@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/surfaces/svelte/state.svelte.js

@@ -0,0 +1,121 @@
+import { RuntimeSvelteStore } from '@vibesdotdev/surface-sveltekit/svelte/state';
+import { peekSecretsSurfaceClient } from "./state-owner.js";
+import { secretsStateScopeSchema } from "../../schemas/ui/svelte/state.schema.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { SecretsStateReader } from "./state-reader.svelte.js";
+/** Reactive descriptors owned by an explicit surface scope and its runtime lifecycle. */
+import { getLogger } from '@vibesdotdev/logging';
+const logger = getLogger('secrets.state');
+export class SecretsState extends SecretsStateReader {
+    surfaceScope;
+    constructor(surfaceScope) {
+        super();
+        this.surfaceScope = surfaceScope;
+    }
+    adoptOwner(owner) {
+        if (!(this.surfaceScope instanceof RuntimeSvelteStore) || this.surfaceScope.runtime !== owner.runtime)
+            return;
+        owner.stateFor(this.surfaceScope, () => this);
+        // SAFETY: this module alone writes stateKey on the validated surface scope.
+        const pending = this.surfaceScope;
+        delete pending[stateKey];
+    }
+    /**
+     * Fetch the value for a single secret. The value is returned to the caller
+     * and IS NOT stored in $state. Callers must render it transiently and avoid
+     * persisting it. Every call is audited server-side.
+     */
+    async reveal(id) {
+        const client = this.requireClient();
+        logger.info('Secret reveal requested', { operation: 'reveal' });
+        try {
+            const result = await client.reveal(id);
+            logger.info('Secret reveal succeeded', { operation: 'reveal' });
+            return result;
+        }
+        catch (err) {
+            logger.warn('Secret reveal failed', { reason: 'secrets-state-reveal-failed' });
+            throw err;
+        }
+    }
+    /** Create a secret. Updates local descriptors on success. */
+    async create(input) {
+        const client = this.requireClient();
+        const generation = this.generation;
+        logger.info('Secret create requested', { operation: 'create' });
+        const created = await client.create(input);
+        if (this.isCurrent(generation))
+            this.secrets = [...this.secrets, created];
+        return created;
+    }
+    /** Update an existing secret (key/metadata or value). Refreshes locally. */
+    async update(id, patch) {
+        const client = this.requireClient();
+        const generation = this.generation;
+        logger.info('Secret update requested', {
+            changesName: patch.name !== undefined,
+            changesValue: patch.value !== undefined,
+            changesMetadata: patch.metadata !== undefined
+        });
+        const updated = await client.update(id, patch);
+        if (this.isCurrent(generation))
+            this.secrets = this.secrets.map((s) => (s.id === id ? updated : s));
+        return updated;
+    }
+    /** Rotate a secret. Updates local descriptors on success. */
+    async rotate(id, newValue) {
+        const client = this.requireClient();
+        const generation = this.generation;
+        logger.info('Secret rotate requested', { operation: 'rotate' });
+        const updated = await client.rotate(id, newValue);
+        if (this.isCurrent(generation))
+            this.secrets = this.secrets.map((s) => (s.id === id ? updated : s));
+        return updated;
+    }
+    /** Remove a secret. Updates local descriptors on success. */
+    async remove(id) {
+        const client = this.requireClient();
+        const generation = this.generation;
+        logger.info('Secret delete requested', { operation: 'delete' });
+        await client.delete(id);
+        if (this.isCurrent(generation))
+            this.secrets = this.secrets.filter((s) => s.id !== id);
+    }
+}
+/** A fresh, independent state. */
+export function createSecretsState() {
+    return new SecretsState();
+}
+// The explicit surface scope owns its adapter, including before runtime activation.
+// No module owns a mutable state or a runtime-keyed cache.
+const stateKey = Symbol('secrets.surface-state');
+export function secretsStateFor(scope) {
+    const parsed = secretsStateScopeSchema.safeParse(scope);
+    if (!parsed.success)
+        throw new CapabilityError('A surface object scope is required.', 'UNAVAILABLE', {
+            reason: 'secrets-state-no-scope', retryable: false
+        });
+    scope = parsed.data;
+    // SAFETY: the boundary validates an object identity; this module alone writes stateKey.
+    const owned = parsed.data;
+    const runtime = scope instanceof RuntimeSvelteStore ? scope.runtime : undefined;
+    const owner = runtime ? peekSecretsSurfaceClient(runtime) : undefined;
+    if (owner) {
+        const state = owner.stateFor(scope, () => owned[stateKey] ?? new SecretsState(scope));
+        if (scope instanceof RuntimeSvelteStore)
+            state.setRuntimeScope(scope);
+        delete owned[stateKey];
+        return state;
+    }
+    if (!owned[stateKey]) {
+        const state = new SecretsState(scope);
+        if (scope instanceof RuntimeSvelteStore)
+            state.setRuntimeScope(scope);
+        Object.defineProperty(owned, stateKey, { value: state, configurable: true });
+        // The compatibility browser adapter follows the document lifetime.
+        if ('defaultView' in scope && scope.defaultView instanceof EventTarget) {
+            scope.defaultView.addEventListener('pagehide', () => { state.dispose(); }, { once: true });
+        }
+    }
+    return owned[stateKey];
+}

package/dist/surfaces/svelte/styles.css

@@ -0,0 +1,8 @@
+/*
+ * Tailwind v4 source declaration for consumers — mirrors @vibesdotdev/kit's
+ * styles.css pattern. Apps that @import this file get this package's
+ * components scanned by their Tailwind build, so utility classes used only
+ * inside these components are emitted in the app's CSS bundle (Tailwind
+ * never scans node_modules). Paths resolve relative to this file.
+ */
+@source "./";

