@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/domain/client/secrets-client.js

@@ -0,0 +1,108 @@
+/**
+ * SecretsClient — the unified, runtime-resolved entry point to all secrets.
+ *
+ * One client, scope-routed facets (design §5). `env(tier)` is the env-keyed infra layer
+ * (encrypted-local / env-file / vault / cloudflare-secrets-store, via the secrets/store
+ * backends). `managed(scope, scopeId)` is the multi-tenant vault — CRUD over the cloud-api
+ * storage adapter (the platform secrets DB).
+ *
+ * Resolve anywhere with `getVibesSecretsClient(runtime)`. Built on BaseRuntimeClient and
+ * transport-blind — it composes the runtime's registered backends, never reaching for a
+ * transport itself.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { secretRecordDescriptor } from "../vault/secret-record.js";
+import { EnvSecretsHandle } from "./env-handle.js";
+import { ManagedSecretsHandle } from "./managed-handle.js";
+export class SecretsClient extends BaseRuntimeClient {
+    constructor(descriptor = { id: 'secrets', kind: 'runtime/client' }, context, runtime) {
+        super(descriptor, context, runtime);
+    }
+    /**
+     * The env-keyed facet for one environment tier — key-addressed get/set/unset + bulk
+     * getAll/setAll over the registered `secrets/store` backend.
+     */
+    env(tier) {
+        return new EnvSecretsHandle(this.runtime, tier);
+    }
+    async checkCredentialPresence(input) {
+        const owner = await import("./credential-use.js");
+        return owner.checkCredentialPresence(this.runtime, input);
+    }
+    /** Sign with a referenced credential; the value never leaves Secrets. */
+    async signPayload(input) {
+        const owner = await import("./credential-use.js");
+        return owner.signCredentialPayload(this.runtime, input);
+    }
+    async sendAuthenticatedRequest(input) {
+        const owner = await import("./authenticated-request.js");
+        return owner.sendAuthenticatedRequest(this.runtime, input);
+    }
+    async resolveOAuthAuthorizationUrl(input) {
+        const owner = await import("./credential-use.js");
+        return owner.resolveOAuthAuthorizationUrl(this.runtime, input);
+    }
+    async exchangeOAuthAuthorizationCode(input) {
+        const owner = await import("./credential-use.js");
+        return owner.exchangeOAuthAuthorizationCode(this.runtime, input);
+    }
+    async exchangeOAuthRefreshToken(input) {
+        const owner = await import("./credential-use.js");
+        return owner.exchangeOAuthRefreshToken(this.runtime, input);
+    }
+    /** Build a credential reference for a managed record through its declared value store. */
+    managedCredentialReference(secretId) {
+        const stores = this.runtime
+            .query('secrets/store')
+            .enabled()
+            .filter((descriptor) => descriptor.managedCredentialValues === true)
+            .descriptors();
+        if (stores.length !== 1) {
+            throw new CapabilityError('Managed secret values require exactly one declared credential-value store.', 'UNAVAILABLE', {
+                reason: stores.length === 0
+                    ? 'managed-credential-value-store-unavailable'
+                    : 'managed-credential-value-store-ambiguous',
+                retryable: false
+            });
+        }
+        return CredentialReferenceSchema.parse({
+            source: 'secret',
+            key: secretId,
+            store: stores[0].id
+        });
+    }
+    /**
+     * The managed multi-tenant vault facet for a (scope, scopeId) — id-addressed CRUD over the
+     * cloud-api storage adapter (the platform secrets DB). Requires the storage.cloud-api adapter.
+     */
+    async managed(scope, scopeId) {
+        const unregistered = (cause) => new CapabilityError('The storage.cloud-api adapter is not registered. Add ' +
+            '@vibesdotdev/storage/adapters/cloud-api/plugin to this app to use the managed secret vault.', 'UNAVAILABLE', { reason: 'storage-cloud-api-unregistered', retryable: false, cause });
+        let adapter;
+        try {
+            // SAFETY: storage.cloud-api descriptor resolves to a StorageAdapterInterface for storage record operations.
+            adapter = (await this.runtime
+                .query('storage/adapter')
+                .withId('storage.cloud-api')
+                .resolve());
+        }
+        catch (error) {
+            // Only the confirmed absence of that adapter is "not registered"; any other failure propagates.
+            if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'storage/adapter', 'storage.cloud-api')) {
+                throw unregistered(error);
+            }
+            throw error;
+        }
+        if (!adapter)
+            throw unregistered();
+        // The cloud-api adapter resolves origins, the service token and the caller
+        // bearer on the runtime it is configured with; hand it this client's runtime.
+        // SAFETY: this.runtime is the host VibesRuntime instance required by cloud-api adapter
+        adapter.configure({ runtime: this.runtime });
+        const record = adapter.record(secretRecordDescriptor);
+        return new ManagedSecretsHandle(record, scope, scopeId);
+    }
+}
+//# sourceMappingURL=secrets-client.js.map

