@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/schemas/managed/secret.schema.d.ts

@@ -0,0 +1,261 @@
+/**
+ * Unified secret model — the canonical shapes the whole secrets family converges on.
+ *
+ * One concept, many backends. A secret is a (scope, scopeId, key) → value with
+ * metadata. `scope='env'` is the env-keyed infra layer (scopeId = environment tier,
+ * key = the env KEY, served by the secrets/store backends); the tenant scopes are the
+ * managed multi-tenant vault (served over the cloud-api storage adapter). See
+ * docs/superpowers/specs/2026-06-03-unified-secrets-architecture-design.md.
+ *
+ * These supersede the client-safe shapes in @vibesdotdev/platform/secrets/schemas
+ * (which platform re-exports during the consume-ready migration). Browser-safe: zod +
+ * types only — never the encrypted value or Drizzle rows.
+ */
+import * as z from 'zod/v4';
+/**
+ * Every supported portable secret-reference scope. `env` selects tier-scoped
+ * infrastructure storage; the four identity scopes select the managed vault.
+ */
+export declare const secretScopeSchema: z.ZodEnum<{
+    user: "user";
+    env: "env";
+    platform: "platform";
+    project: "project";
+    org: "org";
+}>;
+export type SecretScope = z.infer<typeof secretScopeSchema>;
+/** The four identity scopes served by the managed vault (cloud-api backend). */
+export declare const managedSecretScopeSchema: z.ZodEnum<{
+    user: "user";
+    platform: "platform";
+    project: "project";
+    org: "org";
+}>;
+export type ManagedSecretScope = z.infer<typeof managedSecretScopeSchema>;
+/** Rotation cadence for managed secrets. Env secrets do not rotate. */
+export declare const secretRotationPolicySchema: z.ZodEnum<{
+    never: "never";
+    manual: "manual";
+    monthly: "monthly";
+    quarterly: "quarterly";
+    yearly: "yearly";
+}>;
+export type SecretRotationPolicy = z.infer<typeof secretRotationPolicySchema>;
+/** Recursive, JSON-safe metadata bag (mirrors @vibesdotdev/platform/secrets metadata). */
+export declare const secretMetadataValueSchema: z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>;
+export type SecretMetadataValue = z.infer<typeof secretMetadataValueSchema>;
+export declare const secretMetadataSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export type SecretMetadata = z.infer<typeof secretMetadataSchema>;
+/**
+ * How a consumer NAMES a secret to resolve it — the unifying reference across all
+ * backends. `scopeId` is the env tier (for `env`) or the owner id (user/org/project);
+ * omit it for singleton scopes like `platform`. `key` is the user-facing name / env KEY.
+ *
+ *   env:     { scope: 'env',  scopeId: 'production', key: 'ANTHROPIC_API_KEY' }
+ *   managed: { scope: 'user', scopeId: '<userId>',   key: 'openai' }
+ */
+export declare const secretRefSchema: z.ZodObject<{
+    scope: z.ZodEnum<{
+        user: "user";
+        env: "env";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodOptional<z.ZodString>;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type SecretRef = z.infer<typeof secretRefSchema>;
+/**
+ * The wire/UI projection of a managed secret. NEVER carries the encrypted value or the
+ * audit-only `createdBy`. Widened from @vibesdotdev/platform/secrets `PublicSecret` to
+ * the unified scope enum.
+ */
+export declare const publicSecretSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    providerType: z.ZodString;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+    lastUsedAt: z.ZodNullable<z.ZodDate>;
+    lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
+    rotationPolicy: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        manual: "manual";
+        monthly: "monthly";
+        quarterly: "quarterly";
+        yearly: "yearly";
+    }>>;
+    metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+}, z.core.$strip>;
+export type PublicSecret = z.infer<typeof publicSecretSchema>;
+/** A date on the wire: an ISO string, an epoch number, or a `Date` a host already revived. */
+export declare const secretWireDateSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+/**
+ * A managed secret as `/api/secrets` serves it (platform-web's
+ * `vibesCrudCollection` / `vibesCrudItem`): the PublicSecret fields with dates as
+ * JSON values, and NEVER a `value`. The one record shape the vault record
+ * descriptor, the managed client and the Svelte client all parse.
