@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/cli/shared/stores/store-transfer.js

@@ -0,0 +1,96 @@
+import { keyOptionSchema } from "../../../../schemas/cli/transfer.schema.js";
+export { keyOptionSchema } from "../../../../schemas/cli/transfer.schema.js";
+/**
+ * What `secrets pull` and `secrets push` share when they copy one store's
+ * values into another: the `--key` filter (every key validated), the source
+ * read (a write-only store is refused, never copied as empty), the destination
+ * write (a raw backend failure typed), and the drift fingerprint each copied
+ * value records, exactly as `secrets set` does.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { assertSecretKey } from "../../../../domain/kinds/secret-key.js";
+import { outcomeOf } from "../../../../support/file-failure.js";
+import { driftFingerprintHome, recordFingerprint } from "./drift-fingerprints.impl.consumer.js";
+import { typedStoreFailure } from "./store-selection.js";
+/** The keys a `--key` option names, each validated; undefined when it names none. */
+export function parseKeyFilter(value) {
+    if (value === undefined)
+        return undefined;
+    const list = Array.isArray(value) ? value : [value];
+    const keys = list
+        .flatMap((entry) => entry.split(','))
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    for (const key of keys)
+        assertSecretKey(key);
+    return keys.length > 0 ? new Set(keys) : undefined;
+}
+/** Copying a store's environment onto itself is not a copy. */
+export function assertDistinctStores(source, target) {
+    if (source.id === target.id && source.environment === target.environment) {
+        throw new CapabilityError(`The source and the destination are the same store ('${source.id}') and environment ('${source.environment}'); there is nothing to copy.`, 'INVALID_INPUT', {
+            reason: 'store-source-equals-target',
+            retryable: false,
+            recoveryHint: 'Name the other store with --from <id> or --to <id>.',
+            details: { store: source.id, environment: source.environment }
+        });
+    }
+}
+/**
+ * Every value the source holds for `environment` (narrowed to `filter`). A
+ * source that lists a key as set but returns no value for it is write-only:
+ * copying would silently drop it, so the copy is refused `UNAVAILABLE`
+ * `secret-write-only`, naming the keys.
+ */
+export async function readSourceSecrets(source, environment, filter) {
+    const read = await outcomeOf(async () => ({ all: await source.getAll(environment), listed: await source.list(environment) }));
+    if (!read.ok)
+        throw typedStoreFailure(read.failure, 'read', source.id);
+    const { all, listed } = read.value;
+    const selected = Object.fromEntries(Object.entries(all).filter(([key]) => filter === undefined || filter.has(key)));
+    const unreadable = listed
+        .filter((entry) => entry.hasValue && (filter === undefined || filter.has(entry.key)) && !Object.hasOwn(selected, entry.key))
+        .map((entry) => entry.key);
+    if (unreadable.length > 0) {
+        throw new CapabilityError(`The store '${source.id}' lists ${unreadable.join(', ')} as set but cannot read the values back (write-only), so they cannot be copied.`, 'UNAVAILABLE', {
+            reason: 'secret-write-only',
+            retryable: false,
+            details: { store: source.id, keys: unreadable }
+        });
+    }
+    return selected;
+}
+/** Write `secrets` to the destination; a raw backend failure is typed. */
+export async function writeTargetSecrets(target, environment, secrets) {
+    const written = await outcomeOf(() => target.setAll(environment, secrets));
+    if (!written.ok)
+        throw typedStoreFailure(written.failure, 'write', target.id);
+}
+/**
+ * Record each copied value's drift fingerprint under the destination store, as
+ * `secrets set` does. A failure does not undo the copy: it is counted and
+ * returned for the command to report. Values are never reported.
+ */
+export async function recordCopiedFingerprints(runtime, input) {
+    const outcome = { recorded: 0, failed: 0 };
+    const homeOutcome = await outcomeOf(() => driftFingerprintHome(runtime));
+    if (!homeOutcome.ok) {
+        const failure = CapabilityError.from(homeOutcome.failure);
+        return { recorded: 0, failed: Object.keys(input.secrets).length, reason: failure.reason, message: failure.message };
+    }
+    const home = homeOutcome.value;
+    for (const [key, value] of Object.entries(input.secrets)) {
+        const recorded = await outcomeOf(() => recordFingerprint({ environment: input.environment, backend: input.backend, key, value, home }));
+        if (recorded.ok) {
+            outcome.recorded += 1;
+            continue;
+        }
+        const failure = CapabilityError.from(recorded.failure);
+        outcome.failed += 1;
+        outcome.reason ??= failure.reason;
+        outcome.message ??= failure.message;
+    }
+    return outcome;
+}
+//# sourceMappingURL=store-transfer.js.map

