@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.import.cli-command.impl.consumer.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAkC,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,YAAY,EAAC,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sDAAsD,CAAC;AACnI,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAC,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAC,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AACpH,OAAO,EACP,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sDAAsD,CAAC;AAEnI;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,EAA8B,EAAE,IAAY;IACtE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,6CAA6C;IAC7C,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5E,2EAA2E;IAC3E,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAClD,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,aAAa,EAAE;QACpF,MAAM,EAAE,0BAA0B;QAClC,KAAK,EAAE,IAAI,CAAC,OAAO;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,KAAK,UAAU,0BAA0B,CACxC,OAAmB,EACnB,WAAmB,EACnB,OAAe,EACf,KAA6B;IAE7B,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,SAAS,SAAS,CACjB,MAAmC,EACnC,GAAW,EACX,OAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,IAAwB,EAAE,cAA8B;QACxF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,+CAA+C;QAC/C,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAc,CAAC;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CACxD,OAAO,EACP,EAAE,EACF,OAAO,CAAC,WAAW,CACnB,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACpC,4FAA4F;QAC5F,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACnF,EAAE,CAAC,KAAK,CAAC,mBAAmB,YAAY,YAAY,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;QACzE,uFAAuF;QACvF,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,IAAI,YAAY,IAAI,EAAE,KAAK,YAAY;gBAAE,SAAS;YAClD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACf,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,aAAa,GAAyC,EAAE,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,OAAO,EAAE,CAAC;YACrD,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;gBAAE,SAAS;YAC5D,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjE,SAAS;YACV,CAAC;YACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,IAAI,KAAK,CAAC,QAAQ;oBAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;oBAC/C,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,QAAQ;oBAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;oBAC/C,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACrC,SAAS;YACV,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAE7C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,EAAE,CAAC,GAAG,CAAC,2BAA2B,UAAU,kBAAkB,OAAO,IAAI,CAAC,CAAC;YAC3E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;gBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC5B,EAAE,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,MAAM,gCAAgC,CAAC,CAAC;gBACtE,KAAK,MAAM,GAAG,IAAI,eAAe;oBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC5B,EAAE,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,MAAM,gCAAgC,CAAC,CAAC;gBACtE,KAAK,MAAM,GAAG,IAAI,eAAe;oBAAE,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,EAAE,CAAC,GAAG,CAAC,OAAO,aAAa,CAAC,MAAM,sDAAsD,CAAC,CAAC;gBAC1F,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;oBAC/C,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACF,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,OAAO;QACR,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACtB,EAAE,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACnE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;gBAAE,cAAc,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO;QACR,CAAC;QAED,qGAAqG;QACrG,MAAM,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,iBAAiB,CAAC,CAAC;QAEjG,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE9E,EAAE,CAAC,OAAO,CAAC,YAAY,UAAU,oBAAoB,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;QAElF,mFAAmF;QACnF,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,GAAG,CAAC,IAAI,CACP,YAAY,UAAU,8DAA8D,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,GAAG;gBAC1H,qFAAqF,CACrF,CAAC;QACH,CAAC;QAED,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,IAAI,CACN,GAAG,aAAa,CAAC,MAAM,8DAA8D,qBAAqB,CAAC,MAC3G,YAAY,CACZ,CAAC;QACH,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,EAAE,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,6CAA6C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5G,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,EAAE,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,gCAAgC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=secrets.precommit.cli-command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.precommit.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAajB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.js

@@ -0,0 +1,16 @@
+const descriptor = {
+    kind: 'cli/command',
+    id: 'dev.secrets.pre-commit-check',
+    name: 'pre-commit-check',
+    description: 'Run secrets pattern detection on staged files',
+    group: 'secrets',
+    options: [
+        { flags: '--workspace <path>', description: 'Workspace root (default: the bound workspace)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 1
+};
+export default descriptor;
+//# sourceMappingURL=secrets.precommit.cli-command.descriptor.js.map

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.precommit.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,8BAA8B;IAClC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,+CAA+C;IAC5D,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,+CAA+C,EAAE;KAC7F;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,CAAC;CACR,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.d.ts

