@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/cli/commands/exec/exec.command.impl.js

@@ -0,0 +1,110 @@
+import {} from "../../../../schemas/cli/commands/exec.schema.js";
+import { EXEC_BASE_PASS, SESSION_BEARER_KEY, SESSION_STORE_ID, parseExecRequest, runtimeOutput } from "./exec-input.js";
+export { execArgsSchema, execOptionsSchema, stringSchema } from "../../../../schemas/cli/commands/exec.schema.js";
+export { ENV_NAME, EXEC_BASE_PASS, SESSION_BEARER_KEY, SESSION_STORE_ID, composeExecChildEnv, parseExecRequest, parsePassNames, principalKeyReserved, repeatedWith, runtimeOutput, splitWithKeys, usageRefusal } from "./exec-input.js";
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { resolveCredentialLeases, spawnResolvedCredentials } from "../../../../exec/spawn-with-credentials.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { resolveSecretsForLeverage, writeLeverageAudit, writeOnlyRefusal } from "../../shared/stores/leverage-shared.js";
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const out = await openCommandOutput(runtime);
+    // What an attempt audits if it is refused before anything spawns; validation and resolution fill it in.
+    const attempt = {
+        action: 'secrets.exec',
+        keys: [],
+        environment: '',
+        backend: '',
+        target: ''
+    };
+    let request;
+    let resolved;
+    try {
+        request = parseExecRequest(args, opts, attempt);
+        const { keys, options, backend, target } = request;
+        resolved =
+            options.environment !== undefined
+                ? await resolveAcrossTiers(runtime, out, keys, { ...options, backend }, attempt)
+                : await resolveAsLeases(runtime, out, keys, { ...options, backend }, target);
+    }
+    catch (error) {
+        // A refusal before spawn is an attempt: one failure line with its typed reason, never a value.
+        writeLeverageAudit(out, { ...attempt, outcome: 'failure', reason: CapabilityError.from(CaughtFailureSchema.parse(error)).reason });
+        throw error;
+    }
+    const spawnOptions = {
+        command: request.target,
+        args: request.command.slice(1),
+        stdin: 'inherit',
+        publishHostCredentials: true,
+        pass: [...EXEC_BASE_PASS, ...request.passNames],
+        output: runtimeOutput(out)
+    };
+    // A failure to spawn propagates typed to the CLI surface after its audit.
+    const child = await spawnResolvedCredentials(runtime, spawnOptions, resolved);
+    requestCLIExit(await child.exited);
+}
+/** The session bearer, only for `--session`, from the device session store. */
+function sessionReference() {
+    return { source: 'secret', key: SESSION_BEARER_KEY, store: SESSION_STORE_ID };
+}
+/**
+ * The plain path: each key is a lease through `runtime.resolveCredential`. A
+ * key the store confirms is not set fails closed (typed) unless
+ * `--allow-missing`, which reports it and runs without it.
+ */
+async function resolveAsLeases(runtime, out, keys, options, target) {
+    const references = {};
+    for (const key of keys) {
+        const ref = { source: 'secret', key };
+        if (options.backend) {
+            ref.store = options.backend;
+        }
+        references[key] = ref;
+    }
+    if (options.session)
+        references[SESSION_BEARER_KEY] = sessionReference();
+    const leases = await resolveCredentialLeases(runtime, references, target, { action: 'secrets.exec', target }, options.allowMissing === true);
+    if (leases.notSet.length > 0) {
+        out.warn(`secrets exec: not set, running without: ${leases.notSet.join(', ')} (--allow-missing).`);
+    }
+    return leases;
+}
+/**
+ * The secrets owner's cross-tier read (rc05 :62-63), for `--environment T`:
+ * the one store for T (or the named `--backend`) answers through the
+ * `secrets/store` kind. A key the store does not hold is a typed `NOT_FOUND`
+ * `credential-not-set`, as on the lease path, unless `--allow-missing`.
+ */
+async function resolveAcrossTiers(runtime, out, keys, options, attempt) {
+    const resolved = keys.length > 0
+        ? await resolveSecretsForLeverage(runtime, [...keys], { environment: options.environment, backend: options.backend })
+        : null;
+    attempt.environment = resolved?.environment ?? options.environment ?? '';
+    attempt.backend = resolved?.backendId ?? SESSION_STORE_ID;
+    if (resolved)
+        attempt.hops = resolved.hops;
+    if (resolved && resolved.unreadable.length > 0)
+        throw writeOnlyRefusal('secrets exec', resolved);
+    if (resolved && resolved.missing.length > 0 && !options.allowMissing) {
+        throw new CapabilityError(`secrets exec: missing in environment "${resolved.environment}": ${resolved.missing.join(', ')} (use --allow-missing to run anyway).`, 'NOT_FOUND', {
+            reason: 'credential-not-set',
+            retryable: false,
+            details: { keys: resolved.missing, environment: resolved.environment }
+        });
+    }
+    if (resolved && resolved.missing.length > 0) {
+        out.warn(`secrets exec: not set, running without: ${resolved.missing.join(', ')} (--allow-missing).`);
+    }
+    const values = resolved ? { ...resolved.values } : {};
+    if (options.session) {
+        const bearer = await runtime.resolveCredential(sessionReference());
+        if (!bearer.ok)
+            throw bearer.error;
+        values[SESSION_BEARER_KEY] = bearer.value;
+    }
+    return { values, audit: { ...attempt, keys: Object.keys(values) } };
+}
+export default { execute };
+//# sourceMappingURL=exec.command.impl.js.map