package/dist/surfaces/cli/shared/stores/store-transfer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-transfer.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/store-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0B,MAAM,4CAA4C,CAAC;AACrG,OAAO,EAAE,eAAe,EAA0B,MAAM,4CAA4C,CAAC;AACrG;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAC,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAAsC;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI;SACf,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CACnC,MAA2C,EAC3C,MAA2C;IAE3C,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,IAAI,eAAe,CACxB,uDAAuD,MAAM,CAAC,EAAE,wBAAwB,MAAM,CAAC,WAAW,+BAA+B,EACzI,eAAe,EACf;YACC,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,qDAAqD;YACnE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;SAC9D,CACD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAkC,EAClC,WAAmB,EACnB,MAAuC;IAEvC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,UAAU,GAAG,MAAM;SACvB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;SAC3H,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACxB,cAAc,MAAM,CAAC,EAAE,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF,EACxI,aAAa,EACb;YACC,MAAM,EAAE,mBAAmB;YAC3B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAC/C,CACD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,MAAkC,EAClC,WAAmB,EACnB,OAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAmB,EACnB,KAA0F;IAE1F,MAAM,OAAO,GAAuB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACrH,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CACrC,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAC/F,CAAC;QACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QAClC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/surfaces/svelte/account/account-errors.d.ts

@@ -0,0 +1,10 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+export declare const ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS = 30000;
+export declare const ACCOUNT_SECRETS_MAX_BODY_BYTES: number;
+export declare const ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH = 200;
+export declare class AccountSecretsClientError extends CapabilityError {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function boundServerMessage(message: string): string;
+//# sourceMappingURL=account-errors.d.ts.map

package/dist/surfaces/svelte/account/account-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-errors.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/account/account-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,qBAAqB,CAAC;AAE/E,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,eAAO,MAAM,8BAA8B,QAAkB,CAAC;AAC9D,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAwBtD,qBAAa,yBAA0B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS3C;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK1D"}

package/dist/surfaces/svelte/account/account-errors.js

@@ -0,0 +1,45 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { printableLine } from "../../../transport/text.js";
+export const ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS = 30_000;
+export const ACCOUNT_SECRETS_MAX_BODY_BYTES = 4 * 1024 * 1024;
+export const ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH = 200;
+function httpStatusToCapabilityCode(status) {
+    switch (status) {
+        case 400:
+            return 'INVALID_INPUT';
+        case 401:
+            return 'AUTH_REQUIRED';
+        case 403:
+            return 'PERMISSION_DENIED';
+        case 404:
+            return 'NOT_FOUND';
+        case 409:
+            return 'CONFLICT';
+        case 429:
+            return 'RATE_LIMITED';
+        case 503:
+            return 'UNAVAILABLE';
+        case 504:
+            return 'TIMEOUT';
+        default:
+            return status >= 400 && status < 500 ? 'INVALID_INPUT' : 'INTERNAL';
+    }
+}
+export class AccountSecretsClientError extends CapabilityError {
+    status;
+    constructor(message, status) {
+        super(message, httpStatusToCapabilityCode(status), {
+            reason: `http-${status}`,
+            details: { status }
+        });
+        this.name = 'AccountSecretsClientError';
+        this.status = status;
+        Object.setPrototypeOf(this, AccountSecretsClientError.prototype);
+    }
+}
+export function boundServerMessage(message) {
+    const printable = printableLine(message);
+    return printable.length > ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH
+        ? `${printable.slice(0, ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH)}…`
+        : printable;
+}

package/dist/surfaces/svelte/account/account-transport.d.ts

@@ -0,0 +1,10 @@
+import * as z from 'zod/v4';
+import type { AccountSecretsClientOptions } from '../../../schemas/managed/account-client.schema.ts';
+export declare function createAccountTransport(origin: string, authorization: string | undefined, options: AccountSecretsClientOptions): {
+    buildHeaders: (extraContentType?: string) => Headers;
+    url: (path: string, query?: Record<string, string | number | boolean | undefined>) => string;
+    send: (operation: string, target: string, init: RequestInit) => Promise<Response>;
+    readJsonOrThrow: <S extends z.ZodType>(response: Response, schema: S, fallbackMessage: string) => Promise<z.output<S>>;
+    expectOkOrThrow: (response: Response, fallbackMessage: string) => Promise<void>;
+};
+//# sourceMappingURL=account-transport.d.ts.map

