@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/requirements/resolver.js

@@ -1,196 +0,0 @@
-/**
- * Secret Requirements Resolver
- *
- * Resolves secret requirements from two intentional sources:
- *
- * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
- *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
- *    declare secrets here because they are infrastructure resources, not web apps.
- *    The `infra/web-app` path is kept for completeness but no longer discovers
- *    vestigial descriptors (deleted 2026-05-20).
- *
- * 2. `deployment.config.ts` files — the canonical per-app deployment system.
- *    Loads each config via `@vibesdotdev/infra-deploy` and extracts `secret: true`
- *    env entries from the `AppDeployment.env` array. This is the authoritative
- *    source for web-app secrets.
- *
- * The two-system split is intentional, not transitional:
- * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
- * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
- *
- * Used by `vibes secrets check` to cross-reference stored secrets against
- * declared requirements.
- */
-import { loadDeploymentConfig } from '@vibesdotdev/infra-deploy';
-const BAKED_SECRET_REQUIREMENTS_JSON = typeof __VIBES_BAKED_SECRET_REQUIREMENTS__ !== 'undefined'
-    ? __VIBES_BAKED_SECRET_REQUIREMENTS__
-    : '[]';
-function readBakedRequirements() {
-    if (!BAKED_SECRET_REQUIREMENTS_JSON || BAKED_SECRET_REQUIREMENTS_JSON === '[]') {
-        return [];
-    }
-    try {
-        const parsed = JSON.parse(BAKED_SECRET_REQUIREMENTS_JSON);
-        return Array.isArray(parsed) ? parsed : [];
-    }
-    catch {
-        return [];
-    }
-}
-function extractRequirements(descriptors) {
-    const results = [];
-    for (const desc of descriptors) {
-        if (!desc.env)
-            continue;
-        for (const entry of desc.env) {
-            if (!entry.secret)
-                continue;
-            results.push({
-                key: entry.name,
-                appId: desc.id,
-                required: entry.required ?? true,
-                description: entry.description
-            });
-        }
-    }
-    return results;
-}
-/**
- * Resolve secret requirements from deployment.config.ts files.
- *
- * Walks the workspace for `deployment.config.ts` files (same discovery logic
- * as `infra-deploy regenerate`), loads each via subprocess, and extracts
- * `secret: true` env entries from the `AppDeployment.env` array.
- */
-async function resolveFromDeploymentConfigs(rootDir) {
-    const { readdirSync, statSync } = await import('node:fs');
-    const { join } = await import('node:path');
-    const IGNORED = new Set([
-        'node_modules', '.git', '.svelte-kit', 'dist', '.next', '.turbo', '.vite', '.wrangler'
-    ]);
-    const CONFIG_NAMES = new Set([
-        'deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'
-    ]);
-    // Discover deployment.config.ts files (mirrors infra-deploy's findDeploymentConfigs)
-    const configs = [];
-    function walk(dir, depth) {
-        if (depth > 4)
-            return;
-        let entries;
-        try {
-            entries = readdirSync(dir);
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            if (CONFIG_NAMES.has(entry))
-                configs.push(join(dir, entry));
-        }
-        for (const entry of entries) {
-            if (IGNORED.has(entry) || entry.startsWith('.'))
-                continue;
-            const full = join(dir, entry);
-            let info;
-            try {
-                info = statSync(full);
-            }
-            catch {
-                continue;
-            }
-            if (info.isDirectory())
-                walk(full, depth + 1);
-        }
-    }
-    walk(rootDir, 0);
-    const requirements = [];
-    for (const configPath of configs) {
-        const appDir = configPath.replace(/\/deployment\.config\.(ts|js|mjs)$/, '');
-        try {
-            const loaded = await loadDeploymentConfig(appDir);
-            for (const entry of loaded.deployment.env) {
-                if (!entry.secret)
-                    continue;
-                requirements.push({
-                    key: entry.name,
-                    appId: loaded.deployment.appId,
-                    required: entry.required ?? true,
-                    description: entry.description
-                });
-            }
-        }
-        catch {
-            // Config load failures are non-fatal for secret resolution.
-            // The regen pipeline catches these separately.
-        }
-    }
-    return requirements;
-}
-/**
- * Resolve all secret requirements from infra descriptors and deployment configs.
- *
- * Queries two sources:
- * 1. Runtime for `infra/worker` descriptors (`.infra.ts` — workers + infrastructure)
- * 2. `deployment.config.ts` files via `@vibesdotdev/infra-deploy` (web apps)
- *
- * These two sources are mutually exclusive by app type, so there should be no
- * overlap. Both are queried to cover the full surface:
- * - Workers declare secrets in `.infra.ts` (job-workers, ai-workers, etc.)
- * - Web apps declare secrets in `deployment.config.ts` (auth-web, ai-web, etc.)
- *
- * Deployment config entries are appended after descriptor entries.
- * Duplicates are harmless for check reporting.
- */
-export async function resolveSecretRequirements(runtime, options) {
-    const requirements = [];
-    if (runtime.hasKind('infra/web-app')) {
-        const webApps = runtime.assets('infra/web-app').descriptors();
-        requirements.push(...extractRequirements(webApps));
-    }
-    if (runtime.hasKind('infra/worker')) {
-        const workers = runtime.assets('infra/worker').descriptors();
-        requirements.push(...extractRequirements(workers));
-    }
-    // Load web-app secrets from deployment.config.ts — the canonical source.
-    // Falls back to process.cwd() when no root is explicitly provided.
-    let liveDeployReqs = [];
-    if (options?.deploymentConfigRoot || typeof process !== 'undefined') {
-        const root = options?.deploymentConfigRoot ?? process.cwd();
-        try {
-            liveDeployReqs = await resolveFromDeploymentConfigs(root);
-        }
-        catch {
-            // infra-deploy subprocess failures shouldn't block the check.
-        }
-    }
-    // In compiled binaries, `resolveFromDeploymentConfigs` returns [] because
-    // the standalone executable can't import workspace deployment.config.ts
-    // files at runtime. Fall back to the build-time snapshot captured by
-    // `apps/cli-bin/scripts/build.ts` so `--app <id>` filtering still works.
-    if (liveDeployReqs.length === 0) {
-        requirements.push(...readBakedRequirements());
-    }
-    else {
-        requirements.push(...liveDeployReqs);
-    }
-    return requirements;
-}
-/**
- * Group requirements by app/worker ID for per-app reporting.
- */
-export function groupRequirementsByApp(requirements) {
-    const grouped = new Map();
-    for (const req of requirements) {
-        const existing = grouped.get(req.appId) ?? [];
-        existing.push(req);
-        grouped.set(req.appId, existing);
-    }
-    return grouped;
-}
-/**
- * Get unique secret keys across all apps (deduped).
- */
-export function uniqueSecretKeys(requirements) {
-    return [...new Set(requirements.map((r) => r.key))];
-}
-//# sourceMappingURL=resolver.js.map

