@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/cli/commands/store/set.command.descriptor.js

@@ -0,0 +1,51 @@
+/**
+ * `vibes secrets set <key> [-]` — set/update a secret.
+ *
+ * A TTY uses a hidden prompt. Passing `-` or `--stdin` reads STDIN instead.
+ * Literal positional values are rejected to avoid shell-history leaks.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const setCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'secrets.set',
+    name: 'set',
+    description: 'Set or update a secret from a hidden TTY prompt or stdin',
+    group: 'secrets',
+    arguments: [
+        {
+            name: 'key',
+            description: "Secret key (1-128 characters; no control character, '/' or '\\', never __proto__, constructor or prototype)",
+            required: true
+        },
+        {
+            name: 'value',
+            description: "STDIN marker '-' only; literal values are rejected",
+            required: false
+        }
+    ],
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--backend <id>', description: 'Target backend (default: highest-priority local backend for the tier)' },
+        { flags: '--stdin', description: 'Read the value from STDIN (skip the hidden prompt)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 30,
+    examples: [
+        {
+            command: 'vibes secrets set MY_KEY',
+            description: 'Hidden prompt on a TTY (value is not echoed or stored in shell history)'
+        },
+        {
+            command: 'printf %s "$SECRET_VALUE" | vibes secrets set MY_KEY --stdin',
+            description: 'Set MY_KEY from stdin'
+        },
+        {
+            command: 'echo "secret" | vibes secrets set MY_KEY -',
+            description: 'Pipe a value from STDIN'
+        }
+    ]
+});
+export default setCommandDescriptor;
+//# sourceMappingURL=set.command.descriptor.js.map

package/dist/surfaces/cli/commands/store/set.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.command.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;IACtD,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,0DAA0D;IACvE,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,6GAA6G;YAC1H,QAAQ,EAAE,IAAI;SACd;QACD;YACC,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,KAAK;SACf;KACD;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,uEAAuE,EAAE;QACjH,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,oDAAoD,EAAE;KACvF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,0BAA0B;YACnC,WAAW,EAAE,yEAAyE;SACtF;QACD;YACC,OAAO,EAAE,8DAA8D;YACvE,WAAW,EAAE,uBAAuB;SACpC;QACD;YACC,OAAO,EAAE,4CAA4C;YACrD,WAAW,EAAE,yBAAyB;SACtC;KACD;CACD,CAAC,CAAC;AAEH,eAAe,oBAAoB,CAAC"}

package/dist/surfaces/cli/commands/store/set.command.impl.d.ts

@@ -0,0 +1,10 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type SetArgs, type SetOptions } from '../../../../schemas/cli/commands/store/set.schema.ts';
+export { type SetArgs, type SetOptions } from "../../../../schemas/cli/commands/store/set.schema.ts";
+export { SECRET_STDIN_MAX_BYTES, readPipedValue, readSecretValue } from "./set-input.ts";
+export declare function execute(rawArgs: SetArgs, rawOpts: SetOptions, commandContext: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=set.command.impl.d.ts.map

package/dist/surfaces/cli/commands/store/set.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.command.impl.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAiC,KAAK,OAAO,EAAC,KAAK,UAAU,EAAE,MAAM,sDAAsD,CAAC;AAGnI,OAAO,EAAE,KAAK,OAAO,EAAC,KAAK,UAAU,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAC,cAAc,EAAC,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA+CvF,wBAAsB,OAAO,CAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC,CAyEf;;;;AAED,wBAA2B"}