package/dist/surfaces/svelte/account/account-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-transport.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/account/account-transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAUrG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,2BAA2B;sCAsBpF,MAAM;gBAcxC,MAAM,UACJ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,KAC3D,MAAM;sBAWsB,MAAM,UAAU,MAAM,QAAQ,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAmC7D,CAAC,SAAS,CAAC,CAAC,OAAO,YACvC,QAAQ,UACV,CAAC,mBACQ,MAAM,KACrB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gCASkB,QAAQ,mBAAmB,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;EAS1F"}

package/dist/surfaces/svelte/account/account-transport.js

@@ -0,0 +1,112 @@
+// vibes-runtime-fetch-allow-file: portable account transport, injectable network boundary.
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { errorPayloadSchema } from "../../../schemas/managed/account-client.schema.js";
+import { isDeadlineFailure, readBoundedText } from "../../../transport/bounded-body.js";
+import { isSendableHeaderValue } from "../../../transport/header-value.js";
+import { parseJsonBody } from "../../../transport/json-body.js";
+import { parseSecureUrl } from "../../../transport/secure-url.js";
+import { ACCOUNT_SECRETS_MAX_BODY_BYTES, ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS, AccountSecretsClientError, boundServerMessage } from "./account-errors.js";
+function joinUrl(origin, path) {
+    return origin ? origin.replace(/\/$/, '') + path : path;
+}
+export function createAccountTransport(origin, authorization, options) {
+    if (origin !== '') {
+        const parsed = parseSecureUrl(origin, { allowLoopbackHttp: options.allowLoopbackHttp === true });
+        if (!parsed.ok) {
+            throw new CapabilityError('The account origin is not an https URL the secrets client may send to.', 'INVALID_INPUT', {
+                reason: 'account-origin-invalid',
+                retryable: false,
+                details: { problem: parsed.problem }
+            });
+        }
+    }
+    // A token no header can carry is refused by shape: the runtime's own TypeError would quote it.
+    if (authorization && !isSendableHeaderValue(`Bearer ${authorization}`)) {
+        throw new CapabilityError('The account token is not a value an Authorization header can carry; no client was made.', 'INVALID_INPUT', {
+            reason: 'account-token-invalid',
+            retryable: false
+        });
+    }
+    const credentials = origin === '' ? 'same-origin' : authorization ? 'omit' : 'include';
+    const timeoutMs = options.requestTimeoutMs ?? ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS;
+    function buildHeaders(extraContentType) {
+        const headers = new Headers({
+            Accept: 'application/json'
+        });
+        if (authorization) {
+            headers.set('authorization', `Bearer ${authorization}`);
+        }
+        if (extraContentType) {
+            headers.set('Content-Type', extraContentType);
+        }
+        return headers;
+    }
+    function url(path, query) {
+        const base = joinUrl(origin, path);
+        if (!query)
+            return base;
+        const u = origin === '' ? new URL(base, 'http://localhost') : new URL(base);
+        for (const [k, v] of Object.entries(query)) {
+            if (v !== undefined)
+                u.searchParams.set(k, String(v));
+        }
+        return origin === '' ? `${u.pathname}${u.search}` : u.toString();
+    }
+    /** One request with its deadline; a transport failure is a typed `UNAVAILABLE`. */
+    async function send(operation, target, init) {
+        const doFetch = options.fetchImpl ?? globalThis.fetch;
+        try {
+            // `redirect: 'error'`: a redirect would carry the bearer (or the session cookie) to wherever it points.
+            return await doFetch.call(globalThis, target, { ...init, credentials, redirect: 'error', signal: AbortSignal.timeout(timeoutMs) });
+        }
+        catch (thrown) {
+            throw failedRequest(operation, CaughtFailureSchema.parse(thrown));
+        }
+    }
+    /** The body text, bounded; a body past the bound is a typed refusal. */
+    async function readText(operation, response) {
+        let read;
+        try {
+            read = await readBoundedText(response, ACCOUNT_SECRETS_MAX_BODY_BYTES);
+        }
+        catch (thrown) {
+            throw failedRequest(operation, CaughtFailureSchema.parse(thrown));
+        }
+        if (read.truncated) {
+            throw new AccountSecretsClientError(`${operation}: the response is too large.`, 502);
+        }
+        return read.text;
+    }
+    /** A failed answer as its typed error: the server's message, bounded, else the operation's own. */
+    function refuse(response, text, fallbackMessage) {
+        // A body that is not the error shape is not echoed: the fallback names the operation only.
+        const outcome = parseJsonBody(text, errorPayloadSchema);
+        const serverMessage = outcome.ok ? (outcome.data.error ?? outcome.data.message) : undefined;
+        throw new AccountSecretsClientError(serverMessage ? boundServerMessage(serverMessage) || fallbackMessage : fallbackMessage, response.status);
+    }
+    async function readJsonOrThrow(response, schema, fallbackMessage) {
+        const text = await readText(fallbackMessage, response);
+        if (!response.ok)
+            return refuse(response, text, fallbackMessage);
+        const outcome = parseJsonBody(text, schema);
+        if (outcome.ok)
+            return outcome.data;
+        // Only that the shape is wrong: the parser's error and the schema's issues can quote server text.
+        throw new AccountSecretsClientError(`Invalid response shape: ${fallbackMessage}`, 502);
+    }
+    async function expectOkOrThrow(response, fallbackMessage) {
+        if (response.ok) {
+            await response.body?.cancel();
+            return;
+        }
+        await refuse(response, await readText(fallbackMessage, response), fallbackMessage);
+    }
+    return { buildHeaders, url, send, readJsonOrThrow, expectOkOrThrow };
+}
+function failedRequest(operation, failure) {
+    return new CapabilityError(isDeadlineFailure(failure) ? `${operation} timed out.` : `${operation} could not reach the account service.`, 'UNAVAILABLE', {
+        reason: isDeadlineFailure(failure) ? 'account-secrets-timeout' : 'account-secrets-unreachable',
+        retryable: true,
+        cause: failure
+    });
+}

