@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/svelte/loaders.js

@@ -0,0 +1,64 @@
+/**
+ * SvelteKit `load` helpers for `@vibesdotdev/secrets/svelte`.
+ *
+ * Exported under the `./loaders` subpath so SvelteKit keeps server-only code
+ * out of the browser bundle (see SURFACE-PACKAGE-CONVENTIONS §2.5 / §2.7).
+ *
+ * Secret values live in platform-web's `src/server/` tree (the SecretService +
+ * encryption pipeline). Per §2.5.1, we accept the data sources via
+ * dependency-injected fetchers so consumers (platform-web today, other admin
+ * surfaces tomorrow) wire their own `src/server/` modules without forking the
+ * loader.
+ *
+ * Critical contract: this loader returns DESCRIPTORS ONLY. Values never appear
+ * in `+page.server.ts` / `+layout.server.ts` payloads — they're fetched
+ * on-demand via the reveal endpoint, audited per-call.
+ */
+/**
+ * Compose the secrets layout payload for a SvelteKit `+page.server.ts` or
+ * `+layout.server.ts`. Returns a serializable object the consuming app spreads
+ * into its own `LayoutServerLoad`/`PageServerLoad` return. The client-side
+ * `getSecretsState().seedInitial()` consumes the same fields.
+ *
+ * A failing fetcher is NOT turned into an empty list: its failure propagates to
+ * SvelteKit, because an empty inventory that looks like success hides the
+ * failure. (No signed-in user, or no scope, is the one empty answer: nothing is
+ * asked.)
+ *
+ * Usage:
+ *
+ *   import { loadSecretsLayoutData } from '@vibesdotdev/secrets/svelte/loaders';
+ *
+ *   export const load: PageServerLoad = async ({ locals }) => {
+ *     const data = await loadSecretsLayoutData({
+ *       user: locals.user,
+ *       scope: 'platform',
+ *       fetchers: {
+ *         listSecrets: ({ userId, scope, scopeId, limit }) =>
+ *           secretService.list({ scope, scopeId, limit }, secretContextFor(userId)),
+ *       },
+ *     });
+ *     return data;
+ *   };
+ */
+export async function loadSecretsLayoutData(input) {
+    const { user, scope, scopeId, fetchers, limit } = input;
+    if (!user || !scope) {
+        return {
+            secrets: [],
+            scope: scope ?? null,
+            scopeId: scopeId ?? null
+        };
+    }
+    const secrets = await fetchers.listSecrets({
+        userId: user.id,
+        scope,
+        scopeId: scopeId ?? undefined,
+        limit
+    });
+    return {
+        secrets,
+        scope,
+        scopeId: scopeId ?? null
+    };
+}

package/dist/surfaces/svelte/state-context.d.ts

@@ -0,0 +1,6 @@
+import { type SecretsState } from './state.svelte.ts';
+/** Explicit adapter also usable by non-component browser/SSR hosts. */
+export declare function secretsStateForContext(scope?: WeakKey, browserDocument?: WeakKey): SecretsState;
+/** SSR never consults a process default runtime or a browser fallback. */
+export declare function getSecretsState(): SecretsState;
+//# sourceMappingURL=state-context.d.ts.map

package/dist/surfaces/svelte/state-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-context.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/state-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEvE,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,YAAY,CAQ/F;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,YAAY,CAE9C"}

package/dist/surfaces/svelte/state-context.js

@@ -0,0 +1,19 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { peekRuntimeSvelteContext } from '@vibesdotdev/surface-sveltekit/svelte/state';
+import { secretsStateFor } from "./state.svelte.js";
+/** Explicit adapter also usable by non-component browser/SSR hosts. */
+export function secretsStateForContext(scope, browserDocument) {
+    if (scope)
+        return secretsStateFor(scope);
+    if (browserDocument)
+        return secretsStateFor(browserDocument);
+    throw new CapabilityError('No runtime scope encloses this component.', 'UNAVAILABLE', {
+        reason: 'secrets-state-no-scope',
+        retryable: false,
+        recoveryHint: 'Provide a runtime Svelte context around secrets components.'
+    });
+}
+/** SSR never consults a process default runtime or a browser fallback. */
+export function getSecretsState() {
+    return secretsStateForContext(peekRuntimeSvelteContext(), 'document' in globalThis ? globalThis.document : undefined);
+}