package/dist/surfaces/cli/commands/store/set.command.impl.js

@@ -0,0 +1,100 @@
+import { setArgsSchema, setOptionsSchema } from "../../../../schemas/cli/commands/store/set.schema.js";
+import { parseCommandInput } from "../../shared/parse-options.js";
+import { readSecretValue } from "./set-input.js";
+export {} from "../../../../schemas/cli/commands/store/set.schema.js";
+export { SECRET_STDIN_MAX_BYTES, readPipedValue, readSecretValue } from "./set-input.js";
+/**
+ * `vibes secrets set <key> [-]` implementation.
+ *
+ * Security contract:
+ *   - The value is NEVER passed through console.log or any logger, and is
+ *     never echoed. Confirmation reports the KEY, never the value.
+ *   - A TTY that supports raw mode uses a hidden prompt so the value is not
+ *     in shell history. `--stdin` / `-` / a pipe reads stdin until EOF.
+ *   - Default routing restricts to local-tier backends; remote backends
+ *     (vault, cloudflare-secrets-store, ...) are reached via
+ *     `secrets push` after explicit opt-in. Pass `--backend <id>` to
+ *     override.
+ */
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { assertSecretKey } from "../../../../domain/kinds/secret-key.js";
+import { outcomeOf } from "../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../environment.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { driftFingerprintHome, recordFingerprint } from "../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore, typedStoreFailure } from "../../shared/stores/store-selection.js";
+/** `set` writes to a local store unless `--backend` names another: remote stores are reached by `secrets push`. */
+const LOCAL_BACKEND_KINDS = new Set(['env-file', 'encrypted-local']);
+const logger = getLogger('secrets.set');
+async function tryRecordFingerprint(runtime, options) {
+    try {
+        await recordFingerprint({ ...options, home: await driftFingerprintHome(runtime) });
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export async function execute(rawArgs, rawOpts, commandContext) {
+    const { runtime } = commandContext;
+    const out = await openCommandOutput(runtime);
+    const args = parseCommandInput(setArgsSchema, rawArgs, 'set');
+    const opts = parseCommandInput(setOptionsSchema, rawOpts, 'set');
+    const key = args.key;
+    const argValue = args.value;
+    const options = {
+        environment: opts.environment,
+        backend: opts.backend,
+        stdin: opts.stdin === true,
+        format: opts.format
+    };
+    if (!key) {
+        out.warn('Usage: vibes secrets set <KEY> [-] --stdin');
+        requestCLIExit(1);
+    }
+    // The key is checked before anything is read or written; a refusal never carries it.
+    assertSecretKey(key);
+    if (argValue !== undefined && argValue !== '-') {
+        out.warn('Secret values cannot be passed as positional argv. Use stdin from an env var, for example: ' +
+            'printf %s "$SECRET_VALUE" | vibes secrets set KEY --stdin');
+        requestCLIExit(1);
+    }
+    // An unregistered kind, an unregistered `--backend`, a tied tier and a tier with no store are typed refusals.
+    const descriptors = listStoreDescriptors(runtime);
+    const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+    const target = selectStore(descriptors, envTier, options.backend, (d) => LOCAL_BACKEND_KINDS.has(d.backend));
+    const value = await readSecretValue(key, options.stdin === true || argValue === '-', runtime, out);
+    if (!value) {
+        out.warn('No value provided');
+        requestCLIExit(1);
+    }
+    const impl = await resolveStoreImplementation(runtime, target.id);
+    const written = await outcomeOf(() => impl.set(envName, key, value));
+    if (!written.ok)
+        throw typedStoreFailure(written.failure, 'write', target.id);
+    const fpOutcome = await tryRecordFingerprint(runtime, {
+        environment: envName,
+        backend: target.id,
+        key,
+        value
+    });
+    // The value is stored; a drift index that could not take its fingerprint is reported, not just logged.
+    let fingerprint = { recorded: true };
+    if (!fpOutcome.ok) {
+        const failure = CapabilityError.from(CaughtFailureSchema.parse(fpOutcome.error));
+        fingerprint = { recorded: false, reason: failure.reason };
+        logger.warn('Set key but could not record a drift fingerprint', { key, error: fpOutcome.error });
+        out.warn(`Set ${key}, but could not record its drift fingerprint (${failure.reason}): ${failure.message} ` +
+            '`vibes secrets check --drift` will not see this value until it is re-recorded.');
+    }
+    if (options.format === 'json') {
+        out.line(JSON.stringify({ environment: envName, backend: target.id, key, outcome: 'success', fingerprint }, null, 2));
+        return;
+    }
+    // Report the KEY + backend ONLY — never the value.
+    out.line(`Set ${key} in [${target.id}] for environment: ${envName}`);
+}
+export default { execute };
+//# sourceMappingURL=set.command.impl.js.map

package/dist/surfaces/cli/commands/store/set.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAC,gBAAgB,EAA+B,MAAM,sDAAsD,CAAC;AACnI,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAgC,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAC,cAAc,EAAC,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvF;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAC,iBAAiB,EAAE,MAAM,yDAAyD,CAAC;AACjH,OAAO,EACP,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EAChB,MAAM,wCAAwC,CAAC;AAEhD,mHAAmH;AACnH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAErE,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;AAExC,KAAK,UAAU,oBAAoB,CAClC,OAAmB,EACnB,OAA8D;IAE9D,IAAI,CAAC;QACJ,MAAM,iBAAiB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,OAAgB,EAChB,OAAmB,EACnB,cAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAe;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC;IAEF,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvD,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,eAAe,CAAC,GAAG,CAAC,CAAC;IAErB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CACP,6FAA6F;YAC7F,2DAA2D,CAC3D,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,8GAA8G;IAC9G,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7G,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9B,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE;QACrD,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,GAAG;QACH,KAAK;KACL,CAAC,CAAC;IACH,uGAAuG;IACvG,IAAI,WAAW,GAA6D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/F,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,WAAW,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,IAAI,CACP,OAAO,GAAG,iDAAiD,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,OAAO,GAAG;YACjG,gFAAgF,CAChF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACP,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3G,CAAC;QACF,OAAO;IACR,CAAC;IAED,mDAAmD;IACnD,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,MAAM,CAAC,EAAE,sBAAsB,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/environment.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The one re-export path for the environment helper (`./cli/environment`): every
+ * `vibes secrets` command imports it from here; the implementation is
+ * `../environment.ts`, also reachable from the package root.
+ */
+export { resolveSecretsEnvironment, type ResolvedSecretsEnvironment } from '../../support/environment.ts';
+//# sourceMappingURL=environment.d.ts.map

package/dist/surfaces/cli/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/surfaces/cli/environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAC,KAAK,0BAA0B,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/surfaces/cli/environment.js