package/dist/surfaces/tui/components/InspectorNotices.d.ts

@@ -0,0 +1,12 @@
+import type { ReactNode } from 'react';
+export declare function SecretsContentNotice({ error }: {
+    error: string | null;
+}): ReactNode;
+export declare function SecretsUnavailablePane({ error, onRefresh }: {
+    error: string;
+    onRefresh: () => void;
+}): ReactNode;
+export declare function SecretsOpening({ onRefresh }: {
+    onRefresh: () => void;
+}): ReactNode;
+//# sourceMappingURL=InspectorNotices.d.ts.map

package/dist/surfaces/tui/components/InspectorNotices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InspectorNotices.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/InspectorNotices.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,CAanF;AAED,wBAAgB,sBAAsB,CAAC,EACtC,KAAK,EACL,SAAS,EACT,EAAE;IACF,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,IAAI,CAAC;CACtB,GAAG,SAAS,CAsBZ;AAED,wBAAgB,cAAc,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,SAAS,CAYlF"}

package/dist/surfaces/tui/components/InspectorNotices.js

@@ -0,0 +1,17 @@
+import { jsx as _jsx, jsxs as _jsxs } from "@opentui/react/jsx-runtime";
+import { DSButton, DSText, Panel } from '@vibesdotdev/tui/components/content';
+import { HStack, VStack } from '@vibesdotdev/tui/components/layout';
+import { dsBase, dsColors } from '@vibesdotdev/tui/theme';
+export function SecretsContentNotice({ error }) {
+    if (error) {
+        return (_jsx(VStack, { style: { paddingLeft: 1, paddingRight: 1, paddingTop: 1, paddingBottom: 1 }, children: _jsx("text", { style: { fg: dsColors.warning.solid }, children: `! ${error}` }) }));
+    }
+    return (_jsx(VStack, { style: { paddingLeft: 1, paddingRight: 1, paddingTop: 1, paddingBottom: 1 }, children: _jsx(DSText, { variant: "muted", children: "Values stay hidden until you confirm a reveal." }) }));
+}
+export function SecretsUnavailablePane({ error, onRefresh }) {
+    return (_jsx(Panel, { bordered: true, status: "warning", padding: "md", gap: "sm", children: _jsxs(VStack, { gap: 1, children: [_jsx("text", { style: { fg: dsColors.warning.solid }, children: "Secrets unavailable" }), _jsx("text", { style: { fg: dsBase.foreground }, children: error }), _jsx("text", { style: { fg: dsBase.mutedForeground }, children: "No secret keys or values were loaded. Register the secrets core/backend runtime plugins, or refresh after config storage is ready." }), _jsx(HStack, { gap: "xs", children: _jsx(DSButton, { label: "Refresh", variant: "ghost", color: "primary", size: "sm", onClick: onRefresh }) })] }) }));
+}
+export function SecretsOpening({ onRefresh }) {
+    return (_jsx(VStack, { padding: 2, justify: "start", style: { width: '100%', height: '100%' }, children: _jsxs(Panel, { padding: "sm", gap: "xs", status: "default", children: [_jsxs(HStack, { gap: 1, children: [_jsx(DSText, { color: dsColors.primary.solid, children: "Opening secret keys" }), _jsx(DSButton, { label: "Refresh", size: "sm", color: "neutral", variant: "ghost", onClick: onRefresh })] }), _jsx(DSText, { variant: "muted", children: "Reading the environment's key index." })] }) }));
+}
+//# sourceMappingURL=InspectorNotices.js.map

package/dist/surfaces/tui/components/InspectorNotices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InspectorNotices.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/InspectorNotices.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAC,MAAM,EAAC,KAAK,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAC,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,UAAU,oBAAoB,CAAC,EAAE,KAAK,EAA4B;IACvE,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CACN,KAAC,MAAM,IAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAClF,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,YAAG,KAAK,KAAK,EAAE,GAAQ,GAC1D,CACT,CAAC;IACH,CAAC;IACD,OAAO,CACN,KAAC,MAAM,IAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAClF,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,+DAAwD,GACvE,CACT,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACtC,KAAK,EACL,SAAS,EAIT;IACA,OAAO,CACN,KAAC,KAAK,IAAC,QAAQ,QAAC,MAAM,EAAC,SAAS,EAAC,OAAO,EAAC,IAAI,EAAC,GAAG,EAAC,IAAI,YACrD,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,oCAA4B,EACvE,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,YAAG,KAAK,GAAQ,EACtD,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,mJAGpC,EACP,KAAC,MAAM,IAAC,GAAG,EAAC,IAAI,YACf,KAAC,QAAQ,IACR,KAAK,EAAC,SAAS,EACf,OAAO,EAAC,OAAO,EACf,KAAK,EAAC,SAAS,EACf,IAAI,EAAC,IAAI,EACT,OAAO,EAAE,SAAS,GACjB,GACM,IACD,GACF,CACR,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAA6B;IACtE,OAAO,CACN,KAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAC,OAAO,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAC3E,MAAC,KAAK,IAAC,OAAO,EAAC,IAAI,EAAC,GAAG,EAAC,IAAI,EAAC,MAAM,EAAC,SAAS,aAC5C,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,KAAC,MAAM,IAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,oCAA8B,EACnE,KAAC,QAAQ,IAAC,KAAK,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,OAAO,EAAC,OAAO,EAAE,SAAS,GAAI,IAClF,EACT,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,qDAA8C,IAC9D,GACA,CACT,CAAC;AACH,CAAC"}