package/dist/domain/client/secrets-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-client.js","sourceRoot":"","sources":["../../../src/domain/client/secrets-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,iCAAiC,CAAC;AAErG,OAAO,EAAE,iBAAiB,EAA+B,MAAM,4BAA4B,CAAC;AAI5F,OAAO,EAAE,sBAAsB,EAA2B,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAI3D,MAAM,OAAO,aAAc,SAAQ,iBAA+B;IACjE,YACC,aAAsC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC/E,OAAmC,EACnC,OAAsB;QAEtB,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,IAAqB;QACxB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAmC;QAChE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,WAAW,CAAC,KAAsC;QACvD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAqC;QACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAwC;QAC1E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,8BAA8B,CAAC,KAA+C;QACnF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,KAA0C;QACzE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,0FAA0F;IAC1F,0BAA0B,CAAC,QAAgB;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO;aACzB,KAAK,CAAkC,eAAe,CAAC;aACvD,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,uBAAuB,KAAK,IAAI,CAAC;aACnE,WAAW,EAAE,CAAC;QAEhB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACxB,4EAA4E,EAC5E,aAAa,EACb;gBACC,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;oBAC1B,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,0CAA0C;gBAC7C,SAAS,EAAE,KAAK;aAChB,CACD,CAAC;QACH,CAAC;QAED,OAAO,yBAAyB,CAAC,KAAK,CAAC;YACtC,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE;SACpB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAyB,EAAE,OAAe;QACvD,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CACtC,IAAI,eAAe,CAClB,uDAAuD;YACvD,6FAA6F,EAC7F,aAAa,EACb,EAAE,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CACrE,CAAC;QACH,IAAI,OAA8D,CAAC;QACnE,IAAI,CAAC;YACJ,4GAA4G;YAC5G,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO;iBAC3B,KAAK,CAAC,iBAAiB,CAAC;iBACxB,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,OAAO,EAAE,CAA0D,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gGAAgG;YAChG,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAC1G,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QACnC,2EAA2E;QAC3E,8EAA8E;QAC9E,uFAAuF;QACvF,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAuB,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAsB,sBAAsB,CAAC,CAAC;QAC3E,OAAO,IAAI,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;CACD"}

package/dist/domain/config/load.d.ts

@@ -0,0 +1,6 @@
+import { CapabilityError, type VibesRuntime } from '@vibesdotdev/kernel';
+import { type SecretsConfig } from './secrets.config.descriptor.ts';
+/** No host origin and no composed secrets config manifest named an account origin. */
+export declare function accountOriginUndeclared(): CapabilityError;
+export declare function loadSecretsConfig(runtime: VibesRuntime): Promise<SecretsConfig>;
+//# sourceMappingURL=load.d.ts.map

package/dist/domain/config/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/domain/config/load.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAEP,KAAK,aAAa,EACjB,MAAM,gCAAgC,CAAC;AAExC,sFAAsF;AACtF,wBAAgB,uBAAuB,IAAI,eAAe,CAMzD;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAMrF"}

package/dist/domain/config/load.js

@@ -0,0 +1,15 @@
+import { ConfigManifest } from '@vibesdotdev/config/manifest/config-manifest';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { SECRETS_CONFIG_MANIFEST_ID } from "./secrets.config.descriptor.js";
+/** No host origin and no composed secrets config manifest named an account origin. */
+export function accountOriginUndeclared() {
+    return new CapabilityError('No account origin is declared: the host origin or the secrets config manifest must name one.', 'INVALID_INPUT', { reason: 'account-origin-undeclared', retryable: false });
+}
+export async function loadSecretsConfig(runtime) {
+    const composed = runtime.hasKind('config/manifest') &&
+        runtime.query('config/manifest').withId(SECRETS_CONFIG_MANIFEST_ID).descriptors().length > 0;
+    if (!composed)
+        throw accountOriginUndeclared();
+    return await ConfigManifest.forRuntime(runtime, SECRETS_CONFIG_MANIFEST_ID).load();
+}
+//# sourceMappingURL=load.js.map