@@ -0,0 +1,16 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type PreCommitCheckArgs, type PreCommitCheckOptionsInput } from "../../../../../schemas/cli/commands/precommit.schema.ts";
+export { preCommitCheckOptionsSchema, type PreCommitCheckArgs, type PreCommitCheckOptionsInput } from "../../../../../schemas/cli/commands/precommit.schema.ts";
+/**
+ * The workspace the check scans. `--workspace` names a directory relative to
+ * the host's captured cwd (a host with none refuses `UNAVAILABLE`
+ * `cwd-unavailable`); without it the check runs on the bound workspace
+ * (`runtime/workspace-path`).
+ */
+export declare function preCommitWorkspacePath(runtime: Pick<RuntimeRef, 'localEnvironment' | 'context' | 'hasKind' | 'query'>, workspace: string | undefined): Promise<string>;
+declare const _default: {
+    execute(_args: PreCommitCheckArgs, opts: PreCommitCheckOptionsInput, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.precommit.cli-command.impl.consumer.d.ts.map

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.precommit.cli-command.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAA8B,KAAK,kBAAkB,EAAC,KAAK,0BAA0B,EAAE,MAAM,yDAAyD,CAAC;AAE9J,OAAO,EAAE,2BAA2B,EAAC,KAAK,kBAAkB,EAAC,KAAK,0BAA0B,EAAE,MAAM,yDAAyD,CAAC;AAE9J;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,EAC/E,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,MAAM,CAAC,CAMjB;;mBAOQ,kBAAkB,QACnB,0BAA0B,WACvB,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;;AALjB,wBAaE"}

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.js

@@ -0,0 +1,32 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { preCommitCheckOptionsSchema } from "../../../../../schemas/cli/commands/precommit.schema.js";
+import { runSecretsPreCommitCheck } from "../../../hooks/pre-commit-secrets.js";
+export { preCommitCheckOptionsSchema } from "../../../../../schemas/cli/commands/precommit.schema.js";
+/**
+ * The workspace the check scans. `--workspace` names a directory relative to
+ * the host's captured cwd (a host with none refuses `UNAVAILABLE`
+ * `cwd-unavailable`); without it the check runs on the bound workspace
+ * (`runtime/workspace-path`).
+ */
+export async function preCommitWorkspacePath(runtime, workspace) {
+    if (workspace) {
+        const cwd = requireRuntimeCwd(runtime);
+        return (await getRuntimePath(runtime)).resolve(cwd, workspace);
+    }
+    return runtime.context('runtime/workspace-path');
+}
+import { openCommandOutput } from "../../../shared/output/command-output.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+export default {
+    async execute(_args, opts, context) {
+        const options = parseCommandInput(preCommitCheckOptionsSchema, opts, 'pre-commit-check');
+        const out = await openCommandOutput(context.runtime);
+        const workspacePath = await preCommitWorkspacePath(context.runtime, options.workspace);
+        // A scan that could not run throws typed (non-zero); only a completed scan returns 0 or 1.
+        const exitCode = await runSecretsPreCommitCheck(context.runtime, workspacePath, out);
+        requestCLIExit(exitCode);
+    }
+};
+//# sourceMappingURL=secrets.precommit.cli-command.impl.consumer.js.map

package/dist/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.precommit.cli-command.impl.consumer.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAkB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAA0D,MAAM,yDAAyD,CAAC;AAC9J,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAA0D,MAAM,yDAAyD,CAAC;AAE9J;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAA+E,EAC/E,SAA6B;IAE7B,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAyB,EACzB,IAAgC,EAChC,OAAuB;QAEvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACrF,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.pull.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAiBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.descriptor.js

@@ -0,0 +1,20 @@
+const descriptor = {
+    kind: 'cli/command',
+    id: 'secrets.pull',
+    name: 'pull',
+    description: 'Pull secrets from a remote backend to local store',
+    group: 'secrets',
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--from <backend>', description: 'Source store id (default: the one store serving the environment\'s tier)' },
+        { flags: '--to <backend>', description: 'Destination store id (default: the one store serving the local tier)' },
+        { flags: '--key <key>', description: 'Pull only one secret key (repeat or comma-separate for multiple keys)' },
+        { flags: '--dry-run', description: 'Show what would be pulled without pulling' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 70
+};
+export default descriptor;
+//# sourceMappingURL=secrets.pull.cli-command.descriptor.js.map

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.pull.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,0EAA0E,EAAE;QACtH,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,sEAAsE,EAAE;QAChH,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,uEAAuE,EAAE;QAC9G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,2CAA2C,EAAE;KAChF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.d.ts