package/dist/surfaces/svelte/client/runtime.d.ts

@@ -0,0 +1,12 @@
+/** Portable account client. Values are returned only by the explicit reveal operation. */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type AccountSecretsClient, type AccountSecretsClientOptions } from '../../../schemas/managed/account-client.schema.ts';
+export { secretSummarySchema } from '../../../schemas/managed/account-client.schema.ts';
+export type { AccountSecretsClient, AccountSecretsClientOptions, ListSecretsFilter, SecretInput, SecretSummary } from '../../../schemas/managed/account-client.schema.ts';
+export type { ManagedSecretScope, SecretScope } from '../../../schemas/managed/secret.schema.ts';
+export { ACCOUNT_SECRETS_MAX_BODY_BYTES, ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH, ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS, AccountSecretsClientError, boundServerMessage } from '../account/account-errors.ts';
+export declare function getAccountOrigin(runtime?: VibesRuntime | null): Promise<string>;
+export declare function createAccountSecretsClient(origin: string, authorization?: string, options?: AccountSecretsClientOptions): AccountSecretsClient;
+/** The client options a runtime implies: loopback http only on its development host. */
+export declare function accountSecretsClientOptionsFor(runtime: VibesRuntime | null | undefined): AccountSecretsClientOptions;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/surfaces/svelte/client/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/client/runtime.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAoE,KAAK,oBAAoB,EAAC,KAAK,2BAA2B,EAAqB,MAAM,mDAAmD,CAAC;AAIpN,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,YAAY,EAAE,oBAAoB,EAAC,2BAA2B,EAAC,iBAAiB,EAAC,WAAW,EAAC,aAAa,EAAE,MAAM,mDAAmD,CAAC;AACtK,YAAY,EAAE,kBAAkB,EAAC,WAAW,EAAE,MAAM,2CAA2C,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAC,kCAAkC,EAAC,kCAAkC,EAAC,yBAAyB,EAAC,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEjM,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrF;AAGD,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,OAAO,GAAE,2BAAgC,GACvC,oBAAoB,CAsFtB;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,2BAA2B,CAEpH"}