package/dist/surfaces/svelte/state-owner.d.ts

@@ -0,0 +1,173 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import type { SecretsStateReader } from './state-reader.svelte.ts';
+import type { SecretsState } from './state.svelte.ts';
+/** Runtime lifetime for the explicit Svelte surface, without a universal Svelte import. */
+declare class SecretsSurfaceClient extends BaseRuntimeClient<VibesRuntime> {
+    private readonly states;
+    private readonly scoped;
+    stateFor(scope: WeakKey, create: () => SecretsState): SecretsState;
+    retain(state: SecretsStateReader): () => void;
+    account(origin: string, authorization?: string): {
+        list: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
+            scope: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                user: "user";
+                env: "env";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>>;
+            scopeId: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            providerType: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            limit: import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>;
+            offset: import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>;
+        }, import("zod/v4/core").$strip>>], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodArray<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            createdAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            updatedAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            lastUsedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            lastRotatedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            rotationPolicy: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, import("zod/v4/core").$strip>>>>;
+        get: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            createdAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            updatedAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            lastUsedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            lastRotatedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            rotationPolicy: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, import("zod/v4/core").$strip>>>;
+        create: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodObject<{
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            value: import("zod/v4").ZodString;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+            id: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            description: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+        }, import("zod/v4/core").$strip>], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            createdAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            updatedAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            lastUsedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            lastRotatedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            rotationPolicy: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, import("zod/v4/core").$strip>>>;
+        update: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString, import("zod/v4").ZodObject<{
+            name: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            value: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+        }, import("zod/v4/core").$strip>], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            createdAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            updatedAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            lastUsedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            lastRotatedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            rotationPolicy: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, import("zod/v4/core").$strip>>>;
+        delete: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodVoid>>;
+        rotate: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString, import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            name: import("zod/v4").ZodString;
+            scope: import("zod/v4").ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: import("zod/v4").ZodString;
+            providerType: import("zod/v4").ZodString;
+            createdAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            updatedAt: import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>;
+            lastUsedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            lastRotatedAt: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodDate]>>>;
+            rotationPolicy: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodNullable<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, import("zod/v4/core").$strip>>>;
+        reveal: import("zod/v4/core").$InferOuterFunctionType<import("zod/v4").ZodTuple<readonly [import("zod/v4").ZodString], null>, import("zod/v4").ZodPromise<import("zod/v4").ZodObject<{
+            id: import("zod/v4").ZodString;
+            value: import("zod/v4").ZodString;
+        }, import("zod/v4/core").$strip>>>;
+    };
+    protected onDispose(): void;
+}
+export declare function getSecretsSurfaceClient(runtime: VibesRuntime): Promise<SecretsSurfaceClient>;
+export declare function peekSecretsSurfaceClient(runtime: VibesRuntime): SecretsSurfaceClient | undefined;
+export {};
+//# sourceMappingURL=state-owner.d.ts.map

package/dist/surfaces/svelte/state-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-owner.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/state-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAqC,MAAM,4BAA4B,CAAC;AAElG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,2FAA2F;AAC3F,cAAM,oBAAqB,SAAQ,iBAAiB,CAAC,YAAY,CAAC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,GAAG,YAAY;IASlE,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAQ7C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAI3B,SAAS,IAAI,IAAI;CAIpC;AAWD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAIlG;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,YAAY,GAAG,oBAAoB,GAAG,SAAS,CAEhG"}

package/dist/surfaces/svelte/state-owner.js

@@ -0,0 +1,49 @@
+import { CapabilityError, createRuntimePlugin } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, getVibesClient, tryGetVibesClient } from '@vibesdotdev/kernel/client';
+import { accountSecretsClientOptionsFor, createAccountSecretsClient } from "./client/runtime.js";
+/** Runtime lifetime for the explicit Svelte surface, without a universal Svelte import. */
+class SecretsSurfaceClient extends BaseRuntimeClient {
+    states = new Set();
+    scoped = new WeakMap();
+    stateFor(scope, create) {
+        const existing = this.scoped.get(scope);
+        if (existing)
+            return existing;
+        const state = create();
+        this.scoped.set(scope, state);
+        this.retain(state);
+        return state;
+    }
+    retain(state) {
+        if (this.runtime.lifecycle.signal.aborted)
+            throw new CapabilityError('Secrets state runtime has been disposed.', 'UNAVAILABLE', {
+                reason: 'secrets-state-disposed', retryable: false
+            });
+        this.states.add(state);
+        return () => { this.states.delete(state); };
+    }
+    account(origin, authorization) {
+        return createAccountSecretsClient(origin, authorization, accountSecretsClientOptionsFor(this.runtime));
+    }
+    onDispose() {
+        for (const state of this.states)
+            state.dispose();
+        this.states.clear();
+    }
+}
+const surfacePlugin = createRuntimePlugin({
+    id: 'secrets-svelte-state',
+    name: 'Secrets Svelte state lifecycle',
+    onRegister(runtime) {
+        runtime.registerDescriptor('runtime/client', { id: 'secrets.svelte', kind: 'runtime/client' });
+        runtime.registerLoader('runtime/client', 'secrets.svelte', async () => ({ impl: SecretsSurfaceClient }));
+    }
+});
+export async function getSecretsSurfaceClient(runtime) {
+    await runtime.registerPlugin(surfacePlugin);
+    return tryGetVibesClient('secrets.svelte', runtime)
+        ?? getVibesClient('secrets.svelte', runtime);
+}
+export function peekSecretsSurfaceClient(runtime) {
+    return tryGetVibesClient('secrets.svelte', runtime);
+}