package/dist/surfaces/cli/commands/exec/exec.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/exec/exec.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,MAAM,iDAAiD,CAAC;AACvH,OAAO,EAAE,cAAc,EAAC,kBAAkB,EAAC,gBAAgB,EAAC,gBAAgB,EAAC,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACrI,OAAO,EAAE,cAAc,EAAC,iBAAiB,EAAC,YAAY,EAAuD,MAAM,iDAAiD,CAAC;AACrK,OAAO,EAAE,QAAQ,EAAC,cAAc,EAAC,kBAAkB,EAAC,gBAAgB,EAAC,mBAAmB,EAAC,gBAAgB,EAAC,cAAc,EAAC,oBAAoB,EAAC,YAAY,EAAC,aAAa,EAAC,aAAa,EAAC,YAAY,EAAmB,MAAM,iBAAiB,CAAC;AA0B9O,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAoB,MAAM,qBAAqB,CAAC;AAE5F,OAAO,EACP,uBAAuB,EACvB,wBAAwB,EAEvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAqB,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EACP,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAEf,MAAM,wCAAwC,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAc,EACd,IAAsB,EACtB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE7C,wGAAwG;IACxG,MAAM,OAAO,GAAoD;QAChE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;KACV,CAAC;IACF,IAAI,OAAoB,CAAC;IACzB,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnD,QAAQ;YACP,OAAO,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC;gBAChF,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,+FAA+F;QAC/F,kBAAkB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnI,MAAM,KAAK,CAAC;IACb,CAAC;IAED,MAAM,YAAY,GAAG;QACpB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,KAAK,EAAE,SAAkB;QACzB,sBAAsB,EAAE,IAAI;QAC5B,IAAI,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;KAC1B,CAAC;IACF,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9E,cAAc,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB;IACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,GAAkB,EAClB,IAAuB,EACvB,OAAoB,EACpB,MAAc;IAEd,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAwB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;QAC7B,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO;QAAE,UAAU,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC3C,OAAO,EACP,UAAU,EACV,MAAM,EACN,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAClC,OAAO,CAAC,YAAY,KAAK,IAAI,CAC7B,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAqB,EACrB,GAAkB,EAClB,IAAuB,EACvB,OAAoB,EACpB,OAAwD;IAExD,MAAM,QAAQ,GACb,IAAI,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACrH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,CAAC,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IACzE,OAAO,CAAC,OAAO,GAAG,QAAQ,EAAE,SAAS,IAAI,gBAAgB,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,gBAAgB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACjG,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CACxB,yCAAyC,QAAQ,CAAC,WAAW,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,EACrI,WAAW,EACX;YACC,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;SACtE,CACD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/check-diagnostics.d.ts

@@ -0,0 +1,47 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../../../../domain/kinds/store.interface.ts';
+import { type SecretsStoreDescriptor } from '../../../../../domain/kinds/store.schema.ts';
+export { type ManifestCheck, type StoreDiagnostic } from "../../../../../schemas/discovery/check-report.schema.ts";
+export declare function sanitizeDiagnosticMessage(message: string): string;
+export declare function storeAccessAction(desc: SecretsStoreDescriptor, message: string, context: {
+    environment: string;
+    app?: string;
+    manifest?: boolean;
+    json?: boolean;
+}): string;
+/**
+ * Zero requirements has three distinct causes and they must not render alike:
+ * nothing declared, configs discovered but none loadable, or no configs in the
+ * bound workspace at all. Before 2026-08-23 all three printed one vague sentence while
+ * 17 discoverable deployment configs silently failed to load.
+ */
+export declare function describeEmptyDiscovery(discovery: {
+    configsDiscovered: number;
+    configsLoaded: number;
+    failures: {
+        path: string;
+        message: string;
+    }[];
+}): string;
+export declare function withStoreDeadline<T>(runtime: Pick<RuntimeRef, 'lifecycle'>, operation: Promise<T>, timeoutMs: number): Promise<T>;
+export declare const logger: import("@vibesdotdev/logging").LoggerImplementation;
+export declare function tryListStoreEntries(runtime: CommandContext['runtime'], descId: string, envName: string, storeTimeoutMs: number): Promise<{
+    ok: true;
+    entries: Array<{
+        key: string;
+        hasValue: boolean;
+        source: string;
+    }>;
+} | {
+    ok: false;
+    error: unknown;
+}>;
+export declare function tryResolveStoreBounded(operation: Promise<SecretsStoreImplementation>): Promise<{
+    ok: true;
+    store: SecretsStoreImplementation;
+} | {
+    ok: false;
+    error: unknown;
+}>;
+//# sourceMappingURL=check-diagnostics.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/check-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-diagnostics.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACP,KAAK,sBAAsB,EAC1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,KAAK,aAAa,EAAC,KAAK,eAAe,EAAE,MAAM,yDAAyD,CAAC;AAElH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAChF,MAAM,CA0BR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GAAG,MAAM,CAQT;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACxC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EACtC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EACrB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED,eAAO,MAAM,MAAM,qDAA6B,CAAC;AAEjD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAiB3H;AAED,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC5C,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,0BAA0B,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAO1F"}