package/dist/surfaces/svelte/client/runtime.js

@@ -0,0 +1,107 @@
+/** Portable account client. Values are returned only by the explicit reveal operation. */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { accountOriginUndeclared, loadSecretsConfig } from "../../../domain/config/load.js";
+import { listSecretsFilterSchema, revealResponseSchema, rotateResponseSchema } from "../../../schemas/managed/account-client.schema.js";
+import { managedCreateTransportSchema, secretCollectionEnvelopeSchema, secretItemEnvelopeSchema, updateSecretInputSchema } from "../../../schemas/managed/secret.schema.js";
+import { isDevelopmentHost } from "../../../transport/secure-url.js";
+import { createAccountTransport } from "../account/account-transport.js";
+export { secretSummarySchema } from "../../../schemas/managed/account-client.schema.js";
+export { ACCOUNT_SECRETS_MAX_BODY_BYTES, ACCOUNT_SECRETS_MAX_MESSAGE_LENGTH, ACCOUNT_SECRETS_REQUEST_TIMEOUT_MS, AccountSecretsClientError, boundServerMessage } from "../account/account-errors.js";
+export async function getAccountOrigin(runtime) {
+    if (runtime) {
+        const hostOrigin = runtime.localEnvironment?.getOrigin?.();
+        if (hostOrigin)
+            return hostOrigin;
+        const declared = (await loadSecretsConfig(runtime)).accountOrigin;
+        if (declared)
+            return declared;
+    }
+    throw accountOriginUndeclared();
+}
+export function createAccountSecretsClient(origin, authorization, options = {}) {
+    const { buildHeaders, url, send, readJsonOrThrow, expectOkOrThrow } = createAccountTransport(origin, authorization, options);
+    const client = {
+        async list(filter) {
+            const parsed = listSecretsFilterSchema.safeParse(filter ?? {});
+            if (!parsed.success)
+                throw invalidMutation();
+            filter = parsed.data;
+            const response = await send('Failed to list secrets', url('/api/secrets', {
+                scope: filter?.scope,
+                scopeId: filter?.scopeId,
+                providerType: filter?.providerType,
+                limit: filter?.limit,
+                offset: filter?.offset
+            }), { method: 'GET', headers: buildHeaders() });
+            const payload = await readJsonOrThrow(response, secretCollectionEnvelopeSchema, 'Failed to list secrets');
+            return payload.results;
+        },
+        async get(id) {
+            const response = await send('Failed to load secret', url(`/api/secrets/${encodeURIComponent(id)}`), {
+                method: 'GET',
+                headers: buildHeaders()
+            });
+            const payload = await readJsonOrThrow(response, secretItemEnvelopeSchema, 'Failed to load secret');
+            return payload.result;
+        },
+        async create(input) {
+            const parsed = managedCreateTransportSchema.safeParse(input);
+            if (!parsed.success)
+                throw invalidMutation();
+            const response = await send('Failed to create secret', url('/api/secrets'), {
+                method: 'POST',
+                headers: buildHeaders('application/json'),
+                body: JSON.stringify(parsed.data)
+            });
+            const payload = await readJsonOrThrow(response, secretItemEnvelopeSchema, 'Failed to create secret');
+            return payload.result;
+        },
+        async update(id, patch) {
+            const parsed = updateSecretInputSchema.safeParse(patch);
+            if (!parsed.success)
+                throw invalidMutation();
+            const response = await send('Failed to update secret', url(`/api/secrets/${encodeURIComponent(id)}`), {
+                method: 'PATCH',
+                headers: buildHeaders('application/json'),
+                body: JSON.stringify(parsed.data)
+            });
+            const payload = await readJsonOrThrow(response, secretItemEnvelopeSchema, 'Failed to update secret');
+            return payload.result;
+        },
+        async delete(id) {
+            const response = await send('Failed to delete secret', url(`/api/secrets/${encodeURIComponent(id)}`), {
+                method: 'DELETE',
+                headers: buildHeaders()
+            });
+            await expectOkOrThrow(response, 'Failed to delete secret');
+        },
+        async rotate(id, newValue) {
+            const response = await send('Failed to rotate secret', url(`/api/secrets/${encodeURIComponent(id)}/rotate`), {
+                method: 'POST',
+                headers: buildHeaders('application/json'),
+                body: JSON.stringify({ newValue })
+            });
+            await readJsonOrThrow(response, rotateResponseSchema, 'Failed to rotate secret');
+            // Rotation acknowledges success; fetch the updated descriptor from the item route.
+            return client.get(id);
+        },
+        async reveal(id) {
+            const response = await send('Failed to reveal secret', url(`/api/secrets/${encodeURIComponent(id)}/reveal`), {
+                method: 'POST',
+                headers: buildHeaders()
+            });
+            const payload = await readJsonOrThrow(response, revealResponseSchema, 'Failed to reveal secret');
+            return { id: payload.id ?? id, value: payload.value };
+        }
+    };
+    return client;
+}
+/** The client options a runtime implies: loopback http only on its development host. */
+export function accountSecretsClientOptionsFor(runtime) {
+    return { allowLoopbackHttp: runtime ? isDevelopmentHost(runtime) : false };
+}
+function invalidMutation() {
+    return new CapabilityError('The managed secret input is invalid.', 'INVALID_INPUT', {
+        reason: 'managed-secret-input-invalid', retryable: false
+    });
+}

