@vibesdotdev/pm 0.0.0-stage → 1.0.0-rc.2

package/dist/helpers/managed-process-admission.js

@@ -0,0 +1,102 @@
+/**
+ * Admitting and restarting one registered process through PM, shared by the
+ * daemon-module context (PM's own manager, in the daemon) and the runtime
+ * daemon supervisor (PM's client, in any other process). Both narrow PM to the
+ * calls below, so a caller can restart a process PM registered but cannot
+ * register commands or reach unrelated processes.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+/** Bound on a declared readiness check after a start or restart. */
+export const MANAGED_PROCESS_READY_TIMEOUT_MS = 45_000;
+export function processNotRegistered(processId) {
+    return new CapabilityError(`Process config not found: ${processId}`, 'NOT_FOUND', {
+        reason: 'pm-process-not-registered',
+        details: { processId }
+    });
+}
+/** Start options that await the process's declared readiness, when it declares one. */
+export function readinessStartOptions(config) {
+    if (!config.healthCheck)
+        return { wait: false };
+    return { wait: true, timeout: MANAGED_PROCESS_READY_TIMEOUT_MS };
+}
+/**
+ * The admission receipt for a state PM returned, or the typed refusal: the
+ * process did not enter `running`, or it declares a readiness check it did
+ * not pass.
+ */
+export function admittedProcessReceipt(processId, config, state) {
+    if (state.status !== 'running') {
+        throw new CapabilityError(`Process ${processId} did not enter running state`, 'UNAVAILABLE', {
+            reason: 'pm-process-not-running',
+            details: { processId, status: state.status }
+        });
+    }
+    if (config.healthCheck && state.healthStatus !== 'healthy') {
+        throw new CapabilityError(`Process ${processId} did not pass its readiness check`, 'UNAVAILABLE', {
+            reason: 'pm-process-not-ready',
+            details: { processId }
+        });
+    }
+    const receipt = { processId, ready: true, status: 'running' };
+    if (state.pid)
+        receipt.pid = state.pid;
+    if (state.healthStatus === 'healthy')
+        receipt.healthStatus = 'healthy';
+    return receipt;
+}
+/** The pid of a registered process's live run, or `null` when PM tracks no running run. */
+export async function managedProcessPid(pm, processId) {
+    if (!(await pm.getConfig(processId)))
+        throw processNotRegistered(processId);
+    const state = await pm.getStatus(processId);
+    if (state?.status !== 'running' || state.pid === undefined)
+        return null;
+    return state.pid;
+}
+/**
+ * Restart a registered process through PM: PM stops its tracked run (if one
+ * is live) and starts a fresh one, awaiting declared readiness. `force` kills
+ * the live run outright first (PM's own restart stops gracefully). The process
+ * stays PM's: its record, auto-restart and logs carry over to the new run.
+ */
+export async function restartManagedProcess(pm, processId, options = {}) {
+    const config = await pm.getConfig(processId);
+    if (!config)
+        throw processNotRegistered(processId);
+    if (options.force) {
+        const current = await pm.getStatus(processId);
+        if (current?.status === 'running')
+            await pm.stop(processId, { force: true });
+    }
+    const state = await pm.restart(processId, readinessStartOptions(config));
+    return admittedProcessReceipt(processId, config, state);
+}
+/**
+ * Start a registered process through PM unless it already runs (PM's start is
+ * idempotent and serialized per process), awaiting declared readiness.
+ */
+export async function ensureManagedProcess(pm, processId) {
+    const config = await pm.getConfig(processId);
+    if (!config)
+        throw processNotRegistered(processId);
+    const state = await pm.start(config, readinessStartOptions(config));
+    return admittedProcessReceipt(processId, config, state);
+}
+/**
+ * Stop a registered process's live run through PM, on purpose: PM records the
+ * run stopped by its own stop command, so it does not auto-restart it. A
+ * process PM does not track as running has nothing to stop.
+ */
+export async function stopManagedProcess(pm, processId, options = {}) {
+    if (!(await pm.getConfig(processId)))
+        throw processNotRegistered(processId);
+    const state = await pm.getStatus(processId);
+    if (state?.status !== 'running')
+        return;
+    const stopOptions = {};
+    if (options.force)
+        stopOptions.force = true;
+    await pm.stop(processId, stopOptions);
+}
+//# sourceMappingURL=managed-process-admission.js.map