package/dist/surfaces/cli/commands/maintenance/check/check-diagnostics.js

@@ -0,0 +1,82 @@
+import {} from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import {} from "../../../../../domain/kinds/store.schema.js";
+export {} from "../../../../../schemas/discovery/check-report.schema.js";
+export function sanitizeDiagnosticMessage(message) {
+    return message
+        .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [redacted]')
+        .replace(/(api[_-]?token["']?\s*[:=]\s*["']?)[^"'`\s,}]+/gi, '$1[redacted]')
+        .replace(/(authorization["'=:\s]+)[A-Za-z0-9._~+/=-]+/gi, '$1[redacted]');
+}
+export function storeAccessAction(desc, message, context) {
+    if (/cloudflare/i.test(desc.backend) &&
+        (/\b(401|403|404|7003)\b/.test(message) ||
+            /(?:credential.*(?:missing|invalid|rejected)|rejected.*credential)/i.test(message))) {
+        const tokenKey = desc.config?.apiTokenEnvVar ?? 'CLOUDFLARE_API_TOKEN';
+        const selectors = [
+            context.app ? `--app ${context.app}` : undefined,
+            context.manifest ? '--manifest' : undefined,
+            context.json ? '--json' : undefined
+        ]
+            .filter((value) => value !== undefined)
+            .join(' ');
+        const checkCommand = ['vibes secrets check', `--environment ${context.environment}`, selectors]
+            .filter(Boolean)
+            .join(' ');
+        return [
+            'Cloudflare rejected the operator credential or account/store identifier while listing secret names.',
+            'When the operator credential is managed locally, rerun through the redacting leverage path:',
+            `\`VIBES_HOME="$HOME/.vibes" vibes secrets exec --environment local --with ${tokenKey} -- ${checkCommand}\`.`,
+            'Do not reveal, copy, or manually export the credential.',
+            'This is a control-plane access failure, not evidence that app secrets are absent.'
+        ].join(' ');
+    }
+    return 'Fix this secrets store backend before treating unresolved required keys as missing app secrets.';
+}
+/**
+ * Zero requirements has three distinct causes and they must not render alike:
+ * nothing declared, configs discovered but none loadable, or no configs in the
+ * bound workspace at all. Before 2026-08-23 all three printed one vague sentence while
+ * 17 discoverable deployment configs silently failed to load.
+ */
+export function describeEmptyDiscovery(discovery) {
+    if (discovery.configsDiscovered === 0) {
+        return 'No secret requirements found: no deployment or service-release configs were discovered in the bound workspace and no infra descriptors declare secrets. Pass --workspace-root to check another workspace.';
+    }
+    if (discovery.failures.length > 0) {
+        return `Discovered ${discovery.configsDiscovered} deployment/service-release config(s) but ${discovery.failures.length} failed to load and ${discovery.configsLoaded} loaded cleanly with zero declared secrets. This is a discovery defect, not proof that no secrets are required:`;
+    }
+    return `Discovered and loaded ${discovery.configsLoaded} deployment/service-release config(s); none declares a secret requirement.`;
+}
+export async function withStoreDeadline(runtime, operation, timeoutMs) {
+    return runtime.lifecycle.wait(() => operation, {
+        timeoutMs,
+        reason: 'secret store check (availability is unknown)'
+    });
+}
+export const logger = getLogger('secrets.check');
+export async function tryListStoreEntries(runtime, descId, envName, storeTimeoutMs) {
+    try {
+        const entries = await withStoreDeadline(runtime, (async () => {
+            const impl = await runtime
+                .query('secrets/store')
+                .withId(descId)
+                .resolve();
+            return await impl.list(envName);
+        })(), storeTimeoutMs);
+        return { ok: true, entries };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export async function tryResolveStoreBounded(operation) {
+    try {
+        const store = await operation;
+        return { ok: true, store };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+//# sourceMappingURL=check-diagnostics.js.map

