@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/domain/requirements/config-requirements.js

@@ -0,0 +1,115 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import {} from "../../schemas/discovery/diagnostics.schema.js";
+import { deploymentModuleSchema, requirementEnvEntrySchema, requirementInfraDescriptorSchema, serviceReleaseModuleSchema } from "../../schemas/discovery/requirements.schema.js";
+import { outcomeOf } from "../../support/file-failure.js";
+export function secretEntryRequirement(appId, entry) {
+    if (!entry.secret)
+        return undefined;
+    const key = entry.storeKey ?? entry.name;
+    const req = {
+        key,
+        appId,
+        required: entry.required ?? true,
+        description: entry.description
+    };
+    if (key !== entry.name) {
+        req.binding = entry.name;
+    }
+    return req;
+}
+/** The requirements of the registered infra descriptors; a malformed descriptor is a failure, never skipped silently. */
+export function extractRequirements(kind, descriptors, failures) {
+    const results = [];
+    descriptors.forEach((candidate, index) => {
+        const parsed = requirementInfraDescriptorSchema.safeParse(candidate);
+        if (!parsed.success) {
+            failures.push({
+                path: `${kind}[${index}]`,
+                reason: 'requirements-descriptor-invalid',
+                message: `An ${kind} descriptor does not match the requirement shape (${[...new Set(parsed.error.issues.map((issue) => issue.path.join('.') || '(root)'))].join(', ')}).`
+            });
+            return;
+        }
+        for (const entry of parsed.data.env ?? []) {
+            const req = secretEntryRequirement(parsed.data.id, entry);
+            if (req)
+                results.push(req);
+        }
+    });
+    return results;
+}
+export function configFailure(path, reason, message, cause) {
+    return { ok: false, failure: cause === undefined ? { path, reason, message } : { path, reason, message, cause } };
+}
+/** A caught failure as a discovery entry: the value-free `from()` text beside the failure itself. */
+export function caughtDiscoveryFailure(path, reason, caught) {
+    const cause = CapabilityError.from(caught);
+    return { path, reason, message: cause.message, cause };
+}
+export function deploymentRequirements(path, mod) {
+    const parsed = deploymentModuleSchema.safeParse(mod);
+    if (!parsed.success) {
+        return configFailure(path, 'requirements-config-invalid', 'The module does not export a deployment config with an `env` list.');
+    }
+    const appId = parsed.data.appId;
+    if (!appId)
+        return configFailure(path, 'requirements-appid-missing', 'The deployment config declares no `appId`.');
+    const requirements = [];
+    for (const entry of parsed.data.env ?? []) {
+        const req = secretEntryRequirement(appId, entry);
+        if (req)
+            requirements.push(req);
+    }
+    return { ok: true, requirements };
+}
+export function serviceReleaseRequirements(path, mod) {
+    const parsed = serviceReleaseModuleSchema.safeParse(mod);
+    if (!parsed.success) {
+        return configFailure(path, 'requirements-config-invalid', 'The module does not export service-release secret declarations in the expected shape.');
+    }
+    if (!parsed.data.serviceReleaseId) {
+        return configFailure(path, 'requirements-appid-missing', 'The service-release config declares no `serviceReleaseId`.');
+    }
+    const appId = parsed.data.serviceReleaseId;
+    const bindingRequirements = [];
+    for (const binding of parsed.data.serviceReleaseSecretBindings ?? []) {
+        if (binding.source?.kind !== 'secret-store' || !binding.source.key)
+            continue;
+        if (!binding.target?.name || !binding.target.key)
+            continue;
+        bindingRequirements.push({
+            key: binding.source.key,
+            binding: `${binding.target.name}/${binding.target.key}`,
+            appId,
+            required: true,
+            description: binding.description
+        });
+    }
+    const operatorRequirements = [];
+    for (const req of parsed.data.serviceReleaseOperatorSecretRequirements ?? []) {
+        const caps = req.capabilities?.filter((c) => c.length > 0);
+        const requirement = {
+            key: req.key,
+            appId,
+            required: req.required !== false,
+            description: req.description
+        };
+        if (caps && caps.length > 0) {
+            requirement.capabilities = caps;
+        }
+        operatorRequirements.push(requirement);
+    }
+    return { ok: true, requirements: [...operatorRequirements, ...bindingRequirements] };
+}
+export async function loadConfig(loader, configPath) {
+    const imported = await outcomeOf(() => loader.importModule(configPath));
+    if (!imported.ok) {
+        const failure = CapabilityError.from(imported.failure);
+        return configFailure(configPath, 'requirements-config-load-failed', failure.message, failure);
+    }
+    return configPath.includes('service-release.config.')
+        ? serviceReleaseRequirements(configPath, imported.value)
+        : deploymentRequirements(configPath, imported.value);
+}
+//# sourceMappingURL=config-requirements.js.map