package/dist/requirements/resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/requirements/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAmBjE,MAAM,8BAA8B,GACnC,OAAO,mCAAmC,KAAK,WAAW;IACzD,CAAC,CAAC,mCAAmC;IACrC,CAAC,CAAC,IAAI,CAAC;AAET,SAAS,qBAAqB;IAC7B,IAAI,CAAC,8BAA8B,IAAI,8BAA8B,KAAK,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAyC;IACrE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,SAAS;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,KAAK,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,EAAE;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC9B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,4BAA4B,CAC1C,OAAe;IAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW;KACtF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC5B,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB;KACvE,CAAC,CAAC;IAEH,qFAAqF;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACvC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEjB,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,SAAS;gBAC5B,YAAY,CAAC,IAAI,CAAC;oBACjB,GAAG,EAAE,KAAK,CAAC,IAAI;oBACf,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;oBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,4DAA4D;YAC5D,+CAA+C;QAChD,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAkC,EAClC,OAA2C;IAE3C,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAwB,CAAC;QACpF,YAAY,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAwB,CAAC;QACnF,YAAY,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,cAAc,GAAwB,EAAE,CAAC;IAC7C,IAAI,OAAO,EAAE,oBAAoB,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC;YACJ,cAAc,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACR,8DAA8D;QAC/D,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CAAC,GAAG,qBAAqB,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACP,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,YAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAiC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/requirements/schemas/requirements.d.ts