+ */
+export declare const secretWireRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    providerType: z.ZodString;
+    createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+    updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+    lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+    lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+    rotationPolicy: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        manual: "manual";
+        monthly: "monthly";
+        quarterly: "quarterly";
+        yearly: "yearly";
+    }>>;
+    metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+}, z.core.$strip>;
+export type SecretWireRecord = z.infer<typeof secretWireRecordSchema>;
+/**
+ * The one wire envelope: `{ results }` for a list and `{ result }` for an item.
+ * The server also emits the legacy `{ secrets }` / `{ secret }` members beside
+ * them until its PlatformClient migration; no client here reads those.
+ */
+export declare const secretCollectionEnvelopeSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const secretItemEnvelopeSchema: z.ZodObject<{
+    result: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** Editor compatibility: id identifies an existing item; description maps to metadata. */
+export declare const secretEditorInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    providerType: z.ZodString;
+    value: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    id: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SecretEditorInput = z.infer<typeof secretEditorInputSchema>;
+export declare const createSecretInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    providerType: z.ZodString;
+    value: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    id: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CreateSecretInput = z.infer<typeof createSecretInputSchema>;
+/** Editor fields become the canonical create transport payload at either client boundary. */
+export declare const managedCreateTransportSchema: z.ZodPipe<z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    providerType: z.ZodString;
+    value: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    id: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodTransform<{
+    name: string;
+    scope: "user" | "platform" | "project" | "org";
+    scopeId: string;
+    providerType: string;
+    value: string;
+    metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+}, {
+    name: string;
+    scope: "user" | "platform" | "project" | "org";
+    scopeId: string;
+    providerType: string;
+    value: string;
+    metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | undefined;
+    id?: string | undefined;
+    description?: string | undefined;
+}>>;
+/** Patch a managed secret. Only provided fields change; identity fields cannot change. */
+export declare const updateSecretInputSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    value: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+}, z.core.$strip>;
+export type UpdateSecretInput = z.infer<typeof updateSecretInputSchema>;
+//# sourceMappingURL=secret.schema.d.ts.map

package/dist/schemas/managed/secret.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/managed/secret.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;;EAAwD,CAAC;AACvF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB;;;;;EAAiD,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,uEAAuE;AACvE,eAAO,MAAM,0BAA0B;;;;;;EAAgE,CAAC;AACxG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,iPAAkB,CAAC;AACzD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,oBAAoB,2QAAkD,CAAC;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;iBAY7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,oBAAoB,4DAA8C,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;iBAYjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyD,CAAC;AACrG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;iBAA+C,CAAC;AAWrF,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;iBAA0B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,6FAA6F;AAC7F,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAIvC,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/managed/secret.schema.js

@@ -0,0 +1,114 @@
+/**
+ * Unified secret model — the canonical shapes the whole secrets family converges on.
+ *
+ * One concept, many backends. A secret is a (scope, scopeId, key) → value with
+ * metadata. `scope='env'` is the env-keyed infra layer (scopeId = environment tier,
+ * key = the env KEY, served by the secrets/store backends); the tenant scopes are the
+ * managed multi-tenant vault (served over the cloud-api storage adapter). See
+ * docs/superpowers/specs/2026-06-03-unified-secrets-architecture-design.md.
+ *
+ * These supersede the client-safe shapes in @vibesdotdev/platform/secrets/schemas
+ * (which platform re-exports during the consume-ready migration). Browser-safe: zod +
+ * types only — never the encrypted value or Drizzle rows.
+ */
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import * as z from 'zod/v4';
+/**
+ * Every supported portable secret-reference scope. `env` selects tier-scoped
+ * infrastructure storage; the four identity scopes select the managed vault.
+ */
+export const secretScopeSchema = z.enum(['env', 'user', 'org', 'project', 'platform']);
+/** The four identity scopes served by the managed vault (cloud-api backend). */
+export const managedSecretScopeSchema = z.enum(['user', 'org', 'project', 'platform']);
+/** Rotation cadence for managed secrets. Env secrets do not rotate. */
+export const secretRotationPolicySchema = z.enum(['manual', 'monthly', 'quarterly', 'yearly', 'never']);
+/** Recursive, JSON-safe metadata bag (mirrors @vibesdotdev/platform/secrets metadata). */
+export const secretMetadataValueSchema = JsonValueSchema;
+export const secretMetadataSchema = z.record(z.string(), secretMetadataValueSchema);
+/**
+ * How a consumer NAMES a secret to resolve it — the unifying reference across all
+ * backends. `scopeId` is the env tier (for `env`) or the owner id (user/org/project);
+ * omit it for singleton scopes like `platform`. `key` is the user-facing name / env KEY.