package/dist/surfaces/tui/components/RevealPane.d.ts

@@ -0,0 +1,41 @@
+/**
+ * RevealPane - confirmation-gated, time-limited secret reveal surface.
+ *
+ * SECURITY MODEL (mirrors `secrets-cli/src/commands/reveal.command.impl.ts`):
+ *
+ *   1. The pane starts in IDLE: nothing rendered besides instructions.
+ *   2. Pressing [v] transitions to CONFIRM: a visible TTY confirmation
+ *      prompt asks the user to press [y] to reveal or [n]/Esc to abort.
+ *   3. On [y], the pane calls `onReveal(entry.id)` - the app impl
+ *      resolves the value out-of-band via the secrets/store kind. The
+ *      promise resolves with the value AS LOCAL COMPONENT STATE ONLY.
+ *   4. RENDERED state shows the value in a single `<text>` for a
+ *      bounded countdown window (default 10s) and a "[Esc] hide now"
+ *      action. When the countdown reaches 0 OR the user hits Esc, the
+ *      value is wiped from local state and the pane returns to IDLE.
+ *
+ * The lifecycle (state, countdown, wipe) lives in `useRevealLifecycle`;
+ * this file renders it. The phase and seconds shapes live in
+ * `src/schemas/reveal.schema.ts`.
+ */
+import type { RuntimeLifecycle } from '@vibesdotdev/kernel';
+import type { ReactNode } from 'react';
+import { type RevealPhase } from '../../../schemas/ui/reveal.schema.ts';
+import type { SecretDescriptorEntry } from '../state/secrets.tui-state.descriptor.ts';
+interface RevealPaneProps {
+    lifecycle: RuntimeLifecycle;
+    entry: SecretDescriptorEntry | null;
+    /** Triggered when the active flow should change. The app impl owns key handlers. */
+    phase: RevealPhase;
+    onPhaseChange: (next: RevealPhase) => void;
+    /**
+     * Out-of-band reveal: resolves the secret value via the
+     * secrets/store kind. The value MUST NOT be logged by the caller
+     * and is held only in this component's local state.
+     */
+    onReveal: (entry: SecretDescriptorEntry) => Promise<string>;
+    revealSeconds?: number;
+}
+export declare function RevealPane({ lifecycle, entry, phase, onPhaseChange, onReveal, revealSeconds }: RevealPaneProps): ReactNode;
+export {};
+//# sourceMappingURL=RevealPane.d.ts.map

package/dist/surfaces/tui/components/RevealPane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevealPane.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/RevealPane.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAGtF,UAAU,eAAe;IACxB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAC;IACnB,aAAa,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,aAAa,EACb,QAAQ,EACR,aAAsC,EACtC,EAAE,eAAe,GAAG,SAAS,CAyF7B"}

package/dist/surfaces/tui/components/RevealPane.js

@@ -0,0 +1,35 @@
+import { jsx as _jsx, jsxs as _jsxs } from "@opentui/react/jsx-runtime";
+import { DSBadge, DSText } from '@vibesdotdev/tui/components/content';
+import { HStack, VStack } from '@vibesdotdev/tui/components/layout';
+import { dsBase, dsColors } from '@vibesdotdev/tui/theme';
+import { DEFAULT_REVEAL_SECONDS } from "../../../schemas/ui/reveal.schema.js";
+import { useRevealLifecycle } from "./useRevealLifecycle.js";
+export function RevealPane({ lifecycle, entry, phase, onPhaseChange, onReveal, revealSeconds = DEFAULT_REVEAL_SECONDS }) {
+    const { value, errorMessage, secondsLeft } = useRevealLifecycle({
+        lifecycle,
+        entry,
+        phase,
+        onPhaseChange,
+        onReveal,
+        revealSeconds
+    });
+    if (!entry) {
+        return (_jsxs(VStack, { padding: 1, gap: 0, children: [_jsx(DSText, { variant: "muted", children: "Select a secret to enable reveal." }), _jsx(DSText, { variant: "muted", children: `Confirmed first; auto-clears after ${revealSeconds}s.` })] }));
+    }
+    if (phase === 'idle') {
+        return (_jsxs(VStack, { padding: 1, gap: 1, children: [_jsx(DSText, { children: "Value protected" }), _jsx(DSText, { variant: "muted", children: `Press V to reveal ${entry.key}.` }), _jsx(DSText, { variant: "muted", children: `Confirm first; auto-clear: ${revealSeconds}s.` }), entry.hasValue ? null : (_jsx("text", { style: { fg: dsColors.warning.solid }, children: "! This entry has no stored value (empty)." }))] }));
+    }
+    if (phase === 'confirm') {
+        return (_jsxs(VStack, { padding: 1, gap: 1, children: [_jsxs("text", { style: { fg: dsColors.warning.solid }, children: ["! Reveal \"", entry.key, "\" to the terminal?"] }), _jsx(DSText, { variant: "muted", children: `Displayed for ${revealSeconds}s, then auto-cleared.` }), _jsx(DSText, { variant: "muted", children: "Visible to anyone watching this terminal." }), _jsxs(HStack, { gap: 1, children: [_jsx(DSBadge, { label: "Y reveal", color: "danger", variant: "subtle" }), _jsx(DSBadge, { label: "N cancel", color: "neutral", variant: "subtle" }), _jsx(DSBadge, { label: "Esc cancel", color: "neutral", variant: "subtle" })] })] }));
+    }
+    if (phase === 'loading') {
+        return (_jsx(VStack, { padding: 1, gap: 1, children: _jsx(DSText, { variant: "muted", children: "Fetching the value." }) }));
+    }
+    if (phase === 'error') {
+        return (_jsxs(VStack, { padding: 1, gap: 1, children: [_jsx("text", { style: { fg: dsColors.danger.solid }, children: `! Reveal failed: ${errorMessage ?? 'unknown error'}` }), _jsx(DSText, { variant: "muted", children: "Press V to try again." })] }));
+    }
+    // phase === 'revealed' - render the value briefly. This is the ONLY
+    // place in the package where a secret value appears in the React tree.
+    return (_jsxs(VStack, { padding: 1, gap: 1, children: [_jsxs(HStack, { gap: 1, children: [_jsx(DSBadge, { label: "REVEALED", color: "danger", variant: "subtle" }), _jsx(DSBadge, { label: `auto-clear in ${secondsLeft}s`, color: "warning", variant: "subtle" }), _jsx(DSBadge, { label: "Esc hide now", color: "neutral", variant: "subtle" })] }), _jsx(DSText, { variant: "muted", children: `${entry.key} =` }), _jsx("text", { style: { fg: dsBase.foreground }, children: value ?? '' })] }));
+}
+//# sourceMappingURL=RevealPane.js.map