package/dist/domain/requirements/config-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-requirements.js","sourceRoot":"","sources":["../../../src/domain/requirements/config-requirements.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAoC,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAC,yBAAyB,EAAC,gCAAgC,EAAC,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAE9K,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAI1D,MAAM,UAAU,sBAAsB,CACrC,KAAa,EACb,KAAgD;IAEhD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;IACzC,MAAM,GAAG,GAAsB;QAC9B,GAAG;QACH,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC9B,CAAC;IACF,IAAI,GAAG,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,mBAAmB,CAClC,IAAY,EACZ,WAA+B,EAC/B,QAAuC;IAEvC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG;gBACzB,MAAM,EAAE,iCAAiC;gBACzC,OAAO,EAAE,MAAM,IAAI,qDAAqD,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;aACzK,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,IAAI,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,IAAY,EACZ,MAA6C,EAC7C,OAAe,EACf,KAAuB;IAEvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;AACnH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAA6C,EAAE,MAAqB;IACxH,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAAiB;IACrE,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC,IAAI,EAAE,6BAA6B,EAAE,oEAAoE,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,4BAA4B,EAAE,4CAA4C,CAAC,CAAC;IACnH,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,GAAG;YAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,GAAiB;IACzE,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC,IAAI,EAAE,6BAA6B,EAAE,uFAAuF,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC,IAAI,EAAE,4BAA4B,EAAE,4DAA4D,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAE3C,MAAM,mBAAmB,GAAwB,EAAE,CAAC;IACpD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YAAE,SAAS;QAC7E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;YAAE,SAAS;QAC3D,mBAAmB,CAAC,IAAI,CAAC;YACxB,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YACvB,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE;YACvD,KAAK;YACL,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAwB,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAsB;YACtC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,KAAK;YAChC,WAAW,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC;QACjC,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,oBAAoB,EAAE,GAAG,mBAAmB,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAmC,EAAE,UAAkB;IACvF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,aAAa,CAAC,UAAU,EAAE,iCAAiC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACpD,CAAC,CAAC,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/domain/requirements/config-walk.d.ts

@@ -0,0 +1,29 @@
+import { type RequirementDiscoveryFailure } from "../../schemas/discovery/diagnostics.schema.ts";
+import type { WalkLoader, Walked } from '../../schemas/discovery/runtime.schema.ts';
+import type { SecretRequirement, SecretRequirementsRuntime } from './schemas/requirements.ts';
+export type { WalkLoader, Walked } from '../../schemas/discovery/runtime.schema.ts';
+/** Directories below the root that the walk descends into. */
+export declare const REQUIREMENTS_MAX_DEPTH = 6;
+/** Entries read from one directory before the rest are a named `requirements-walk-capped` failure. */
+export declare const REQUIREMENTS_MAX_DIRECTORY_ENTRIES = 5000;
+/** Directories visited in one walk before the walk stops with a named `requirements-walk-capped` failure. */
+export declare const REQUIREMENTS_MAX_DIRECTORIES = 20000;
+/** Config files accepted in one walk before the rest are a named `requirements-walk-capped` failure. */
+export declare const REQUIREMENTS_MAX_CONFIGS = 1000;
+export declare function selectWalkLoader(runtime: SecretRequirementsRuntime): Promise<WalkLoader>;
+export declare const IGNORED: Set<string>;
+export declare const CONFIG_NAMES: Set<string>;
+/**
+ * Find the config files under `rootDir` (mirrors infra-deploy's
+ * findDeploymentConfigs): breadth-first, `REQUIREMENTS_MAX_DEPTH` deep, ignoring
+ * build and dot directories. A directory the host reports absent is skipped; any
+ * other failure, and every cap hit, is a named failure.
+ */
+export declare function walkForConfigs(walk: WalkLoader, rootDir: string): Walked;
+export declare function resolveFromDeploymentConfigs(runtime: SecretRequirementsRuntime, rootDir: string): Promise<{
+    requirements: SecretRequirement[];
+    discovered: number;
+    loaded: number;
+    failures: RequirementDiscoveryFailure[];
+}>;
+//# sourceMappingURL=config-walk.d.ts.map

package/dist/domain/requirements/config-walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-walk.d.ts","sourceRoot":"","sources":["../../../src/domain/requirements/config-walk.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EAAE,UAAU,EAAC,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnF,OAAO,KAAK,EAAE,iBAAiB,EAAC,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAC,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnF,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,sGAAsG;AACtG,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AAExD,6GAA6G;AAC7G,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,wGAAwG;AACxG,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,CAmB9F;AAED,eAAO,MAAM,OAAO,aASlB,CAAC;AAEH,eAAO,MAAM,YAAY,aAOvB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA6DxE;AAED,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,2BAA2B,EAAE,CAAA;CAAE,CAAC,CAgB7H"}