@@ -1,27 +0,0 @@
-export interface SecretRequirement {
-    /** Secret key name (e.g., VIBES_AUTH_SECRET) */
-    key: string;
-    /** App or worker ID that requires this secret */
-    appId: string;
-    /** Whether the secret is required for the app to function */
-    required: boolean;
-    /** Human-readable description of the secret's purpose */
-    description: string | undefined;
-}
-export interface RequirementEnvEntry {
-    name: string;
-    secret?: boolean;
-    required?: boolean;
-    description?: string;
-}
-export interface RequirementInfraDescriptor {
-    id: string;
-    env?: RequirementEnvEntry[];
-}
-export interface SecretRequirementsRuntime {
-    hasKind(kind: string): boolean;
-    assets(kind: string): {
-        descriptors(): RequirementInfraDescriptor[];
-    };
-}
-//# sourceMappingURL=requirements.d.ts.map

package/dist/requirements/schemas/requirements.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"requirements.d.ts","sourceRoot":"","sources":["../../../src/requirements/schemas/requirements.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,QAAQ,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;QACrB,WAAW,IAAI,0BAA0B,EAAE,CAAC;KAC5C,CAAC;CACF"}

package/dist/requirements/schemas/requirements.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../src/requirements/schemas/requirements.ts"],"names":[],"mappings":""}

package/dist/secrets.plugin.d.ts

@@ -1,8 +0,0 @@
-/**
- * Secrets Runtime Plugin
- *
- * Registers the secrets/store kind and CLI backend loaders.
- */
-declare const _default: import("@vibesdotdev/runtime").RuntimePlugin;
-export default _default;
-//# sourceMappingURL=secrets.plugin.d.ts.map

package/dist/secrets.plugin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.plugin.d.ts","sourceRoot":"","sources":["../src/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;AAwBH,wBAoCG"}

package/dist/secrets.plugin.js

@@ -1,59 +0,0 @@
-/**
- * Secrets Runtime Plugin
- *
- * Registers the secrets/store kind and CLI backend loaders.
- */
-import { createRuntimePlugin, loader } from '@vibesdotdev/runtime';
-import { secretsStoreKind } from './kinds/store.kind';
-// CLI
-import secretsGroup from "./cli/secrets.cli-group.descriptor.js";
-import secretsCheck from "./cli/check/secrets.check.cli-command.descriptor.js";
-import secretsImport from "./cli/import/secrets.import.cli-command.descriptor.js";
-import secretsExport from "./cli/export/secrets.export.cli-command.descriptor.js";
-import secretsList from "./cli/list/secrets.list.cli-command.descriptor.js";
-import secretsPull from "./cli/pull/secrets.pull.cli-command.descriptor.js";
-import secretsPush from "./cli/push/secrets.push.cli-command.descriptor.js";
-import secretsSet from "./cli/set/secrets.set.cli-command.descriptor.js";
-import secretsUnset from "./cli/unset/secrets.unset.cli-command.descriptor.js";
-import secretsReveal from "./cli/reveal/secrets.reveal.cli-command.descriptor.js";
-import secretsPreCommitCheck from "./cli/pre-commit/secrets.pre-commit-check.cli-command.descriptor.js";
-// Docs
-import secretsBackendsDescriptor from "./docs/backends.docs.descriptor.js";
-import secretsEncryptionDescriptor from "./docs/encryption.docs.descriptor.js";
-import secretsEnvFileDescriptor from "./docs/env-file.docs.descriptor.js";
-export default createRuntimePlugin({
-    id: 'secrets',
-    name: 'Secrets Management',
-    description: 'Environment-aware secrets storage with multiple backends',
-    dependencies: ['config'],
-    kinds: [secretsStoreKind],
-    descriptors: [
-        secretsGroup,
-        secretsCheck,
-        secretsImport,
-        secretsExport,
-        secretsList,
-        secretsPull,
-        secretsPush,
-        secretsSet,
-        secretsUnset,
-        secretsReveal,
-        secretsPreCommitCheck,
-        secretsBackendsDescriptor,
-        secretsEncryptionDescriptor,
-        secretsEnvFileDescriptor
-    ],
-    loaders: [
-        loader('secrets.check', () => import('./cli/check/secrets.check.cli-command.impl.js')),
-        loader('secrets.import', () => import('./cli/import/secrets.import.cli-command.impl.js')),
-        loader('secrets.export', () => import('./cli/export/secrets.export.cli-command.impl.js')),
-        loader('secrets.list', () => import('./cli/list/secrets.list.cli-command.impl.js')),
-        loader('secrets.pull', () => import('./cli/pull/secrets.pull.cli-command.impl.js')),
-        loader('secrets.push', () => import('./cli/push/secrets.push.cli-command.impl.js')),
-        loader('secrets.set', () => import('./cli/set/secrets.set.cli-command.impl.js')),
-        loader('secrets.unset', () => import('./cli/unset/secrets.unset.cli-command.impl.js')),
-        loader('secrets.reveal', () => import('./cli/reveal/secrets.reveal.cli-command.impl.js')),
-        loader('dev.secrets.pre-commit-check', () => import('./cli/pre-commit/secrets.pre-commit-check.cli-command.impl.js'))
-    ]
-});
-//# sourceMappingURL=secrets.plugin.js.map