package/dist/surfaces/cli/commands/maintenance/check/check-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-diagnostics.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAEN,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAA2C,MAAM,yDAAyD,CAAC;AAElH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACxD,OAAO,OAAO;SACZ,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,kDAAkD,EAAE,cAAc,CAAC;SAC3E,OAAO,CAAC,+CAA+C,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAChC,IAA4B,EAC5B,OAAe,EACf,OAAkF;IAElF,IACC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;YACtC,oEAAoE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACnF,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,IAAI,sBAAsB,CAAC;QACvE,MAAM,SAAS,GAAG;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACnC;aACC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aACvD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,YAAY,GAAG,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC;aAC7F,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,OAAO;YACN,qGAAqG;YACrG,6FAA6F;YAC7F,6EAA6E,QAAQ,OAAO,YAAY,KAAK;YAC7G,yDAAyD;YACzD,mFAAmF;SACnF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,iGAAiG,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAItC;IACA,IAAI,SAAS,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,2MAA2M,CAAC;IACpN,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,cAAc,SAAS,CAAC,iBAAiB,6CAA6C,SAAS,CAAC,QAAQ,CAAC,MAAM,uBAAuB,SAAS,CAAC,aAAa,iHAAiH,CAAC;IACvR,CAAC;IACD,OAAO,yBAAyB,SAAS,CAAC,aAAa,4EAA4E,CAAC;AACrI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAsC,EACtC,SAAqB,EACrB,SAAiB;IAEjB,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE;QAC9C,SAAS;QACT,MAAM,EAAE,8CAA8C;KACtD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAkC,EAClC,MAAc,EACd,OAAe,EACf,cAAsB;IAEtB,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,OAAO,EACP,CAAC,KAAK,IAAI,EAAE;YACX,MAAM,IAAI,GAAG,MAAM,OAAO;iBACxB,KAAK,CAAqD,eAAe,CAAC;iBAC1E,MAAM,CAAC,MAAM,CAAC;iBACd,OAAO,EAAE,CAAC;YACZ,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC,EAAE,EACJ,cAAc,CACd,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,SAA8C;IAE9C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/check-drift.d.ts

@@ -0,0 +1,16 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../../../../domain/kinds/store.interface.ts';
+import { type SecretsStoreDescriptor } from '../../../../../domain/kinds/store.schema.ts';
+import { type DriftHome, type DriftRow, type UnreadableKey } from '../../../shared/stores/drift-fingerprints.impl.consumer.ts';
+import { type StoreDiagnostic } from "./check-diagnostics.ts";
+export declare function collectDriftRows(runtime: Pick<RuntimeRef, 'lifecycle'> & {
+    query: (kind: string) => {
+        withId: (id: string) => {
+            resolve: () => Promise<SecretsStoreImplementation>;
+        };
+    };
+}, home: DriftHome, envName: string, tierStores: SecretsStoreDescriptor[], timeoutMs: number, diagnostics: StoreDiagnostic[]): Promise<{
+    rows: DriftRow[];
+    unreadable: UnreadableKey[];
+}>;
+//# sourceMappingURL=check-drift.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/check-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-drift.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACP,KAAK,sBAAsB,EAC1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAIP,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,aAAa,EACjB,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAA4E,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAExI,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG;IACxC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QACxB,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK;YAAE,OAAO,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;SAAE,CAAC;KAC/E,CAAC;CACF,EACD,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,sBAAsB,EAAE,EACpC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,eAAe,EAAE,GAC5B,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,UAAU,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAwD5D"}