package/dist/domain/requirements/config-walk.js

@@ -0,0 +1,138 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from "../../schemas/discovery/diagnostics.schema.js";
+import { attemptOf } from "../../support/file-failure.js";
+import { caughtDiscoveryFailure, loadConfig } from "./config-requirements.js";
+/** Directories below the root that the walk descends into. */
+export const REQUIREMENTS_MAX_DEPTH = 6;
+/** Entries read from one directory before the rest are a named `requirements-walk-capped` failure. */
+export const REQUIREMENTS_MAX_DIRECTORY_ENTRIES = 5_000;
+/** Directories visited in one walk before the walk stops with a named `requirements-walk-capped` failure. */
+export const REQUIREMENTS_MAX_DIRECTORIES = 20_000;
+/** Config files accepted in one walk before the rest are a named `requirements-walk-capped` failure. */
+export const REQUIREMENTS_MAX_CONFIGS = 1_000;
+export async function selectWalkLoader(runtime) {
+    const selected = runtime.hasKind('runtime/loader')
+        ? await runtime.query('runtime/loader').enabled().select()
+        : undefined;
+    const loader = selected?.impl;
+    const { listDirectory, stat, joinPath } = loader ?? {};
+    if (!loader || !listDirectory || !stat || !joinPath) {
+        throw new CapabilityError('The handed runtime has no host loader that can list directories, stat paths and import modules, so workspace requirement configs cannot be discovered.', 'UNAVAILABLE', { reason: 'requirements-loader-unavailable', retryable: false });
+    }
+    return {
+        loader,
+        listDirectory: (path) => listDirectory.call(loader, path),
+        stat: (path) => stat.call(loader, path),
+        joinPath: (...segments) => joinPath.apply(loader, segments)
+    };
+}
+export const IGNORED = new Set([
+    'node_modules',
+    '.git',
+    '.svelte-kit',
+    'dist',
+    'build',
+    '.turbo',
+    '.vibes',
+    '.wrangler'
+]);
+export const CONFIG_NAMES = new Set([
+    'deployment.config.ts',
+    'deployment.config.js',
+    'deployment.config.mjs',
+    'service-release.config.ts',
+    'service-release.config.js',
+    'service-release.config.mjs'
+]);
+/**
+ * Find the config files under `rootDir` (mirrors infra-deploy's
+ * findDeploymentConfigs): breadth-first, `REQUIREMENTS_MAX_DEPTH` deep, ignoring
+ * build and dot directories. A directory the host reports absent is skipped; any
+ * other failure, and every cap hit, is a named failure.
+ */
+export function walkForConfigs(walk, rootDir) {
+    const configs = [];
+    const failures = [];
+    const queue = [{ dir: rootDir, depth: 0 }];
+    let visited = 0;
+    let configsCapped = false;
+    for (let next = queue.shift(); next !== undefined; next = queue.shift()) {
+        const { dir, depth } = next;
+        if (visited >= REQUIREMENTS_MAX_DIRECTORIES) {
+            failures.push({
+                path: dir,
+                reason: 'requirements-walk-capped',
+                message: `The walk stopped after ${REQUIREMENTS_MAX_DIRECTORIES} directories; the rest of the workspace was not searched.`
+            });
+            break;
+        }
+        visited += 1;
+        const listing = attemptOf(() => walk.listDirectory(dir));
+        if (!listing.ok) {
+            failures.push(caughtDiscoveryFailure(dir, 'requirements-walk-unreadable', listing.failure));
+            continue;
+        }
+        const entries = listing.value;
+        if (entries === null)
+            continue;
+        let considered = entries;
+        if (entries.length > REQUIREMENTS_MAX_DIRECTORY_ENTRIES) {
+            failures.push({
+                path: dir,
+                reason: 'requirements-walk-capped',
+                message: `The directory has ${entries.length} entries; only the first ${REQUIREMENTS_MAX_DIRECTORY_ENTRIES} were searched.`
+            });
+            considered = entries.slice(0, REQUIREMENTS_MAX_DIRECTORY_ENTRIES);
+        }
+        for (const entry of considered) {
+            if (!CONFIG_NAMES.has(entry))
+                continue;
+            if (configs.length >= REQUIREMENTS_MAX_CONFIGS) {
+                if (!configsCapped) {
+                    failures.push({
+                        path: dir,
+                        reason: 'requirements-walk-capped',
+                        message: `More than ${REQUIREMENTS_MAX_CONFIGS} config files were found; the rest were not read.`
+                    });
+                    configsCapped = true;
+                }
+                continue;
+            }
+            configs.push(walk.joinPath(dir, entry));
+        }
+        if (depth >= REQUIREMENTS_MAX_DEPTH)
+            continue;
+        for (const entry of considered) {
+            if (IGNORED.has(entry) || entry.startsWith('.'))
+                continue;
+            const full = walk.joinPath(dir, entry);
+            const kind = attemptOf(() => walk.stat(full));
+            if (!kind.ok) {
+                failures.push(caughtDiscoveryFailure(full, 'requirements-walk-unreadable', kind.failure));
+                continue;
+            }
+            if (kind.value === 'directory')
+                queue.push({ dir: full, depth: depth + 1 });
+        }
+    }
+    return { configs, failures };
+}
+export async function resolveFromDeploymentConfigs(runtime, rootDir) {
+    const walk = await selectWalkLoader(runtime);
+    const walked = walkForConfigs(walk, rootDir);
+    const requirements = [];
+    const failures = [...walked.failures];
+    let loaded = 0;
+    for (const configPath of walked.configs) {
+        const outcome = await loadConfig(walk.loader, configPath);
+        if (outcome.ok) {
+            requirements.push(...outcome.requirements);
+            loaded += 1;
+        }
+        else {
+            failures.push(outcome.failure);
+        }
+    }
+    return { requirements, discovered: walked.configs.length, loaded, failures };
+}
+//# sourceMappingURL=config-walk.js.map