package/dist/helpers/managed-process-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-process-admission.js","sourceRoot":"","sources":["../../src/helpers/managed-process-admission.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAWvD,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACrD,OAAO,IAAI,eAAe,CAAC,6BAA6B,SAAS,EAAE,EAAE,WAAW,EAAE;QACjF,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,EAAE,SAAS,EAAE;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IAC1D,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,SAAiB,EACjB,MAAqB,EACrB,KAAmB;IAEnB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,WAAW,SAAS,8BAA8B,EAAE,aAAa,EAAE;YAC5F,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAC5C,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,WAAW,SAAS,mCAAmC,EAAE,aAAa,EAAE;YACjG,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzF,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IACvE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAA2B,EAAE,SAAiB;IACrF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,KAAK,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,EAA2B,EAC3B,SAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAA2B,EAAE,SAAiB;IACxF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,EAA2B,EAC3B,SAAiB,EACjB,UAA+B,EAAE;IAEjC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO;IACxC,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK;QAAE,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC"}

package/dist/helpers/managed-process-id.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Which process-state rows are managed processes.
+ *
+ * Internal bookkeeping keys (e.g. `__lastStoreCleanup`) are stored alongside
+ * real process state but are not managed processes. Every surface that counts
+ * or lists rows — the CLI tables and the daemon's own health count — applies
+ * this one predicate (dogfood friction_bxbn38nyk6j2 / friction_qehtrqppz7rf;
+ * `pm daemon status` measured 45 against `pm status`'s 44 on 2026-09-06).
+ */
+import type { ProcessState } from '../schemas/process.ts';
+export declare function isManagedProcessId(id: string): boolean;
+export declare function filterManagedProcessStates(states: ProcessState[]): ProcessState[];
+//# sourceMappingURL=managed-process-id.d.ts.map

package/dist/helpers/managed-process-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-process-id.d.ts","sourceRoot":"","sources":["../../src/helpers/managed-process-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAEjF"}

package/dist/helpers/managed-process-id.js

@@ -0,0 +1,16 @@
+/**
+ * Which process-state rows are managed processes.
+ *
+ * Internal bookkeeping keys (e.g. `__lastStoreCleanup`) are stored alongside
+ * real process state but are not managed processes. Every surface that counts
+ * or lists rows — the CLI tables and the daemon's own health count — applies
+ * this one predicate (dogfood friction_bxbn38nyk6j2 / friction_qehtrqppz7rf;
+ * `pm daemon status` measured 45 against `pm status`'s 44 on 2026-09-06).
+ */
+export function isManagedProcessId(id) {
+    return id.length > 0 && !id.startsWith('__');
+}
+export function filterManagedProcessStates(states) {
+    return states.filter((s) => isManagedProcessId(s.id));
+}
+//# sourceMappingURL=managed-process-id.js.map

package/dist/helpers/managed-process-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-process-id.js","sourceRoot":"","sources":["../../src/helpers/managed-process-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAsB;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/helpers/node-path.d.ts