@@ -0,0 +1,7 @@
+/**
+ * The one re-export path for the environment helper (`./cli/environment`): every
+ * `vibes secrets` command imports it from here; the implementation is
+ * `../environment.ts`, also reachable from the package root.
+ */
+export { resolveSecretsEnvironment } from "../../support/environment.js";
+//# sourceMappingURL=environment.js.map

package/dist/surfaces/cli/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/surfaces/cli/environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAkC,MAAM,8BAA8B,CAAC"}

package/dist/surfaces/cli/hooks/pre-commit-secrets.d.ts

@@ -0,0 +1,40 @@
+import { type PreCommitScanReport } from "../../../schemas/discovery/scan.schema.ts";
+export { type PreCommitScanReport } from "../../../schemas/discovery/scan.schema.ts";
+/**
+ * Staged-content credential scanner behind `vibes secrets pre-commit-check`.
+ *
+ * This is the last mechanical guard before a credential enters history, so the
+ * ways it can fail are all silent: not knowing a provider's key shape,
+ * scanning something other than what is about to be committed, a scanner that
+ * cannot run reporting success, and a report that prints the credential it
+ * found. The signature table is `../../credential-signatures.ts` (the one
+ * table); git runs through the handed runtime's `runtime/execution`.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { CommandOutput } from '../shared/output/command-output.ts';
+/** The runtime this scan needs: process execution through the handed runtime. */
+type ScanRuntime = RuntimeRef;
+/**
+ * Scan the STAGED content of staged files.
+ *
+ * Reading the working tree instead is a real bypass: stage a credential, edit
+ * it back out of the file, and the commit carries the secret while the scanner
+ * reports the clean worktree. `git show :<file>` is the bytes git is about to
+ * write, which is the only content this check is about.
+ *
+ * The staged paths are listed NUL-separated (`-z`): a quoted path or one with a
+ * newline is one entry, not two mangled ones. Added, copied, modified and
+ * renamed files are scanned (`ACMR`); a submodule pointer has no content and is
+ * left out. A git failure is a typed `UNAVAILABLE` `pre-commit-git-failed`
+ * throw, never a report of zero findings.
+ */
+export declare function scanStagedFilesForSecrets(runtime: ScanRuntime, workspacePath: string): Promise<PreCommitScanReport>;
+/**
+ * Run the check and report it through `out`. Returns the exit code: 1 when
+ * credential-shaped content is staged, 0 when the staged files were scanned and
+ * clean. A scan that could not run throws (non-zero by the CLI surface); it is
+ * never reported as clean. A finding prints the signature, path, line and
+ * match length, never the matched text.
+ */
+export declare function runSecretsPreCommitCheck(runtime: ScanRuntime, workspacePath: string, out: CommandOutput): Promise<number>;
+//# sourceMappingURL=pre-commit-secrets.d.ts.map

package/dist/surfaces/cli/hooks/pre-commit-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-commit-secrets.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/cli/hooks/pre-commit-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF;;;;;;;;;GASG;AAEH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAOtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAKxE,iFAAiF;AACjF,KAAK,WAAW,GAAG,UAAU,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,WAAW,EACpB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,WAAW,EACpB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,aAAa,GAChB,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/surfaces/cli/hooks/pre-commit-secrets.js

