@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/cli/commands/request/request-http.js

@@ -0,0 +1,78 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { redactionForms } from "../../../../exec/redactor.js";
+import { parseSecureUrl } from "../../../../transport/secure-url.js";
+/** Same-origin redirects followed before the request is refused. */
+export const REQUEST_MAX_REDIRECTS = 5;
+/**
+ * One request, following only same-origin redirects and only up to
+ * {@link REQUEST_MAX_REDIRECTS}. A redirect to another origin (or scheme) is
+ * refused before it is requested, so no header travels with it.
+ */
+export async function fetchSameOrigin(first, init, policy) {
+    let current = first;
+    let method = init.method ?? 'GET';
+    let body = init.body;
+    let headers = new Headers(init.headers);
+    for (let hop = 0; hop <= REQUEST_MAX_REDIRECTS; hop += 1) {
+        let response;
+        try {
+            // This command IS the generic HTTP probe primitive — the URL is
+            // caller-supplied (any https host, incl. a development host's loopback
+            // server), so there is no product runtime client to route through.
+            // vibes-runtime-fetch-allow
+            response = await globalThis.fetch(current.href, { ...init, method, headers, body, redirect: 'manual' });
+        }
+        catch (error) {
+            return { kind: 'transport-failure', error };
+        }
+        const location = response.headers.get('location');
+        if (response.status < 300 || response.status >= 400 || location === null)
+            return { kind: 'response', response };
+        await response.body?.cancel();
+        const next = URL.canParse(location, current.href) ? new URL(location, current.href) : undefined;
+        const checked = next ? parseSecureUrl(next.href, policy) : undefined;
+        if (!checked?.ok || checked.url.origin !== first.origin) {
+            return {
+                kind: 'refused',
+                refusal: new CapabilityError('secrets request: the server redirected to another origin; the credential is not forwarded.', 'PERMISSION_DENIED', { reason: 'request-redirect-cross-origin', retryable: false, details: { status: response.status } })
+            };
+        }
+        current = checked.url;
+        // fetch's own rule: 303, and 301/302 after POST, become a bodiless GET.
+        if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST')) {
+            method = 'GET';
+            body = undefined;
+            headers = new Headers(headers);
+            headers.delete('content-type');
+        }
+    }
+    return {
+        kind: 'refused',
+        refusal: new CapabilityError(`secrets request: more than ${REQUEST_MAX_REDIRECTS} redirects.`, 'UNAVAILABLE', { reason: 'request-redirect-limit', retryable: false })
+    };
+}
+/** The shortest cut prefix of a value that is trimmed: a shorter fragment is not a recognizable part of a secret and trimming it would only eat innocent output. */
+const MIN_TRIMMED_PREFIX_LENGTH = 4;
+/**
+ * When a truncated body ends part-way through a secret value, drop that partial
+ * tail: the redactor matches whole values, so a cut prefix would print. Each form
+ * the redactor recognizes (the value, and its base64, base64url, URL, form and hex
+ * encodings) is trimmed by its exact prefixes, from `MIN_TRIMMED_PREFIX_LENGTH`
+ * characters (or all but one character of a shorter form).
+ */
+export function trimPartialSecretTail(text, values) {
+    let out = text;
+    for (const value of Object.values(values)) {
+        for (const form of redactionForms(value)) {
+            const shortest = Math.min(MIN_TRIMMED_PREFIX_LENGTH, form.length - 1);
+            for (let length = Math.min(form.length - 1, out.length); length >= shortest && length >= 1; length -= 1) {
+                if (out.endsWith(form.slice(0, length))) {
+                    out = out.slice(0, out.length - length);
+                    break;
+                }
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=request-http.js.map