@@ -0,0 +1,16 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+export interface PreferExternalNodePathOptions {
+    /** The host platform the handed runtime declared (`process.platform` spelling). */
+    platform: string;
+    /** The child's HOME (from the handed runtime's snapshot), for user-level node installs. */
+    home?: string;
+    candidateDirs?: string[];
+    resolveNode?: (path: string) => Promise<string | undefined> | string | undefined;
+}
+/**
+ * The PATH with a preferred node install ahead of Codex's bundled node. Every
+ * existence check goes through the handed runtime's host filesystem and its
+ * path mechanics.
+ */
+export declare function preferExternalNodePath(runtime: RuntimeRef, currentPath: string | undefined, options: PreferExternalNodePathOptions): Promise<string>;
+//# sourceMappingURL=node-path.d.ts.map

package/dist/helpers/node-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-path.d.ts","sourceRoot":"","sources":["../../src/helpers/node-path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAsDtD,MAAM,WAAW,6BAA6B;IAC7C,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CACjF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAoBjB"}

package/dist/helpers/node-path.js

@@ -0,0 +1,67 @@
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem/client/resolve-adapter';
+const CODEX_NODE_MARKER = 'Codex.app';
+/** The PATH mechanics of the host platform the handed runtime declared (`process.platform` spelling). */
+function pathMechanics(platform) {
+    const windows = platform === 'win32';
+    return {
+        separator: windows ? ';' : ':',
+        nodeBinary: windows ? 'node.exe' : 'node',
+        normalize: (entry) => (windows ? entry.toLowerCase() : entry)
+    };
+}
+/** Node install dirs to prefer over a PATH whose node is Codex's bundled one; `home` is the child's HOME. */
+function getPreferredNodeDirs(path, platform, home) {
+    if (platform === 'win32')
+        return [];
+    const dirs = platform === 'darwin' ? ['/opt/homebrew/bin', '/usr/local/bin'] : ['/usr/local/bin'];
+    if (home) {
+        dirs.push(path.join(home, '.asdf', 'shims'), path.join(home, '.volta', 'bin'));
+    }
+    return dirs;
+}
+function moveDirsToFront(platform, currentPath, dirs) {
+    const { separator, normalize } = pathMechanics(platform);
+    const preferred = Array.from(new Set(dirs.map(normalize)));
+    const parts = currentPath.split(separator).filter(Boolean);
+    const filteredParts = parts.filter((part) => !preferred.includes(normalize(part)));
+    return [...dirs, ...filteredParts].join(separator);
+}
+/** Resolve the first node binary on a PATH string through the handed runtime's filesystem. */
+async function whichOnPath(files, path, platform, pathEnv) {
+    const { separator, nodeBinary } = pathMechanics(platform);
+    for (const dir of pathEnv.split(separator)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, nodeBinary);
+        if (await files.exists(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * The PATH with a preferred node install ahead of Codex's bundled node. Every
+ * existence check goes through the handed runtime's host filesystem and its
+ * path mechanics.
+ */
+export async function preferExternalNodePath(runtime, currentPath, options) {
+    const { platform } = options;
+    const { nodeBinary } = pathMechanics(platform);
+    const basePath = currentPath || '';
+    const path = await getRuntimePath(runtime);
+    const files = await resolveFileSystemAdapter(runtime, { binding: false });
+    const resolveNode = options.resolveNode ?? ((searchPath) => whichOnPath(files, path, platform, searchPath));
+    const resolvedNode = await resolveNode(basePath);
+    if (resolvedNode && !resolvedNode.includes(CODEX_NODE_MARKER)) {
+        return basePath;
+    }
+    const preferredDirs = [];
+    for (const dir of options.candidateDirs ?? getPreferredNodeDirs(path, platform, options.home)) {
+        if (await files.exists(path.join(dir, nodeBinary)))
+            preferredDirs.push(dir);
+    }
+    if (preferredDirs.length === 0)
+        return basePath;
+    return moveDirsToFront(platform, basePath, preferredDirs);
+}
+//# sourceMappingURL=node-path.js.map

package/dist/helpers/node-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-path.js","sourceRoot":"","sources":["../../src/helpers/node-path.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,yGAAyG;AACzG,SAAS,aAAa,CAAC,QAAgB;IACtC,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC;IACrC,OAAO;QACN,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;QACzC,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACrE,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAS,oBAAoB,CAAC,IAAiB,EAAE,QAAgB,EAAE,IAAwB;IAC1F,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAElG,IAAI,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,WAAmB,EAAE,IAAc;IAC7E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CACzB,KAAiC,EACjC,IAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAmB,EACnB,WAA+B,EAC/B,OAAsC;IAEtC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,WAAW,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACpH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC/D,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEhD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC"}