package/dist/surfaces/tui/components/RevealPane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevealPane.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/RevealPane.tsx"],"names":[],"mappings":";AAsBA,OAAO,EAAE,OAAO,EAAC,MAAM,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAC,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAmB,MAAM,sCAAsC,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAiB7D,MAAM,UAAU,UAAU,CAAC,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,aAAa,EACb,QAAQ,EACR,aAAa,GAAG,sBAAsB,EACrB;IACjB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QAC/D,SAAS;QACT,KAAK;QACL,KAAK;QACL,aAAa;QACb,QAAQ;QACR,aAAa;KACb,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,kDAA2C,EAClE,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YACrB,sCAAsC,aAAa,IAAI,GAChD,IACD,CACT,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,KAAC,MAAM,kCAAyB,EAChC,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YAAE,qBAAqB,KAAK,CAAC,GAAG,GAAG,GAAU,EACpE,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YAAE,8BAA8B,aAAa,IAAI,GAAU,EACjF,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,0DAEpC,CACP,IACO,CACT,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,gBAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,4BAC/B,KAAK,CAAC,GAAG,2BACd,EACP,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YAAE,iBAAiB,aAAa,uBAAuB,GAAU,EACxF,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,0DAAmD,EAC1E,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,KAAC,OAAO,IAAC,KAAK,EAAC,UAAU,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,GAAG,EAC5D,KAAC,OAAO,IAAC,KAAK,EAAC,UAAU,EAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,QAAQ,GAAG,EAC7D,KAAC,OAAO,IAAC,KAAK,EAAC,YAAY,EAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,QAAQ,GAAG,IACvD,IACD,CACT,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACN,KAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,YACzB,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,oCAA6B,GAC5C,CACT,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,YACxC,oBAAoB,YAAY,IAAI,eAAe,EAAE,GAChD,EACP,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,sCAA+B,IAC9C,CACT,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,KAAC,OAAO,IAAC,KAAK,EAAC,UAAU,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,GAAG,EAC5D,KAAC,OAAO,IACP,KAAK,EAAE,iBAAiB,WAAW,GAAG,EACtC,KAAK,EAAC,SAAS,EACf,OAAO,EAAC,QAAQ,GACf,EACF,KAAC,OAAO,IAAC,KAAK,EAAC,cAAc,EAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,QAAQ,GAAG,IACzD,EACT,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YAAE,GAAG,KAAK,CAAC,GAAG,IAAI,GAAU,EACnD,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,YAAG,KAAK,IAAI,EAAE,GAAQ,IACpD,CACT,CAAC;AACH,CAAC"}

package/dist/surfaces/tui/components/SecretMetadataPane.d.ts

@@ -0,0 +1,5 @@
+import { type SecretMetadataPaneProps } from "../../../schemas/ui/tui/metadata.schema.ts";
+export { type SecretMetadataPaneProps } from "../../../schemas/ui/tui/metadata.schema.ts";
+import { type ReactNode } from 'react';
+export declare function SecretMetadataPane({ entry, environment }: SecretMetadataPaneProps): ReactNode;
+//# sourceMappingURL=SecretMetadataPane.d.ts.map

package/dist/surfaces/tui/components/SecretMetadataPane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretMetadataPane.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/SecretMetadataPane.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAgB1F,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAYvC,wBAAgB,kBAAkB,CAAC,EAClC,KAAK,EACL,WAAW,EACX,EAAE,uBAAuB,GAAG,SAAS,CAkCrC"}