package/dist/surfaces/cli/commands/request/request-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-http.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAMvC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,KAAU,EACV,IAAiB,EACjB,MAAsC;IAEtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IAClC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAC,GAAG,IAAI,qBAAqB,EAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,gEAAgE;YAChE,uEAAuE;YACvE,mEAAmE;YACnE,4BAA4B;YAC5B,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAChH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI,eAAe,CAC3B,4FAA4F,EAC5F,mBAAmB,EACnB,EAAE,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CACnG;aACD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QACtB,wEAAwE;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC5G,MAAM,GAAG,KAAK,CAAC;YACf,IAAI,GAAG,SAAS,CAAC;YACjB,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,OAAO;QACN,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI,eAAe,CAC3B,8BAA8B,qBAAqB,aAAa,EAChE,aAAa,EACb,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD;KACD,CAAC;AACH,CAAC;AAED,oKAAoK;AACpK,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAA8B;IACjF,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtE,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAC,MAAM,IAAI,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;oBACxC,MAAM;gBACP,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/surfaces/cli/commands/request/request-input.d.ts

@@ -0,0 +1,12 @@
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import type { RequestOptions } from '../../../../schemas/cli/request.schema.ts';
+/** The largest `--body-file` read, in bytes. */
+export declare const REQUEST_MAX_BODY_FILE_BYTES: number;
+export declare function urlInvalid(problem: string): CapabilityError;
+export declare function requestSecretKeys(options: RequestOptions): Set<string>;
+export declare function prepareRequest(runtime: RuntimeRef, options: RequestOptions, values: Record<string, string>): Promise<{
+    headers: Headers;
+    body: string | undefined;
+    method: string;
+}>;
+//# sourceMappingURL=request-input.d.ts.map

package/dist/surfaces/cli/commands/request/request-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-input.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAIhF,gDAAgD;AAChD,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAM5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAM3D;AAyBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAOtE;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;GA8ChH"}

package/dist/surfaces/cli/commands/request/request-input.js

@@ -0,0 +1,93 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { setHeaderValue } from "../../../../transport/header-value.js";
+import { readHostTextFile } from "../../../../transport/host-file.js";
+/** The largest `--body-file` read, in bytes. */
+export const REQUEST_MAX_BODY_FILE_BYTES = 10 * 1024 * 1024;
+const TEMPLATE = /\{\{\s*([_A-Z0-9]+)\s*\}\}/g;
+/** An RFC 9110 token: a header name or a method. */
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+export function urlInvalid(problem) {
+    return new CapabilityError('secrets request: the URL must be https (or http to loopback on a development host); nothing was sent.', 'INVALID_INPUT', { reason: 'request-url-invalid', retryable: false, details: { problem } });
+}
+function headerInvalid(option, index, problem, cause) {
+    // The spec is never quoted: it may hold a credential typed inline.
+    return new CapabilityError(`secrets request: ${option} #${index + 1} is not a valid header (${problem}).`, 'INVALID_INPUT', {
+        reason: 'request-header-invalid',
+        retryable: false,
+        details: cause === undefined ? { option, index, problem } : { option, index, problem, rejection: cause }
+    });
+}
+/**
+ * Set one header after validating its name and value; a failure never quotes
+ * either. A value is refused (control character, or a code unit above U+00FF
+ * that no header can carry) before `Headers` sees it, and a throw from
+ * `Headers` itself is mapped to the same refusal without its message, which
+ * quotes the value.
+ */
+function setHeader(headers, name, value, option, index) {
+    if (!TOKEN.test(name))
+        throw headerInvalid(option, index, 'name');
+    const outcome = setHeaderValue(headers, name, value);
+    // Only the problem is reported: a `value-rejected` failure's own message quotes the value.
+    if (!outcome.ok)
+        throw headerInvalid(option, index, 'value', outcome.problem);
+}
+export function requestSecretKeys(options) {
+    const keys = new Set();
+    if (options.bearer)
+        keys.add(options.bearer);
+    for (const spec of options.secretHeader) {
+        for (const match of spec.matchAll(TEMPLATE))
+            keys.add(match[1]);
+    }
+    return keys;
+}
+export async function prepareRequest(runtime, options, values) {
+    // Build headers. Secret values exist only here and in the fetch call.
+    const headers = new Headers();
+    options.header.forEach((spec, index) => {
+        const idx = spec.indexOf(':');
+        if (idx < 1)
+            throw headerInvalid('--header', index, "expected 'Name: value'");
+        setHeader(headers, spec.slice(0, idx).trim(), spec.slice(idx + 1).trim(), '--header', index);
+    });
+    options.secretHeader.forEach((spec, index) => {
+        const idx = spec.indexOf(':');
+        if (idx < 1)
+            throw headerInvalid('--secret-header', index, "expected 'Name: {{KEY}}'");
+        const value = spec
+            .slice(idx + 1)
+            .trim()
+            .replace(TEMPLATE, (_, key) => values[key] ?? '');
+        setHeader(headers, spec.slice(0, idx).trim(), value, '--secret-header', index);
+    });
+    if (options.bearer) {
+        setHeader(headers, 'authorization', `Bearer ${values[options.bearer]}`, '--bearer', 0);
+    }
+    let body;
+    if (options.jsonBody !== undefined) {
+        headers.set('content-type', 'application/json');
+        body = options.jsonBody;
+    }
+    else if (options.bodyFile !== undefined) {
+        body = await readHostTextFile(runtime, options.bodyFile, { label: 'request-body-file' }, REQUEST_MAX_BODY_FILE_BYTES);
+    }
+    else {
+        body = options.body;
+    }
+    const method = options.method ?? (body !== undefined ? 'POST' : 'GET');
+    if (!TOKEN.test(method)) {
+        throw new CapabilityError('secrets request: the method is not an HTTP method token.', 'INVALID_INPUT', {
+            reason: 'request-method-invalid',
+            retryable: false
+        });
+    }
+    if (body !== undefined && (method === 'GET' || method === 'HEAD')) {
+        throw new CapabilityError(`secrets request: a ${method} request cannot carry a body.`, 'INVALID_INPUT', {
+            reason: 'request-body-not-allowed',
+            retryable: false
+        });
+    }
+    return { headers, body, method };
+}
+//# sourceMappingURL=request-input.js.map