package/dist/helpers/output-redaction.d.ts

@@ -0,0 +1,36 @@
+/**
+ * What a PM read surface may print about a config (pm.md C10-C12, map DoD P5).
+ *
+ * A process `env` and a resource's provider `config` hold literal values PM
+ * cannot classify (a `DATABASE_URL` carries a password; a `k8s/secret`'s
+ * `data` is the secret). No surface prints them: `pm show`, `pm config`,
+ * `pm preset show` and `pm resource status` print each key with
+ * {@link REDACTED} in place of its value, plus the fields that are
+ * structure, not payload. A value's provenance is its declaration site (the
+ * descriptor file or `config.plugins.pm`), never its content.
+ */
+import type { ProcessConfig, ProcessPreset } from '../schemas/process.ts';
+import type { ProviderPayload, ResourceConfig } from '../schemas/resource.ts';
+import { type JsonValue as PayloadJson } from '@vibesdotdev/kernel/schemas/json';
+export declare const REDACTED = "[redacted]";
+/** Each key of `record`, every value replaced. */
+export declare function redactValues<V>(record: Record<string, V> | undefined): Record<string, string> | undefined;
+/** A process config as a read surface prints it: env values (and hook/override env) redacted. */
+export declare function redactProcessConfig(config: ProcessConfig): ProcessConfig;
+/**
+ * A resource config as a read surface prints it: the provider `config`
+ * payload's values redacted (its keys kept), and hook env redacted.
+ */
+export declare function redactResourceConfig(config: ResourceConfig): ResourceConfig;
+/** A preset as a read surface prints it: bootstrap/teardown hook env redacted. */
+export declare function redactPreset(preset: ProcessPreset): ProcessPreset;
+/**
+ * A provider payload (resource status metadata) as a read surface prints it:
+ * its shape (keys and list lengths, to a bounded depth) with every value
+ * `[redacted]` (SPEC:153). `prefer` names members to print in place of the
+ * whole payload, the first one present winning (fleet providers put their
+ * rows under `records` or `slices`). A payload that is not plain JSON prints
+ * as one `[redacted]`.
+ */
+export declare function redactProviderPayload(payload: ProviderPayload | undefined, prefer?: readonly string[]): PayloadJson | undefined;
+//# sourceMappingURL=output-redaction.d.ts.map

package/dist/helpers/output-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-redaction.d.ts","sourceRoot":"","sources":["../../src/helpers/output-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAwC,KAAK,SAAS,IAAI,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGvH,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,kDAAkD;AAClD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAGzG;AAiCD,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAOxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAM3E;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAKjE;AAoBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,MAAM,GAAE,SAAS,MAAM,EAAO,GAC5B,WAAW,GAAG,SAAS,CAQzB"}