package/dist/surfaces/tui/components/SecretMetadataPane.js

@@ -0,0 +1,30 @@
+import { jsx as _jsx, jsxs as _jsxs } from "@opentui/react/jsx-runtime";
+import {} from "../../../schemas/ui/tui/metadata.schema.js";
+export {} from "../../../schemas/ui/tui/metadata.schema.js";
+/**
+ * SecretMetadataPane - read-only metadata for the selected secret.
+ *
+ * SECURITY: renders DESCRIPTOR FIELDS ONLY - `key`, `backend`,
+ * `backendId`, `source`, `hasValue`, `tier`. NEVER renders the secret
+ * value; that surface lives in `RevealPane` behind explicit
+ * confirmation.
+ *
+ * Stateless: receives the selected entry, environment context, and a
+ * status hint from the app impl.
+ */
+import { DSText } from '@vibesdotdev/tui/components/content';
+import { HStack, VStack } from '@vibesdotdev/tui/components/layout';
+import { dsBase, dsColors } from '@vibesdotdev/tui/theme';
+import {} from 'react';
+function row(label, value) {
+    if (!value)
+        return null;
+    return (_jsxs(HStack, { gap: 1, children: [_jsx("text", { style: { fg: dsBase.mutedForeground }, children: label.padEnd(12) }), _jsx("text", { children: value })] }));
+}
+export function SecretMetadataPane({ entry, environment }) {
+    if (!entry) {
+        return (_jsxs(VStack, { padding: 1, children: [_jsx(DSText, { variant: "muted", children: "Select a secret to view its entry details." }), _jsx(DSText, { variant: "muted", children: "Values are never shown here; use the reveal pane below." })] }));
+    }
+    return (_jsxs(VStack, { padding: 1, gap: 1, children: [_jsxs(HStack, { gap: 1, children: [_jsx("text", { style: { fg: dsColors.primary.solid }, children: entry.key }), _jsx("text", { style: { fg: entry.hasValue ? dsColors.success.solid : dsBase.mutedForeground }, children: entry.hasValue ? 'present' : 'empty' }), _jsx("text", { style: { fg: dsBase.mutedForeground }, children: `${entry.tier} tier` })] }), _jsxs(VStack, { gap: 0, children: [row('Key', entry.key), row('Environment', environment), row('Tier', entry.tier), row('Backend', entry.backend), row('Backend id', entry.backendId), row('Source', entry.source), row('Value', entry.hasValue ? '(present - hidden)' : '(empty)')] })] }));
+}
+//# sourceMappingURL=SecretMetadataPane.js.map

package/dist/surfaces/tui/components/SecretMetadataPane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretMetadataPane.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/SecretMetadataPane.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAgC,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAgC,MAAM,4CAA4C,CAAC;AAC1F;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAC,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAkB,MAAM,OAAO,CAAC;AAEvC,SAAS,GAAG,CAAC,KAAa,EAAE,KAAgC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,CACN,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,YAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAQ,EACtE,yBAAO,KAAK,GAAQ,IACZ,CACT,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAClC,KAAK,EACL,WAAW,EACc;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,aACjB,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,2DAEd,EACT,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,wEAEd,IACD,CACT,CAAC;IACH,CAAC;IAED,OAAO,CACN,MAAC,MAAM,IAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,aACzB,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACb,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,YAAG,KAAK,CAAC,GAAG,GAAQ,EAC/D,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,YACnF,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAC/B,EACP,eAAM,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,YAAG,GAAG,KAAK,CAAC,IAAI,OAAO,GAAQ,IAClE,EACT,MAAC,MAAM,IAAC,GAAG,EAAE,CAAC,aACZ,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACrB,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,EAC/B,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EACvB,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAC7B,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EAClC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAC3B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,IACxD,IACD,CACT,CAAC;AACH,CAAC"}

package/dist/surfaces/tui/components/SecretsListPane.d.ts

@@ -0,0 +1,5 @@
+import { type SecretsListPaneProps } from "../../../schemas/ui/tui/pane.schema.ts";
+export { type SecretsListPaneProps } from "../../../schemas/ui/tui/pane.schema.ts";
+import { type ReactNode } from 'react';
+export declare function SecretsListPane({ entries, totalCount, filter, onFilterChange, selectedId, onSelect }: SecretsListPaneProps): ReactNode;
+//# sourceMappingURL=SecretsListPane.d.ts.map

package/dist/surfaces/tui/components/SecretsListPane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsListPane.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/SecretsListPane.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAkBnF,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE/C,wBAAgB,eAAe,CAAC,EAC/B,OAAO,EACP,UAAU,EACV,MAAM,EACN,cAAc,EACd,UAAU,EACV,QAAQ,EACR,EAAE,oBAAoB,GAAG,SAAS,CAkElC"}

package/dist/surfaces/tui/components/SecretsListPane.js

@@ -0,0 +1,34 @@
+import { jsx as _jsx, jsxs as _jsxs } from "@opentui/react/jsx-runtime";
+import {} from "../../../schemas/ui/tui/pane.schema.js";
+export {} from "../../../schemas/ui/tui/pane.schema.js";
+/**
+ * SecretsListPane - sidebar list of secret descriptors for the active
+ * environment.
+ *
+ * SECURITY: this pane renders DESCRIPTORS ONLY - `{ key, source,
+ * hasValue, backend }`. It MUST NEVER render a secret value. Selection
+ * exposes metadata (right pane); the reveal flow is a separate
+ * confirmation-gated control.
+ *
+ * Stateless: receives entries, selected id, and onSelect from the app
+ * impl.
+ */
+import { DSText } from '@vibesdotdev/tui/components/content';
+import { List } from '@vibesdotdev/tui/components/data/List';
+import { DSInput } from '@vibesdotdev/tui/components/form/controls/Input';
+import { HStack, VStack } from '@vibesdotdev/tui/components/layout';
+import { useMemo } from 'react';
+export function SecretsListPane({ entries, totalCount, filter, onFilterChange, selectedId, onSelect }) {
+    const items = useMemo(() => entries.map((e) => ({
+        id: e.id,
+        primary: e.key,
+        // Secondary shows source + presence - NEVER value.
+        secondary: `${e.source} - ${e.hasValue ? 'set' : 'empty'}`
+    })), [entries]);
+    if (totalCount === 0) {
+        return (_jsx(VStack, { padding: 2, children: _jsx(DSText, { variant: "muted", children: "No secrets registered for this environment." }) }));
+    }
+    const filtering = filter.trim().length > 0;
+    return (_jsxs(VStack, { grow: true, gap: 1, paddingTop: 1, paddingBottom: 1, children: [_jsxs(HStack, { justify: "between", paddingLeft: 1, paddingRight: 1, children: [_jsx(DSText, { children: "Keys" }), _jsx(DSText, { variant: "muted", children: filtering ? `${entries.length}/${totalCount} keys` : `${totalCount} keys` })] }), _jsx(HStack, { paddingLeft: 1, paddingRight: 1, children: _jsx(DSInput, { id: "secrets-filter", zone: "sidebar", value: filter, onChange: onFilterChange, placeholder: "Filter keys", variant: "search", size: "sm" }) }), entries.length === 0 ? (_jsx(VStack, { paddingLeft: 1, paddingRight: 1, children: _jsx(DSText, { variant: "muted", children: `No keys match "${filter.trim()}".` }) })) : (_jsx(List, { id: "secrets-list", zone: "sidebar", items: items, selectedId: selectedId ?? undefined, onSelect: (item) => onSelect(item.id), keyboardEnabled: true, autoFocus: true, emptyMessage: "No secrets.", showFocusRing: false, showCursor: true }))] }));
+}
+//# sourceMappingURL=SecretsListPane.js.map