package/dist/surfaces/cli/commands/request/request-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-input.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,gDAAgD;AAChD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,oDAAoD;AACpD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAE9C,MAAM,UAAU,UAAU,CAAC,OAAe;IACzC,OAAO,IAAI,eAAe,CACzB,uGAAuG,EACvG,eAAe,EACf,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe,EAAE,KAAc;IACpF,mEAAmE;IACnE,OAAO,IAAI,eAAe,CAAC,oBAAoB,MAAM,KAAK,KAAK,GAAG,CAAC,2BAA2B,OAAO,IAAI,EAAE,eAAe,EAAE;QAC3H,MAAM,EAAE,wBAAwB;QAChC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;KACxG,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa;IAC9F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,2FAA2F;IAC3F,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAmB,EAAE,OAAuB,EAAE,MAA8B;IAChH,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAC9E,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,aAAa,CAAC,iBAAiB,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI;aAChB,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;aACd,IAAI,EAAE;aACN,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACvH,CAAC;SAAM,CAAC;QACP,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,eAAe,EAAE;YACtG,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CAAC,sBAAsB,MAAM,+BAA+B,EAAE,eAAe,EAAE;YACvG,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAGD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/surfaces/cli/commands/request/request.command.descriptor.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `vibes secrets request <url>` — make an HTTP request with a secret
+ * injected into the Authorization header (or a templated header), without
+ * the value ever entering the terminal, shell history, or an agent
+ * transcript.
+ *
+ * The canonical way to smoke-test token-gated internal endpoints
+ * (e.g. `/api/internal/*` behind VIBES_INTERNAL_SERVICE_TOKEN). Replaces
+ * the banned `$(vibes secrets reveal KEY)` → curl pattern. Response status
+ * and body are printed with every resolved value redacted.
+ */
+export declare const requestCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "secrets.request";
+    readonly name: "request";
+    readonly description: "HTTP request with a secret injected as a bearer/header (value never printed; response redacted)";
+    readonly group: "secrets";
+    readonly arguments: [{
+        readonly name: "url";
+        readonly description: "Request URL";
+        readonly required: true;
+    }];
+    readonly options: [{
+        readonly flags: "--bearer <key>";
+        readonly description: "Secret key whose value is sent as `Authorization: Bearer <value>`";
+    }, {
+        readonly flags: "--secret-header <spec...>";
+        readonly description: "Header with a secret template, e.g. 'X-Api-Key: {{MY_KEY}}' (repeatable)";
+    }, {
+        readonly flags: "--header <spec...>";
+        readonly description: "Plain header (repeatable, no secrets)";
+    }, {
+        readonly flags: "-X, --method <method>";
+        readonly description: "HTTP method (default: GET; POST with a body)";
+    }, {
+        readonly flags: "--json-body <body>";
+        readonly description: "JSON body (sets Content-Type: application/json)";
+    }, {
+        readonly flags: "--body <raw>";
+        readonly description: "Raw request body";
+    }, {
+        readonly flags: "--body-file <path>";
+        readonly description: "Read the request body from a file";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Target environment (default: current)";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Read from this one store (exactly one store answers each key; a comma chain or @environment pin is refused, use --environment for another tier)";
+    }, {
+        readonly flags: "--timeout <ms>";
+        readonly description: "Request timeout in milliseconds (default: 30000)";
+    }, {
+        readonly flags: "--include";
+        readonly description: "Print response headers before the body";
+    }, {
+        readonly flags: "--max-body <bytes>";
+        readonly description: "Truncate printed body (default: 65536)";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 23;
+    readonly examples: [{
+        readonly command: "vibes secrets request http://localhost:5173/api/internal/ocr --bearer VIBES_INTERNAL_SERVICE_TOKEN -X POST --json-body '{\"image\":\"...\"}'";
+        readonly description: "Probe a token-gated internal endpoint; the token never leaves the process";
+        readonly expectExit: 0;
+    }];
+};
+export default requestCommandDescriptor;
+//# sourceMappingURL=request.command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/request/request.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDnC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/surfaces/cli/commands/request/request.command.descriptor.js