package/dist/surfaces/svelte/state-reader.svelte.d.ts

@@ -0,0 +1,59 @@
+import type { RuntimeSvelteStore } from '@vibesdotdev/surface-sveltekit/svelte/state';
+import { type AccountSecretsClient, type ListSecretsFilter } from './client/runtime.ts';
+import type { SecretsStateInitOptions } from '../../schemas/ui/svelte/state.schema.ts';
+import { getSecretsSurfaceClient } from './state-owner.ts';
+export declare class SecretsStateReader {
+    /** Descriptors only; plaintext reveal values never enter this state. */
+    secrets: {
+        id: string;
+        name: string;
+        scope: "user" | "platform" | "project" | "org";
+        scopeId: string;
+        providerType: string;
+        createdAt: string | number | Date;
+        updatedAt: string | number | Date;
+        lastUsedAt?: string | number | Date | null | undefined;
+        lastRotatedAt?: string | number | Date | null | undefined;
+        rotationPolicy?: "never" | "manual" | "monthly" | "quarterly" | "yearly" | undefined;
+        metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | null | undefined;
+    }[];
+    activeBackend: "user" | "env" | "platform" | "project" | "org" | null;
+    initialized: boolean;
+    loading: boolean;
+    error: string | null;
+    protected client: AccountSecretsClient | null;
+    protected inflight: Promise<void> | null;
+    protected currentFilter: ListSecretsFilter | undefined;
+    protected generation: number;
+    protected disposed: boolean;
+    private runtimeScope?;
+    private releaseOwner?;
+    private releaseRuntime?;
+    private runtimeSignal?;
+    get count(): number;
+    get byProvider(): Record<string, {
+        id: string;
+        name: string;
+        scope: "user" | "platform" | "project" | "org";
+        scopeId: string;
+        providerType: string;
+        createdAt: string | number | Date;
+        updatedAt: string | number | Date;
+        lastUsedAt?: string | number | Date | null | undefined;
+        lastRotatedAt?: string | number | Date | null | undefined;
+        rotationPolicy?: "never" | "manual" | "monthly" | "quarterly" | "yearly" | undefined;
+        metadata?: Record<string, import("@vibesdotdev/kernel/bootstrap").JsonValue> | null | undefined;
+    }[]>;
+    setRuntimeScope(scope: RuntimeSvelteStore): void;
+    private ownRuntime;
+    init(options?: SecretsStateInitOptions): Promise<void>;
+    private load;
+    protected adoptOwner(_owner: Awaited<ReturnType<typeof getSecretsSurfaceClient>>): void;
+    seedInitial(options: SecretsStateInitOptions): void;
+    refresh(filter?: ListSecretsFilter): Promise<void>;
+    protected isCurrent(generation: number): boolean;
+    protected assertActive(): void;
+    protected requireClient(): AccountSecretsClient;
+    dispose(): void;
+}
+//# sourceMappingURL=state-reader.svelte.d.ts.map