package/dist/secrets.plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.plugin.js","sourceRoot":"","sources":["../src/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM;AACN,OAAO,YAAY,MAAM,uCAAuC,CAAC;AACjE,OAAO,YAAY,MAAM,qDAAqD,CAAC;AAC/E,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,UAAU,MAAM,iDAAiD,CAAC;AACzE,OAAO,YAAY,MAAM,qDAAqD,CAAC;AAC/E,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,qBAAqB,MAAM,qEAAqE,CAAC;AAExG,OAAO;AACP,OAAO,yBAAyB,MAAM,oCAAoC,CAAC;AAC3E,OAAO,2BAA2B,MAAM,sCAAsC,CAAC;AAC/E,OAAO,wBAAwB,MAAM,oCAAoC,CAAC;AAE1E,eAAe,mBAAmB,CAAC;IAClC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,0DAA0D;IACvE,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,KAAK,EAAE,CAAC,gBAA+C,CAAC;IAExD,WAAW,EAAE;QACZ,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,WAAW;QACX,WAAW;QACX,WAAW;QACX,UAAU;QACV,YAAY;QACZ,aAAa;QACb,qBAAqB;QACrB,yBAAyB;QACzB,2BAA2B;QAC3B,wBAAwB;KACxB;IAED,OAAO,EAAE;QACR,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACtF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAChF,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACtF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAAC;KACrH;CACD,CAAC,CAAC"}

package/src/cli/check/schemas/check-result.ts

@@ -1,8 +0,0 @@
-export interface CheckResult {
-	key: string;
-	appId: string;
-	required: boolean;
-	description: string | undefined;
-	status: 'ok' | 'missing' | 'warn';
-	source: string | undefined;
-}

package/src/cli/check/secrets.check.cli-command.descriptor.ts

@@ -1,21 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.check',
-	name: 'check',
-	description: 'Validate stored secrets against infra manifest requirements',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--app <id>', description: 'Check a specific app or worker only' },
-		{ flags: '--manifest', description: 'Also cross-check against the canonical import manifest' },
-		{ flags: '--json', description: 'Output as JSON' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 50
-};
-
-export default descriptor;