@@ -0,0 +1,61 @@
+/**
+ * `vibes secrets request <url>` — make an HTTP request with a secret
+ * injected into the Authorization header (or a templated header), without
+ * the value ever entering the terminal, shell history, or an agent
+ * transcript.
+ *
+ * The canonical way to smoke-test token-gated internal endpoints
+ * (e.g. `/api/internal/*` behind VIBES_INTERNAL_SERVICE_TOKEN). Replaces
+ * the banned `$(vibes secrets reveal KEY)` → curl pattern. Response status
+ * and body are printed with every resolved value redacted.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const requestCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'secrets.request',
+    name: 'request',
+    description: 'HTTP request with a secret injected as a bearer/header (value never printed; response redacted)',
+    group: 'secrets',
+    arguments: [{ name: 'url', description: 'Request URL', required: true }],
+    options: [
+        {
+            flags: '--bearer <key>',
+            description: 'Secret key whose value is sent as `Authorization: Bearer <value>`'
+        },
+        {
+            flags: '--secret-header <spec...>',
+            description: "Header with a secret template, e.g. 'X-Api-Key: {{MY_KEY}}' (repeatable)"
+        },
+        { flags: '--header <spec...>', description: 'Plain header (repeatable, no secrets)' },
+        { flags: '-X, --method <method>', description: 'HTTP method (default: GET; POST with a body)' },
+        {
+            // NOT `--json` — that is the global `--format json` alias in the vibes
+            // CLI surface (register-commands.ts) and would parse as a boolean.
+            flags: '--json-body <body>',
+            description: 'JSON body (sets Content-Type: application/json)'
+        },
+        { flags: '--body <raw>', description: 'Raw request body' },
+        { flags: '--body-file <path>', description: 'Read the request body from a file' },
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        {
+            flags: '--backend <id>',
+            description: 'Read from this one store (exactly one store answers each key; a comma chain or @environment pin is refused, use --environment for another tier)'
+        },
+        { flags: '--timeout <ms>', description: 'Request timeout in milliseconds (default: 30000)' },
+        { flags: '--include', description: 'Print response headers before the body' },
+        { flags: '--max-body <bytes>', description: 'Truncate printed body (default: 65536)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 23,
+    examples: [
+        {
+            command: "vibes secrets request http://localhost:5173/api/internal/ocr --bearer VIBES_INTERNAL_SERVICE_TOKEN -X POST --json-body '{\"image\":\"...\"}'",
+            description: 'Probe a token-gated internal endpoint; the token never leaves the process',
+            expectExit: 0
+        }
+    ]
+});
+export default requestCommandDescriptor;
+//# sourceMappingURL=request.command.descriptor.js.map