@@ -0,0 +1,17 @@
+import { type PullArgs, type PullOptionsInput } from "../../../../../schemas/cli/commands/pull.schema.ts";
+export { pullOptionsSchema, type PullArgs, type PullOptionsInput } from "../../../../../schemas/cli/commands/pull.schema.ts";
+/**
+ * `vibes secrets pull`: copy a source store's values for the environment into a
+ * destination store. No backend id is built in: the source is `--from <id>`,
+ * else the one store answering the environment's tier; the destination is
+ * `--to <id>`, else the one store answering the `local` tier. A tier tied at
+ * the top priority is `store-ambiguous`; a named store must be registered; a
+ * source that lists keys it cannot return (write-only) is refused; each copied
+ * value records its drift fingerprint, as `secrets set` does.
+ */
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+declare const _default: {
+    execute(_args: PullArgs, opts: PullOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.pull.cli-command.impl.d.ts.map

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.pull.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAC,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAC3H;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;;mBAmB/C,QAAQ,QAAQ,gBAAgB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADtG,wBA4CE"}

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.js

@@ -0,0 +1,41 @@
+import { pullOptionsSchema } from "../../../../../schemas/cli/commands/pull.schema.js";
+export { pullOptionsSchema } from "../../../../../schemas/cli/commands/pull.schema.js";
+import { resolveSecretsEnvironment } from "../../../environment.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { listStoreDescriptors, requireNamedStore, resolveStoreImplementation, selectStore } from "../../../shared/stores/store-selection.js";
+import { assertDistinctStores, parseKeyFilter, readSourceSecrets, recordCopiedFingerprints, writeTargetSecrets } from "../../../shared/stores/store-transfer.js";
+export default {
+    async execute(_args, opts, commandContext) {
+        const { runtime } = commandContext;
+        const ui = await runtime.context('cli/ui');
+        const options = parseCommandInput(pullOptionsSchema, opts, 'pull');
+        const keyFilter = parseKeyFilter(options.key);
+        const descriptors = listStoreDescriptors(runtime);
+        const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+        const source = selectStore(descriptors, envTier, options.from);
+        const target = options.to !== undefined ? requireNamedStore(descriptors, options.to) : selectStore(descriptors, 'local', undefined);
+        assertDistinctStores({ id: source.id, environment: envName }, { id: target.id, environment: envName });
+        const secrets = await readSourceSecrets(await resolveStoreImplementation(runtime, source.id), envName, keyFilter);
+        const keys = Object.keys(secrets);
+        if (keys.length === 0) {
+            ui.info(`No secrets found in [${source.id}] for environment: ${envName}`);
+            return;
+        }
+        if (options.dryRun) {
+            ui.log(`\nDry run: would pull ${keys.length} secret(s) from [${source.id}] to [${target.id}]\n`);
+            for (const key of keys.sort()) {
+                ui.log(`  ${key}`);
+            }
+            ui.log('');
+            return;
+        }
+        await writeTargetSecrets(await resolveStoreImplementation(runtime, target.id), envName, secrets);
+        const fingerprints = await recordCopiedFingerprints(runtime, { environment: envName, backend: target.id, secrets });
+        ui.success(`Pulled ${keys.length} secret(s) from [${source.id}] to [${target.id}] for ${envName}`);
+        if (fingerprints.failed > 0) {
+            ui.warn(`Could not record ${fingerprints.failed} drift fingerprint(s) (${fingerprints.reason}): ${fingerprints.message} ` +
+                '`vibes secrets check --drift` will not see them until they are re-recorded.');
+        }
+    }
+};
+//# sourceMappingURL=secrets.pull.cli-command.impl.js.map

package/dist/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.pull.cli-command.impl.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/pull/secrets.pull.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAsC,MAAM,oDAAoD,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAsC,MAAM,oDAAoD,CAAC;AAa3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACP,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAC1B,WAAW,EACV,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACP,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EACjB,MAAM,0CAA0C,CAAC;AAElD,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAe,EAAE,IAAsB,EAAE,cAA8B;QACpF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,MAAM,GACX,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAEtH,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvG,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,EAAE,sBAAsB,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO;QACR,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,MAAM,oBAAoB,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACjG,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACpB,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,OAAO;QACR,CAAC;QAED,MAAM,kBAAkB,CAAC,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpH,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,oBAAoB,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;QACnG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,IAAI,CACN,oBAAoB,YAAY,CAAC,MAAM,0BAA0B,YAAY,CAAC,MAAM,MAAM,YAAY,CAAC,OAAO,GAAG;gBACjH,6EAA6E,CAC7E,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.push.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAmBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.descriptor.js