package/dist/domain/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/domain/config/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EACP,0BAA0B,EAEzB,MAAM,gCAAgC,CAAC;AAExC,sFAAsF;AACtF,MAAM,UAAU,uBAAuB;IACtC,OAAO,IAAI,eAAe,CACzB,8FAA8F,EAC9F,eAAe,EACf,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAqB;IAC5D,MAAM,QAAQ,GACb,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,IAAI,CAAC,QAAQ;QAAE,MAAM,uBAAuB,EAAE,CAAC;IAC/C,OAAO,MAAM,cAAc,CAAC,UAAU,CAAgB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAC;AACnG,CAAC"}

package/dist/domain/config/secrets.config.descriptor.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Secrets svelte settings — config/manifest with no default origin.
+ *
+ * The account origin is declared when the composing app uses that service.
+ * Local credential stores need no account service; no default is supplied.
+ */
+export { SecretsConfigSchema, type SecretsConfig } from '../../schemas/domain/config.schema.ts';
+export declare const SECRETS_CONFIG_MANIFEST_ID = "secrets";
+declare const descriptor: {
+    kind: "config/manifest";
+    id: string;
+    name: string;
+    namespace: string;
+    description: string;
+    schema: import("zod/v4").ZodObject<{
+        accountOrigin: import("zod/v4").ZodOptional<import("zod/v4").ZodURL>;
+    }, import("zod/v4/core").$strict>;
+    scope: "global";
+    tier: "user";
+    storedLayer: "none";
+    allowedAdapters: string[];
+    fields: {
+        accountOrigin: {
+            ui: {
+                label: string;
+                component: "input";
+            };
+        };
+    };
+    customTables: false;
+    version: number;
+    internal: false;
+};
+export default descriptor;
+//# sourceMappingURL=secrets.config.descriptor.d.ts.map

package/dist/domain/config/secrets.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.config.descriptor.d.ts","sourceRoot":"","sources":["../../../src/domain/config/secrets.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEhG,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;CAiBoB,CAAC;AAErC,eAAe,UAAU,CAAC"}

package/dist/domain/config/secrets.config.descriptor.js

@@ -0,0 +1,29 @@
+/**
+ * Secrets svelte settings — config/manifest with no default origin.
+ *
+ * The account origin is declared when the composing app uses that service.
+ * Local credential stores need no account service; no default is supplied.
+ */
+import { SecretsConfigSchema } from "../../schemas/domain/config.schema.js";
+export { SecretsConfigSchema } from "../../schemas/domain/config.schema.js";
+export const SECRETS_CONFIG_MANIFEST_ID = 'secrets';
+const descriptor = {
+    kind: 'config/manifest',
+    id: SECRETS_CONFIG_MANIFEST_ID,
+    name: 'Secrets',
+    namespace: 'secrets',
+    description: 'Account origin for the secrets svelte client',
+    schema: SecretsConfigSchema,
+    scope: 'global',
+    tier: 'user',
+    storedLayer: 'none',
+    allowedAdapters: ['storage.json', 'storage.localdb'],
+    fields: {
+        accountOrigin: { ui: { label: 'Account origin', component: 'input' } }
+    },
+    customTables: false,
+    version: 1,
+    internal: false
+};
+export default descriptor;
+//# sourceMappingURL=secrets.config.descriptor.js.map

package/dist/domain/config/secrets.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.config.descriptor.js","sourceRoot":"","sources":["../../../src/domain/config/secrets.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,uCAAuC,CAAC;AAEhG,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAEpD,MAAM,UAAU,GAAG;IAClB,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,SAAS;IACf,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,8CAA8C;IAC3D,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACpD,MAAM,EAAE;QACP,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;KACtE;IACD,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;CACoB,CAAC;AAErC,eAAe,UAAU,CAAC"}

package/dist/domain/kinds/index.d.ts

@@ -0,0 +1,5 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor, type EnvironmentTier, type ResolvedSecretsStoreDescriptor, type SecretsBackend, type SecretsStoreDescriptor, type SecretsStoreSelection } from './store.schema.ts';
+export type { SecretEntry, SecretsStoreImplementation, StoreOperationContext } from './store.interface.ts';
+export { parseSecretsStoreDescriptors, pickTierSecretsStore } from './store-selection.ts';
+export { secretsStoreKind } from './store.kind.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/kinds/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EAAC,4BAA4B,EACjD,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAClG,6BAA6B,EAAC,KAAK,eAAe,EAAC,KAAK,8BAA8B,EAAC,KAAK,cAAc,EAAC,KAAK,sBAAsB,EAAC,KAAK,qBAAqB,EAChK,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACZ,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,4BAA4B,EAAC,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/domain/kinds/index.js