package/dist/helpers/output-redaction.js

@@ -0,0 +1,120 @@
+/**
+ * What a PM read surface may print about a config (pm.md C10-C12, map DoD P5).
+ *
+ * A process `env` and a resource's provider `config` hold literal values PM
+ * cannot classify (a `DATABASE_URL` carries a password; a `k8s/secret`'s
+ * `data` is the secret). No surface prints them: `pm show`, `pm config`,
+ * `pm preset show` and `pm resource status` print each key with
+ * {@link REDACTED} in place of its value, plus the fields that are
+ * structure, not payload. A value's provenance is its declaration site (the
+ * descriptor file or `config.plugins.pm`), never its content.
+ */
+import { JsonValueSchema as PayloadJsonSchema } from '@vibesdotdev/kernel/schemas/json';
+import z from 'zod/v4';
+export const REDACTED = '[redacted]';
+/** Each key of `record`, every value replaced. */
+export function redactValues(record) {
+    if (!record)
+        return undefined;
+    return Object.fromEntries(Object.keys(record).map((key) => [key, REDACTED]));
+}
+/** A lifecycle or build hook with its `env` values redacted. */
+function redactHook(hook) {
+    if (!hook)
+        return undefined;
+    return hook.env ? { ...hook, env: redactValues(hook.env) } : hook;
+}
+/** A per-profile override block carries its own `env`. */
+const profileOutputSchema = z.looseObject({ env: z.unknown().optional() });
+function redactLivenessConfig(livenessConfig) {
+    if (!livenessConfig)
+        return undefined;
+    return Object.fromEntries(Object.entries(livenessConfig).map(([profile, overrides]) => {
+        // Profiles are intentionally opaque. Project only the output-owned env field,
+        // and enumerate its keys without evaluating secret-bearing value accessors.
+        let input = overrides;
+        if (Array.isArray(overrides) && 'env' in overrides) {
+            // Match the previous plain-own-property output for env-bearing arrays:
+            // custom JSON serializers must see redacted env, never the original array.
+            const properties = { ...overrides };
+            input = Object.hasOwn(properties, 'env') ? properties : { ...properties, env: overrides.env };
+        }
+        const projection = profileOutputSchema.safeParse(input);
+        if (!projection.success || !('env' in projection.data))
+            return [profile, overrides];
+        const env = projection.data.env;
+        projection.data.env = env ? Object.fromEntries(Object.keys(env).map((key) => [key, REDACTED])) : undefined;
+        return [profile, projection.data];
+    }));
+}
+/** A process config as a read surface prints it: env values (and hook/override env) redacted. */
+export function redactProcessConfig(config) {
+    const output = { ...config };
+    if (config.env)
+        output.env = redactValues(config.env);
+    if (config.livenessConfig)
+        output.livenessConfig = redactLivenessConfig(config.livenessConfig);
+    if (config.build)
+        output.build = redactHook(config.build);
+    if (config.preBuild)
+        output.preBuild = redactHook(config.preBuild);
+    return output;
+}
+/**
+ * A resource config as a read surface prints it: the provider `config`
+ * payload's values redacted (its keys kept), and hook env redacted.
+ */
+export function redactResourceConfig(config) {
+    const output = { ...config, config: redactValues(config.config) ?? {} };
+    if (config.onCreate)
+        output.onCreate = redactHook(config.onCreate);
+    if (config.onUpdate)
+        output.onUpdate = redactHook(config.onUpdate);
+    if (config.onDelete)
+        output.onDelete = redactHook(config.onDelete);
+    return output;
+}
+/** A preset as a read surface prints it: bootstrap/teardown hook env redacted. */
+export function redactPreset(preset) {
+    const output = { ...preset };
+    if (preset.bootstrap)
+        output.bootstrap = redactHook(preset.bootstrap);
+    if (preset.teardown)
+        output.teardown = redactHook(preset.teardown);
+    return output;
+}
+/** How deep a provider payload's shape is printed; anything deeper is one `[redacted]`. */
+const MAX_PAYLOAD_DEPTH = 4;
+const PayloadLeafSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+function isPayloadLeaf(value) {
+    return PayloadLeafSchema.safeParse(value).success;
+}
+function redactJson(value, depth) {
+    if (isPayloadLeaf(value))
+        return REDACTED;
+    if (depth >= MAX_PAYLOAD_DEPTH)
+        return REDACTED;
+    if (Array.isArray(value))
+        return value.map((item) => redactJson(item, depth + 1));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactJson(item, depth + 1)]));
+}
+/**
+ * A provider payload (resource status metadata) as a read surface prints it:
+ * its shape (keys and list lengths, to a bounded depth) with every value
+ * `[redacted]` (SPEC:153). `prefer` names members to print in place of the
+ * whole payload, the first one present winning (fleet providers put their
+ * rows under `records` or `slices`). A payload that is not plain JSON prints
+ * as one `[redacted]`.
+ */
+export function redactProviderPayload(payload, prefer = []) {
+    if (payload === undefined)
+        return undefined;
+    const parsed = PayloadJsonSchema.safeParse(payload);
+    if (!parsed.success)
+        return REDACTED;
+    const whole = parsed.data;
+    const record = isPayloadLeaf(whole) || Array.isArray(whole) ? {} : whole;
+    const preferred = prefer.map((key) => record[key]).find((member) => member !== undefined && member !== null);
+    return redactJson(preferred ?? whole, 0);
+}
+//# sourceMappingURL=output-redaction.js.map

