoreId = 'digitalocean-app-operation-' + globalThis.crypto.randomUUID();
+        const operationValues = new Map();
+        let unregisterStore;
+        try {
+            const clientOptions = {
+                runtime: this.runtime,
+                credentialRuntime: this.runtime,
+                onCredentialSelected: (provenance) => {
+                    if (provenance === undefined)
+                        return;
+                    log.info(`Using DigitalOcean API token candidate (${provenance.kind}, key ${provenance.reference.key}).`);
+                }
+            };
+            if (options.baseUrl !== undefined)
+                clientOptions.baseUrl = options.baseUrl;
+            if (options.fetchImpl !== undefined)
+                clientOptions.fetchImpl = options.fetchImpl;
+            if (options.retry !== undefined)
+                clientOptions.retry = options.retry;
+            if (options.credentialCandidates !== undefined) {
+                clientOptions.credentialCandidates = options.credentialCandidates;
+            }
+            const spec = buildDigitalOceanAppSpec({
+                deployment: request.deployment,
+                appConfig: request.appConfig,
+                defaultGithub: request.git?.repoCloneUrl
+                    ? {
+                        repo: request.git.repoCloneUrl,
+                        branch: request.git.branch ?? 'main',
+                        deployOnPush: false
+                    }
+                    : undefined,
+                regionOverride: request.region,
+                includeUnresolvedSecrets: true
+            });
+            const credentialBindings = appCredentialBindings(request.deployment, request.appConfig, spec, operationStoreId, operationValues);
+            const explicitToken = options.token === undefined ? undefined : requireApiToken(options.token);
+            const usesSecretsCredentialUse = explicitToken === undefined || credentialBindings.length > 0;
+            if (usesSecretsCredentialUse) {
+                delete clientOptions.fetchImpl;
+            }
+            if (explicitToken !== undefined && credentialBindings.length > 0) {
+                const reference = createOperationSecretReference(operationStoreId, operationValues, explicitToken.value);
+                clientOptions.credentialCandidates = DigitalOceanTokenCredentialCandidatesSchema.parse([{
+                        reference,
+                        kind: explicitToken.kind
+                    }]);
+            }
+            if (operationValues.size > 0) {
+                unregisterStore = registerOperationSecretStore(this.runtime, operationStoreId, operationValues);
+            }
+            const { runtime, ...runtimeOptions } = clientOptions;
+            const client = explicitToken !== undefined && !usesSecretsCredentialUse
+                ? new DigitalOceanControlPlaneClient({ ...clientOptions, token: explicitToken })
+                : await DigitalOceanControlPlaneClient.fromRuntime(runtime, runtimeOptions);
+            const requestOptions = credentialBindings.length > 0 ? { credentialBindings } : {};
+            const targetAppId = request.appId ?? request.appConfig?.id;
+            let app;
+            let forcedDeploymentId;
+            let forcedPhase;
+            if (targetAppId) {
+                options.onLine?.('stdout', `Updating DO App ${targetAppId}...`);
+                const updated = await client.put(`/apps/${targetAppId}`, { spec }, requestOptions, AppDeploymentResourceResponseSchema);
+                app = updated.app;
+                options.onLine?.('stdout', `Forcing fresh deployment (branch HEAD) for ${targetAppId}...`);
+                const forced = await client.post(`/apps/${targetAppId}/deployments`, { force_build: true }, {}, CreateAppDeploymentResponseSchema);
+                forcedDeploymentId = forced.deployment?.id;
+                forcedPhase = forced.deployment?.phase === undefined
+                    ? undefined
+                    : DigitalOceanAppDeploymentPhaseSchema.parse(forced.deployment.phase);
+            }
+            else {
+                options.onLine?.('stdout', `Creating DO App '${request.deployment.appId}'...`);
+                const created = await client.post('/apps', { spec }, requestOptions, AppDeploymentResourceResponseSchema);
+                app = created.app;
+            }
+            return DigitalOceanAppCredentialMutationOutcomeSchema.parse({
+                appId: app.id,
+                liveUrl: app.live_url ?? app.default_ingress,
+                deploymentId: forcedDeploymentId ?? app.in_progress_deployment?.id ?? app.active_deployment?.id,
+                phase: forcedPhase ?? mutationPhase(app)
+            });
+        }
+        finally {
+            try {
+                unregisterStore?.();