package/dist/surfaces/tui/components/SecretsListPane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsListPane.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/SecretsListPane.tsx"],"names":[],"mappings":";AAAA,OAAO,EAA6B,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAA6B,MAAM,wCAAwC,CAAC;AACnF;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qCAAqC,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAgB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAC,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,OAAO,EAAiB,MAAM,OAAO,CAAC;AAE/C,MAAM,UAAU,eAAe,CAAC,EAC/B,OAAO,EACP,UAAU,EACV,MAAM,EACN,cAAc,EACd,UAAU,EACV,QAAQ,EACc;IACtB,MAAM,KAAK,GAAG,OAAO,CACpB,GAAG,EAAE,CACJ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,GAAG;QACd,mDAAmD;QACnD,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE;KAC1D,CAAC,CAAC,EACJ,CAAC,OAAO,CAAC,CACT,CAAC;IAEF,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CACN,KAAC,MAAM,IAAC,OAAO,EAAE,CAAC,YACjB,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,4DAEd,GACD,CACT,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3C,OAAO,CACN,MAAC,MAAM,IAAC,IAAI,QAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,aACnD,MAAC,MAAM,IAAC,OAAO,EAAC,SAAS,EAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,aACxD,KAAC,MAAM,uBAAc,EACrB,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YACrB,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,GAClE,IACD,EAIT,KAAC,MAAM,IAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,YACtC,KAAC,OAAO,IACP,EAAE,EAAC,gBAAgB,EACnB,IAAI,EAAC,SAAS,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAC,aAAa,EACzB,OAAO,EAAC,QAAQ,EAChB,IAAI,EAAC,IAAI,GACR,GACM,EACR,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACvB,KAAC,MAAM,IAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,YACtC,KAAC,MAAM,IAAC,OAAO,EAAC,OAAO,YAAE,kBAAkB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAU,GAC9D,CACT,CAAC,CAAC,CAAC,CACH,KAAC,IAAI,IACJ,EAAE,EAAC,cAAc,EACjB,IAAI,EAAC,SAAS,EACd,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,UAAU,IAAI,SAAS,EACnC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EACrC,eAAe,QACf,SAAS,QACT,YAAY,EAAC,aAAa,EAC1B,aAAa,EAAE,KAAK,EACpB,UAAU,SACT,CACF,IACO,CACT,CAAC;AACH,CAAC"}

package/dist/surfaces/tui/components/useInspectorKeys.d.ts

@@ -0,0 +1,16 @@
+import type { RevealPhase } from '../../../schemas/ui/reveal.schema.ts';
+import type { SecretDescriptorEntry } from '../state/secrets.tui-state.descriptor.ts';
+interface InspectorKeys {
+    filter: string;
+    setFilter(value: string): void;
+    selected: SecretDescriptorEntry | null;
+    selectedId: string | null;
+    setSelectedId(value: string | null): void;
+    revealPhase: RevealPhase;
+    setRevealPhase(value: RevealPhase): void;
+    triggerRefresh(): void;
+    navigate?: (path: string) => void;
+}
+export declare function useInspectorKeys({ filter, setFilter, selected, selectedId, setSelectedId, revealPhase, setRevealPhase, triggerRefresh, navigate }: InspectorKeys): void;
+export {};
+//# sourceMappingURL=useInspectorKeys.d.ts.map

package/dist/surfaces/tui/components/useInspectorKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useInspectorKeys.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/useInspectorKeys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,UAAU,aAAa;IACtB,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAC7G,WAAW,EAAE,WAAW,CAAC;IAAC,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IACnE,cAAc,IAAI,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1D;AACD,wBAAgB,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,aAAa,GAAG,IAAI,CAoDvK"}