package/dist/domain/requirements/config-walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-walk.js","sourceRoot":"","sources":["../../../src/domain/requirements/config-walk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAoC,MAAM,+CAA+C,CAAC;AAEjG,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAC,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAI7E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,sGAAsG;AACtG,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,CAAC;AAExD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAkC;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAiD,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAC1G,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC9B,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CACxB,wJAAwJ,EACxJ,aAAa,EACb,EAAE,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM;QACN,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QACzD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IACnC,sBAAsB;IACtB,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,4BAA4B;CAC5B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,OAAe;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAkC,EAAE,CAAC;IACnD,MAAM,KAAK,GAA0C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,EAAC,IAAI,KAAK,SAAS,EAAC,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,IAAI,OAAO,IAAI,4BAA4B,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,0BAA0B,4BAA4B,2DAA2D;aAC1H,CAAC,CAAC;YACH,MAAM;QACP,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5F,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,UAAU,GAAG,OAAO,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,GAAG,kCAAkC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,qBAAqB,OAAO,CAAC,MAAM,4BAA4B,kCAAkC,iBAAiB;aAC3H,CAAC,CAAC;YACH,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvC,IAAI,OAAO,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAChD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpB,QAAQ,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,GAAG;wBACT,MAAM,EAAE,0BAA0B;wBAClC,OAAO,EAAE,aAAa,wBAAwB,mDAAmD;qBACjG,CAAC,CAAC;oBACH,aAAa,GAAG,IAAI,CAAC;gBACtB,CAAC;gBACD,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,IAAI,sBAAsB;YAAE,SAAS;QAC9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,8BAA8B,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1F,SAAS;YACV,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAkC,EAClC,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9E,CAAC"}

package/dist/domain/requirements/index.d.ts

@@ -0,0 +1,2 @@
+export { groupRequirementsByApp, resolveSecretRequirements, resolveSecretRequirementsWithDiagnostics, uniqueSecretKeys, type RequirementDiscoveryDiagnostics, type RequirementDiscoveryFailure, type SecretRequirement } from './resolver.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/requirements/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,sBAAsB,EAAC,yBAAyB,EAChD,wCAAwC,EAAC,gBAAgB,EACzD,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACrB,MAAM,eAAe,CAAC"}

package/dist/domain/requirements/index.js

@@ -0,0 +1,2 @@
+export { groupRequirementsByApp, resolveSecretRequirements, resolveSecretRequirementsWithDiagnostics, uniqueSecretKeys } from "./resolver.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/requirements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,sBAAsB,EAAC,yBAAyB,EAChD,wCAAwC,EAAC,gBAAgB,EAIxD,MAAM,eAAe,CAAC"}