@@ -0,0 +1,4 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor } from "./store.schema.js";
+export { parseSecretsStoreDescriptors, pickTierSecretsStore } from "./store-selection.js";
+export { secretsStoreKind } from "./store.kind.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/kinds/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/kinds/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EAAC,4BAA4B,EACjD,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAClG,6BAA6B,EAC5B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,4BAA4B,EAAC,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/domain/kinds/schemas/store.schema.d.ts

@@ -0,0 +1,2 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor, type EnvironmentTier, type ResolvedSecretsStoreDescriptor, type SecretsBackend, type SecretsStoreDescriptor, type SecretsStoreSelection } from '../../../schemas/domain/store/store.schema.ts';
+//# sourceMappingURL=store.schema.d.ts.map

package/dist/domain/kinds/schemas/store.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.d.ts","sourceRoot":"","sources":["../../../../src/domain/kinds/schemas/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAC,oBAAoB,EAAC,4BAA4B,EAAC,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAAC,6BAA6B,EAAC,KAAK,eAAe,EAAC,KAAK,8BAA8B,EAAC,KAAK,cAAc,EAAC,KAAK,sBAAsB,EAAC,KAAK,qBAAqB,EAAE,MAAM,+CAA+C,CAAC"}

package/dist/domain/kinds/schemas/store.schema.js

@@ -0,0 +1,2 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor } from "../../../schemas/domain/store/store.schema.js";
+//# sourceMappingURL=store.schema.js.map

package/dist/domain/kinds/schemas/store.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.js","sourceRoot":"","sources":["../../../../src/domain/kinds/schemas/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAC,oBAAoB,EAAC,4BAA4B,EAAC,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAAC,6BAA6B,EAAsI,MAAM,+CAA+C,CAAC"}

package/dist/domain/kinds/schemas/store.types.d.ts

@@ -0,0 +1,2 @@
+export type { SecretEntry, SecretsStoreImplementation, StoreOperationContext } from '../../../schemas/domain/store/store.types.ts';
+//# sourceMappingURL=store.types.d.ts.map

package/dist/domain/kinds/schemas/store.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.d.ts","sourceRoot":"","sources":["../../../../src/domain/kinds/schemas/store.types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAC,0BAA0B,EAAC,qBAAqB,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/domain/kinds/schemas/store.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.js","sourceRoot":"","sources":["../../../../src/domain/kinds/schemas/store.types.ts"],"names":[],"mappings":""}

package/dist/domain/kinds/secret-key.d.ts

@@ -0,0 +1,13 @@
+/** The longest credential name the kernel's credential reference accepts. */
+export declare const SECRET_KEY_MAX_LENGTH = 128;
+/** What a store accepts as a credential name: environment-variable shaped. */
+export declare const ENVIRONMENT_KEY_PATTERN: RegExp;
+/**
+ * Refuse a key no store may read or write: empty, over-long, an object-internal
+ * name, or one carrying a control character or path separator. The key itself is
+ * never put in the error, so a mistyped credential value cannot leak through it.
+ */
+export declare function assertSecretKey<Input>(key: Input): asserts key is Input & string;
+/** `assertSecretKey`, plus the environment-variable shape a dotenv file can hold. */
+export declare function assertEnvironmentSecretKey<Input>(key: Input): asserts key is Input & string;
+//# sourceMappingURL=secret-key.d.ts.map

package/dist/domain/kinds/secret-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-key.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/secret-key.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAczC,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,QAA6B,CAAC;AAUlE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,GAAG,MAAM,CAMhF;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,GAAG,MAAM,CAG3F"}