@@ -0,0 +1,99 @@
+import {} from "../../../schemas/discovery/scan.schema.js";
+export {} from "../../../schemas/discovery/scan.schema.js";
+/**
+ * Staged-content credential scanner behind `vibes secrets pre-commit-check`.
+ *
+ * This is the last mechanical guard before a credential enters history, so the
+ * ways it can fail are all silent: not knowing a provider's key shape,
+ * scanning something other than what is about to be committed, a scanner that
+ * cannot run reporting success, and a report that prints the credential it
+ * found. The signature table is `../../credential-signatures.ts` (the one
+ * table); git runs through the handed runtime's `runtime/execution`.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { runCapture } from '@vibesdotdev/kernel/execution';
+import { SECRET_PATTERNS, scanTextForSecretPatterns } from "../../../support/credential-signatures.js";
+/** git's own words about a failure, bounded: it names paths and refs, never staged content. */
+const GIT_STDERR_LIMIT = 300;
+/** A git command that could not run, or ran and failed: the scanner cannot vouch for the commit. */
+function gitFailed(args, detail) {
+    return new CapabilityError(`git ${args[0]} failed (exit ${detail.exitCode ?? 'none'}), so the staged files were not scanned and the commit is not cleared.`, 'UNAVAILABLE', {
+        reason: 'pre-commit-git-failed',
+        retryable: false,
+        recoveryHint: 'Run the check inside a git repository with git installed; a scanner that cannot run does not pass a commit.',
+        details: { command: args[0] ?? '', exitCode: detail.exitCode, stderr: detail.stderr.trim().slice(0, GIT_STDERR_LIMIT) }
+    });
+}
+async function git(runtime, workspacePath, args) {
+    // git needs the host's captured environment (PATH, HOME, its configuration); the call names why.
+    const result = await runCapture(runtime, 'git', args, {
+        envMode: 'inherit',
+        inheritReason: 'git resolves the repository and its configuration from the host environment',
+        cwd: workspacePath
+    });
+    if (result.exitCode !== 0)
+        throw gitFailed(args, result);
+    return result.stdout;
+}
+/**
+ * Scan the STAGED content of staged files.
+ *
+ * Reading the working tree instead is a real bypass: stage a credential, edit
+ * it back out of the file, and the commit carries the secret while the scanner
+ * reports the clean worktree. `git show :<file>` is the bytes git is about to
+ * write, which is the only content this check is about.
+ *
+ * The staged paths are listed NUL-separated (`-z`): a quoted path or one with a
+ * newline is one entry, not two mangled ones. Added, copied, modified and
+ * renamed files are scanned (`ACMR`); a submodule pointer has no content and is
+ * left out. A git failure is a typed `UNAVAILABLE` `pre-commit-git-failed`
+ * throw, never a report of zero findings.
+ */
+export async function scanStagedFilesForSecrets(runtime, workspacePath) {
+    const listing = await git(runtime, workspacePath, [
+        'diff',
+        '--cached',
+        '--name-only',
+        '-z',
+        '--diff-filter=ACMR',
+        '--ignore-submodules=all'
+    ]);
+    const stagedFiles = listing.split('\0').filter((path) => path.length > 0);
+    if (stagedFiles.length === 0)
+        return { exitCode: 0, scannedFiles: 0, findings: [] };
+    const findings = [];
+    for (const file of stagedFiles) {
+        const content = await git(runtime, workspacePath, ['show', `:${file}`]);
+        findings.push(...scanTextForSecretPatterns(file, content));
+    }
+    return { exitCode: findings.length > 0 ? 1 : 0, scannedFiles: stagedFiles.length, findings };
+}
+/**
+ * Run the check and report it through `out`. Returns the exit code: 1 when
+ * credential-shaped content is staged, 0 when the staged files were scanned and
+ * clean. A scan that could not run throws (non-zero by the CLI surface); it is
+ * never reported as clean. A finding prints the signature, path, line and
+ * match length, never the matched text.
+ */
+export async function runSecretsPreCommitCheck(runtime, workspacePath, out) {
+    const report = await scanStagedFilesForSecrets(runtime, workspacePath);
+    if (report.findings.length > 0) {
+        out.warn(`\n[SECRETS-001] ${report.findings.length} secret pattern(s) detected across ${report.scannedFiles} staged file(s).\n`);
+        for (const finding of report.findings) {
+            out.warn(`  BLOCKED  ${finding.file}:${finding.lineNumber}`);
+            out.warn(`    Pattern: ${finding.name}`);
+            out.warn(`    Match: ${finding.matchLength} characters (not shown)\n`);
+        }
+        out.warn('Commit blocked: production secrets must not be committed.');
+        out.warn('  - Rotate any exposed keys immediately.');
+        out.warn('  - Use `vibes secrets set` to store in a secret manager.');
+        out.warn('  - Add to .gitignore if genuinely not a secret.\n');
+        return report.exitCode;
+    }
+    // Report the denominator. Printing nothing made a clean run and a run that
+    // scanned nothing at all look identical — which is how a guard that had
+    // stopped guarding went unnoticed.
+    out.line(`secrets pre-commit-check: ${report.scannedFiles} staged file(s) scanned against ${SECRET_PATTERNS.length} signature(s); no findings`);
+    return report.exitCode;
+}
+//# sourceMappingURL=pre-commit-secrets.js.map