package/dist/domain/requirements/resolver.d.ts

@@ -0,0 +1,27 @@
+import { type RequirementDiscoveryDiagnostics, type SecretRequirementOptions } from "../../schemas/discovery/diagnostics.schema.ts";
+export { type RequirementDiscoveryDiagnostics, type RequirementDiscoveryFailure, type SecretRequirementOptions } from "../../schemas/discovery/diagnostics.schema.ts";
+export { deploymentConfigSchema, deploymentExportSchema, deploymentModuleSchema, deploymentWrapperSchema, requirementEnvEntrySchema, requirementInfraDescriptorSchema, serviceReleaseBindingSchema, serviceReleaseModuleSchema, serviceReleaseOperatorRequirementSchema } from "../../schemas/discovery/requirements.schema.ts";
+export { caughtDiscoveryFailure, configFailure, deploymentRequirements, extractRequirements, loadConfig, secretEntryRequirement, serviceReleaseRequirements, type ConfigModule, type ConfigOutcome } from "./config-requirements.ts";
+export { CONFIG_NAMES, IGNORED, REQUIREMENTS_MAX_CONFIGS, REQUIREMENTS_MAX_DEPTH, REQUIREMENTS_MAX_DIRECTORIES, REQUIREMENTS_MAX_DIRECTORY_ENTRIES, resolveFromDeploymentConfigs, selectWalkLoader, walkForConfigs, type WalkLoader, type Walked } from "./config-walk.ts";
+import type { SecretRequirement, SecretRequirementsRuntime } from './schemas/requirements.ts';
+export type { SecretRequirement } from './schemas/requirements.ts';
+export declare function resolveSecretRequirements(runtime: SecretRequirementsRuntime, options: SecretRequirementOptions): Promise<SecretRequirement[]>;
+/**
+ * Like {@link resolveSecretRequirements}, but reports HOW discovery went so
+ * callers can distinguish "nothing declared" from "everything failed to load"
+ * — the two rendered identically before 2026-08-23, letting 17 discoverable
+ * configs report as an empty-but-green requirements surface.
+ */
+export declare function resolveSecretRequirementsWithDiagnostics(runtime: SecretRequirementsRuntime, options: SecretRequirementOptions): Promise<{
+    requirements: SecretRequirement[];
+    discovery: RequirementDiscoveryDiagnostics;
+}>;
+/**
+ * Group requirements by app/worker ID for per-app reporting.
+ */
+export declare function groupRequirementsByApp(requirements: SecretRequirement[]): Map<string, SecretRequirement[]>;
+/**
+ * Get unique secret keys across all apps (deduped).
+ */
+export declare function uniqueSecretKeys(requirements: SecretRequirement[]): string[];
+//# sourceMappingURL=resolver.d.ts.map

package/dist/domain/requirements/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/domain/requirements/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,+BAA+B,EAAC,KAAK,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAGnI,OAAO,EAAE,KAAK,+BAA+B,EAAC,KAAK,2BAA2B,EAAC,KAAK,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACpK,OAAO,EAAE,sBAAsB,EAAC,sBAAsB,EAAC,sBAAsB,EAAC,uBAAuB,EAAC,yBAAyB,EAAC,gCAAgC,EAAC,2BAA2B,EAAC,0BAA0B,EAAC,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AACxT,OAAO,EAAE,sBAAsB,EAAC,aAAa,EAAC,sBAAsB,EAAC,mBAAmB,EAAC,UAAU,EAAC,sBAAsB,EAAC,0BAA0B,EAAC,KAAK,YAAY,EAAC,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC7N,OAAO,EAAE,YAAY,EAAC,OAAO,EAAC,wBAAwB,EAAC,sBAAsB,EAAC,4BAA4B,EAAC,kCAAkC,EAAC,4BAA4B,EAAC,gBAAgB,EAAC,cAAc,EAAC,KAAK,UAAU,EAAC,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoDjQ,OAAO,KAAK,EAAE,iBAAiB,EAAC,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAE7F,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,wBAAwB,GAC/B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAE9B;AAED;;;;;GAKG;AACH,wBAAsB,wCAAwC,CAC7D,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,wBAAwB,GAC/B,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,+BAA+B,CAAA;CAAE,CAAC,CAqD5F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,YAAY,EAAE,iBAAiB,EAAE,GAC/B,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAQlC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE5E"}