@@ -0,0 +1,22 @@
+const descriptor = {
+    kind: 'cli/command',
+    id: 'secrets.push',
+    name: 'push',
+    description: 'Deploy secrets from local store to a remote backend',
+    group: 'secrets',
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--source-env <name>', description: 'Source environment in the source backend (default: source backend\'s primary tier, e.g. "local" for encrypted-local)' },
+        { flags: '--from <backend>', description: 'Source store id (default: the one store serving the source environment\'s tier, local unless --source-env)' },
+        { flags: '--to <backend>', description: 'Destination store id (default: the one store serving the environment\'s tier)' },
+        { flags: '--key <key>', description: 'Push only one secret key (repeat or comma-separate for multiple keys)' },
+        { flags: '--app <id>', description: 'Push only secrets required by this app' },
+        { flags: '--dry-run', description: 'Show what would be pushed without pushing' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 60
+};
+export default descriptor;
+//# sourceMappingURL=secrets.push.cli-command.descriptor.js.map

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.push.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,qDAAqD;IAClE,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,sHAAsH,EAAE;QACrK,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,4GAA4G,EAAE;QACxJ,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,+EAA+E,EAAE;QACzH,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,uEAAuE,EAAE;QAC9G,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,wCAAwC,EAAE;QAC9E,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,2CAA2C,EAAE;KAChF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.d.ts

@@ -0,0 +1,20 @@
+import { type PushArgs, type PushOptionsInput } from "../../../../../schemas/cli/commands/push.schema.ts";
+export { pushOptionsSchema, type PushArgs, type PushOptionsInput } from "../../../../../schemas/cli/commands/push.schema.ts";
+/**
+ * `vibes secrets push`: copy a source store's values into the destination
+ * store for the environment. No backend id is built in: the destination is
+ * `--to <id>`, else the one store answering the environment's tier; the source
+ * is `--from <id>` (read at the lowest tier it serves), else the one store
+ * answering the source environment's tier (`--source-env`, default `local`). A
+ * tier tied at the top priority is `store-ambiguous`; a named store must be
+ * registered; `--app <id>` must name a declared requirement target, exactly as
+ * `check --app` does (`INVALID_INPUT`, never "No secrets to push" with exit 0);
+ * a write-only source is refused; each pushed value records its drift
+ * fingerprint, as `secrets set` does.
+ */
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+declare const _default: {
+    execute(_args: PushArgs, opts: PushOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.push.cli-command.impl.d.ts.map

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.push.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAC,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAC3H;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;;mBAwC/C,QAAQ,QAAQ,gBAAgB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADtG,wBAiFE"}