package/dist/domain/kinds/secret-key.js

@@ -0,0 +1,47 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+/** The longest credential name the kernel's credential reference accepts. */
+export const SECRET_KEY_MAX_LENGTH = 128;
+/** Names that address object internals, never a credential. */
+const FORBIDDEN_KEY_NAMES = new Set(['__proto__', 'constructor', 'prototype']);
+/** NUL and the other control characters, and the path separators every file-backed store would misread. */
+function hasUnsafeCharacter(key) {
+    for (const character of key) {
+        const code = character.codePointAt(0) ?? 0;
+        if (code <= 0x1f || code === 0x7f || character === '/' || character === '\\')
+            return true;
+    }
+    return false;
+}
+/** What a store accepts as a credential name: environment-variable shaped. */
+export const ENVIRONMENT_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function invalid(reason) {
+    return new CapabilityError('The secret key is not a valid credential name.', 'INVALID_INPUT', {
+        reason: 'secret-key-invalid',
+        retryable: false,
+        details: { problem: reason }
+    });
+}
+/**
+ * Refuse a key no store may read or write: empty, over-long, an object-internal
+ * name, or one carrying a control character or path separator. The key itself is
+ * never put in the error, so a mistyped credential value cannot leak through it.
+ */
+export function assertSecretKey(key) {
+    if (typeof key !== 'string')
+        throw invalid('not-a-string');
+    if (key.length === 0)
+        throw invalid('empty');
+    if (key.length > SECRET_KEY_MAX_LENGTH)
+        throw invalid('too-long');
+    if (FORBIDDEN_KEY_NAMES.has(key))
+        throw invalid('reserved-name');
+    if (hasUnsafeCharacter(key))
+        throw invalid('unsafe-character');
+}
+/** `assertSecretKey`, plus the environment-variable shape a dotenv file can hold. */
+export function assertEnvironmentSecretKey(key) {
+    assertSecretKey(key);
+    if (!ENVIRONMENT_KEY_PATTERN.test(key))
+        throw invalid('not-environment-shaped');
+}
+//# sourceMappingURL=secret-key.js.map

package/dist/domain/kinds/secret-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-key.js","sourceRoot":"","sources":["../../../src/domain/kinds/secret-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpG,2GAA2G;AAC3G,SAAS,kBAAkB,CAAC,GAAW;IACtC,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,SAAS,OAAO,CAAC,MAAc;IAC9B,OAAO,IAAI,eAAe,CAAC,gDAAgD,EAAE,eAAe,EAAE;QAC7F,MAAM,EAAE,oBAAoB;QAC5B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;KAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAQ,GAAU;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAqB;QAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAQ,GAAU;IAC3D,eAAe,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjF,CAAC"}

package/dist/domain/kinds/store-operation.d.ts

@@ -0,0 +1,3 @@
+import type { SecretsStoreImplementation } from './store.interface.ts';
+export declare function guardStoreOperations(store: SecretsStoreImplementation): SecretsStoreImplementation;
+//# sourceMappingURL=store-operation.d.ts.map

package/dist/domain/kinds/store-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-operation.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/store-operation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAwB,MAAM,sBAAsB,CAAC;AAwB7F,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,0BAA0B,GAC/B,0BAA0B,CAsB5B"}

package/dist/domain/kinds/store-operation.js

@@ -0,0 +1,43 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+// Tokens contain no values and cannot be reconstructed from caller JSON. This is
+// immutable ancestry, not a global list of busy backends: concurrent roots differ.
+const ancestry = new WeakMap();
+/** A context the kind did not issue (serialized, hand-built or replayed) is refused before the backend runs. */
+function contextInvalid(store) {
+    return new CapabilityError('Invalid secret store operation context', 'INVALID_INPUT', {
+        reason: 'store-context-invalid',
+        retryable: false,
+        details: { store: store.id }
+    });
+}
+/** A backend that (transitively) reads or writes through itself to bootstrap is refused, not looped. */
+function recursion(store) {
+    return new CapabilityError('Secret store bootstrap dependency cycle', 'INVALID_INPUT', {
+        reason: 'store-recursion',
+        retryable: false,
+        details: { store: store.id }
+    });
+}
+export function guardStoreOperations(store) {
+    const enter = async (context, run) => {
+        const parents = context === undefined ? [] : ancestry.get(context);
+        if (!parents)
+            throw contextInvalid(store);
+        if (parents.includes(store))
+            throw recursion(store);
+        const next = Object.freeze({});
+        ancestry.set(next, [...parents, store]);
+        return await run(next);
+    };
+    return {
+        id: store.id,
+        descriptor: store.descriptor,
+        list: (env, context) => enter(context, (next) => store.list(env, next)),
+        get: (env, key, context) => enter(context, (next) => store.get(env, key, next)),
+        getAll: (env, context) => enter(context, (next) => store.getAll(env, next)),
+        set: (env, key, value, context) => enter(context, (next) => store.set(env, key, value, next)),
+        unset: (env, key, context) => enter(context, (next) => store.unset(env, key, next)),
+        setAll: (env, values, context) => enter(context, (next) => store.setAll(env, values, next))
+    };
+}
+//# sourceMappingURL=store-operation.js.map