package/dist/domain/requirements/resolver.js

@@ -0,0 +1,131 @@
+import {} from "../../schemas/discovery/diagnostics.schema.js";
+import { extractRequirements } from "./config-requirements.js";
+import { resolveFromDeploymentConfigs } from "./config-walk.js";
+export {} from "../../schemas/discovery/diagnostics.schema.js";
+export { deploymentConfigSchema, deploymentExportSchema, deploymentModuleSchema, deploymentWrapperSchema, requirementEnvEntrySchema, requirementInfraDescriptorSchema, serviceReleaseBindingSchema, serviceReleaseModuleSchema, serviceReleaseOperatorRequirementSchema } from "../../schemas/discovery/requirements.schema.js";
+export { caughtDiscoveryFailure, configFailure, deploymentRequirements, extractRequirements, loadConfig, secretEntryRequirement, serviceReleaseRequirements } from "./config-requirements.js";
+export { CONFIG_NAMES, IGNORED, REQUIREMENTS_MAX_CONFIGS, REQUIREMENTS_MAX_DEPTH, REQUIREMENTS_MAX_DIRECTORIES, REQUIREMENTS_MAX_DIRECTORY_ENTRIES, resolveFromDeploymentConfigs, selectWalkLoader, walkForConfigs } from "./config-walk.js";
+/**
+ * Secret Requirements Resolver
+ *
+ * Resolves secret requirements from two intentional sources:
+ *
+ * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
+ *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
+ *    declare secrets here because they are infrastructure resources, not web apps.
+ *    The `infra/web-app` path is kept for completeness but no longer discovers
+ *    vestigial descriptors (deleted 2026-05-20). Every descriptor is parsed
+ *    (`requirementInfraDescriptorSchema`), never cast; a malformed one is a named
+ *    `failures` entry.
+ *
+ * 2. `deployment.config.ts` files — the canonical per-app deployment system.
+ *    Loads each config through the handed runtime's `runtime/loader` and extracts
+ *    `secret: true` env entries from the `AppDeployment.env` array. This is the
+ *    authoritative source for web-app secrets.
+ *
+ * 3. `service-release.config.ts` files — managed stateful service releases.
+ *    These export inert `serviceReleaseSecretBindings`; discovery reads only
+ *    their secret-store source keys and never evaluates the release factory or
+ *    its non-secret image/cluster/CIDR bindings. Operator-only credentials may
+ *    additionally declare `serviceReleaseOperatorSecretRequirements`, including
+ *    provider capabilities that availability checks must surface but cannot
+ *    prove merely from value presence.
+ *
+ * The two-system split is intentional, not transitional:
+ * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
+ * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
+ *
+ * Host access: the directory walk and the module import both go through the
+ * host's `runtime/loader` (`listDirectory`, `stat`, `joinPath`, `importModule`);
+ * this module imports no fs, path or url module. Importing a config runs that
+ * module's top-level code (a host's `importModule` is the only way to read its
+ * exports), so discovery trusts the workspace it was pointed at exactly as the
+ * deployment tooling does. The loader caches a module per process: a long-lived
+ * process sees a config as of its first import (the former
+ * `?secret-requirements=<time>` cache-buster leaked one module instance per call
+ * and is gone).
+ *
+ * A config that fails to load, does not match its schema, or declares no app id
+ * is a named `discovery.failures` entry (typed `reason`); it is never counted as
+ * loaded and never an empty success. The walk is bounded in depth and breadth;
+ * hitting a breadth cap is a named failure, never a silent truncation.
+ *
+ * Used by `vibes secrets check` to cross-reference stored secrets against
+ * declared requirements.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { outcomeOf } from "../../support/file-failure.js";
+export async function resolveSecretRequirements(runtime, options) {
+    return (await resolveSecretRequirementsWithDiagnostics(runtime, options)).requirements;
+}
+/**
+ * Like {@link resolveSecretRequirements}, but reports HOW discovery went so
+ * callers can distinguish "nothing declared" from "everything failed to load"
+ * — the two rendered identically before 2026-08-23, letting 17 discoverable
+ * configs report as an empty-but-green requirements surface.
+ */
+export async function resolveSecretRequirementsWithDiagnostics(runtime, options) {
+    const requirements = [];
+    const discovery = {
+        configsDiscovered: 0,
+        configsLoaded: 0,
+        failures: []
+    };
+    if (runtime.hasKind('infra/web-app')) {
+        requirements.push(...extractRequirements('infra/web-app', runtime.assets('infra/web-app').descriptors(), discovery.failures));
+    }
+    if (runtime.hasKind('infra/worker')) {
+        requirements.push(...extractRequirements('infra/worker', runtime.assets('infra/worker').descriptors(), discovery.failures));
+    }
+    // Load web-app secrets from deployment.config.ts — the canonical source —
+    // under the root the caller read from its runtime (never the process cwd).
+    let liveDeployReqs = [];
+    if (options.includeDeploymentConfigs !== false) {
+        const root = options.deploymentConfigRoot;
+        const discovered = await outcomeOf(() => resolveFromDeploymentConfigs(runtime, root));
+        if (discovered.ok) {
+            liveDeployReqs = discovered.value.requirements;
+            discovery.configsDiscovered = discovered.value.discovered;
+            discovery.configsLoaded = discovered.value.loaded;
+            discovery.failures.push(...discovered.value.failures);
+        }
+        else {
+            const failure = CapabilityError.from(discovered.failure);
+            discovery.failures.push({
+                path: root,
+                reason: failure.reason === 'requirements-loader-unavailable' ? 'requirements-loader-unavailable' : 'requirements-walk-unreadable',
+                message: failure.message
+            });
+        }
+    }
+    // LIVE DISCOVERY IS THE ONLY SOURCE (WU-11). A compile-time define injected
+    // a snapshot that filled in here, because a monolith could not import a
+    // workspace `deployment.config.ts` at runtime (plan §1 P8) and failed
+    // PARTIALLY — a config with no imports loaded while every config importing
+    // `@vibesdotdev/*` did not, so 1 live requirement once hid 94 baked ones.
+    // A thin host imports those configs from real on-disk packages, so there is
+    // nothing left for a build-time snapshot to rescue. What replaced it is
+    // already here and is strictly better: `discovery.failures` names every
+    // config that would have been silently papered over.
+    requirements.push(...liveDeployReqs);
+    return { requirements, discovery };
+}
+/**
+ * Group requirements by app/worker ID for per-app reporting.
+ */
+export function groupRequirementsByApp(requirements) {
+    const grouped = new Map();
+    for (const req of requirements) {
+        const existing = grouped.get(req.appId) ?? [];
+        existing.push(req);
+        grouped.set(req.appId, existing);
+    }
+    return grouped;
+}
+/**
+ * Get unique secret keys across all apps (deduped).
+ */
+export function uniqueSecretKeys(requirements) {
+    return [...new Set(requirements.map((r) => r.key))];
+}
+//# sourceMappingURL=resolver.js.map