package/dist/surfaces/cli/commands/maintenance/check/check-drift.js

@@ -0,0 +1,57 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import {} from "../../../../../domain/kinds/store.schema.js";
+import { backfillFingerprints, compareFingerprints, isKeyRefusal } from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { logger, sanitizeDiagnosticMessage, tryResolveStoreBounded, withStoreDeadline } from "./check-diagnostics.js";
+export async function collectDriftRows(runtime, home, envName, tierStores, timeoutMs, diagnostics) {
+    const stores = [];
+    for (const desc of tierStores) {
+        // Do not start another request against a store whose availability failed.
+        if (diagnostics.some((diagnostic) => diagnostic.storeId === desc.id))
+            continue;
+        const bounded = async (operation, perKey = false) => {
+            try {
+                return await withStoreDeadline(runtime, operation, timeoutMs);
+            }
+            catch (error) {
+                // A key the store refuses by its own rule is that key's unknown, not the store's: it is not a store diagnostic.
+                if (perKey && isKeyRefusal(CaughtFailureSchema.parse(error)))
+                    throw error;
+                if (!diagnostics.some((diagnostic) => diagnostic.storeId === desc.id)) {
+                    diagnostics.push({
+                        storeId: desc.id,
+                        storeName: desc.name ?? desc.id,
+                        backend: desc.backend,
+                        environment: envName,
+                        error: sanitizeDiagnosticMessage(error instanceof Error ? error.message : String(error)),
+                        action: 'Restore store access before treating recorded drift fingerprints as a complete comparison.'
+                    });
+                }
+                throw error;
+            }
+        };
+        // SAFETY: Resolving a secrets/store descriptor produces a SecretsStoreImplementation.
+        const resolveOp = bounded(runtime.query('secrets/store').withId(desc.id).resolve());
+        const outcome = await tryResolveStoreBounded(resolveOp);
+        if (!outcome.ok) {
+            logger.warn('Skipping store in drift row collection due to error', {
+                storeId: desc.id,
+                error: outcome.error
+            });
+            continue;
+        }
+        const store = outcome.store;
+        stores.push({
+            id: desc.id,
+            list: (environment) => bounded(store.list(environment)),
+            get: (environment, key) => diagnostics.some((diagnostic) => diagnostic.storeId === desc.id)
+                ? Promise.resolve(undefined)
+                : bounded(store.get(environment, key), true)
+        });
+    }
+    const unreadable = await backfillFingerprints({ home, environment: envName, stores });
+    // A key a store held but refused is unknown, whatever an earlier run recorded for it.
+    const refused = new Set(unreadable.map((entry) => entry.key));
+    const rows = (await compareFingerprints(home, envName)).map((row) => refused.has(row.key) ? { ...row, status: 'unknown' } : row);
+    return { rows, unreadable };
+}
+//# sourceMappingURL=check-drift.js.map

package/dist/surfaces/cli/commands/maintenance/check/check-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-drift.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAEN,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EAIX,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,MAAM,EAAC,yBAAyB,EAAC,sBAAsB,EAAC,iBAAiB,EAAuB,MAAM,wBAAwB,CAAC;AAExI,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAIC,EACD,IAAe,EACf,OAAe,EACf,UAAoC,EACpC,SAAiB,EACjB,WAA8B;IAE9B,MAAM,MAAM,GAAyD,EAAE,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/E,MAAM,OAAO,GAAG,KAAK,EAAK,SAAqB,EAAE,MAAM,GAAG,KAAK,EAAc,EAAE;YAC9E,IAAI,CAAC;gBACJ,OAAO,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,gHAAgH;gBAChH,IAAI,MAAM,IAAI,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBACvE,WAAW,CAAC,IAAI,CAAC;wBAChB,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;wBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,WAAW,EAAE,OAAO;wBACpB,KAAK,EAAE,yBAAyB,CAC/B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD;wBACD,MAAM,EACL,4FAA4F;qBAC7F,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC,CAAC;QACF,sFAAsF;QACtF,MAAM,SAAS,GAAG,OAAO,CACxB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CACxD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBAClE,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CACzB,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC/D,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;SAC9C,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAY,EAAE,CAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAC1D,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/check-json.d.ts

@@ -0,0 +1,11 @@
+import { type UIContext } from '@vibesdotdev/cli/providers';
+import * as z from 'zod/v4';
+import { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.ts";
+import { type DriftRow, type UnreadableKey } from '../../../shared/stores/drift-fingerprints.impl.consumer.ts';
+import type { ManifestCheck, StoreDiagnostic } from './check-diagnostics.ts';
+import type { CheckResult } from './schemas/check-result.ts';
+export declare function renderCheckJson(ui: UIContext, options: z.output<typeof checkOptionsSchema>, envName: string, envTier: string, results: CheckResult[], manifestChecks: ManifestCheck[], drift: {
+    rows: DriftRow[];
+    unreadable: UnreadableKey[];
+}, driftRows: DriftRow[], driftUnknown: boolean, driftDiverged: number, storeDiagnostics: StoreDiagnostic[]): void;
+//# sourceMappingURL=check-json.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/check-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-json.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EACP,KAAK,QAAQ,EACb,KAAK,aAAa,EACjB,MAAM,4DAA4D,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAC,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,UAAU,EAAE,aAAa,EAAE,CAAA;CAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,IAAI,CA0FhW"}