+ *
+ *   env:     { scope: 'env',  scopeId: 'production', key: 'ANTHROPIC_API_KEY' }
+ *   managed: { scope: 'user', scopeId: '<userId>',   key: 'openai' }
+ */
+export const secretRefSchema = z.object({
+    scope: secretScopeSchema,
+    scopeId: z.string().optional(),
+    key: z.string().min(1)
+});
+/**
+ * The wire/UI projection of a managed secret. NEVER carries the encrypted value or the
+ * audit-only `createdBy`. Widened from @vibesdotdev/platform/secrets `PublicSecret` to
+ * the unified scope enum.
+ */
+export const publicSecretSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    scope: managedSecretScopeSchema,
+    scopeId: z.string(),
+    providerType: z.string(),
+    createdAt: z.date(),
+    updatedAt: z.date(),
+    lastUsedAt: z.date().nullable(),
+    lastRotatedAt: z.date().nullable().optional(),
+    rotationPolicy: secretRotationPolicySchema.optional(),
+    metadata: secretMetadataSchema.nullable()
+});
+/** A date on the wire: an ISO string, an epoch number, or a `Date` a host already revived. */
+export const secretWireDateSchema = z.union([z.string(), z.number(), z.date()]);
+/**
+ * A managed secret as `/api/secrets` serves it (platform-web's
+ * `vibesCrudCollection` / `vibesCrudItem`): the PublicSecret fields with dates as
+ * JSON values, and NEVER a `value`. The one record shape the vault record
+ * descriptor, the managed client and the Svelte client all parse.
+ */
+export const secretWireRecordSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    scope: managedSecretScopeSchema,
+    scopeId: z.string(),
+    providerType: z.string(),
+    createdAt: secretWireDateSchema,
+    updatedAt: secretWireDateSchema,
+    lastUsedAt: secretWireDateSchema.nullable().optional(),
+    lastRotatedAt: secretWireDateSchema.nullable().optional(),
+    rotationPolicy: secretRotationPolicySchema.optional(),
+    metadata: secretMetadataSchema.nullable().optional()
+});
+/**
+ * The one wire envelope: `{ results }` for a list and `{ result }` for an item.
+ * The server also emits the legacy `{ secrets }` / `{ secret }` members beside
+ * them until its PlatformClient migration; no client here reads those.
+ */
+export const secretCollectionEnvelopeSchema = z.object({ results: z.array(secretWireRecordSchema) });
+export const secretItemEnvelopeSchema = z.object({ result: secretWireRecordSchema });
+const managedSecretFieldsSchema = z.object({
+    name: z.string().min(1).max(100),
+    scope: managedSecretScopeSchema,
+    scopeId: z.string(),
+    providerType: z.string(),
+    value: z.string().min(1),
+    metadata: secretMetadataSchema.optional()
+});
+/** Editor compatibility: id identifies an existing item; description maps to metadata. */
+export const secretEditorInputSchema = managedSecretFieldsSchema.extend({
+    id: z.string().optional(),
+    description: z.string().optional()
+});
+export const createSecretInputSchema = secretEditorInputSchema;
+/** Editor fields become the canonical create transport payload at either client boundary. */
+export const managedCreateTransportSchema = createSecretInputSchema.transform(({ id: _id, description, ...data }) => {
+    const request = { ...data };
+    if (description !== undefined)
+        request.metadata = { ...data.metadata, description };
+    return request;
+});
+/** Patch a managed secret. Only provided fields change; identity fields cannot change. */
+export const updateSecretInputSchema = z.object({
+    name: z.string().min(1).max(100).optional(),
+    value: z.string().min(1).optional(),
+    metadata: secretMetadataSchema.optional()
+});
+//# sourceMappingURL=secret.schema.js.map

package/dist/schemas/managed/secret.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.schema.js","sourceRoot":"","sources":["../../../src/schemas/managed/secret.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGvF,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGvF,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAGxG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAGzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAGpF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzD,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACrG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAErF,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,MAAM,CAAC;IACvE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAG/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;IACnH,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5B,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACpF,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC"}