package/dist/surfaces/cli/commands/request/request.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.command.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;IAC1D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,SAAS;IACf,WAAW,EACV,iGAAiG;IAClG,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxE,OAAO,EAAE;QACR;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,mEAAmE;SAChF;QACD;YACC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,0EAA0E;SACvF;QACD,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACrF,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,8CAA8C,EAAE;QAC/F;YACC,uEAAuE;YACvE,mEAAmE;YACnE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,iDAAiD;SAC9D;QACD,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE;QAC1D,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACjF,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACV,iJAAiJ;SAClJ;QACD,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,kDAAkD,EAAE;QAC5F,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,wCAAwC,EAAE;QAC7E,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,wCAAwC,EAAE;KACtF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EACN,8IAA8I;YAC/I,WAAW,EAAE,2EAA2E;YACxF,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/surfaces/cli/commands/request/request.command.impl.d.ts

@@ -0,0 +1,11 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type RequestArgs, type RequestOptionsInput } from "../../../../schemas/cli/request.schema.ts";
+export { REQUEST_MAX_BODY_CEILING, REQUEST_MAX_TIMEOUT_MS, requestArgsSchema, requestOptionsSchema, stringOrArraySchema, type RequestArgs, type RequestOptionsInput } from "../../../../schemas/cli/request.schema.ts";
+export { REQUEST_MAX_REDIRECTS } from './request-http.ts';
+export { REQUEST_MAX_BODY_FILE_BYTES } from './request-input.ts';
+export declare function execute(args: RequestArgs, opts: RequestOptionsInput, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=request.command.impl.d.ts.map

package/dist/surfaces/cli/commands/request/request.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.command.impl.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAyC,KAAK,WAAW,EAAC,KAAK,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAa7I,OAAO,EAAE,wBAAwB,EAAC,sBAAsB,EAAC,iBAAiB,EAAC,oBAAoB,EAAC,mBAAmB,EAAC,KAAK,WAAW,EAAC,KAAK,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACjN,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAIjE,wBAAsB,OAAO,CAC5B,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAyIf;;;;AAED,wBAA2B"}