package/dist/domain/kinds/store-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-operation.js","sourceRoot":"","sources":["../../../src/domain/kinds/store-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,iFAAiF;AACjF,mFAAmF;AACnF,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA6B,CAAC;AAE1D,gHAAgH;AAChH,SAAS,cAAc,CAAC,KAAiC;IACxD,OAAO,IAAI,eAAe,CAAC,wCAAwC,EAAE,eAAe,EAAE;QACrF,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;KAC5B,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAiC;IACnD,OAAO,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;QACtF,MAAM,EAAE,iBAAiB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;KAC5B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAiC;IAEjC,MAAM,KAAK,GAAG,KAAK,EAClB,OAA0C,EAC1C,GAAgD,EACnC,EAAE;QACf,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,GAA0B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/E,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7F,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACnF,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;KAC3F,CAAC;AACH,CAAC"}

package/dist/domain/kinds/store-selection.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The one scope-store selection every resolver shares: the kind's unnamed
+ * lookup (`selectScopeSecretsStore`), `resolveSecretsStore`, and every
+ * `vibes secrets` command's tier pick. Highest priority among the scope stores
+ * serving the tier wins; a priority tie is `INVALID_INPUT` `store-ambiguous`,
+ * never a silent first; descriptors are parsed, never cast.
+ */
+import { type EnvironmentTier, type ResolvedSecretsStoreDescriptor } from './schemas/store.schema.ts';
+/**
+ * Parse every registered descriptor with the kind's schema. A malformed one is
+ * a typed refusal (`INVALID_INPUT` `store-descriptor-invalid`), because skipping
+ * it would silently change which store answers.
+ */
+export declare function parseSecretsStoreDescriptors(raw: readonly unknown[]): ResolvedSecretsStoreDescriptor[];
+/**
+ * The one scope store serving `tier`: the highest priority wins. No candidate
+ * is `undefined`; a tie at the top is `INVALID_INPUT` `store-ambiguous`
+ * naming the tied ids.
+ */
+export declare function pickTierSecretsStore(descriptors: readonly ResolvedSecretsStoreDescriptor[], tier: EnvironmentTier): ResolvedSecretsStoreDescriptor | undefined;
+//# sourceMappingURL=store-selection.d.ts.map

package/dist/domain/kinds/store-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-selection.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/store-selection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAGP,KAAK,eAAe,EACpB,KAAK,8BAA8B,EAClC,MAAM,2BAA2B,CAAC;AAKnC;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,GAAG,8BAA8B,EAAE,CAiBtG;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,SAAS,8BAA8B,EAAE,EACtD,IAAI,EAAE,eAAe,GACnB,8BAA8B,GAAG,SAAS,CAoB5C"}

package/dist/domain/kinds/store-selection.js

@@ -0,0 +1,57 @@
+/**
+ * The one scope-store selection every resolver shares: the kind's unnamed
+ * lookup (`selectScopeSecretsStore`), `resolveSecretsStore`, and every
+ * `vibes secrets` command's tier pick. Highest priority among the scope stores
+ * serving the tier wins; a priority tie is `INVALID_INPUT` `store-ambiguous`,
+ * never a silent first; descriptors are parsed, never cast.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { SecretsStoreDescriptorSchema, isGenericSecretsStoreDescriptor } from "./schemas/store.schema.js";
+/** The one field a refusal may name from a descriptor that did not parse. */
+const descriptorIdSchema = z.object({ id: z.string() });
+/**
+ * Parse every registered descriptor with the kind's schema. A malformed one is
+ * a typed refusal (`INVALID_INPUT` `store-descriptor-invalid`), because skipping
+ * it would silently change which store answers.
+ */
+export function parseSecretsStoreDescriptors(raw) {
+    const parsed = [];
+    for (const candidate of raw) {
+        const result = SecretsStoreDescriptorSchema.safeParse(candidate);
+        if (!result.success) {
+            const named = descriptorIdSchema.safeParse(candidate);
+            const issues = result.error.issues.map((issue) => issue.path.join('.') || '(root)');
+            const details = named.success ? { issues, id: named.data.id } : { issues };
+            throw new CapabilityError('A registered secrets/store descriptor is malformed.', 'INVALID_INPUT', {
+                reason: 'store-descriptor-invalid',
+                retryable: false,
+                details
+            });
+        }
+        parsed.push(result.data);
+    }
+    return parsed;
+}
+/**
+ * The one scope store serving `tier`: the highest priority wins. No candidate
+ * is `undefined`; a tie at the top is `INVALID_INPUT` `store-ambiguous`
+ * naming the tied ids.
+ */
+export function pickTierSecretsStore(descriptors, tier) {
+    const eligible = descriptors.filter((descriptor) => isGenericSecretsStoreDescriptor(descriptor) && descriptor.tiers.includes(tier));
+    if (eligible.length === 0)
+        return undefined;
+    const top = Math.max(...eligible.map((descriptor) => descriptor.priority));
+    const winners = eligible.filter((descriptor) => descriptor.priority === top);
+    if (winners.length > 1) {
+        throw new CapabilityError(`More than one secrets store serves tier '${tier}' at priority ${top}.`, 'INVALID_INPUT', {
+            reason: 'store-ambiguous',
+            retryable: false,
+            recoveryHint: 'Give the stores distinct priorities, or name one with --backend <id>.',
+            details: { tier, priority: top, stores: winners.map((descriptor) => descriptor.id) }
+        });
+    }
+    return winners[0];
+}
+//# sourceMappingURL=store-selection.js.map