package/dist/domain/requirements/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/domain/requirements/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsE,MAAM,+CAA+C,CAAC;AACnI,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAuG,MAAM,+CAA+C,CAAC;AACpK,OAAO,EAAE,sBAAsB,EAAC,sBAAsB,EAAC,sBAAsB,EAAC,uBAAuB,EAAC,yBAAyB,EAAC,gCAAgC,EAAC,2BAA2B,EAAC,0BAA0B,EAAC,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AACxT,OAAO,EAAE,sBAAsB,EAAC,aAAa,EAAC,sBAAsB,EAAC,mBAAmB,EAAC,UAAU,EAAC,sBAAsB,EAAC,0BAA0B,EAAuC,MAAM,0BAA0B,CAAC;AAC7N,OAAO,EAAE,YAAY,EAAC,OAAO,EAAC,wBAAwB,EAAC,sBAAsB,EAAC,4BAA4B,EAAC,kCAAkC,EAAC,4BAA4B,EAAC,gBAAgB,EAAC,cAAc,EAA8B,MAAM,kBAAkB,CAAC;AACjQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAK1D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAkC,EAClC,OAAiC;IAEjC,OAAO,CAAC,MAAM,wCAAwC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC7D,OAAkC,EAClC,OAAiC;IAEjC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAoC;QAClD,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,YAAY,CAAC,IAAI,CAChB,GAAG,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAC1G,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,YAAY,CAAC,IAAI,CAChB,GAAG,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CACxG,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,cAAc,GAAwB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,wBAAwB,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;YAC/C,SAAS,CAAC,iBAAiB,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1D,SAAS,CAAC,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;YAClD,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACP,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzD,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACvB,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,iCAAiC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B;gBACjI,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,qDAAqD;IACrD,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IAErC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,YAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAiC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/domain/requirements/schemas/requirements.d.ts

@@ -0,0 +1,2 @@
+export type { RequirementEnvEntry, RequirementInfraDescriptor, SecretRequirement, SecretRequirementsRuntime } from '../../../schemas/discovery/runtime.schema.ts';
+//# sourceMappingURL=requirements.d.ts.map

package/dist/domain/requirements/schemas/requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.d.ts","sourceRoot":"","sources":["../../../../src/domain/requirements/schemas/requirements.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,mBAAmB,EAAC,0BAA0B,EAAC,iBAAiB,EAAC,yBAAyB,EAAE,MAAM,8CAA8C,CAAC"}

package/dist/domain/requirements/schemas/requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../../src/domain/requirements/schemas/requirements.ts"],"names":[],"mappings":""}

package/dist/domain/secrets.plugin.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Secrets Runtime Plugin
+ *
+ * Registers the secrets/store kind and the unified secrets `runtime/client`.
+ */
+declare const defaultExport: import("@vibesdotdev/kernel").RuntimePlugin;
+export default defaultExport;
+//# sourceMappingURL=secrets.plugin.d.ts.map

package/dist/domain/secrets.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.plugin.d.ts","sourceRoot":"","sources":["../../src/domain/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6BH,QAAA,MAAM,aAAa,6CAuCjB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/domain/secrets.plugin.js