package/dist/surfaces/svelte/state-reader.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-reader.svelte.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/state-reader.svelte.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAGtF,OAAO,EAEN,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EACjD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,qBAAa,kBAAkB;IAC9B,wEAAwE;IACxE,OAAO;;;;;;;;;;;;QAA+B;IACtC,aAAa,yDAAoC;IACjD,WAAW,UAAiB;IAC5B,OAAO,UAAiB;IACxB,KAAK,gBAA+B;IAEpC,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAQ;IACrD,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAQ;IAChD,SAAS,CAAC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvD,SAAS,CAAC,UAAU,SAAK;IACzB,SAAS,CAAC,QAAQ,UAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAa;IAClC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAc;IAEpC,IAAI,KAAK,IAAI,MAAM,CAAgC;IAEnD,IAAI,UAAU;;;;;;;;;;;;SAIb;IAED,eAAe,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAKhD,OAAO,CAAC,UAAU;IAcZ,IAAI,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;YAsBlD,IAAI;IA+BlB,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,GAAG,IAAI;IAEvF,WAAW,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM7C,OAAO,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBxD,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIhD,SAAS,CAAC,YAAY,IAAI,IAAI;IAM9B,SAAS,CAAC,aAAa,IAAI,oBAAoB;IAQ/C,OAAO,IAAI,IAAI;CAiBf"}

package/dist/surfaces/svelte/state-reader.svelte.js

@@ -0,0 +1,176 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { createAccountSecretsClient, getAccountOrigin } from "./client/runtime.js";
+import { getSecretsSurfaceClient } from "./state-owner.js";
+const logger = getLogger('secrets.state');
+export class SecretsStateReader {
+    /** Descriptors only; plaintext reveal values never enter this state. */
+    secrets = $state([]);
+    activeBackend = $state(null);
+    initialized = $state(false);
+    loading = $state(false);
+    error = $state(null);
+    client = null;
+    inflight = null;
+    currentFilter;
+    generation = 0;
+    disposed = false;
+    runtimeScope;
+    releaseOwner;
+    releaseRuntime;
+    runtimeSignal;
+    get count() { return this.secrets.length; }
+    get byProvider() {
+        const out = {};
+        for (const secret of this.secrets)
+            (out[secret.providerType] ??= []).push(secret);
+        return out;
+    }
+    setRuntimeScope(scope) {
+        this.runtimeScope = scope;
+        if (scope.runtime)
+            this.ownRuntime(scope.runtime);
+    }
+    ownRuntime(runtime) {
+        const signal = runtime.lifecycle.signal;
+        if (this.runtimeSignal === signal)
+            return;
+        this.releaseRuntime?.();
+        this.runtimeSignal = signal;
+        if (signal.aborted) {
+            this.dispose();
+            return;
+        }
+        const dispose = () => { this.dispose(); };
+        signal.addEventListener('abort', dispose, { once: true });
+        this.releaseRuntime = () => { signal.removeEventListener('abort', dispose); };
+    }
+    async init(options = {}) {
+        this.assertActive();
+        options = { ...options, runtime: options.runtime ?? this.runtimeScope?.runtime };
+        if (this.initialized) {
+            this.seedInitial(options);
+            return;
+        }
+        if (this.inflight)
+            return this.inflight;
+        if (options.runtime)
+            this.ownRuntime(options.runtime);
+        this.assertActive();
+        this.seedInitial(options);
+        const generation = this.generation;
+        const run = this.load(options, generation);
+        this.inflight = run;
+        try {
+            await run;
+        }
+        finally {
+            if (this.inflight === run)
+                this.inflight = null;
+        }
+    }
+    async load(options, generation) {
+        this.loading = true;
+        this.error = null;
+        try {
+            const owner = options.runtime ? await getSecretsSurfaceClient(options.runtime) : undefined;
+            if (!this.isCurrent(generation))
+                return;
+            this.releaseOwner = owner?.retain(this);
+            if (owner)
+                this.adoptOwner(owner);
+            const origin = options.accountOrigin ?? await getAccountOrigin(options.runtime);
+            if (!this.isCurrent(generation))
+                return;
+            const client = options.client ?? (owner
+                ? owner.account(origin, options.authorization)
+                : createAccountSecretsClient(origin, options.authorization));
+            this.client = client;
+            this.currentFilter = options.filter;
+            const secrets = await client.list(options.filter);
+            if (!this.isCurrent(generation))
+                return;
+            this.secrets = secrets;
+            this.initialized = true;
+        }
+        catch (err) {
+            if (this.isCurrent(generation)) {
+                this.error = 'Secrets could not be loaded.';
+                this.initialized = true;
+                logger.warn('Secrets init failed', { reason: 'secrets-state-load-failed', typed: err instanceof CapabilityError });
+            }
+            throw err;
+        }
+        finally {
+            if (this.isCurrent(generation))
+                this.loading = false;
+        }
+    }
+    adoptOwner(_owner) { }
+    seedInitial(options) {
+        this.assertActive();
+        if (options.initialSecrets)
+            this.secrets = options.initialSecrets;
+        if (options.activeBackend !== undefined)
+            this.activeBackend = options.activeBackend;
+    }
+    async refresh(filter) {
+        const client = this.requireClient();
+        const generation = this.generation;
+        const effective = filter ?? this.currentFilter;
+        this.loading = true;
+        this.error = null;
+        try {
+            const secrets = await client.list(effective);
+            if (!this.isCurrent(generation))
+                return;
+            this.secrets = secrets;
+            this.currentFilter = effective;
+        }
+        catch (err) {
+            if (this.isCurrent(generation)) {
+                this.error = 'Secrets could not be refreshed.';
+                logger.warn('Secrets refresh failed', { reason: 'secrets-state-refresh-failed', typed: err instanceof CapabilityError });
+            }
+            throw err;
+        }
+        finally {
+            if (this.isCurrent(generation))
+                this.loading = false;
+        }
+    }
+    isCurrent(generation) {
+        return !this.disposed && generation === this.generation;
+    }
+    assertActive() {
+        if (this.disposed)
+            throw new CapabilityError('Secrets state has been disposed.', 'UNAVAILABLE', {
+                reason: 'secrets-state-disposed', retryable: false
+            });
+    }
+    requireClient() {
+        this.assertActive();
+        if (!this.client)
+            throw new CapabilityError('Secrets state is not initialized. Mount <SecretsLoader /> first.', 'UNAVAILABLE', {
+                reason: 'secrets-state-uninitialized', retryable: false
+            });
+        return this.client;
+    }
+    dispose() {
+        this.disposed = true;
+        this.generation++;
+        this.releaseOwner?.();
+        this.releaseOwner = undefined;
+        this.releaseRuntime?.();
+        this.releaseRuntime = undefined;
+        this.runtimeSignal = undefined;
+        this.client = null;
+        this.inflight = null;
+        this.currentFilter = undefined;
+        this.initialized = false;
+        this.loading = false;
+        this.secrets = [];
+        this.activeBackend = null;
+        this.error = null;
+    }
+}