+            }
+            finally {
+                operationValues.clear();
+            }
+        }
+    }
+}
+export { DIGITALOCEAN_APP_CREDENTIALS_CLIENT_ID };
+//# sourceMappingURL=app-credentials.impl.js.map

package/dist/secrets/app-platform/app-credentials.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-credentials.impl.js","sourceRoot":"","sources":["../../../src/secrets/app-platform/app-credentials.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAA8C,MAAM,+BAA+B,CAAC;AAC3H,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EACN,mCAAmC,EACnC,iCAAiC,EACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,2CAA2C,EAC3C,2CAA2C,EAC3C,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EACN,sCAAsC,EACtC,8CAA8C,EAC9C,8CAA8C,EAC9C,oCAAoC,EAMpC,MAAM,iCAAiC,CAAC;AAGzC,MAAM,SAAS,GAAkB,EAAE,IAAI,KAAI,CAAC,EAAE,CAAC;AAE/C,SAAS,sBAAsB;IAC9B,OAAO,IAAI,eAAe,CACzB,+DAA+D,EAC/D,aAAa,EACb,EAAE,MAAM,EAAE,4CAA4C,EAAE,SAAS,EAAE,KAAK,EAAE,CAC1E,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACtC,OAAe,EACf,MAA2B,EAC3B,KAAa;IAEb,MAAM,GAAG,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,2CAA2C,CAAC,KAAK,CAAC;QACxD,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,OAAO;QACd,GAAG;KACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACpC,OAAqB,EACrB,OAAe,EACf,MAA2B;IAE3B,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC;QACrD,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,4BAA4B;QACrC,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;QAChD,OAAO,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,oBAAoB,CAAC,eAAe,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,EAAE;YACL,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,UAAU;YACV,KAAK,CAAC,IAAI;gBACT,OAAO,EAAE,CAAC;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAW;gBACnC,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,KAAK,CAAC,MAAM;gBACX,MAAM,sBAAsB,EAAE,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,GAAG;gBACR,MAAM,sBAAsB,EAAE,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,KAAK;gBACV,MAAM,sBAAsB,EAAE,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,MAAM;gBACX,MAAM,sBAAsB,EAAE,CAAC;YAChC,CAAC;SACD;KACD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAC5B,GAAW,EACX,IAAc,EACd,QAAiB,EACjB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS;QACpC,CAAC,CAAC,2CAA2C,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC9E,CAAC,CAAC,2CAA2C,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,0BAA0B,CAAC,KAAK,CAAC;QACvC,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,IAAI;QACJ,QAAQ;KACR,CAAC,CAAC;AACJ,CAAC;AAOD,SAAS,qBAAqB,CAC7B,UAAyB,EACzB,SAAkD,EAClD,IAAe,EACf,OAAe,EACf,eAAoC;IAEpC,MAAM,QAAQ,GAA+E,EAAE,CAAC;IAChG,MAAM,MAAM,GAIP;QACJ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE;QACpF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,EAAE;QACjF;YACC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACtB,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;SACrE;QACD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,EAAE,EAAE;KAC/F,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;YACtF,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAEpC,MAAM,aAAa,GAAG,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CACtE,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,QAAQ,CACpC,CAAC;gBACF,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5D,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,MAAM,KAAK,IAAI,CACnC,CAAC;gBACF,MAAM,MAAM,GAAG,aAAa,IAAI,WAAW,CAAC;gBAC5C,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBAEnC,IAAI,GAAW,CAAC;gBAChB,IAAI,KAAyB,CAAC;gBAC9B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,SAAS,GAAG,8BAA8B,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzF,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;oBACpB,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACP,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CACjC,GAAG,EACH,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAC/E,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,KAAK,KAAK,EAClE,KAAK,CACL,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,CAAC,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACtC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvB,KAAK,SAAS;gBACb,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CACjC,QAAQ,CAAC,cAAc,EACvB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAC5E,KAAK,CACL,CAAC,CAAC;gBACH,MAAM;YACP,KAAK,SAAS;gBACb,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CACjC,QAAQ,CAAC,aAAa,EACtB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAC1E,KAAK,CACL,CAAC,CAAC;gBACH,MAAM;YACP,KAAK,YAAY;gBAChB,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;oBACpC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CACjC,QAAQ,CAAC,qBAAqB,EAC9B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,EAC3F,KAAK,CACL,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,yBAAyB,