package/dist/surfaces/cli/hooks/pre-commit-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-commit-secrets.js","sourceRoot":"","sources":["../../../../src/surfaces/cli/hooks/pre-commit-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAA4B,MAAM,2CAA2C,CAAC;AACrF;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EACP,eAAe,EACf,yBAAyB,EAExB,MAAM,2CAA2C,CAAC;AAGnD,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAK7B,oGAAoG;AACpG,SAAS,SAAS,CAAC,IAAuB,EAAE,MAAmD;IAC9F,OAAO,IAAI,eAAe,CACzB,OAAO,IAAI,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,QAAQ,IAAI,MAAM,wEAAwE,EAChI,aAAa,EACb;QACC,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,6GAA6G;QAC3H,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE;KACvH,CACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,OAAoB,EAAE,aAAqB,EAAE,IAAuB;IACtF,iGAAiG;IACjG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;QACrD,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,6EAA6E;QAC5F,GAAG,EAAE,aAAa;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAoB,EACpB,aAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE;QACjD,MAAM;QACN,UAAU;QACV,aAAa;QACb,IAAI;QACJ,oBAAoB;QACpB,yBAAyB;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEpF,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAoB,EACpB,aAAqB,EACrB,GAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CACP,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,sCAAsC,MAAM,CAAC,YAAY,oBAAoB,CACtH,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,WAAW,2BAA2B,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,mCAAmC;IACnC,GAAG,CAAC,IAAI,CACP,6BAA6B,MAAM,CAAC,YAAY,mCAAmC,eAAe,CAAC,MAAM,4BAA4B,CACrI,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC;AACxB,CAAC"}

package/dist/surfaces/cli/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @vibesdotdev/secrets/cli — barrel export.
+ *
+ * Re-exports the plugin (default + named), group descriptor, and command
+ * descriptors so consumers can register the plugin directly and reference
+ * individual descriptors for testing/docs.
+ */
+export { default as execCommandDescriptor, execCommandDescriptor as secretsExecCommandDescriptor } from './commands/exec/exec.command.descriptor.ts';
+export { default as oauthClientMintCommandDescriptor, oauthClientMintCommandDescriptor as secretsOauthClientMintCommandDescriptor } from './commands/oauth-client/mint.command.descriptor.ts';
+export { default as oauthClientGroupDescriptor } from './commands/oauth-client/oauth-client.cli-group.descriptor.ts';
+export { default as requestCommandDescriptor, requestCommandDescriptor as secretsRequestCommandDescriptor } from './commands/request/request.command.descriptor.ts';
+export { default as revealCommandDescriptor, revealCommandDescriptor as secretsRevealCommandDescriptor } from './commands/store/reveal.command.descriptor.ts';
+export { default as listCommandDescriptor, listCommandDescriptor as secretsListCommandDescriptor } from './commands/store/secrets.list.command.descriptor.ts';
+export { setCommandDescriptor as secretsSetCommandDescriptor, default as setCommandDescriptor } from './commands/store/set.command.descriptor.ts';
+export { secretsCliPlugin as default, secretsCliPlugin } from './plugin.ts';
+export { default as secretsGroupDescriptor } from './secrets-group.descriptor.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/surfaces/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/surfaces/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACP,OAAO,IAAI,qBAAqB,EAChC,qBAAqB,IAAI,4BAA4B,EACpD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACP,OAAO,IAAI,gCAAgC,EAC3C,gCAAgC,IAAI,uCAAuC,EAC1E,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACP,OAAO,IAAI,wBAAwB,EACnC,wBAAwB,IAAI,+BAA+B,EAC1D,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACP,OAAO,IAAI,uBAAuB,EAClC,uBAAuB,IAAI,8BAA8B,EACxD,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACP,OAAO,IAAI,qBAAqB,EAChC,qBAAqB,IAAI,4BAA4B,EACpD,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACP,oBAAoB,IAAI,2BAA2B,EAAC,OAAO,IAAI,oBAAoB,EAClF,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/surfaces/cli/index.js