package/dist/surfaces/svelte/state.svelte.d.ts

@@ -0,0 +1,30 @@
+import { getSecretsSurfaceClient } from './state-owner.ts';
+import { SecretsStateReader } from './state-reader.svelte.ts';
+export { type SecretsStateInitOptions } from "../../schemas/ui/svelte/state.schema.ts";
+import { type SecretInput, type SecretSummary } from './client/runtime.ts';
+export declare class SecretsState extends SecretsStateReader {
+    private readonly surfaceScope?;
+    constructor(surfaceScope?: WeakKey | undefined);
+    protected adoptOwner(owner: Awaited<ReturnType<typeof getSecretsSurfaceClient>>): void;
+    /**
+     * Fetch the value for a single secret. The value is returned to the caller
+     * and IS NOT stored in $state. Callers must render it transiently and avoid
+     * persisting it. Every call is audited server-side.
+     */
+    reveal(id: string): Promise<{
+        id: string;
+        value: string;
+    }>;
+    /** Create a secret. Updates local descriptors on success. */
+    create(input: SecretInput): Promise<SecretSummary>;
+    /** Update an existing secret (key/metadata or value). Refreshes locally. */
+    update(id: string, patch: Partial<SecretInput>): Promise<SecretSummary>;
+    /** Rotate a secret. Updates local descriptors on success. */
+    rotate(id: string, newValue: string): Promise<SecretSummary>;
+    /** Remove a secret. Updates local descriptors on success. */
+    remove(id: string): Promise<void>;
+}
+/** A fresh, independent state. */
+export declare function createSecretsState(): SecretsState;
+export declare function secretsStateFor(scope: WeakKey): SecretsState;
+//# sourceMappingURL=state.svelte.d.ts.map

package/dist/surfaces/svelte/state.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.svelte.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAA4B,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAKvF,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,aAAa,EACjB,MAAM,qBAAqB,CAAC;AAI7B,qBAAa,YAAa,SAAQ,kBAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAb,YAAY,CAAC,EAAE,OAAO,YAAA;cAEhC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,GAAG,IAAI;IAS/F;;;;OAIG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAahE,6DAA6D;IACvD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IASxD,4EAA4E;IACtE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAa7E,6DAA6D;IACvD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE,6DAA6D;IACvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQvC;AAED,kCAAkC;AAClC,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAMD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CA0B5D"}