package/dist/surfaces/svelte/components/RevealSecretDialog.svelte

@@ -0,0 +1,181 @@
+<script lang="ts">
+	import { settle } from '@vibesdotdev/kernel';
+	import { Button } from '@vibesdotdev/kit/components/ui/button';
+	import { Icon } from '@vibesdotdev/kit/components/icon';
+	import {
+		Dialog,
+		DialogContent,
+		DialogDescription,
+		DialogFooter,
+		DialogHeader,
+		DialogTitle
+	} from '@vibesdotdev/kit/components/ui/dialog';
+	import { getLogger } from '@vibesdotdev/logging';
+	import {
+		type AccountSecretsClient,
+		type SecretSummary
+	} from '../client/runtime';
+
+	type Props = {
+		open: boolean;
+		secret: SecretSummary | null;
+		client: AccountSecretsClient;
+		onClose?: () => void;
+		/** Seconds to keep value in clipboard before clearing. */
+		clearAfterSeconds?: number;
+	};
+
+	let props: Props = $props();
+
+	const openValue = $derived(props.open);
+	const secretValue = $derived(props.secret);
+	const clearAfter = $derived(props.clearAfterSeconds ?? 30);
+
+	type Phase = 'confirm' | 'loading' | 'revealed' | 'error';
+	let phase = $state<Phase>('confirm');
+	let revealedValue = $state<string | null>(null);
+	let errorMessage = $state<string | null>(null);
+	let clipboardTimer = $state<ReturnType<typeof setTimeout> | null>(null);
+	let clipboardArmed = $state(false);
+	let lastSeenSecretId = $state<string | null>(null);
+
+	const logger = getLogger('secrets.reveal');
+
+	$effect(() => {
+		const id = secretValue?.id ?? null;
+		if (id !== lastSeenSecretId) {
+			lastSeenSecretId = id;
+			phase = 'confirm';
+			revealedValue = null;
+			errorMessage = null;
+			clearClipboardTimer();
+		}
+		if (!openValue) {
+			// closing wipes any in-memory reveal
+			revealedValue = null;
+			phase = 'confirm';
+			clearClipboardTimer();
+		}
+	});
+
+	function clearClipboardTimer() {
+		if (clipboardTimer) {
+			clearTimeout(clipboardTimer);
+			clipboardTimer = null;
+		}
+		clipboardArmed = false;
+	}
+
+	function scheduleClipboardWipe() {
+		clearClipboardTimer();
+		clipboardArmed = true;
+		clipboardTimer = setTimeout(async () => {
+			const outcome = await settle(async () => {
+				if (globalThis.navigator?.clipboard) {
+					await globalThis.navigator.clipboard.writeText('');
+				}
+			});
+			if (!outcome.ok) {
+				logger.warn('Clipboard wipe failed', { reason: 'secrets-surface-operation-failed' });
+			}
+			clipboardArmed = false;
+		}, clearAfter * 1000);
+	}
+
+	async function confirmReveal() {
+		const secret = secretValue;
+		if (!secret) return;
+		phase = 'loading';
+		errorMessage = null;
+		logger.info('Reveal confirmed');
+		const outcome = await settle(async () => {
+			const result = await props.client.reveal(secret.id);
+			revealedValue = result.value;
+			phase = 'revealed';
+		});
+		if (!outcome.ok) {
+			errorMessage = 'Failed to reveal secret';
+			phase = 'error';
+			logger.warn('Reveal failed', { reason: 'secrets-surface-operation-failed' });
+		}
+	}
+
+	async function copyToClipboard() {
+		const value = revealedValue;
+		if (!value) return;
+		const outcome = await settle(async () => {
+			if (globalThis.navigator?.clipboard) {
+				await globalThis.navigator.clipboard.writeText(value);
+				scheduleClipboardWipe();
+				logger.info('Secret copied to clipboard', {
+					wipeScheduled: true
+				});
+			}
+		});
+		if (!outcome.ok) {