package/dist/surfaces/cli/commands/maintenance/check/check-json.js

@@ -0,0 +1,54 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import * as z from 'zod/v4';
+import { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.js";
+import {} from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+export function renderCheckJson(ui, options, envName, envTier, results, manifestChecks, drift, driftRows, driftUnknown, driftDiverged, storeDiagnostics) {
+    const summary = {
+        environment: envName,
+        tier: envTier,
+        total: results.length,
+        ok: results.filter((r) => r.status === 'ok').length,
+        missing: results.filter((r) => r.status === 'missing').length,
+        warn: results.filter((r) => r.status === 'warn').length,
+        unknown: results.filter((r) => r.status === 'unknown').length,
+        results
+    };
+    if (options.drift) {
+        summary.drift = {
+            status: driftUnknown ? 'unknown' : 'complete',
+            compared: driftRows.length,
+            match: driftRows.filter((row) => row.status === 'match').length,
+            diverge: driftDiverged,
+            singleStore: driftRows.filter((row) => row.status === 'single-store').length,
+            unknown: driftRows.filter((row) => row.status === 'unknown').length,
+            unreadableKeys: drift.unreadable,
+            results: driftRows
+        };
+    }
+    if (storeDiagnostics.length > 0) {
+        summary.storeDiagnostics = storeDiagnostics;
+    }
+    if (options.manifest) {
+        summary.manifest = {
+            total: manifestChecks.length,
+            ok: manifestChecks.filter((m) => m.status === 'ok').length,
+            missing: manifestChecks.filter((m) => m.status === 'missing').length,
+            warn: manifestChecks.filter((m) => m.status === 'warn').length,
+            unknown: manifestChecks.filter((m) => m.status === 'unknown').length,
+            results: manifestChecks
+        };
+    }
+    ui.render(summary, { format: 'json' });
+    const manifestMissing = manifestChecks.filter((m) => m.status === 'missing').length;
+    const unknownCount = results.filter((r) => r.status === 'unknown').length +
+        manifestChecks.filter((m) => m.status === 'unknown').length;
+    if (results.filter((r) => r.status === 'missing').length > 0 ||
+        manifestMissing > 0 ||
+        unknownCount > 0 ||
+        driftDiverged > 0 ||
+        driftUnknown) {
+        requestCLIExit(1);
+    }
+    return;
+}
+//# sourceMappingURL=check-json.js.map

package/dist/surfaces/cli/commands/maintenance/check/check-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-json.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EAGN,MAAM,4DAA4D,CAAC;AAGpE,MAAM,UAAU,eAAe,CAAC,EAAa,EAAE,OAA4C,EAAE,OAAe,EAAE,OAAe,EAAE,OAAsB,EAAE,cAA+B,EAAE,KAAwD,EAAE,SAAqB,EAAE,YAAqB,EAAE,aAAqB,EAAE,gBAAmC;IAgCzV,MAAM,OAAO,GAAqB;QACjC,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM;QACnD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC7D,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QACvD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC7D,OAAO;KACP,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG;YACf,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7C,QAAQ,EAAE,SAAS,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;YAC/D,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;YAC5E,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACnE,cAAc,EAAE,KAAK,CAAC,UAAU;YAChC,OAAO,EAAE,SAAS;SAClB,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG;YAClB,KAAK,EAAE,cAAc,CAAC,MAAM;YAC5B,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM;YAC1D,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACpE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;YAC9D,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACpE,OAAO,EAAE,cAAc;SACvB,CAAC;IACH,CAAC;IAED,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEpF,MAAM,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QACpD,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAE7D,IACC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACxD,eAAe,GAAG,CAAC;QACnB,YAAY,GAAG,CAAC;QAChB,aAAa,GAAG,CAAC;QACjB,YAAY,EACX,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO;AACR,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/check-report.d.ts

@@ -0,0 +1,12 @@
+import { type UIContext } from '@vibesdotdev/cli/providers';
+import * as z from 'zod/v4';
+import { groupRequirementsByApp } from '../../../../../domain/requirements/resolver.ts';
+import { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.ts";
+import { type DriftRow, type UnreadableKey } from '../../../shared/stores/drift-fingerprints.impl.consumer.ts';
+import type { ManifestCheck, StoreDiagnostic } from './check-diagnostics.ts';
+import type { CheckResult } from './schemas/check-result.ts';
+export declare function renderCheckReport(ui: UIContext, options: z.output<typeof checkOptionsSchema>, envName: string, envTier: string, results: CheckResult[], manifestChecks: ManifestCheck[], drift: {
+    rows: DriftRow[];
+    unreadable: UnreadableKey[];
+}, driftRows: DriftRow[], driftUnknown: boolean, driftDiverged: number, storeDiagnostics: StoreDiagnostic[], requirements: Parameters<typeof groupRequirementsByApp>[0]): void;
+//# sourceMappingURL=check-report.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/check-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-report.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACP,sBAAsB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EACP,KAAK,QAAQ,EACb,KAAK,aAAa,EACjB,MAAM,4DAA4D,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAC,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,UAAU,EAAE,aAAa,EAAE,CAAA;CAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAiI9Z"}