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CACjC,QAAQ,CAAC,yBAAyB,EAClC,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,EAC/F,KAAK,CACL,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM;YACP,KAAK,YAAY;gBAChB,MAAM;QACR,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAMD,SAAS,aAAa,CAAC,GAA4B;IAClD,OAAO,GAAG,CAAC,sBAAsB,EAAE,KAAK,IAAI,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC;AAC1E,CAAC;AAED,qEAAqE;AACrE,MAAM,OAAO,gCACZ,SAAQ,iBAA+B;IAGvC,KAAK,CAAC,MAAM,CACX,KAA+C,EAC/C,UAAoD,EAAE;QAEtD,MAAM,OAAO,GAAG,8CAA8C,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,SAAS,CAAC;QAC/C,MAAM,gBAAgB,GAAG,6BAA6B,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;QAClD,IAAI,eAAyC,CAAC;QAE9C,IAAI,CAAC;YACJ,MAAM,aAAa,GAAuF;gBAC1G,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,iBAAiB,EAAE,IAAI,CAAC,OAAO;gBAC/B,oBAAoB,EAAE,CAAC,UAAwD,EAAE,EAAE;oBAClF,IAAI,UAAU,KAAK,SAAS;wBAAE,OAAO;oBACrC,GAAG,CAAC,IAAI,CACP,2CAA2C,UAAU,CAAC,IAAI,SAAS,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAC/F,CAAC;gBACH,CAAC;aACD,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAC3E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;gBAAE,aAAa,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACjF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,aAAa,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACrE,IAAI,OAAO,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBAChD,aAAa,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;YACnE,CAAC;YAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;gBACrC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY;oBACvC,CAAC,CAAC;wBACD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;wBAC9B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM;wBACpC,YAAY,EAAE,KAAK;qBACnB;oBACD,CAAC,CAAC,SAAS;gBACZ,cAAc,EAAE,OAAO,CAAC,MAAM;gBAC9B,wBAAwB,EAAE,IAAI;aAC9B,CAAC,CAAC;YACH,MAAM,kBAAkB,GAAG,qBAAqB,CAC/C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,EACjB,IAAI,EACJ,gBAAgB,EAChB,eAAe,CACf,CAAC;YACF,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/F,MAAM,wBAAwB,GAAG,aAAa,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9F,IAAI,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,aAAa,CAAC,SAAS,CAAC;YAChC,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,SAAS,GAAG,8BAA8B,CAC/C,gBAAgB,EAChB,eAAe,EACf,aAAa,CAAC,KAAK,CACnB,CAAC;gBACF,aAAa,CAAC,oBAAoB,GAAG,2CAA2C,CAAC,KAAK,CAAC,CAAC;wBACvF,SAAS;wBACT,IAAI,EAAE,aAAa,CAAC,IAAI;qBACxB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC9B,eAAe,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;YACjG,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,aAAa,CAAC;YACrD,MAAM,MAAM,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,wBAAwB;gBACtE,CAAC,CAAC,IAAI,8BAA8B,CAAC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;gBAChF,CAAC,CAAC,MAAM,8BAA8B,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YAC3D,IAAI,GAA4B,CAAC;YACjC,IAAI,kBAAsC,CAAC;YAC3C,IAAI,WAAuD,CAAC;YAE5D,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mBAAmB,WAAW,KAAK,CAAC,CAAC;gBAChE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,SAAS,WAAW,EAAE,EACtB,EAAE,IAAI,EAAE,EACR,cAAc,EACd,mCAAmC,CACnC,CAAC;gBACF,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBAClB,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,8CAA8C,WAAW,KAAK,CAAC,CAAC;gBAE3F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAG/B,SAAS,WAAW,cAAc,EAClC,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,EAAE,EACF,iCAAiC,CACjC,CAAC;gBACF,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC3C,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,KAAK,SAAS;oBACnD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,oCAAoC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,oBAAoB,OAAO,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC;gBAC/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,OAAO,EACP,EAAE,IAAI,EAAE,EACR,cAAc,EACd,mCAAmC,CACnC,CAAC;gBACF,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACnB,CAAC;YAED,OAAO,8CAA8C,CAAC,KAAK,CAAC;gBAC3D,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,eAAe;gBAC5C,YAAY,EAAE,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,EAAE,EAAE,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE;gBAC/F,KAAK,EAAE,WAAW,IAAI,aAAa,CAAC,GAAG,CAAC;aACxC,CAAC,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC;gBACJ,eAAe,EAAE,EAAE,CAAC;YACrB,CAAC;oBAAS,CAAC;gBACV,eAAe,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,OAAO,EAAE,sCAAsC,EAAE,CAAC"}

package/dist/secrets/container-registry/image-publish-settings.descriptor.d.ts

@@ -0,0 +1,11 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type DigitalOceanImagePublishSettings } from '../../schemas/app-deployment.ts';
+export declare const DIGITALOCEAN_IMAGE_PUBLISH_SETTINGS_MANIFEST_ID = "digitalocean.image-publish";
+/**
+ * Return no settings until the application composes this optional capability.