+			logger.warn('Clipboard copy failed', {
+				reason: 'secrets-surface-operation-failed'
+			});
+		}
+	}
+
+	function close() {
+		clearClipboardTimer();
+		revealedValue = null;
+		phase = 'confirm';
+		props.onClose?.();
+	}
+
+	function handleOpenChange(next: boolean) {
+		if (!next) close();
+	}
+</script>
+
+<Dialog open={openValue} onOpenChange={handleOpenChange}>
+	<DialogContent>
+		<DialogHeader>
+			<DialogTitle>Reveal secret</DialogTitle>
+			<DialogDescription>
+				{secretValue ? `You are about to reveal the value for "${secretValue.name}".` : ''}
+				This action is recorded in the audit log.
+			</DialogDescription>
+		</DialogHeader>
+
+		{#if phase === 'confirm'}
+			<div class="rounded-md border border-amber-200 bg-amber-50 p-3 text-sm text-amber-900 dark:border-amber-800 dark:bg-amber-900/20 dark:text-amber-200">
+				<Icon icon="lucide:shield-alert" class="mr-2 inline h-4 w-4" />
+				Only reveal a secret when you must paste it into another system. Close this dialog
+				when you're done — the value is wiped on close.
+			</div>
+		{:else if phase === 'loading'}
+			<p class="text-sm text-muted-foreground">Loading…</p>
+		{:else if phase === 'revealed' && revealedValue !== null}
+			<div class="rounded-md border bg-muted p-3 font-mono text-sm break-all" aria-live="polite">
+				{revealedValue}
+			</div>
+			<p class="text-xs text-muted-foreground">
+				{clipboardArmed
+					? `Clipboard will be cleared in ${clearAfter}s.`
+					: 'Click "Copy" to copy the value to your clipboard.'}
+			</p>
+		{:else if phase === 'error' && errorMessage}
+			<p class="text-sm text-destructive" role="alert">{errorMessage}</p>
+		{/if}
+
+		<DialogFooter>
+			{#if phase === 'confirm'}
+				<Button variant="ghost" onclick={close}>Cancel</Button>
+				<Button onclick={confirmReveal} disabled={!secretValue}>
+					<Icon icon="lucide:eye" class="mr-1 h-4 w-4" />Reveal
+				</Button>
+			{:else if phase === 'revealed'}
+				<Button variant="outline" onclick={copyToClipboard}>
+					<Icon icon="lucide:copy" class="mr-1 h-4 w-4" />Copy
+				</Button>
+				<Button onclick={close}>Done</Button>
+			{:else}
+				<Button onclick={close}>Close</Button>
+			{/if}
+		</DialogFooter>
+	</DialogContent>
+</Dialog>

package/dist/surfaces/svelte/components/RevealSecretDialog.svelte.d.ts

@@ -0,0 +1,13 @@
+import { type AccountSecretsClient, type SecretSummary } from '../client/runtime';
+type Props = {
+    open: boolean;
+    secret: SecretSummary | null;
+    client: AccountSecretsClient;
+    onClose?: () => void;
+    /** Seconds to keep value in clipboard before clearing. */
+    clearAfterSeconds?: number;
+};
+declare const RevealSecretDialog: import("svelte").Component<Props, {}, "">;
+type RevealSecretDialog = ReturnType<typeof RevealSecretDialog>;
+export default RevealSecretDialog;
+//# sourceMappingURL=RevealSecretDialog.svelte.d.ts.map

package/dist/surfaces/svelte/components/RevealSecretDialog.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevealSecretDialog.svelte.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/components/RevealSecretDialog.svelte.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAG3B,KAAK,KAAK,GAAG;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAwKH,QAAA,MAAM,kBAAkB,2CAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}