package/dist/surfaces/cli/commands/request/request.command.impl.js

@@ -0,0 +1,135 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { requestArgsSchema, requestOptionsSchema } from "../../../../schemas/cli/request.schema.js";
+import { isDeadlineFailure, readBoundedText } from "../../../../transport/bounded-body.js";
+import { isDevelopmentHost, parseSecureUrl, redactUrlForDisplay, scrubUrlFromText } from "../../../../transport/secure-url.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { parseCommandInput } from "../../shared/parse-options.js";
+import { redactForPrint, resolveSecretsForLeverage, writeLeverageAudit, writeOnlyRefusal } from "../../shared/stores/leverage-shared.js";
+import { fetchSameOrigin, trimPartialSecretTail } from "./request-http.js";
+import { prepareRequest, requestSecretKeys, urlInvalid } from "./request-input.js";
+export { REQUEST_MAX_BODY_CEILING, REQUEST_MAX_TIMEOUT_MS, requestArgsSchema, requestOptionsSchema, stringOrArraySchema } from "../../../../schemas/cli/request.schema.js";
+export { REQUEST_MAX_REDIRECTS } from "./request-http.js";
+export { REQUEST_MAX_BODY_FILE_BYTES } from "./request-input.js";
+const logger = getLogger('secrets.request');
+export async function execute(args, opts, context) {
+    const out = await openCommandOutput(context.runtime);
+    const parsedArgs = parseCommandInput(requestArgsSchema, args, 'request');
+    const options = parseCommandInput(requestOptionsSchema, opts, 'request');
+    const url = parsedArgs.url;
+    if (!url) {
+        out.warn('Usage: vibes secrets request <url> [--bearer KEY] [--secret-header ...]');
+        requestCLIExit(1);
+    }
+    // The target is checked before any secret is resolved or any request built.
+    const policy = { allowLoopbackHttp: isDevelopmentHost(context.runtime) };
+    const target = parseSecureUrl(url, policy);
+    if (!target.ok)
+        throw urlInvalid(target.problem);
+    const shownUrl = redactUrlForDisplay(url);
+    // Collect every secret key referenced by --bearer and {{KEY}} templates.
+    const keys = requestSecretKeys(options);
+    if (keys.size === 0) {
+        out.warn('secrets request: nothing to inject — pass --bearer <KEY> or --secret-header with a {{KEY}} template.');
+        requestCLIExit(1);
+    }
+    // A resolution failure is a typed CapabilityError; the CLI surface renders it.
+    const resolved = await resolveSecretsForLeverage(context.runtime, [...keys], options);
+    const audit = (outcome, auditTarget, withHops, reason) => writeLeverageAudit(out, {
+        action: 'secrets.request',
+        keys: [...keys],
+        environment: resolved.environment,
+        backend: resolved.backendId,
+        target: auditTarget,
+        outcome,
+        reason,
+        hops: withHops ? resolved.hops : undefined
+    });
+    // Everything printed after the credentials resolve is redacted, error text included.
+    const safe = (text) => redactForPrint(text, resolved.values);
+    const fail = (message) => {
+        out.warn(message);
+        audit('failure', shownUrl, true);
+        requestCLIExit(1);
+    };
+    if (resolved.unreadable.length > 0) {
+        audit('failure', shownUrl, true);
+        throw writeOnlyRefusal('secrets request', resolved);
+    }
+    if (resolved.missing.length > 0) {
+        fail(`secrets request: missing in environment "${resolved.environment}": ${resolved.missing.join(', ')}`);
+    }
+    let prepared;
+    try {
+        prepared = await prepareRequest(context.runtime, options, resolved.values);
+    }
+    catch (error) {
+        audit('failure', shownUrl, true);
+        throw error;
+    }
+    const { headers, body, method } = prepared;
+    const started = Date.now();
+    const fetchInit = {
+        method,
+        headers,
+        // One deadline for the whole exchange: connect, redirects and the body read.
+        signal: AbortSignal.timeout(options.timeout)
+    };
+    if (body !== undefined) {
+        fetchInit.body = body;
+    }
+    const fetchOutcome = await fetchSameOrigin(target.url, fetchInit, policy);
+    if (fetchOutcome.kind === 'refused') {
+        audit('failure', `${method} ${shownUrl}`, false);
+        throw fetchOutcome.refusal;
+    }
+    if (fetchOutcome.kind === 'transport-failure') {
+        const err = fetchOutcome.error;
+        const message = safe(scrubUrlFromText(err instanceof Error ? err.message : String(err), url));
+        logger.warn('secrets request fetch failed', { method, url: shownUrl, error: message });
+        out.warn(`secrets request: ${method} ${shownUrl} failed: ${message}`);
+        audit('failure', shownUrl, false);
+        requestCLIExit(1);
+    }
+    const response = fetchOutcome.response;
+    const answered = `${method} ${shownUrl} -> ${response.status}`;
+    // The body is read BEFORE the exchange is audited as a success or anything is printed:
+    // a body that stalls past the deadline is a failure, never a success followed by a throw.
+    let read;
+    try {
+        read = await readBoundedText(response, options.maxBody);
+    }
+    catch (thrown) {
+        // Past the one deadline: `UNAVAILABLE request-timeout`; any other read failure:
+        // `request-body-unreadable`. Both retryable, fixed message text; the read failure rides as
+        // the cause (a body read echoes neither the URL nor a header value).
+        const failure = CaughtFailureSchema.parse(thrown);
+        const deadline = isDeadlineFailure(failure);
+        audit('failure', answered, true, deadline ? 'request-timeout' : 'request-body-unreadable');
+        throw new CapabilityError(deadline
+            ? `secrets request: the response body did not finish within ${options.timeout} ms.`
+            : 'secrets request: the response body could not be read.', 'UNAVAILABLE', {
+            reason: deadline ? 'request-timeout' : 'request-body-unreadable',
+            retryable: true,
+            details: { timeoutMs: options.timeout },
+            cause: failure
+        });
+    }
+    audit('success', answered, true);
+    out.line(safe(`HTTP ${response.status} ${response.statusText} (${Date.now() - started}ms)`));
+    if (options.include) {
+        for (const [name, value] of response.headers.entries()) {
+            out.line(safe(`${name}: ${value}`));
+        }
+        out.line();
+    }
+    const text = read.truncated ? trimPartialSecretTail(read.text, resolved.values) : read.text;
+    out.line(safe(text.replace(/\n$/, '')));
+    if (read.truncated) {
+        out.warn(`[secrets request] body truncated at ${options.maxBody} bytes`);
+    }
+    requestCLIExit(response.status >= 500 ? 2 : 0);
+}
+export default { execute };
+//# sourceMappingURL=request.command.impl.js.map