+ * With `appDir`, the unit's config chain (an embedded app's `workspace.config`
+ * included) folds over the composition, as `infra.deployment` is read; an app
+ * directory outside the bound workspace reads the composition alone.
+ */
+export declare function loadDigitalOceanImagePublishSettings(runtime: RuntimeRef, appDir?: string): Promise<DigitalOceanImagePublishSettings | undefined>;
+//# sourceMappingURL=image-publish-settings.descriptor.d.ts.map

package/dist/secrets/container-registry/image-publish-settings.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-publish-settings.descriptor.d.ts","sourceRoot":"","sources":["../../../src/secrets/container-registry/image-publish-settings.descriptor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAA0C,KAAK,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEhI,eAAO,MAAM,+CAA+C,+BAA+B,CAAC;AAE5F;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,UAAU,EACnB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,gCAAgC,GAAG,SAAS,CAAC,CAiBvD"}

package/dist/secrets/container-registry/image-publish-settings.descriptor.js

@@ -0,0 +1,26 @@
+/**
+ * Application-composed settings for DigitalOcean Dockerfile image publishing.
+ */
+import { ConfigManifest } from '@vibesdotdev/config';
+import { isWithinBoundWorkspace } from '@vibesdotdev/kernel/bootstrap/unit-config';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { DigitalOceanImagePublishSettingsSchema } from "../../schemas/app-deployment.js";
+export const DIGITALOCEAN_IMAGE_PUBLISH_SETTINGS_MANIFEST_ID = 'digitalocean.image-publish';
+/**
+ * Return no settings until the application composes this optional capability.
+ * With `appDir`, the unit's config chain (an embedded app's `workspace.config`
+ * included) folds over the composition, as `infra.deployment` is read; an app
+ * directory outside the bound workspace reads the composition alone.
+ */
+export async function loadDigitalOceanImagePublishSettings(runtime, appDir) {
+    if (!runtime.hasKind('config/manifest') ||
+        !runtime.query('config/manifest').withId(DIGITALOCEAN_IMAGE_PUBLISH_SETTINGS_MANIFEST_ID).descriptors().length) {
+        return undefined;
+    }
+    if (appDir !== undefined && runtime.hasContext('runtime/workspace-path') && (await isWithinBoundWorkspace(runtime, appDir))) {
+        const config = await getVibesClient('config', runtime);
+        return config.readUnit({ id: DIGITALOCEAN_IMAGE_PUBLISH_SETTINGS_MANIFEST_ID, schema: DigitalOceanImagePublishSettingsSchema }, appDir);
+    }
+    return ConfigManifest.forRuntime(runtime, DIGITALOCEAN_IMAGE_PUBLISH_SETTINGS_MANIFEST_ID).load();
+}
+//# sourceMappingURL=image-publish-settings.descriptor.js.map

package/dist/secrets/container-registry/image-publish-settings.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-publish-settings.descriptor.js","sourceRoot":"","sources":["../../../src/secrets/container-registry/image-publish-settings.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,sCAAsC,EAAyC,MAAM,iCAAiC,CAAC;AAEhI,MAAM,CAAC,MAAM,+CAA+C,GAAG,4BAA4B,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACzD,OAAmB,EACnB,MAAe;IAEf,IACC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACnC,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAC7G,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7H,MAAM,MAAM,GAAG,MAAM,cAAc,CAAe,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,+CAA+C,EAAE,MAAM,EAAE,sCAAsC,EAAE,EAAE,MAAM,CAAC,CAAC;IACzI,CAAC;IAED,OAAO,cAAc,CAAC,UAAU,CAC/B,OAAO,EACP,+CAA+C,CAC/C,CAAC,IAAI,EAAE,CAAC;AACV,CAAC"}

package/dist/secrets/doks-secret.descriptor.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `doks-secret` — deliver stored secrets to workloads as a Kubernetes Secret.