package/dist/surfaces/cli/commands/maintenance/check/check-report.js

@@ -0,0 +1,100 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import * as z from 'zod/v4';
+import { groupRequirementsByApp } from "../../../../../domain/requirements/resolver.js";
+import { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.js";
+import {} from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { renderCheckJson } from "./check-json.js";
+export function renderCheckReport(ui, options, envName, envTier, results, manifestChecks, drift, driftRows, driftUnknown, driftDiverged, storeDiagnostics, requirements) {
+    if (options.json) {
+        renderCheckJson(ui, options, envName, envTier, results, manifestChecks, drift, driftRows, driftUnknown, driftDiverged, storeDiagnostics);
+        return;
+    }
+    const grouped = groupRequirementsByApp(requirements);
+    const okCount = results.filter((r) => r.status === 'ok').length;
+    const missingCount = results.filter((r) => r.status === 'missing').length;
+    const warnCount = results.filter((r) => r.status === 'warn').length;
+    const unknownCount = results.filter((r) => r.status === 'unknown').length;
+    ui.log(`\nSecrets check for environment: ${envName} (${envTier})\n`);
+    if (storeDiagnostics.length > 0) {
+        ui.log('  Store access diagnostics');
+        for (const diagnostic of storeDiagnostics) {
+            ui.log(`    [x] ${diagnostic.storeId} (${diagnostic.backend}) ${diagnostic.environment}: ${diagnostic.error}`);
+            ui.log(`        ${diagnostic.action}`);
+        }
+        ui.log('');
+    }
+    for (const [appId, reqs] of grouped) {
+        ui.log(`  ${appId}`);
+        for (const req of reqs) {
+            const result = results.find((r) => r.key === req.key && r.appId === req.appId);
+            if (!result)
+                continue;
+            const icon = result.status === 'ok' ? '+' : result.status === 'missing' ? 'x' : '?';
+            const label = result.required ? 'required' : 'optional';
+            const src = result.source ? ` (${result.source})` : '';
+            ui.log(`    [${icon}] ${result.key.padEnd(40)} ${label.padEnd(10)} ${result.status}${src}`);
+            if (result.capabilities?.length) {
+                ui.log(`        required capabilities: ${result.capabilities.join(', ')}`);
+            }
+        }
+        ui.log('');
+    }
+    ui.log(`  Summary: ${okCount} ok, ${missingCount} missing, ${warnCount} optional not set, ${unknownCount} unknown`);
+    if (missingCount > 0) {
+        ui.log(`  Run 'vibes secrets set <KEY>' to add missing secrets`);
+    }
+    else if (unknownCount > 0) {
+        ui.log('  Resolve store access diagnostics above before classifying any required key as missing.');
+    }
+    ui.log('');
+    let manifestMissing = 0;
+    let manifestUnknown = 0;
+    if (options.manifest && manifestChecks.length > 0) {
+        ui.log(`  Canonical manifest cross-check (${manifestChecks.length} entries)`);
+        for (const m of manifestChecks) {
+            const icon = m.status === 'ok' ? '+' : m.status === 'missing' ? 'x' : '?';
+            const label = m.required ? 'required' : 'optional';
+            const where = m.storedIn ? ` (${m.storedIn})` : ` <- ${m.source}`;
+            ui.log(`    [${icon}] ${m.key.padEnd(40)} ${label.padEnd(10)} ${m.status}${where}`);
+        }
+        const mOk = manifestChecks.filter((m) => m.status === 'ok').length;
+        manifestMissing = manifestChecks.filter((m) => m.status === 'missing').length;
+        const mWarn = manifestChecks.filter((m) => m.status === 'warn').length;
+        const mUnknown = manifestChecks.filter((m) => m.status === 'unknown').length;
+        manifestUnknown = mUnknown;
+        ui.log(`  Manifest summary: ${mOk} ok, ${manifestMissing} missing, ${mWarn} optional not set, ${mUnknown} unknown`);
+        if (manifestMissing > 0) {
+            ui.log(`  Run 'vibes secrets import' to populate from local sources`);
+        }
+        else if (mUnknown > 0) {
+            ui.log('  Resolve store access diagnostics above before importing or changing app secrets.');
+        }
+        ui.log('');
+    }
+    if (options.drift) {
+        ui.log('  Drift fingerprints (HMAC; values never leave the store)');
+        if (driftUnknown)
+            ui.log('    Drift status is unknown: one or more stores or keys could not be checked.');
+        for (const unreadable of drift.unreadable) {
+            ui.log(`    [?] ${unreadable.key.padEnd(40)} refused by ${unreadable.store}`);
+        }
+        if (driftRows.length === 0) {
+            ui.log('    (no multi-store fingerprints recorded yet; set secrets to seed the index)');
+        }
+        for (const row of driftRows) {
+            const icon = row.status === 'match' ? '+' : row.status === 'diverge' ? 'x' : '?';
+            ui.log(`    [${icon}] ${row.key.padEnd(40)} ${row.status.padEnd(12)} ${row.backends.join(', ')}`);
+        }
+        ui.log(`  Drift summary: ${driftRows.filter((row) => row.status === 'match').length} match, ${driftDiverged} diverge, ${driftRows.filter((row) => row.status === 'single-store').length} single-store`);
+        ui.log('');
+    }
+    if (missingCount > 0 ||
+        manifestMissing > 0 ||
+        unknownCount > 0 ||
+        manifestUnknown > 0 ||
+        driftDiverged > 0 ||
+        driftUnknown) {
+        requestCLIExit(1);
+    }
+}
+//# sourceMappingURL=check-report.js.map