package/dist/surfaces/cli/commands/request/request.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAC,oBAAoB,EAA4C,MAAM,2CAA2C,CAAC;AAC7I,OAAO,EAAE,iBAAiB,EAAC,eAAe,EAAmB,MAAM,uCAAuC,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAC,cAAc,EAAC,mBAAmB,EAAC,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5H,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EACf,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,eAAe,EAAC,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAC,iBAAiB,EAAC,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAC,sBAAsB,EAAC,iBAAiB,EAAC,oBAAoB,EAAC,mBAAmB,EAA4C,MAAM,2CAA2C,CAAC;AACjN,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAiB,EACjB,IAAyB,EACzB,OAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACpF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAE1C,yEAAyE;IACzE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACP,sGAAsG,CACtG,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAG,CAAC,OAA8B,EAAE,WAAmB,EAAE,QAAiB,EAAE,MAAe,EAAQ,EAAE,CAC/G,kBAAkB,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,QAAQ,CAAC,SAAS;QAC3B,MAAM,EAAE,WAAW;QACnB,OAAO;QACP,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1C,CAAC,CAAC;IAEJ,qFAAqF;IACrF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACvC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,gBAAgB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CACH,4CAA4C,QAAQ,CAAC,WAAW,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC;IACb,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAgB;QAC9B,MAAM;QACN,OAAO;QACP,6EAA6E;QAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KAC5C,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,oBAAoB,MAAM,IAAI,QAAQ,YAAY,OAAO,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,QAAQ,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;IAE/D,uFAAuF;IACvF,0FAA0F;IAC1F,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,gFAAgF;QAChF,2FAA2F;QAC3F,qEAAqE;QACrE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC3F,MAAM,IAAI,eAAe,CACxB,QAAQ;YACP,CAAC,CAAC,4DAA4D,OAAO,CAAC,OAAO,MAAM;YACnF,CAAC,CAAC,uDAAuD,EAC1D,aAAa,EACb;YACC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB;YAChE,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;YACvC,KAAK,EAAE,OAAO;SACd,CACD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC5F,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,OAAO,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,cAAc,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/commands/store/reveal-audit.d.ts