+ *
+ * Routed BY ID (`vibes secrets push --backend doks-secret`), never eligible for
+ * generic resolution: this is a delivery target, not somewhere `vibes secrets
+ * set` should silently land. The canonical store stays local; this projects it.
+ *
+ * A caller says which cluster namespace an environment means with
+ * `namespace.<environment>`, falling back to `namespace`. With neither, the
+ * backend refuses rather than guessing — writing production credentials into
+ * the wrong namespace is not a mistake worth being convenient about.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets';
+export declare const DOKS_SECRET_DELIVERY_CLIENT_ID = "digitalocean-doks-secret-delivery";
+export declare const DOKS_SECRET_STORE_ACCESS: unique symbol;
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=doks-secret.descriptor.d.ts.map

package/dist/secrets/doks-secret.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doks-secret.descriptor.d.ts","sourceRoot":"","sources":["../../src/secrets/doks-secret.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAClF,eAAO,MAAM,wBAAwB,EAAE,OAAO,MAA2C,CAAC;AAE1F,QAAA,MAAM,UAAU,EAAE,sBAmBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/secrets/doks-secret.descriptor.js

@@ -0,0 +1,35 @@
+/**
+ * `doks-secret` — deliver stored secrets to workloads as a Kubernetes Secret.
+ *
+ * Routed BY ID (`vibes secrets push --backend doks-secret`), never eligible for
+ * generic resolution: this is a delivery target, not somewhere `vibes secrets
+ * set` should silently land. The canonical store stays local; this projects it.
+ *
+ * A caller says which cluster namespace an environment means with
+ * `namespace.<environment>`, falling back to `namespace`. With neither, the
+ * backend refuses rather than guessing — writing production credentials into
+ * the wrong namespace is not a mistake worth being convenient about.
+ */
+export const DOKS_SECRET_DELIVERY_CLIENT_ID = 'digitalocean-doks-secret-delivery';
+export const DOKS_SECRET_STORE_ACCESS = Symbol('doks-secret-store-access');
+const descriptor = {
+    id: 'doks-secret',
+    kind: 'secrets/store',
+    name: 'DOKS Kubernetes Secret',
+    description: 'Projects stored secrets into a Kubernetes Secret on a DOKS cluster, read by workloads through an ordinary secretKeyRef',
+    tags: ['remote', 'kubernetes', 'delivery-target'],
+    enabled: true,
+    backend: 'doks-secret',
+    tiers: ['dev', 'staging', 'production'],
+    // Below every general-purpose backend: only an explicit --backend reaches it.
+    priority: 1,
+    // A delivery target, named by id; never a scope-selected read store (rc05 §2.3).
+    selection: 'by-id',
+    // `config` is a flat string map by contract, so a per-environment namespace
+    // is spelled `namespace.<environment>`; `namespace` is the fallback.
+    config: {
+        secretName: 'vibes-secrets'
+    }
+};
+export default descriptor;
+//# sourceMappingURL=doks-secret.descriptor.js.map

package/dist/secrets/doks-secret.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doks-secret.descriptor.js","sourceRoot":"","sources":["../../src/secrets/doks-secret.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAkB,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE1F,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACV,wHAAwH;IACzH,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC;IACjD,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC;IACX,iFAAiF;IACjF,SAAS,EAAE,OAAO;IAClB,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE;QACP,UAAU,EAAE,eAAe;KAC3B;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/secrets/doks-secret.impl.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `secrets/store` backed by a Kubernetes Secret on a DOKS cluster.