package/dist/domain/kinds/store-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-selection.js","sourceRoot":"","sources":["../../../src/domain/kinds/store-selection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACP,4BAA4B,EAC5B,+BAA+B,EAG9B,MAAM,2BAA2B,CAAC;AAEnC,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAuB;IACnE,MAAM,MAAM,GAAqC,EAAE,CAAC;IACpD,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;YACpF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3E,MAAM,IAAI,eAAe,CAAC,qDAAqD,EAAE,eAAe,EAAE;gBACjG,MAAM,EAAE,0BAA0B;gBAClC,SAAS,EAAE,KAAK;gBAChB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CACnC,WAAsD,EACtD,IAAqB;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAClC,CAAC,UAAU,EAAE,EAAE,CAAC,+BAA+B,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9F,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACxB,4CAA4C,IAAI,iBAAiB,GAAG,GAAG,EACvE,eAAe,EACf;YACC,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,uEAAuE;YACrF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE;SACpF,CACD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/domain/kinds/store.interface.d.ts

@@ -0,0 +1,2 @@
+export type { SecretEntry, SecretsStoreImplementation, StoreOperationContext } from './schemas/store.types.ts';
+//# sourceMappingURL=store.interface.d.ts.map

package/dist/domain/kinds/store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.interface.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/store.interface.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAC,0BAA0B,EAAC,qBAAqB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/domain/kinds/store.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.interface.js","sourceRoot":"","sources":["../../../src/domain/kinds/store.interface.ts"],"names":[],"mappings":""}

package/dist/domain/kinds/store.kind.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secrets Store Kind Definition
+ *
+ * Registers the secrets/store kind with the runtime. Scope resolution (an
+ * unnamed lookup) is authoritative (rc05 §2.3): among the `selection: 'scope'`
+ * stores whose tiers include the declared tier, the highest priority answers;
+ * a priority tie is `INVALID_INPUT` `store-ambiguous`; no candidate is
+ * `undefined`, which the kernel reports as `no-store`. A `by-id` store is
+ * reachable only through `.withId(id)`, which never runs this resolver. The
+ * pick itself is `pickTierSecretsStore`, shared with `resolveSecretsStore` and
+ * every `vibes secrets` command.
+ */
+import type { KindContext, RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/kind';
+import type { RuntimeScope } from '@vibesdotdev/kernel/schemas/scope';
+import type { SecretsStoreImplementation } from './store.interface.ts';
+import { type ResolvedSecretsStoreDescriptor } from './store.schema.ts';
+/** Select the one scope store for the declared tier, or none. */
+export declare function selectScopeSecretsStore(candidates: RuntimeDescriptor[], scope: RuntimeScope, _context?: KindContext): ResolvedSecretsStoreDescriptor | undefined;
+export declare const secretsStoreKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<SecretsStoreImplementation>;
+//# sourceMappingURL=store.kind.d.ts.map

package/dist/domain/kinds/store.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.kind.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/store.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAC,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAGP,KAAK,8BAA8B,EAElC,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,wBAAgB,uBAAuB,CACtC,UAAU,EAAE,iBAAiB,EAAE,EAC/B,KAAK,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,WAAW,GACpB,8BAA8B,GAAG,SAAS,CAI5C;AAED,eAAO,MAAM,gBAAgB,uFAY3B,CAAC"}