package/dist/helpers/output-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-redaction.js","sourceRoot":"","sources":["../../src/helpers/output-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,eAAe,IAAI,iBAAiB,EAAiC,MAAM,kCAAkC,CAAC;AACvH,OAAO,CAAC,MAAM,QAAQ,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAI,MAAqC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAA6C,IAAmB;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,0DAA0D;AAC1D,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3E,SAAS,oBAAoB,CAAC,cAA+C;IAC5E,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE;QAC3D,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,KAAK,GAAG,SAAS,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACpD,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,UAAU,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YACpC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;QAC/F,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACxD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,cAAc;QAAE,MAAM,CAAC,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IAC1D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,MAAqB;IACjD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AACf,CAAC;AAED,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAI5B,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAEnF,SAAS,aAAa,CAAC,KAAkB;IACxC,OAAO,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB,EAAE,KAAa;IACpD,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,KAAK,IAAI,iBAAiB;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACpC,OAAoC,EACpC,SAA4B,EAAE;IAE9B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC;IAC7G,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/helpers/process-credentials.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A supervised process's declared credentials (RC05 §2.4, D-RC05).
+ *
+ * PM spawns its children itself (runtime/execution, output captured to files
+ * through inherited fds), so it takes the lower-level step of
+ * `@vibesdotdev/secrets/exec`: `resolveCredentialEnv` resolves every declared
+ * reference through `runtime.resolveCredential` before anything spawns, and a
+ * failure throws its typed error. PM layers only the credential variables
+ * onto its own C15 composition; the values never enter argv, the descriptor
+ * or the stored config. Every injected value is kept, per process, for PM's
+ * log read surfaces to redact.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { ProcessConfig } from '../schemas/process.ts';
+export interface ProcessCredentials {
+    /** Credential variable → value; only ever written into the child's environment. */
+    readonly values: Readonly<Record<string, string>>;
+    /** Every injected value, for the read surfaces' redaction. */
+    readonly redact: readonly string[];
+    /** The one `[AUDIT]` line for this spawn's outcome. */
+    audit(outcome: 'success' | 'failure'): void;
+}
+/**
+ * `@vibesdotdev/secrets/exec`, the credential composer. Secrets is an optional
+ * peer of pm (an MIT package never requires a BUSL one): a host composed
+ * without it refuses a process that declares credentials
+ * `UNAVAILABLE pm-credentials-unavailable`, never spawns it without them.
+ * Any other load failure propagates.
+ */
+export declare function loadSecretsExec(importModule?: () => Promise<typeof import('@vibesdotdev/secrets/exec')>): Promise<typeof import('@vibesdotdev/secrets/exec')>;
+/**
+ * Resolve `config.credentials` for one spawn, or `undefined` when the process
+ * declares none. A reference that does not resolve throws (nothing spawns).
+ */
+export declare function resolveProcessCredentials(runtime: VibesRuntime, config: Pick<ProcessConfig, 'id' | 'credentials'>, action?: string): Promise<ProcessCredentials | undefined>;
+/**
+ * The values a process's log read surfaces redact: those injected at its
+ * last spawn by this daemon, else (a process this daemon adopted) its
+ * declared credentials resolved now. A reference that does not resolve fails
+ * the read instead of printing unredacted output.
+ */
+export declare function processLogRedactions(runtime: VibesRuntime, config: Pick<ProcessConfig, 'id' | 'credentials'> | undefined, injected: readonly string[] | undefined): Promise<readonly string[]>;
+/** A lifecycle hook's child environment, its credential values to redact, and its audit. */
+export interface HookEnvironment {
+    env: Record<string, string>;
+    redact: readonly string[];
+    /** Write the spawn outcome's audit line (a no-op when the hook declares no credentials). */
+    audit(outcome: 'success' | 'failure'): void;
+}
+/**
+ * A lifecycle hook's environment (resource `onCreate`/`onUpdate`/`onDelete`,
+ * preset `bootstrap`/`teardown`): PM's C15 composition plus its declared
+ * `credentials`, resolved through `resolveCredentialEnv` exactly as a
+ * process's. Values never enter argv. A reference that does not resolve
+ * throws typed and the hook does not run.
+ */
+export declare function composeHookEnv(runtime: VibesRuntime, hook: {
+    env?: Record<string, string>;
+    inheritEnv?: string[];
+    credentials?: ProcessConfig['credentials'];
+}, cwd: string, hookId: string): Promise<HookEnvironment>;
+//# sourceMappingURL=process-credentials.d.ts.map