package/dist/surfaces/cli/commands/maintenance/check/check-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-report.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/check-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACP,sBAAsB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAC;AACzF,OAAO,EAGN,MAAM,4DAA4D,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,OAA4C,EAAE,OAAe,EAAE,OAAe,EAAE,OAAsB,EAAE,cAA+B,EAAE,KAAwD,EAAE,SAAqB,EAAE,YAAqB,EAAE,aAAqB,EAAE,gBAAmC,EAAE,YAA0D;IACvZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACzI,OAAO;IACR,CAAC;IAGD,MAAM,OAAO,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAEhE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAE1E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEpE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAG1E,EAAE,CAAC,GAAG,CAAC,oCAAoC,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC;IAGrE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACrC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;YAC3C,EAAE,CAAC,GAAG,CACL,WAAW,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,WAAW,KAAK,UAAU,CAAC,KAAK,EAAE,CACtG,CAAC;YACF,EAAE,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAGD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;YAC5F,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBACjC,EAAE,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACF,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAGD,EAAE,CAAC,GAAG,CACL,cAAc,OAAO,QAAQ,YAAY,aAAa,SAAS,sBAAsB,YAAY,UAAU,CAC3G,CAAC;IAEF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,GAAG,CACL,0FAA0F,CAC1F,CAAC;IACH,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAGX,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,IAAI,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,GAAG,CAAC,qCAAqC,cAAc,CAAC,MAAM,WAAW,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YAClE,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QACnE,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7E,eAAe,GAAG,QAAQ,CAAC;QAC3B,EAAE,CAAC,GAAG,CACL,uBAAuB,GAAG,QAAQ,eAAe,aAAa,KAAK,sBAAsB,QAAQ,UAAU,CAC3G,CAAC;QACF,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACzB,EAAE,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzB,EAAE,CAAC,GAAG,CACL,oFAAoF,CACpF,CAAC;QACH,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAGD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACpE,IAAI,YAAY;YACf,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QACzF,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC3C,EAAE,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACjF,EAAE,CAAC,GAAG,CACL,QAAQ,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;QACH,CAAC;QACD,EAAE,CAAC,GAAG,CACL,oBAAoB,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,WAAW,aAAa,aAAa,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM,eAAe,CAC/L,CAAC;QACF,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAGD,IACC,YAAY,GAAG,CAAC;QAChB,eAAe,GAAG,CAAC;QACnB,YAAY,GAAG,CAAC;QAChB,eAAe,GAAG,CAAC;QACnB,aAAa,GAAG,CAAC;QACjB,YAAY,EACX,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACF,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/schemas/check-result.d.ts

@@ -0,0 +1,10 @@
+export interface CheckResult {
+    key: string;
+    appId: string;
+    required: boolean;
+    description: string | undefined;
+    capabilities?: string[];
+    status: 'ok' | 'missing' | 'warn' | 'unknown';
+    source: string | undefined;
+}
+//# sourceMappingURL=check-result.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/schemas/check-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-result.d.ts","sourceRoot":"","sources":["../../../../../../../src/surfaces/cli/commands/maintenance/check/schemas/check-result.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B"}

package/dist/surfaces/cli/commands/maintenance/check/schemas/check-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-result.js","sourceRoot":"","sources":["../../../../../../../src/surfaces/cli/commands/maintenance/check/schemas/check-result.ts"],"names":[],"mappings":""}

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.check.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAyBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.descriptor.js

@@ -0,0 +1,27 @@
+const descriptor = {
+    kind: 'cli/command',
+    id: 'secrets.check',
+    name: 'check',
+    description: 'Validate stored secrets against infra manifest requirements',
+    group: 'secrets',
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--app <id>', description: 'Check a specific app or worker only' },
+        { flags: '--manifest', description: 'Also cross-check against the canonical import manifest' },
+        {
+            flags: '--store-timeout-ms <ms>',
+            description: 'Deadline per store availability check (default: 15000)'
+        },
+        { flags: '--json', description: 'Output as JSON' },
+        {
+            flags: '--drift',
+            description: 'Compare HMAC fingerprints of keys present in more than one store without revealing values'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 50
+};
+export default descriptor;
+//# sourceMappingURL=secrets.check.cli-command.descriptor.js.map

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.check.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC3E,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAC9F;YACC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,wDAAwD;SACrE;QACD,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;QAClD;YACC,KAAK,EAAE,SAAS;YAChB,WAAW,EACV,2FAA2F;SAC5F;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}