package/dist/domain/kinds/store.kind.js

@@ -0,0 +1,33 @@
+/**
+ * Secrets Store Kind Definition
+ *
+ * Registers the secrets/store kind with the runtime. Scope resolution (an
+ * unnamed lookup) is authoritative (rc05 §2.3): among the `selection: 'scope'`
+ * stores whose tiers include the declared tier, the highest priority answers;
+ * a priority tie is `INVALID_INPUT` `store-ambiguous`; no candidate is
+ * `undefined`, which the kernel reports as `no-store`. A `by-id` store is
+ * reachable only through `.withId(id)`, which never runs this resolver. The
+ * pick itself is `pickTierSecretsStore`, shared with `resolveSecretsStore` and
+ * every `vibes secrets` command.
+ */
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory/kind';
+import { guardStoreOperations } from "./store-operation.js";
+import { parseSecretsStoreDescriptors, pickTierSecretsStore } from "./store-selection.js";
+import { EnvironmentTierSchema, SecretsStoreDescriptorSchema } from "./store.schema.js";
+/** Select the one scope store for the declared tier, or none. */
+export function selectScopeSecretsStore(candidates, scope, _context) {
+    const tier = EnvironmentTierSchema.safeParse(scope.qualifiers?.environmentTier);
+    if (!tier.success)
+        return undefined;
+    return pickTierSecretsStore(parseSecretsStoreDescriptors(candidates), tier.data);
+}
+export const secretsStoreKind = createRuntimeKind({
+    id: 'secrets/store',
+    descriptorSchema: SecretsStoreDescriptorSchema,
+    resolve: selectScopeSecretsStore,
+    resolveAuthoritative: true,
+    // SAFETY: resolveValue receives the implementation instance produced by the resolved store loader.
+    resolveValue: async (impl) => guardStoreOperations(impl),
+    contexts: []
+});
+//# sourceMappingURL=store.kind.js.map

package/dist/domain/kinds/store.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.kind.js","sourceRoot":"","sources":["../../../src/domain/kinds/store.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAC,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEzF,OAAO,EACP,qBAAqB,EACrB,4BAA4B,EAG3B,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,MAAM,UAAU,uBAAuB,CACtC,UAA+B,EAC/B,KAAmB,EACnB,QAAsB;IAEtB,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,oBAAoB,CAAC,4BAA4B,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAI/C;IACD,EAAE,EAAE,eAAe;IACnB,gBAAgB,EAAE,4BAA4B;IAC9C,OAAO,EAAE,uBAAuB;IAChC,oBAAoB,EAAE,IAAI;IAC1B,mGAAmG;IACnG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAkC,CAAC;IACtF,QAAQ,EAAE,EAAE;CACZ,CAAC,CAAC"}

package/dist/domain/kinds/store.schema.d.ts

@@ -0,0 +1,2 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor, type EnvironmentTier, type ResolvedSecretsStoreDescriptor, type SecretsBackend, type SecretsStoreDescriptor, type SecretsStoreSelection } from './schemas/store.schema.ts';
+//# sourceMappingURL=store.schema.d.ts.map

package/dist/domain/kinds/store.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.d.ts","sourceRoot":"","sources":["../../../src/domain/kinds/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EAAC,4BAA4B,EACjD,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAClG,6BAA6B,EAAC,KAAK,eAAe,EAAC,KAAK,8BAA8B,EAAC,KAAK,cAAc,EAAC,KAAK,sBAAsB,EAAC,KAAK,qBAAqB,EAChK,MAAM,2BAA2B,CAAC"}

package/dist/domain/kinds/store.schema.js

@@ -0,0 +1,2 @@
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor } from "./schemas/store.schema.js";
+//# sourceMappingURL=store.schema.js.map

package/dist/domain/kinds/store.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.js","sourceRoot":"","sources":["../../../src/domain/kinds/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EAAC,4BAA4B,EACjD,2BAA2B,EAAC,+BAA+B,EAAC,sCAAsC,EAClG,6BAA6B,EAC5B,MAAM,2BAA2B,CAAC"}

package/dist/domain/manifest/authentication.d.ts

@@ -0,0 +1,17 @@
+/** Authentication import entries, validated by the canonical manifest owner. */
+export declare const authenticationSecrets: ({
+    key: string;
+    category: string;
+    source: string;
+    required: boolean;
+    description: string;
+    aliases?: undefined;
+} | {
+    key: string;
+    category: string;
+    source: string;
+    aliases: string[];
+    required: boolean;
+    description: string;
+})[];
+//# sourceMappingURL=authentication.d.ts.map

package/dist/domain/manifest/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/authentication.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;IAqIjC,CAAC"}