package/dist/helpers/process-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-credentials.d.ts","sourceRoot":"","sources":["../../src/helpers/process-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,MAAM,WAAW,kBAAkB;IAClC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,uDAAuD;IACvD,KAAK,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CAC5C;AAKD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACpC,YAAY,GAAE,MAAM,OAAO,CAAC,cAAc,2BAA2B,CAAC,CAA6C,GACjH,OAAO,CAAC,cAAc,2BAA2B,CAAC,CAAC,CAYrD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC,EACjD,MAAM,SAAqB,GACzB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqBzC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,aAAa,CAAC,GAAG,SAAS,EAC7D,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACrC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAW5B;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,4FAA4F;IAC5F,KAAK,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;CAAE,EACzG,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAW1B"}

package/dist/helpers/process-credentials.js

@@ -0,0 +1,107 @@
+/**
+ * A supervised process's declared credentials (RC05 §2.4, D-RC05).
+ *
+ * PM spawns its children itself (runtime/execution, output captured to files
+ * through inherited fds), so it takes the lower-level step of
+ * `@vibesdotdev/secrets/exec`: `resolveCredentialEnv` resolves every declared
+ * reference through `runtime.resolveCredential` before anything spawns, and a
+ * failure throws its typed error. PM layers only the credential variables
+ * onto its own C15 composition; the values never enter argv, the descriptor
+ * or the stored config. Every injected value is kept, per process, for PM's
+ * log read surfaces to redact.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+/** A missing optional module, as Bun and Node report it (`ERR_MODULE_NOT_FOUND`). */
+const ModuleNotFoundSchema = z.object({ code: z.literal('ERR_MODULE_NOT_FOUND') });
+/**
+ * `@vibesdotdev/secrets/exec`, the credential composer. Secrets is an optional
+ * peer of pm (an MIT package never requires a BUSL one): a host composed
+ * without it refuses a process that declares credentials
+ * `UNAVAILABLE pm-credentials-unavailable`, never spawns it without them.
+ * Any other load failure propagates.
+ */
+export async function loadSecretsExec(importModule = () => import('@vibesdotdev/secrets/exec')) {
+    try {
+        return await importModule();
+    }
+    catch (error) {
+        if (!ModuleNotFoundSchema.safeParse(error).success)
+            throw error;
+        throw new CapabilityError('This host is composed without @vibesdotdev/secrets, so it cannot resolve declared credentials.', 'UNAVAILABLE', {
+            reason: 'pm-credentials-unavailable',
+            retryable: false,
+            recoveryHint: 'Install @vibesdotdev/secrets in the host, or remove the process\'s declared credentials.',
+            cause: error
+        });
+    }
+}
+/**
+ * Resolve `config.credentials` for one spawn, or `undefined` when the process
+ * declares none. A reference that does not resolve throws (nothing spawns).
+ */
+export async function resolveProcessCredentials(runtime, config, action = 'pm.process.start') {
+    const credentials = config.credentials;
+    if (!credentials || Object.keys(credentials).length === 0)
+        return undefined;
+    const { resolveCredentialEnv } = await loadSecretsExec();
+    const resolved = await resolveCredentialEnv(runtime, {
+        pass: [],
+        credentials,
+        audit: { action: 'secrets.spawn', target: `${action}:${config.id}` }
+    });
+    const values = {};
+    for (const name of Object.keys(credentials)) {
+        const value = resolved.env[name];
+        if (value === undefined) {