@@ -0,0 +1,62 @@
+/**
+ * Secrets Runtime Plugin
+ *
+ * Registers the secrets/store kind and the unified secrets `runtime/client`.
+ */
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { secretsStoreKind } from "./kinds/store.kind.js";
+import { secretRecordDescriptor } from "./vault/secret-record.js";
+import { createSecretsTransform } from "./vault/secret.transform.js";
+// Every `vibes secrets` cli/command descriptor and impl (list, reveal, set, exec,
+// request, oauth-client mint, check, unset, pull, push, import, export and
+// pre-commit-check) and the `secrets` cli/group belong to the one CLI plugin,
+// `@vibesdotdev/secrets/cli` (`./cli/plugin`, CLI scope only), so this plugin
+// carries no consumer cli-command impl edge — cloud hosts load it for the
+// secrets/store kind + the unified secrets runtime/client.
+// Docs
+import secretsBackendsDescriptor from "../docs/backends.docs.descriptor.js";
+import secretsEncryptionDescriptor from "../docs/encryption.docs.descriptor.js";
+import secretsEnvFileDescriptor from "../docs/env-file.docs.descriptor.js";
+import secretsDescriptor from "../docs/secrets.docs.descriptor.js";
+import secretsConfigDescriptor from "./config/secrets.config.descriptor.js";
+// The `secrets/attestation` kind, its descriptor and its one loader belong to
+// `./attestation`; this plugin composes that plugin instead of registering them again.
+import { secretsAttestationPlugin } from "./attestation/attestation.plugin.js";
+const secretsTransform = createSecretsTransform();
+// Hoisted const: tsc rewriteRelativeImportExtensions does not rewrite `.ts` specifiers inside `export default <expr>` (TS 6.0.3).
+const defaultExport = createRuntimePlugin({
+    id: 'secrets',
+    name: 'Secrets Management',
+    description: 'Environment-aware secrets storage with multiple backends',
+    dependencies: ['config'],
+    // SAFETY: secretsStoreKind conforms to RuntimeKindDescriptorRecord schema.
+    kinds: [secretsStoreKind],
+    descriptors: [
+        secretsDescriptor,
+        secretsBackendsDescriptor,
+        secretsEncryptionDescriptor,
+        secretsEnvFileDescriptor,
+        secretRecordDescriptor,
+        secretsTransform.descriptor,
+        secretsConfigDescriptor
+    ],
+    // The unified secrets client registers as a `runtime/client` here — the per-id
+    // client-loader convention (see @vibesdotdev/kernel/client's plugin). registerLoader
+    // buffers until the runtime/client kind is present, so no hard dependency on it.
+    onRegister: async (runtime) => {
+        runtime.registerLoader('storage/transform', secretsTransform.descriptor.id, async () => secretsTransform.implementation);
+        // Idempotent: a host that already registered `secrets-attestation` keeps its first registration.
+        await runtime.registerPlugin(secretsAttestationPlugin);
+        runtime.registerDescriptor('runtime/client', {
+            id: 'secrets',
+            kind: 'runtime/client',
+            description: 'Unified, runtime-resolved secrets client'
+        });
+        runtime.registerLoader('runtime/client', 'secrets', async () => {
+            const { SecretsClient } = await import("./client/secrets-client.js");
+            return { impl: SecretsClient };
+        });
+    }
+});
+export default defaultExport;
+//# sourceMappingURL=secrets.plugin.js.map

package/dist/domain/secrets.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.plugin.js","sourceRoot":"","sources":["../../src/domain/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,kFAAkF;AAClF,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,2DAA2D;AAE3D,OAAO;AACP,OAAO,yBAAyB,MAAM,qCAAqC,CAAC;AAC5E,OAAO,2BAA2B,MAAM,uCAAuC,CAAC;AAChF,OAAO,wBAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,iBAAiB,MAAM,oCAAoC,CAAC;AACnE,OAAO,uBAAuB,MAAM,uCAAuC,CAAC;AAE5E,8EAA8E;AAC9E,uFAAuF;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;AAElD,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,0DAA0D;IACvE,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,2EAA2E;IAC3E,KAAK,EAAE,CAAC,gBAA+C,CAAC;IAExD,WAAW,EAAE;QACZ,iBAAiB;QACjB,yBAAyB;QACzB,2BAA2B;QAC3B,wBAAwB;QACxB,sBAAsB;QACtB,gBAAgB,CAAC,UAAU;QAC3B,uBAAuB;KACvB;IAED,+EAA+E;IAC/E,qFAAqF;IACrF,iFAAiF;IACjF,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,cAAc,CACrB,mBAAmB,EACnB,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAC9B,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAC3C,CAAC;QACF,iGAAiG;QACjG,MAAM,OAAO,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC;QACvD,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;YAC5C,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,0CAA0C;SACvD,CAAC,CAAC;QACH,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/domain/vault/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @vibesdotdev/secrets/vault — managed-vault wiring (the storage/transform; the storage
+ * record descriptor + managed client facet land alongside the managed handle).
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export type { ManagedSecretRow } from './secret-record.ts';
+export { createSecretsTransform, publicToSecretRow, secretRowToPublic } from './secret.transform.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/vault/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAC,iBAAiB,EAAC,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/domain/vault/index.js

@@ -0,0 +1,8 @@
+/**
+ * @vibesdotdev/secrets/vault — managed-vault wiring (the storage/transform; the storage
+ * record descriptor + managed client facet land alongside the managed handle).
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { createSecretsTransform, publicToSecretRow, secretRowToPublic } from "./secret.transform.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAC,iBAAiB,EAAC,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}