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.js

@@ -0,0 +1,93 @@
+import { pushOptionsSchema } from "../../../../../schemas/cli/commands/push.schema.js";
+export { pushOptionsSchema } from "../../../../../schemas/cli/commands/push.schema.js";
+import { resolveSecretRequirementsWithDiagnostics, uniqueSecretKeys } from "../../../../../domain/requirements/resolver.js";
+import { resolveSecretsEnvironment } from "../../../environment.js";
+import { requirementsForApp } from "../../../shared/app-target.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { listStoreDescriptors, requireNamedStore, resolveStoreImplementation, selectStore } from "../../../shared/stores/store-selection.js";
+import { assertDistinctStores, parseKeyFilter, readSourceSecrets, recordCopiedFingerprints, writeTargetSecrets } from "../../../shared/stores/store-transfer.js";
+// Preferred ordering when picking a named backend's primary tier as the default
+// source-env. We pick the lowest tier the backend serves (local > dev >
+// staging > production), since that's where a developer's local `secrets set`
+// writes land. Keeps `push --environment production` reading from the user's
+// machine-local store rather than stale data left in vault.environments.production
+// from a long-ago `vibes secrets import`.
+const TIER_PREFERENCE = ['local', 'dev', 'staging', 'production'];
+function pickPrimaryTier(descriptor) {
+    for (const tier of TIER_PREFERENCE) {
+        if (descriptor.tiers.includes(tier))
+            return tier;
+    }
+    return descriptor.tiers[0] ?? 'local';
+}
+export default {
+    async execute(_args, opts, commandContext) {
+        const { runtime } = commandContext;
+        const ui = await runtime.context('cli/ui');
+        const options = parseCommandInput(pushOptionsSchema, opts, 'push');
+        const keyFilter = parseKeyFilter(options.key);
+        const descriptors = listStoreDescriptors(runtime);
+        const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+        // The destination is the one store for the target tier; the source is chosen independently of
+        // that tier (typical flow: the machine-local store pushed to the production store, which the
+        // local store does not serve).
+        const target = selectStore(descriptors, envTier, options.to);
+        let source;
+        let sourceEnv;
+        if (options.from !== undefined) {
+            source = requireNamedStore(descriptors, options.from);
+            sourceEnv =
+                options.sourceEnv !== undefined
+                    ? (await resolveSecretsEnvironment(runtime, options.sourceEnv)).name
+                    : pickPrimaryTier(source);
+        }
+        else {
+            // Source env defaults to `local`, NOT the target env: reading `getAll(envName)` blindly used to
+            // pull whatever stale values a prior `vibes secrets import` left in the target's namespace.
+            const resolvedSource = await resolveSecretsEnvironment(runtime, options.sourceEnv ?? 'local');
+            sourceEnv = resolvedSource.name;
+            source = selectStore(descriptors, resolvedSource.tier, undefined);
+        }
+        assertDistinctStores({ id: source.id, environment: sourceEnv }, { id: target.id, environment: envName });
+        // A targeted push needs its target to exist before anything is read or written.
+        let appKeys;
+        if (options.app !== undefined) {
+            // Deployment configs are read from the bound workspace; an unbound
+            // host fails with workspace-unbound instead of reading the cwd.
+            const workspaceRoot = await runtime.context('runtime/workspace-path');
+            const { requirements, discovery } = await resolveSecretRequirementsWithDiagnostics(runtime, {
+                deploymentConfigRoot: workspaceRoot
+            });
+            appKeys = new Set(uniqueSecretKeys(requirementsForApp(options.app, requirements, discovery.failures.length)));
+        }
+        if (sourceEnv !== envName) {
+            ui.log(`Reading from [${source.id}] env "${sourceEnv}" (source backend's primary tier); writing to [${target.id}] env "${envName}". Override with --source-env if needed.`);
+        }
+        let secrets = await readSourceSecrets(await resolveStoreImplementation(runtime, source.id), sourceEnv, keyFilter);
+        if (appKeys) {
+            const wanted = appKeys;
+            secrets = Object.fromEntries(Object.entries(secrets).filter(([key]) => wanted.has(key)));
+        }
+        const keys = Object.keys(secrets);
+        if (keys.length === 0) {
+            ui.info('No secrets to push.');
+            return;
+        }
+        if (options.dryRun) {
+            ui.log(`\nDry run: would push ${keys.length} secret(s) from [${source.id}] to [${target.id}]\n`);
+            for (const key of keys.sort()) {
+                ui.log(`  ${key}`);
+            }
+            ui.log('');
+            return;
+        }
+        await writeTargetSecrets(await resolveStoreImplementation(runtime, target.id), envName, secrets);
+        const fingerprints = await recordCopiedFingerprints(runtime, { environment: envName, backend: target.id, secrets });
+        ui.success(`Pushed ${keys.length} secret(s) from [${source.id}] to [${target.id}] for ${envName}`);
+        if (fingerprints.failed > 0) {
+            ui.warn(`Could not record ${fingerprints.failed} drift fingerprint(s) (${fingerprints.reason}): ${fingerprints.message} ` +
+                '`vibes secrets check --drift` will not see them until they are re-recorded.');
+        }
+    }
+};
+//# sourceMappingURL=secrets.push.cli-command.impl.js.map