package/dist/surfaces/tui/components/useInspectorKeys.js

@@ -0,0 +1,63 @@
+import { useInputModeStore, useOptionalKeybindDispatcherContext } from '@vibesdotdev/tui/input';
+import { useEffect } from 'react';
+export function useInspectorKeys({ filter, setFilter, selected, selectedId, setSelectedId, revealPhase, setRevealPhase, triggerRefresh, navigate }) {
+    // Handled through the shell's KeybindDispatcher (the app's single keyboard
+    // listener). The registry keeps r/v/y/n out of here while the filter input
+    // has focus (insert mode); only `secrets.back` (Esc, not typeable) is
+    // declared allowInInsertMode so it can clear the query.
+    const dispatcher = useOptionalKeybindDispatcherContext();
+    useEffect(() => {
+        if (!dispatcher)
+            return;
+        return dispatcher.onAll({
+            'secrets.refresh': () => {
+                if (revealPhase === 'confirm')
+                    return false;
+                triggerRefresh();
+                return true;
+            },
+            'secrets.reveal': () => {
+                if (revealPhase === 'confirm')
+                    return false;
+                if (!selected?.hasValue)
+                    return false; // nothing to reveal
+                setRevealPhase('confirm');
+                return true;
+            },
+            'secrets.reveal.confirm': () => {
+                if (revealPhase !== 'confirm')
+                    return false;
+                setRevealPhase('loading');
+                return true;
+            },
+            'secrets.reveal.cancel': () => {
+                if (revealPhase !== 'confirm')
+                    return false;
+                setRevealPhase('idle');
+                return true;
+            },
+            'secrets.back': () => {
+                if (useInputModeStore.getState().mode === 'insert') {
+                    if (!filter)
+                        return false;
+                    setFilter('');
+                    return true;
+                }
+                // Confirmation prompt or an active reveal: Esc hides immediately.
+                if (revealPhase !== 'idle') {
+                    setRevealPhase('idle');
+                    return true;
+                }
+                if (selectedId) {
+                    setSelectedId(null);
+                    return true;
+                }
+                if (!navigate)
+                    return false;
+                navigate('/');
+                return true;
+            }
+        });
+    }, [dispatcher, filter, navigate, revealPhase, selected, selectedId, triggerRefresh]);
+}
+//# sourceMappingURL=useInspectorKeys.js.map

package/dist/surfaces/tui/components/useInspectorKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useInspectorKeys.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/useInspectorKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAC,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AASlC,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAiB;IAChK,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,UAAU,GAAG,mCAAmC,EAAE,CAAC;IACzD,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,OAAO,UAAU,CAAC,KAAK,CAAC;YACvB,iBAAiB,EAAE,GAAG,EAAE;gBACvB,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC5C,cAAc,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACb,CAAC;YACD,gBAAgB,EAAE,GAAG,EAAE;gBACtB,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC5C,IAAI,CAAC,QAAQ,EAAE,QAAQ;oBAAE,OAAO,KAAK,CAAC,CAAC,oBAAoB;gBAC3D,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACb,CAAC;YACD,wBAAwB,EAAE,GAAG,EAAE;gBAC9B,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC5C,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACb,CAAC;YACD,uBAAuB,EAAE,GAAG,EAAE;gBAC7B,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC5C,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACb,CAAC;YACD,cAAc,EAAE,GAAG,EAAE;gBACpB,IAAI,iBAAiB,CAAC,QAAQ,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpD,IAAI,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAC;oBAC1B,SAAS,CAAC,EAAE,CAAC,CAAC;oBACd,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,kEAAkE;gBAClE,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;oBAC5B,cAAc,CAAC,MAAM,CAAC,CAAC;oBACvB,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,IAAI,UAAU,EAAE,CAAC;oBAChB,aAAa,CAAC,IAAI,CAAC,CAAC;oBACpB,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,IAAI,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,IAAI,CAAC;YACb,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAEvF,CAAC"}

package/dist/surfaces/tui/components/useRevealLifecycle.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The reveal lifecycle behind `RevealPane`: transient value state, the
+ * auto-clear countdown, and the out-of-band reveal call.
+ *
+ * INVARIANTS (enforced here, rendered by `RevealPane`):
+ * - The revealed value lives ONLY in this hook's `value` cell. It is never
+ *   persisted into shared state, never returned upward, never logged.
+ * - On unmount, on entry-change, on countdown-expiry, and on every exit
+ *   from the revealed phase the value cell is set back to `null` so React
+ *   garbage-collects the string reference.
+ * - Effects key on the entry id, not the entry object: a background list
+ *   refresh rebuilds the object, which must not wipe or restart a reveal.
+ */
+import type { RuntimeLifecycle } from '@vibesdotdev/kernel';
+import { type RevealPhase } from '../../../schemas/ui/reveal.schema.ts';
+import type { SecretDescriptorEntry } from '../state/secrets.tui-state.descriptor.ts';
+export declare function useRevealLifecycle(options: {
+    entry: SecretDescriptorEntry | null;
+    lifecycle: RuntimeLifecycle;
+    phase: RevealPhase;
+    onPhaseChange: (next: RevealPhase) => void;
+    onReveal: (entry: SecretDescriptorEntry) => Promise<string>;
+    revealSeconds?: number;
+}): {
+    value: string | null;
+    errorMessage: string | null;
+    secondsLeft: number;
+};
+//# sourceMappingURL=useRevealLifecycle.d.ts.map

package/dist/surfaces/tui/components/useRevealLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRevealLifecycle.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/useRevealLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AActF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,aAAa,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IAC3C,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;;;;EA6EA"}