@@ -0,0 +1,17 @@
+/**
+ * @vibesdotdev/secrets/cli — barrel export.
+ *
+ * Re-exports the plugin (default + named), group descriptor, and command
+ * descriptors so consumers can register the plugin directly and reference
+ * individual descriptors for testing/docs.
+ */
+export { default as execCommandDescriptor, execCommandDescriptor as secretsExecCommandDescriptor } from "./commands/exec/exec.command.descriptor.js";
+export { default as oauthClientMintCommandDescriptor, oauthClientMintCommandDescriptor as secretsOauthClientMintCommandDescriptor } from "./commands/oauth-client/mint.command.descriptor.js";
+export { default as oauthClientGroupDescriptor } from "./commands/oauth-client/oauth-client.cli-group.descriptor.js";
+export { default as requestCommandDescriptor, requestCommandDescriptor as secretsRequestCommandDescriptor } from "./commands/request/request.command.descriptor.js";
+export { default as revealCommandDescriptor, revealCommandDescriptor as secretsRevealCommandDescriptor } from "./commands/store/reveal.command.descriptor.js";
+export { default as listCommandDescriptor, listCommandDescriptor as secretsListCommandDescriptor } from "./commands/store/secrets.list.command.descriptor.js";
+export { setCommandDescriptor as secretsSetCommandDescriptor, default as setCommandDescriptor } from "./commands/store/set.command.descriptor.js";
+export { secretsCliPlugin as default, secretsCliPlugin } from "./plugin.js";
+export { default as secretsGroupDescriptor } from "./secrets-group.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/surfaces/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/surfaces/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACP,OAAO,IAAI,qBAAqB,EAChC,qBAAqB,IAAI,4BAA4B,EACpD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACP,OAAO,IAAI,gCAAgC,EAC3C,gCAAgC,IAAI,uCAAuC,EAC1E,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AACrH,OAAO,EACP,OAAO,IAAI,wBAAwB,EACnC,wBAAwB,IAAI,+BAA+B,EAC1D,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACP,OAAO,IAAI,uBAAuB,EAClC,uBAAuB,IAAI,8BAA8B,EACxD,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACP,OAAO,IAAI,qBAAqB,EAChC,qBAAqB,IAAI,4BAA4B,EACpD,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACP,oBAAoB,IAAI,2BAA2B,EAAC,OAAO,IAAI,oBAAoB,EAClF,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/surfaces/cli/plugin.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `@vibesdotdev/secrets/cli` plugin
+ *
+ * In-package CLI surface for `@vibesdotdev/secrets`. Registers:
+ *   - the `secrets` cli/group
+ *   - `secrets.list`    — list secret descriptors (NEVER values)
+ *   - `secrets.reveal`  — print a single value to STDOUT (audited; humans only)
+ *   - `secrets.set`     — write a value (accepts STDIN via `-` or --stdin)
+ *   - `secrets.exec`    — run a command with secrets injected as env (LEVERAGE)
+ *   - `secrets.request` — HTTP probe with a secret-injected header (LEVERAGE)
+ *   - `secrets oauth-client mint` — mint OAuth client via store-backed bearer; store id/secret locally
+ *   - the `host-credentials` store, when the CLI was started under a manifest
+ *
+ * The two LEVERAGE commands exist so secrets are used without ever being
+ * handled: values are injected at the point of use and all output is
+ * redacted. Agents and scripts must use these instead of `reveal` — a
+ * revealed value in an agent session goes over the wire to an AI provider.
+ *
+ * This is the ONE secrets CLI plugin (id `@vibesdotdev/secrets/cli`): the
+ * former second plugin (`secrets.cli`, `./cli.plugin`) is merged here, so
+ * check, import, export, pull, push, unset and pre-commit-check register with
+ * the group. Their consumer-only impls are lazy loaders, so registering the
+ * descriptors pulls no fs/path code into a cloud bundle (CLI scope only).
+ */
+export declare const secretsCliPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsCliPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/surfaces/cli/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/surfaces/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAuBH,eAAO,MAAM,gBAAgB,6CAqD3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/surfaces/cli/plugin.js