+ *
+ * `vault-secrets-operator` was installed on `exemplar-staging` to do exactly
+ * this and, measured 2026-09-08, held **zero** CRs across every namespace — a
+ * Vault, an injector and an operator running for 383 days, delivering nothing.
+ * Meanwhile the two realm federators got their signing keys by hand, and the
+ * key the manifests claimed came from `vibes secrets` had never been in the
+ * store at all.
+ *
+ * So the delivery step becomes a backend: `vibes secrets push --backend
+ * doks-secret` writes the store's values into a Kubernetes Secret that
+ * workloads read with an ordinary `secretKeyRef`. No operator, no second
+ * source of truth, no CRD.
+ *
+ * Values are never logged, returned in an error, or placed in argv. Kubernetes
+ * Secrets carry them to workloads; build jobs can read registry credentials from
+ * their mounted `.npmrc` or `.bunfig.toml` files.
+ */
+import { type KindContext, type VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import { type DigitalOceanDoksWorkerCredentialDeliveryOwner, type DigitalOceanDoksWorkerCredentialLease, type DigitalOceanDoksWorkerPlan } from '../schemas/doks-worker.ts';
+import type { StoreOperationContext } from '@vibesdotdev/secrets';
+import type { SecretEntry, SecretsStoreDescriptor } from '@vibesdotdev/secrets';
+import { DOKS_SECRET_STORE_ACCESS } from './doks-secret.descriptor.ts';
+import { type KubernetesApi } from '../kubernetes/authority.ts';
+export declare function createDoksSecretStore(runtime: VibesRuntime, descriptor: SecretsStoreDescriptor, options?: {
+    api?: KubernetesApi;
+}): {
+    id: string;
+    descriptor: {
+        id: string;
+        kind: "secrets/store";
+        backend: string;
+        tiers: ("local" | "dev" | "staging" | "production")[];
+        name?: string | undefined;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+        enabled?: boolean | undefined;
+        hardware?: string[] | undefined;
+        selection?: "scope" | "by-id" | undefined;
+        managedCredentialValues?: true | undefined;
+        priority?: number | undefined;
+        config?: Record<string, string> | undefined;
+    };
+    list(environment: string, operationContext?: StoreOperationContext): Promise<SecretEntry[]>;
+    get(environment: string, key: string, operationContext?: StoreOperationContext): Promise<string | undefined>;
+    set(environment: string, key: string, value: string, operationContext?: StoreOperationContext): Promise<void>;
+    unset(environment: string, key: string, operationContext?: StoreOperationContext): Promise<void>;
+    getAll(environment: string, operationContext?: StoreOperationContext): Promise<Record<string, string>>;
+    setAll(environment: string, secrets: Record<string, string>, operationContext?: StoreOperationContext): Promise<void>;
+    admitWorkerCredentials: (input: DigitalOceanDoksWorkerPlan) => Promise<void>;
+    prepareWorkerCredentials: (input: DigitalOceanDoksWorkerPlan) => Promise<DigitalOceanDoksWorkerPlan>;
+    revokeWorkerCredentials: (input: DigitalOceanDoksWorkerCredentialLease) => Promise<void>;
+};
+/**
+ * Runtime-owned DOKS Secret capability. The store loader and DOKS worker
+ * execution resolve this same BaseRuntimeClient instance, so store connection
+ * reuse and credential delivery share one owner without widening secrets/store.