@@ -0,0 +1,18 @@
+import type { SecretsStoreImplementation } from '../../../../domain/kinds/store.interface.ts';
+import { type CommandOutput } from '../../shared/output/command-output.ts';
+export declare const logger: import("@vibesdotdev/logging").LoggerImplementation;
+export declare function emitAudit(out: CommandOutput, record: {
+    key: string;
+    environment: string;
+    backend: string;
+    outcome: 'success' | 'failure';
+    reason?: 'not_set' | 'value_unreadable' | 'refused_noninteractive';
+}): void;
+export declare function tryCheckKeyInListing(impl: SecretsStoreImplementation, envName: string, key: string): Promise<{
+    ok: true;
+    exists: boolean;
+} | {
+    ok: false;
+    error: unknown;
+}>;
+//# sourceMappingURL=reveal-audit.d.ts.map

package/dist/surfaces/cli/commands/store/reveal-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal-audit.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal-audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAE3E,eAAO,MAAM,MAAM,qDAA8B,CAAC;AAElD,wBAAgB,SAAS,CACxB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE;IACP,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,SAAS,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;CACnE,GACC,IAAI,CAUN;AAED,wBAAsB,oBAAoB,CACzC,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAOxE"}

package/dist/surfaces/cli/commands/store/reveal-audit.js

@@ -0,0 +1,24 @@
+import { getLogger } from '@vibesdotdev/logging';
+import {} from "../../shared/output/command-output.js";
+export const logger = getLogger('secrets.reveal');
+export function emitAudit(out, record) {
+    const payload = {
+        id: crypto.randomUUID(),
+        timestamp: new Date().toISOString(),
+        category: 'data_access',
+        severity: 'high',
+        action: 'secrets.reveal',
+        ...record
+    };
+    out.warn(`[AUDIT] ${JSON.stringify(payload)}`);
+}
+export async function tryCheckKeyInListing(impl, envName, key) {
+    try {
+        const entries = await impl.list(envName);
+        return { ok: true, exists: entries.some((entry) => entry.key === key) };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+//# sourceMappingURL=reveal-audit.js.map

package/dist/surfaces/cli/commands/store/reveal-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal-audit.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAsB,MAAM,uCAAuC,CAAC;AAE3E,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAElD,MAAM,UAAU,SAAS,CACxB,GAAkB,EAClB,MAMC;IAED,MAAM,OAAO,GAAG;QACf,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,gBAAgB;QACxB,GAAG,MAAM;KACT,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,IAAgC,EAChC,OAAe,EACf,GAAW;IAEX,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC"}

package/dist/surfaces/cli/commands/store/reveal.command.descriptor.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `vibes secrets reveal <key>` — reveal a single secret value.
+ *
+ * Per the working-memory note, `vibes secrets export` is broken and the
+ * canonical one-off access path is `vibes secrets reveal KEY --force`.
+ * The value is written to STDOUT exactly once so scripts can capture it
+ * via `$(vibes secrets reveal KEY --force)`; notice + audit messaging
+ * stays on STDERR.
+ */
+export declare const revealCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "secrets.reveal";
+    readonly name: "reveal";
+    readonly description: "Reveal a single secret value to STDOUT (audited)";
+    readonly group: "secrets";
+    readonly arguments: [{
+        readonly name: "key";
+        readonly description: "Secret key to reveal";
+        readonly required: true;
+    }];
+    readonly options: [{
+        readonly flags: "--environment <name>";
+        readonly description: "Target environment (default: current)";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Read from a specific backend";
+    }, {
+        readonly flags: "--force";
+        readonly description: "Skip the confirmation prompt; the only override (required without a terminal)";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 20;
+    readonly examples: [{
+        readonly command: "vibes secrets reveal VIBES_AUTH_SECRET --force";
+        readonly description: "Print the value of VIBES_AUTH_SECRET (no prompt)";
+        readonly expectExit: 0;
+    }];
+};
+export default revealCommandDescriptor;
+//# sourceMappingURL=reveal.command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/store/reveal.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyBlC,CAAC;AAEH,eAAe,uBAAuB,CAAC"}