@@ -0,0 +1,88 @@
+/**
+ * `@vibesdotdev/secrets/cli` plugin
+ *
+ * In-package CLI surface for `@vibesdotdev/secrets`. Registers:
+ *   - the `secrets` cli/group
+ *   - `secrets.list`    — list secret descriptors (NEVER values)
+ *   - `secrets.reveal`  — print a single value to STDOUT (audited; humans only)
+ *   - `secrets.set`     — write a value (accepts STDIN via `-` or --stdin)
+ *   - `secrets.exec`    — run a command with secrets injected as env (LEVERAGE)
+ *   - `secrets.request` — HTTP probe with a secret-injected header (LEVERAGE)
+ *   - `secrets oauth-client mint` — mint OAuth client via store-backed bearer; store id/secret locally
+ *   - the `host-credentials` store, when the CLI was started under a manifest
+ *
+ * The two LEVERAGE commands exist so secrets are used without ever being
+ * handled: values are injected at the point of use and all output is
+ * redacted. Agents and scripts must use these instead of `reveal` — a
+ * revealed value in an agent session goes over the wire to an AI provider.
+ *
+ * This is the ONE secrets CLI plugin (id `@vibesdotdev/secrets/cli`): the
+ * former second plugin (`secrets.cli`, `./cli.plugin`) is merged here, so
+ * check, import, export, pull, push, unset and pre-commit-check register with
+ * the group. Their consumer-only impls are lazy loaders, so registering the
+ * descriptors pulls no fs/path code into a cloud bundle (CLI scope only).
+ */
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import { secretsBackendHostCredentialsPlugin } from "../../backends/host-credentials/host-credentials.plugin.js";
+import { execCommandDescriptor } from "./commands/exec/exec.command.descriptor.js";
+import secretsCheck from "./commands/maintenance/check/secrets.check.cli-command.descriptor.js";
+import secretsExport from "./commands/maintenance/export/secrets.export.cli-command.descriptor.js";
+import secretsImport from "./commands/maintenance/import/secrets.import.cli-command.descriptor.js";
+import secretsPreCommitCheck from "./commands/maintenance/pre-commit/secrets.precommit.cli-command.descriptor.js";
+import secretsPull from "./commands/maintenance/pull/secrets.pull.cli-command.descriptor.js";
+import secretsPush from "./commands/maintenance/push/secrets.push.cli-command.descriptor.js";
+import secretsUnset from "./commands/maintenance/unset/secrets.unset.cli-command.descriptor.js";
+import { oauthClientMintCommandDescriptor } from "./commands/oauth-client/mint.command.descriptor.js";
+import oauthClientGroup from "./commands/oauth-client/oauth-client.cli-group.descriptor.js";
+import { requestCommandDescriptor } from "./commands/request/request.command.descriptor.js";
+import { revealCommandDescriptor } from "./commands/store/reveal.command.descriptor.js";
+import { listCommandDescriptor } from "./commands/store/secrets.list.command.descriptor.js";
+import { setCommandDescriptor } from "./commands/store/set.command.descriptor.js";
+import secretsGroup from "./secrets-group.descriptor.js";
+const CLI_COMMAND = { kind: 'cli/command' };
+export const secretsCliPlugin = createRuntimePlugin({
+    id: '@vibesdotdev/secrets/cli',
+    name: 'Secrets CLI Surface',
+    description: '`vibes secrets list|reveal|set|unset|check|pull|push|import|export|pre-commit-check` + leverage `exec|request` + `oauth-client mint` (inject/store, never print)',
+    dependencies: ['cli', 'secrets'],
+    descriptors: [
+        secretsGroup,
+        listCommandDescriptor,
+        revealCommandDescriptor,
+        setCommandDescriptor,
+        execCommandDescriptor,
+        requestCommandDescriptor,
+        oauthClientGroup,
+        oauthClientMintCommandDescriptor,
+        secretsCheck,
+        secretsImport,
+        secretsExport,
+        secretsPull,
+        secretsPush,
+        secretsUnset,
+        secretsPreCommitCheck
+    ],
+    loaders: [
+        loader('secrets.list', CLI_COMMAND, () => import("./commands/store/secrets.list.command.impl.js")),
+        loader('secrets.reveal', CLI_COMMAND, () => import("./commands/store/reveal.command.impl.js")),
+        loader('secrets.set', CLI_COMMAND, () => import("./commands/store/set.command.impl.js")),
+        loader('secrets.exec', CLI_COMMAND, () => import("./commands/exec/exec.command.impl.js")),
+        loader('secrets.request', CLI_COMMAND, () => import("./commands/request/request.command.impl.js")),
+        loader('secrets.oauth-client.mint', CLI_COMMAND, () => import("./commands/oauth-client/mint.command.impl.js")),
+        loader('secrets.check', CLI_COMMAND, () => import("./commands/maintenance/check/secrets.check.cli-command.impl.js")),
+        loader('secrets.import', CLI_COMMAND, () => import("./commands/maintenance/import/secrets.import.cli-command.impl.consumer.js")),
+        loader('secrets.export', CLI_COMMAND, () => import("./commands/maintenance/export/secrets.export.cli-command.impl.consumer.js")),
+        loader('secrets.pull', CLI_COMMAND, () => import("./commands/maintenance/pull/secrets.pull.cli-command.impl.js")),
+        loader('secrets.push', CLI_COMMAND, () => import("./commands/maintenance/push/secrets.push.cli-command.impl.js")),
+        loader('secrets.unset', CLI_COMMAND, () => import("./commands/maintenance/unset/secrets.unset.cli-command.impl.js")),
+        loader('dev.secrets.pre-commit-check', CLI_COMMAND, () => import("./commands/maintenance/pre-commit/secrets.precommit.cli-command.impl.consumer.js"))
+    ],
+    // The CLI host composes `host-credentials` when it was started under a
+    // `VIBES_HOST_CREDENTIALS` manifest (rc05 §2.2): the plugin registers the
+    // store only when its captured environment holds one.
+    onRegister: async (runtime) => {
+        await runtime.registerPlugin(secretsBackendHostCredentialsPlugin);
+    }
+});
+export default secretsCliPlugin;
+//# sourceMappingURL=plugin.js.map