package/dist/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.push.cli-command.impl.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/push/secrets.push.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAsC,MAAM,oDAAoD,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAsC,MAAM,oDAAoD,CAAC;AAiB3H,OAAO,EACP,wCAAwC,EACxC,gBAAgB,EACf,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACP,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAC1B,WAAW,EACV,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACP,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EACjB,MAAM,0CAA0C,CAAC;AAElD,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,mFAAmF;AACnF,0CAA0C;AAC1C,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAErF,SAAS,eAAe,CAAC,UAA0C;IAClE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;AACvC,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAe,EAAE,IAAsB,EAAE,cAA8B;QACpF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEvG,8FAA8F;QAC9F,6FAA6F;QAC7F,+BAA+B;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAsC,CAAC;QAC3C,IAAI,SAAiB,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,SAAS;gBACR,OAAO,CAAC,SAAS,KAAK,SAAS;oBAC9B,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBACpE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACP,gGAAgG;YAChG,4FAA4F;YAC5F,MAAM,cAAc,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;YAC9F,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC;YAChC,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;QACD,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzG,gFAAgF;QAChF,IAAI,OAAgC,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/B,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;YAC9E,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,MAAM,wCAAwC,CAAC,OAAO,EAAE;gBAC3F,oBAAoB,EAAE,aAAa;aACnC,CAAC,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC3B,EAAE,CAAC,GAAG,CACL,iBAAiB,MAAM,CAAC,EAAE,UAAU,SAAS,kDAAkD,MAAM,CAAC,EAAE,UAAU,OAAO,0CAA0C,CACnK,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClH,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC/B,OAAO;QACR,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,MAAM,oBAAoB,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACjG,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACpB,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,OAAO;QACR,CAAC;QAED,MAAM,kBAAkB,CAAC,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpH,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,oBAAoB,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;QACnG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,IAAI,CACN,oBAAoB,YAAY,CAAC,MAAM,0BAA0B,YAAY,CAAC,MAAM,MAAM,YAAY,CAAC,OAAO,GAAG;gBACjH,6EAA6E,CAC7E,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.unset.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAiBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.unset.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,8CAA8C;IAC3D,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAE;KACzE;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,4CAA4C,EAAE;KACtF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type UnsetArgs, type UnsetOptionsInput } from "../../../../../schemas/cli/commands/store/unset.schema.ts";
+export { unsetArgsSchema, unsetOptionsSchema, type UnsetArgs, type UnsetOptionsInput } from "../../../../../schemas/cli/commands/store/unset.schema.ts";
+declare const _default: {
+    execute(args: UnsetArgs, opts: UnsetOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.unset.cli-command.impl.d.ts.map

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.unset.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAqC,KAAK,SAAS,EAAC,KAAK,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAYrJ,OAAO,EAAE,eAAe,EAAC,kBAAkB,EAAC,KAAK,SAAS,EAAC,KAAK,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;;kBAkBhI,SAAS,QAAQ,iBAAiB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADvG,wBA2BE"}

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.js

@@ -0,0 +1,47 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { assertSecretKey } from "../../../../../domain/kinds/secret-key.js";
+import { unsetArgsSchema, unsetOptionsSchema } from "../../../../../schemas/cli/commands/store/unset.schema.js";
+import { outcomeOf } from "../../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../../environment.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { driftFingerprintHome } from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { forgetFingerprint } from "../../../shared/stores/drift-forget.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore, typedStoreFailure } from "../../../shared/stores/store-selection.js";
+export { unsetArgsSchema, unsetOptionsSchema } from "../../../../../schemas/cli/commands/store/unset.schema.js";
+/**
+ * Drop the removed key's recorded fingerprint. The value is already gone from
+ * the store, so a drift index that cannot be updated is reported, not fatal.
+ */
+async function forgetRecordedFingerprint(runtime, ui, input) {
+    const forgotten = await outcomeOf(async () => forgetFingerprint({ ...input, home: await driftFingerprintHome(runtime) }));
+    if (forgotten.ok)
+        return;
+    const failure = CapabilityError.from(forgotten.failure);
+    ui.warn(`Removed ${input.key}, but could not update the drift fingerprint index (${failure.reason}): ${failure.message}`);
+}
+export default {
+    async execute(args, opts, commandContext) {
+        const { runtime } = commandContext;
+        const ui = await runtime.context('cli/ui');
+        const parsedArgs = parseCommandInput(unsetArgsSchema, args, 'unset');
+        const options = parseCommandInput(unsetOptionsSchema, opts, 'unset');
+        const key = parsedArgs.key;
+        if (!key) {
+            ui.error('Key name is required');
+            requestCLIExit(1);
+        }
+        // The key is checked before any store is resolved or touched.
+        assertSecretKey(key);
+        const descriptors = listStoreDescriptors(runtime);
+        const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+        const target = selectStore(descriptors, envTier, options.backend);
+        const impl = await resolveStoreImplementation(runtime, target.id);
+        const removed = await outcomeOf(() => impl.unset(envName, key));
+        if (!removed.ok)
+            throw typedStoreFailure(removed.failure, 'write', target.id);
+        await forgetRecordedFingerprint(runtime, ui, { environment: envName, backend: target.id, key });
+        ui.success(`Removed ${key} from [${target.id}] for environment: ${envName}`);
+    }
+};
+//# sourceMappingURL=secrets.unset.cli-command.impl.js.map