package/dist/surfaces/tui/components/useRevealLifecycle.js

@@ -0,0 +1,101 @@
+/**
+ * The reveal lifecycle behind `RevealPane`: transient value state, the
+ * auto-clear countdown, and the out-of-band reveal call.
+ *
+ * INVARIANTS (enforced here, rendered by `RevealPane`):
+ * - The revealed value lives ONLY in this hook's `value` cell. It is never
+ *   persisted into shared state, never returned upward, never logged.
+ * - On unmount, on entry-change, on countdown-expiry, and on every exit
+ *   from the revealed phase the value cell is set back to `null` so React
+ *   garbage-collects the string reference.
+ * - Effects key on the entry id, not the entry object: a background list
+ *   refresh rebuilds the object, which must not wipe or restart a reveal.
+ */
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { DEFAULT_REVEAL_SECONDS } from "../../../schemas/ui/reveal.schema.js";
+async function safelyReveal(onReveal, entry) {
+    try {
+        const value = await onReveal(entry);
+        return { ok: true, value };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export function useRevealLifecycle(options) {
+    const { lifecycle, entry, phase, onPhaseChange, onReveal, revealSeconds = DEFAULT_REVEAL_SECONDS } = options;
+    // Local, transient holders. Never exported, never logged.
+    const [value, setValue] = useState(null);
+    const [errorMessage, setErrorMessage] = useState(null);
+    const [secondsLeft, setSecondsLeft] = useState(revealSeconds);
+    const wipeValue = useCallback(() => {
+        // Best-effort: drop the only live reference to the string. Node
+        // strings are immutable, but releasing the reference is the most
+        // we can do at the language layer. Never log it on the way out.
+        setValue(null);
+        setSecondsLeft(revealSeconds);
+    }, [revealSeconds]);
+    const entryId = entry?.id;
+    // Reset to IDLE whenever the selected entry changes - never carry a
+    // revealed value across selections.
+    useEffect(() => {
+        wipeValue();
+        setErrorMessage(null);
+        onPhaseChange('idle');
+    }, [entryId, onPhaseChange, wipeValue]);
+    // Unmount -> wipe.
+    useEffect(() => {
+        return () => {
+            wipeValue();
+        };
+    }, [wipeValue]);
+    useEffect(() => {
+        if (phase !== 'revealed') {
+            wipeValue();
+            return;
+        }
+        const startedAt = lifecycle.now();
+        return lifecycle.interval(() => {
+            const remaining = Math.max(0, revealSeconds - Math.floor((lifecycle.now() - startedAt) / 1000));
+            setSecondsLeft(remaining);
+            if (remaining === 0) {
+                wipeValue();
+                onPhaseChange('idle');
+            }
+        }, 250);
+    }, [lifecycle, phase, revealSeconds, wipeValue, onPhaseChange]);
+    // The live entry for the reveal call: read through a ref so a
+    // background list refresh (same id, new object) does not restart
+    // the in-flight reveal.
+    const entryRef = useRef(entry);
+    entryRef.current = entry;
+    useEffect(() => {
+        if (phase !== 'loading')
+            return;
+        const current = entryRef.current;
+        if (!current)
+            return;
+        let cancelled = false;
+        (async () => {
+            const outcome = await safelyReveal(onReveal, current);
+            if (cancelled)
+                return;
+            if (outcome.ok) {
+                setValue(outcome.value);
+                setSecondsLeft(revealSeconds);
+                onPhaseChange('revealed');
+            }
+            else {
+                // Backend failures may quote values. Render only this fixed diagnostic.
+                setErrorMessage('The secret could not be revealed.');
+                setValue(null);
+                onPhaseChange('error');
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [entryId, onPhaseChange, onReveal, phase, revealSeconds]);
+    return { value, errorMessage, secondsLeft };
+}
+//# sourceMappingURL=useRevealLifecycle.js.map

package/dist/surfaces/tui/components/useRevealLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRevealLifecycle.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/components/useRevealLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,WAAW,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAmB,MAAM,sCAAsC,CAAC;AAG/F,KAAK,UAAU,YAAY,CAC1B,QAA2D,EAC3D,KAA4B;IAE5B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAOlC;IACA,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,sBAAsB,EAAE,GAAG,OAAO,CAAC;IAC7G,0DAA0D;IAC1D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAS,aAAa,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAS,EAAE;QACxC,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC;IAC1B,oEAAoE;IACpE,oCAAoC;IACpC,SAAS,CAAC,GAAG,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,aAAa,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAExC,mBAAmB;IACnB,SAAS,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,EAAE;YACX,SAAS,EAAE,CAAC;QACb,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1B,SAAS,EAAE,CAAC;YACZ,OAAO;QACR,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAChG,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACrB,SAAS,EAAE,CAAC;gBACZ,aAAa,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACF,CAAC,EAAE,GAAG,CAAC,CAAC;IACT,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAEhE,8DAA8D;IAC9D,iEAAiE;IACjE,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACzB,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,CAAC,KAAK,IAAI,EAAE;YACX,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACxB,cAAc,CAAC,aAAa,CAAC,CAAC;gBAC9B,aAAa,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,wEAAwE;gBACxE,eAAe,CAAC,mCAAmC,CAAC,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACf,aAAa,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE;YACX,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAE7D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/dist/surfaces/tui/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @vibesdotdev/secrets/tui - barrel export.
+ *
+ * Re-exports the plugin (default + named) and the descriptors so
+ * consumers can register the plugin directly or reference individual
+ * descriptors for testing / documentation.
+ */
+export { secretsTuiPlugin as default, secretsTuiPlugin } from './secrets-tui.plugin.ts';
+export { default as secretsTuiAppDescriptor } from './secrets.tui-app.descriptor.ts';
+export { default as secretsTuiOpenDescriptor } from './secrets.tui-open.descriptor.ts';
+export { default as secretsTuiStateDescriptor } from './state/secrets.tui-state.descriptor.ts';
+export type { SecretDescriptorEntry, SecretsListState } from './state/secrets.tui-state.descriptor.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/surfaces/tui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAC,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAC/F,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACf,MAAM,yCAAyC,CAAC"}