+ */
+export interface DoksSecretStoreAccess {
+    [DOKS_SECRET_STORE_ACCESS](): ReturnType<typeof createDoksSecretStore>;
+}
+export declare class DigitalOceanDoksSecretRuntimeClient extends BaseRuntimeClient<VibesRuntime> implements DigitalOceanDoksWorkerCredentialDeliveryOwner, DoksSecretStoreAccess {
+    #private;
+    constructor(descriptor: RuntimeClientDescriptor, context: KindContext<VibesRuntime>);
+    [DOKS_SECRET_STORE_ACCESS](): {
+        id: string;
+        descriptor: {
+            id: string;
+            kind: "secrets/store";
+            backend: string;
+            tiers: ("local" | "dev" | "staging" | "production")[];
+            name?: string | undefined;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+            enabled?: boolean | undefined;
+            hardware?: string[] | undefined;
+            selection?: "scope" | "by-id" | undefined;
+            managedCredentialValues?: true | undefined;
+            priority?: number | undefined;
+            config?: Record<string, string> | undefined;
+        };
+        list(environment: string, operationContext?: StoreOperationContext): Promise<SecretEntry[]>;
+        get(environment: string, key: string, operationContext?: StoreOperationContext): Promise<string | undefined>;
+        set(environment: string, key: string, value: string, operationContext?: StoreOperationContext): Promise<void>;
+        unset(environment: string, key: string, operationContext?: StoreOperationContext): Promise<void>;
+        getAll(environment: string, operationContext?: StoreOperationContext): Promise<Record<string, string>>;
+        setAll(environment: string, secrets: Record<string, string>, operationContext?: StoreOperationContext): Promise<void>;
+        admitWorkerCredentials: (input: DigitalOceanDoksWorkerPlan) => Promise<void>;
+        prepareWorkerCredentials: (input: DigitalOceanDoksWorkerPlan) => Promise<DigitalOceanDoksWorkerPlan>;
+        revokeWorkerCredentials: (input: DigitalOceanDoksWorkerCredentialLease) => Promise<void>;
+    };
+    admitWorkerCredentials(plan: DigitalOceanDoksWorkerPlan): Promise<void>;
+    prepareWorkerCredentials(plan: DigitalOceanDoksWorkerPlan): Promise<DigitalOceanDoksWorkerPlan>;
+    revokeWorkerCredentials(lease: DigitalOceanDoksWorkerCredentialLease): Promise<void>;
+}
+//# sourceMappingURL=doks-secret.impl.d.ts.map

package/dist/secrets/doks-secret.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doks-secret.impl.d.ts","sourceRoot":"","sources":["../../src/secrets/doks-secret.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAA2B,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,OAAO,EAON,KAAK,6CAA6C,EAClD,KAAK,qCAAqC,EAC1C,KAAK,0BAA0B,EAC/B,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EACX,WAAW,EACX,sBAAsB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAerF,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,sBAAsB,EAClC,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,aAAa,CAAA;CAAE;;;;;;;;;;;;;;;;;sBA6dlB,MAAM,qBACA,qBAAqB,GACtC,OAAO,CAAC,WAAW,EAAE,CAAC;qBAUX,MAAM,OACd,MAAM,qBACQ,qBAAqB,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;qBAMhB,MAAM,OACd,MAAM,SACJ,MAAM,qBACM,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;uBAMF,MAAM,OACd,MAAM,qBACQ,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;wBAKF,MAAM,qBACA,qBAAqB,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;wBAKpB,MAAM,WACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,qBACZ,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;oCAtW4B,0BAA0B,KAAG,OAAO,CAAC,IAAI,CAAC;sCAmJxC,0BAA0B,KAAG,OAAO,CAAC,0BAA0B,CAAC;qCAwJjE,qCAAqC,KAAG,OAAO,CAAC,IAAI,CAAC;EAoEnG;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;CACvE;AAED,qBAAa,mCAAoC,SAAQ,iBAAiB,CAAC,YAAY,CACtF,YAAW,6CAA6C,EAAE,qBAAqB;;gBAInE,UAAU,EAAE,uBAAuB,EAAE,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC;IAenF,CAAC,wBAAwB,CAAC;;;;;;;;;;;;;;;;;0BAzFX,MAAM,qBACA,qBAAqB,GACtC,OAAO,CAAC,WAAW,EAAE,CAAC;yBAUX,MAAM,OACd,MAAM,qBACQ,qBAAqB,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;yBAMhB,MAAM,OACd,MAAM,SACJ,MAAM,qBACM,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;2BAMF,MAAM,OACd,MAAM,qBACQ,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;4BAKF,MAAM,qBACA,qBAAqB,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;4BAKpB,MAAM,WACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,qBACZ,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;wCAtW4B,0BAA0B,KAAG,OAAO,CAAC,IAAI,CAAC;0CAmJxC,0BAA0B,KAAG,OAAO,CAAC,0BAA0B,CAAC;yCAwJjE,qCAAqC,KAAG,OAAO,CAAC,IAAI,CAAC;;IAuGnG,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,wBAAwB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAI/F,uBAAuB,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpF"}