package/dist/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.unset.cli-command.impl.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/unset/secrets.unset.cli-command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAC,kBAAkB,EAAwC,MAAM,2DAA2D,CAAC;AACrJ,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EACP,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,eAAe,EAAC,kBAAkB,EAAwC,MAAM,2DAA2D,CAAC;AAErJ;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACvC,OAAmB,EACnB,EAAa,EACb,KAA4D;IAE5D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1H,IAAI,SAAS,CAAC,EAAE;QAAE,OAAO;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,GAAG,uDAAuD,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,IAAe,EAAE,IAAuB,EAAE,cAA8B;QACrF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACjC,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,8DAA8D;QAC9D,eAAe,CAAC,GAAG,CAAC,CAAC;QAErB,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE9E,MAAM,yBAAyB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhG,EAAE,CAAC,OAAO,CAAC,WAAW,GAAG,UAAU,MAAM,CAAC,EAAE,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint-input.d.ts

@@ -0,0 +1,23 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { mintArgsSchema, mintOptsSchema } from '../../../../schemas/cli/commands/mint.schema.ts';
+import type { CommandOutput } from '../../shared/output/command-output.ts';
+export declare function parseMintRequest(args: z.output<typeof mintArgsSchema>, opts: z.output<typeof mintOptsSchema>, out: CommandOutput, runtime: VibesRuntime): {
+    bearerKey: string;
+    environment: string | undefined;
+    backend: string | undefined;
+    clientIdKey: string;
+    clientSecretKey: string;
+    shownUrl: string;
+    clientName: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    scope: string;
+    mintUrl: {
+        ok: true;
+        url: URL;
+    };
+    timeout: number;
+    url: string;
+};
+//# sourceMappingURL=mint-input.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-input.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAC,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEhG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAG3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY;;;;;;;;;;;;;;;;;EA0DvJ"}

package/dist/surfaces/cli/commands/oauth-client/mint-input.js

@@ -0,0 +1,60 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { mintArgsSchema, mintOptsSchema } from "../../../../schemas/cli/commands/mint.schema.js";
+import { isDevelopmentHost, parseSecureUrl, redactUrlForDisplay } from "../../../../transport/secure-url.js";
+import { DEFAULT_SCOPE, KEY_PATTERN } from "./mint.command.impl.js";
+export function parseMintRequest(args, opts, out, runtime) {
+    const clientName = args.clientName ?? args.client_name;
+    const redirectUris = opts.redirectUri;
+    const postLogoutRedirectUris = opts.postLogoutRedirectUri;
+    const scope = opts.scope && opts.scope.length > 0 ? opts.scope : DEFAULT_SCOPE;
+    const url = opts.url;
+    const bearerKey = opts.bearer;
+    const clientIdKey = opts.clientIdKey;
+    const clientSecretKey = opts.clientSecretKey;
+    const environment = opts.environment;
+    const backend = opts.backend;
+    const timeout = opts.timeout;
+    if (!clientName) {
+        out.warn('Usage: vibes secrets oauth-client mint <client-name> --redirect-uri <uri>');
+        requestCLIExit(1);
+    }
+    if (redirectUris.length === 0) {
+        out.warn('secrets oauth-client mint: at least one --redirect-uri is required');
+        requestCLIExit(1);
+    }
+    // The endpoint and the store keys are the caller's own: this package ships
+    // no default mint service and no default key names.
+    if (!url || url.length === 0) {
+        out.warn('secrets oauth-client mint: --url is required');
+        requestCLIExit(1);
+    }
+    if (!bearerKey || bearerKey.length === 0) {
+        out.warn('secrets oauth-client mint: --bearer is required');
+        requestCLIExit(1);
+    }
+    if (!clientIdKey || clientIdKey.length === 0) {
+        out.warn('secrets oauth-client mint: --client-id-key is required');
+        requestCLIExit(1);
+    }
+    if (!clientSecretKey || clientSecretKey.length === 0) {
+        out.warn('secrets oauth-client mint: --client-secret-key is required');
+        requestCLIExit(1);
+    }
+    const shownUrl = redactUrlForDisplay(url);
+    for (const key of [bearerKey, clientIdKey, clientSecretKey]) {
+        if (!KEY_PATTERN.test(key)) {
+            out.warn(`Secret key must match pattern: ${KEY_PATTERN.source} (got ${key})`);
+            requestCLIExit(1);
+        }
+    }
+    // The bearer goes only to a parsed https URL (loopback http on a development host):
+    // checked before any secret is resolved or any request is built.
+    const mintUrl = parseSecureUrl(url, { allowLoopbackHttp: isDevelopmentHost(runtime) });
+    if (!mintUrl.ok) {
+        throw new CapabilityError('secrets oauth-client mint: --url must be https (or http to loopback on a development host); nothing was sent.', 'INVALID_INPUT', { reason: 'mint-url-invalid', retryable: false, details: { problem: mintUrl.problem } });
+    }
+    return { bearerKey, environment, backend, clientIdKey, clientSecretKey, shownUrl, clientName, redirectUris, postLogoutRedirectUris, scope, mintUrl, timeout, url };
+}
+//# sourceMappingURL=mint-input.js.map