package/dist/surfaces/cli/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/surfaces/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,mBAAmB,EAAC,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,4DAA4D,CAAC;AAEjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,YAAY,MAAM,sEAAsE,CAAC;AAChG,OAAO,aAAa,MAAM,wEAAwE,CAAC;AACnG,OAAO,aAAa,MAAM,wEAAwE,CAAC;AACnG,OAAO,qBAAqB,MAAM,+EAA+E,CAAC;AAClH,OAAO,WAAW,MAAM,oEAAoE,CAAC;AAC7F,OAAO,WAAW,MAAM,oEAAoE,CAAC;AAC7F,OAAO,YAAY,MAAM,sEAAsE,CAAC;AAChG,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,gBAAgB,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,YAAY,MAAM,+BAA+B,CAAC;AAEzD,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAW,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,kKAAkK;IACnK,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAEhC,WAAW,EAAE;QACZ,YAAY;QACZ,qBAAqB;QACrB,uBAAuB;QACvB,oBAAoB;QACpB,qBAAqB;QACrB,wBAAwB;QACxB,gBAAgB;QAChB,gCAAgC;QAChC,YAAY;QACZ,aAAa;QACb,aAAa;QACb,WAAW;QACX,WAAW;QACX,YAAY;QACZ,qBAAqB;KACrB;IAED,OAAO,EAAE;QACR,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAClG,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAC9F,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACxF,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACzF,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAClG,MAAM,CAAC,2BAA2B,EAAE,WAAW,EAAE,GAAG,EAAE,CACrD,MAAM,CAAC,8CAA8C,CAAC,CACtD;QACD,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;QACpH,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAC;QAChI,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAC;QAChI,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QACjH,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QACjH,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;QACpH,MAAM,CACL,8BAA8B,EAC9B,WAAW,EACX,GAAG,EAAE,CAAC,MAAM,CAAC,kFAAkF,CAAC,CAChG;KACD;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sDAAsD;IACtD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,CAAC,cAAc,CAAC,mCAAmC,CAAC,CAAC;IACnE,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/surfaces/cli/secrets-group.descriptor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Secrets CLI Group Descriptor
+ *
+ * Root group for `vibes secrets *` commands. Lives in the canonical
+ * in-package `{feature}/cli` export.
+ *
+ * Wave 4 takeover note: this id (`secrets`) was previously registered by
+ * `@vibesdotdev/secrets/plugin`. That registration was removed in the same
+ * commit that introduced this package — atomic, no shim — so the group
+ * lives here while the remaining secrets.* commands (check, import, export,
+ * pull, push, unset, pre-commit) continue to register from
+ * `@vibesdotdev/secrets/plugin` against this group.
+ */
+import type { CLIGroupAssetDescriptor } from '@vibesdotdev/cli/schemas/descriptors';
+declare const descriptor: CLIGroupAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=secrets-group.descriptor.d.ts.map

package/dist/surfaces/cli/secrets-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-group.descriptor.d.ts","sourceRoot":"","sources":["../../../src/surfaces/cli/secrets-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF,QAAA,MAAM,UAAU,EAAE,uBASjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/secrets-group.descriptor.js

@@ -0,0 +1,25 @@
+/**
+ * Secrets CLI Group Descriptor
+ *
+ * Root group for `vibes secrets *` commands. Lives in the canonical
+ * in-package `{feature}/cli` export.
+ *
+ * Wave 4 takeover note: this id (`secrets`) was previously registered by
+ * `@vibesdotdev/secrets/plugin`. That registration was removed in the same
+ * commit that introduced this package — atomic, no shim — so the group
+ * lives here while the remaining secrets.* commands (check, import, export,
+ * pull, push, unset, pre-commit) continue to register from
+ * `@vibesdotdev/secrets/plugin` against this group.
+ */
+const descriptor = {
+    kind: 'cli/group',
+    id: 'secrets',
+    name: 'secrets',
+    description: 'Manage environment secrets across backends',
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 50
+};
+export default descriptor;
+//# sourceMappingURL=secrets-group.descriptor.js.map

package/dist/surfaces/cli/secrets-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-group.descriptor.js","sourceRoot":"","sources":["../../../src/surfaces/cli/secrets-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,UAAU,GAA4B;IAC3C,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/shared/app-target.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A targeted `--app <id>` must name a declared secret-requirement target. A typo
+ * or an undiscoverable target is an invalid request, never a successful
+ * zero-item result: `check --app` and `push --app` refuse it the same way
+ * (`INVALID_INPUT` `unknown-secret-requirement-app`).
+ */
+import type { SecretRequirement } from '../../../domain/requirements/schemas/requirements.ts';
+/**
+ * The requirements declared for `appId`, or the typed refusal naming the known
+ * ids. `discoveryFailures` is how many requirement configs failed to load: the
+ * list of known ids is then incomplete, which the refusal says.
+ */
+export declare function requirementsForApp(appId: string, allRequirements: readonly SecretRequirement[], discoveryFailures?: number): SecretRequirement[];
+//# sourceMappingURL=app-target.d.ts.map

package/dist/surfaces/cli/shared/app-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-target.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/cli/shared/app-target.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sDAAsD,CAAC;AAE9F;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,SAAS,iBAAiB,EAAE,EAC7C,iBAAiB,SAAI,GACnB,iBAAiB,EAAE,CAerB"}