+            throw new CapabilityError(`Credential '${name}' for '${config.id}' resolved but was not composed.`, 'INTERNAL', {
+                reason: 'pm-credential-not-composed',
+                details: { processId: config.id, name }
+            });
+        }
+        values[name] = value;
+    }
+    return { values, redact: resolved.redact, audit: (outcome) => resolved.audit(outcome) };
+}
+/**
+ * The values a process's log read surfaces redact: those injected at its
+ * last spawn by this daemon, else (a process this daemon adopted) its
+ * declared credentials resolved now. A reference that does not resolve fails
+ * the read instead of printing unredacted output.
+ */
+export async function processLogRedactions(runtime, config, injected) {
+    if (injected)
+        return injected;
+    const credentials = config?.credentials;
+    if (!credentials)
+        return [];
+    const values = [];
+    for (const reference of Object.values(credentials)) {
+        const resolution = await runtime.resolveCredential(reference);
+        if (!resolution.ok)
+            throw resolution.error;
+        values.push(resolution.value);
+    }
+    return values;
+}
+/**
+ * A lifecycle hook's environment (resource `onCreate`/`onUpdate`/`onDelete`,
+ * preset `bootstrap`/`teardown`): PM's C15 composition plus its declared
+ * `credentials`, resolved through `resolveCredentialEnv` exactly as a
+ * process's. Values never enter argv. A reference that does not resolve
+ * throws typed and the hook does not run.
+ */
+export async function composeHookEnv(runtime, hook, cwd, hookId) {
+    // PM's Node child-env composer (PATH repair, .env files), loaded where a hook runs.
+    const { composePMChildEnv } = await import("./process-env.js");
+    const env = await composePMChildEnv(runtime, { env: hook.env, inheritEnv: hook.inheritEnv, cwd });
+    const credentials = await resolveProcessCredentials(runtime, { id: hookId, credentials: hook.credentials }, 'pm.hook.run');
+    if (!credentials)
+        return { env, redact: [], audit: () => undefined };
+    return {
+        env: { ...env, ...credentials.values },
+        redact: credentials.redact,
+        audit: (outcome) => credentials.audit(outcome)
+    };
+}
+//# sourceMappingURL=process-credentials.js.map

package/dist/helpers/process-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-credentials.js","sourceRoot":"","sources":["../../src/helpers/process-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAW5B,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,eAA0E,GAAG,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC;IAEnH,IAAI,CAAC;QACJ,OAAO,MAAM,YAAY,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,gGAAgG,EAAE,aAAa,EAAE;YAC1I,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,0FAA0F;YACxG,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,MAAiD,EACjD,MAAM,GAAG,kBAAkB;IAE3B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,EAAE;QACR,WAAW;QACX,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE;KACpE,CAAC,CAAC;IACH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,UAAU,MAAM,CAAC,EAAE,kCAAkC,EAAE,UAAU,EAAE;gBAC/G,MAAM,EAAE,4BAA4B;gBACpC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE;aACvC,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAqB,EACrB,MAA6D,EAC7D,QAAuC;IAEvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;IACxC,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,KAAK,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAqB,EACrB,IAAyG,EACzG,GAAW,EACX,MAAc;IAEd,oFAAoF;IACpF,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3H,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACrE,OAAO;QACN,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;KAC9C,CAAC;AACH,CAAC"}