package/dist/surfaces/cli/commands/oauth-client/mint-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-input.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAC,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAC,cAAc,EAAC,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAC,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEnE,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,IAAqC,EAAE,GAAkB,EAAE,OAAqB;IACvJ,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,MAAM,sBAAsB,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACtF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC/E,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACzD,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC5D,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACnE,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACvE,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,kCAAkC,WAAW,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC;YAC9E,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;IAED,oFAAoF;IACpF,iEAAiE;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CACxB,+GAA+G,EAC/G,eAAe,EACf,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CACvF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACpK,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint-response.d.ts

@@ -0,0 +1,14 @@
+export declare function fetchMintedPair(mintUrl: {
+    ok: true;
+    url: URL;
+}, bearerValue: string, body: {
+    client_name: string;
+    redirect_uris: string[];
+    post_logout_redirect_uris: string[];
+    scope: string;
+}, timeout: number, safe: (text: string) => string, url: string, fail: (message: string) => never, shownUrl: string): Promise<{
+    mintedClientId: string;
+    mintedClientSecret: string;
+    response: Response;
+}>;
+//# sourceMappingURL=mint-response.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-response.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-response.ts"],"names":[],"mappings":"AAGA,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;CAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IAAC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;CAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,QAAQ,EAAE,MAAM;;;;GAsCzT"}

package/dist/surfaces/cli/commands/oauth-client/mint-response.js

@@ -0,0 +1,30 @@
+import { scrubUrlFromText } from "../../../../transport/secure-url.js";
+import { tryFetchOAuthClient, tryParseOAuthResponse } from "./mint.command.impl.js";
+export async function fetchMintedPair(mintUrl, bearerValue, body, timeout, safe, url, fail, shownUrl) {
+    const fetchOutcome = await tryFetchOAuthClient(mintUrl.url, bearerValue, body, timeout);
+    if (!fetchOutcome.ok) {
+        const message = safe(scrubUrlFromText(fetchOutcome.error instanceof Error ? fetchOutcome.error.message : String(fetchOutcome.error), url));
+        fail(`secrets oauth-client mint: POST ${shownUrl} failed: ${message}`);
+    }
+    const response = fetchOutcome.response;
+    const rawText = fetchOutcome.text;
+    if (!response.ok) {
+        // Redact the whole text (body and status line) BEFORE it is cut to 200 characters: a
+        // cut inside the bearer would leave a prefix no redaction recognizes.
+        const safeSnippet = scrubUrlFromText(safe(rawText), url).replace(/\s+/g, ' ').slice(0, 200);
+        fail(safe(`secrets oauth-client mint: POST ${shownUrl} -> HTTP ${response.status} ${response.statusText}`) +
+            (safeSnippet ? `: ${safeSnippet}` : ''));
+    }
+    const parsedOutcome = tryParseOAuthResponse(rawText);
+    if (!parsedOutcome.ok) {
+        fail('secrets oauth-client mint: response was not JSON');
+    }
+    const parsed = parsedOutcome.data;
+    const mintedClientId = parsed.client_id ?? parsed.clientId;
+    const mintedClientSecret = parsed.client_secret ?? parsed.clientSecret;
+    if (!mintedClientId || !mintedClientSecret) {
+        fail('secrets oauth-client mint: response missing client_id/client_secret (or clientId/clientSecret)');
+    }
+    return { mintedClientId, mintedClientSecret, response };
+}
+//# sourceMappingURL=mint-response.js.map