package/src/cli/check/secrets.check.cli-command.impl.ts

@@ -1,163 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor } from '../../kinds/store.schema';
-import type { CheckResult } from './schemas/check-result';
-import { resolveSecretRequirements, groupRequirementsByApp } from '../../requirements/resolver';
-import { canonicalImportManifest } from '../../manifest/canonical';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-interface ManifestCheck {
-	key: string;
-	required: boolean;
-	source: string | undefined;
-	status: 'ok' | 'missing' | 'warn';
-	storedIn: string | undefined;
-}
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			app?: string;
-			manifest?: boolean;
-			json?: boolean;
-		};
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		let requirements = await resolveSecretRequirements(runtime);
-		if (options.app) {
-			requirements = requirements.filter((r) => r.appId === options.app);
-		}
-
-		if (requirements.length === 0 && !options.manifest) {
-			ui.info(options.app
-				? `No secret requirements found for app: ${options.app}`
-				: 'No secret requirements found in infra descriptors');
-			return;
-		}
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const tierStores = descriptors.filter((d) => d.tiers.includes(envTier));
-
-		const availableKeys = new Map<string, string>();
-		for (const desc of tierStores) {
-			const impl = (await runtime
-				.query('secrets/store')
-				.withId(desc.id)
-				.resolve()) as SecretsStoreImplementation;
-			const entries = await impl.list(envName);
-			for (const entry of entries) {
-				if (entry.hasValue && !availableKeys.has(entry.key)) {
-					availableKeys.set(entry.key, entry.source);
-				}
-			}
-		}
-
-		const results: CheckResult[] = requirements.map((req) => {
-			const source = availableKeys.get(req.key);
-			let status: 'ok' | 'missing' | 'warn';
-			if (source) {
-				status = 'ok';
-			} else if (req.required) {
-				status = 'missing';
-			} else {
-				status = 'warn';
-			}
-			return { ...req, status, source };
-		});
-
-		const manifestChecks: ManifestCheck[] = options.manifest
-			? canonicalImportManifest.secrets.map((entry) => {
-					const storedIn = availableKeys.get(entry.key);
-					let status: 'ok' | 'missing' | 'warn';
-					if (storedIn) status = 'ok';
-					else if (entry.required) status = 'missing';
-					else status = 'warn';
-					return { key: entry.key, required: entry.required, source: entry.source, status, storedIn };
-				})
-			: [];
-
-		if (options.json) {
-			const summary: Record<string, unknown> = {
-				environment: envName,
-				tier: envTier,
-				total: results.length,
-				ok: results.filter((r) => r.status === 'ok').length,
-				missing: results.filter((r) => r.status === 'missing').length,
-				warn: results.filter((r) => r.status === 'warn').length,
-				results
-			};
-			if (options.manifest) {
-				summary.manifest = {
-					total: manifestChecks.length,
-					ok: manifestChecks.filter((m) => m.status === 'ok').length,
-					missing: manifestChecks.filter((m) => m.status === 'missing').length,
-					warn: manifestChecks.filter((m) => m.status === 'warn').length,
-					results: manifestChecks
-				};
-			}
-			ui.render(summary, { format: 'json' });
-			const manifestMissing = manifestChecks.filter((m) => m.status === 'missing').length;
-			if (results.filter((r) => r.status === 'missing').length > 0 || manifestMissing > 0) {
-				process.exit(1);
-			}
-			return;
-		}
-
-		const grouped = groupRequirementsByApp(requirements);
-		const okCount = results.filter((r) => r.status === 'ok').length;
-		const missingCount = results.filter((r) => r.status === 'missing').length;
-		const warnCount = results.filter((r) => r.status === 'warn').length;
-
-		ui.log(`\nSecrets check for environment: ${envName} (${envTier})\n`);
-
-		for (const [appId, reqs] of grouped) {
-			ui.log(`  ${appId}`);
-			for (const req of reqs) {
-				const result = results.find((r) => r.key === req.key && r.appId === req.appId);
-				if (!result) continue;
-				const icon = result.status === 'ok' ? '+' : result.status === 'missing' ? 'x' : '?';
-				const label = result.required ? 'required' : 'optional';
-				const src = result.source ? ` (${result.source})` : '';
-				ui.log(`    [${icon}] ${result.key.padEnd(40)} ${label.padEnd(10)} ${result.status}${src}`);
-			}
-			ui.log('');
-		}
-
-		ui.log(`  Summary: ${okCount} ok, ${missingCount} missing, ${warnCount} optional not set`);
-		if (missingCount > 0) {
-			ui.log(`  Run 'vibes secrets set <KEY>' to add missing secrets`);
-		}
-		ui.log('');
-
-		let manifestMissing = 0;
-		if (options.manifest && manifestChecks.length > 0) {
-			ui.log(`  Canonical manifest cross-check (${manifestChecks.length} entries)`);
-			for (const m of manifestChecks) {
-				const icon = m.status === 'ok' ? '+' : m.status === 'missing' ? 'x' : '?';
-				const label = m.required ? 'required' : 'optional';
-				const where = m.storedIn ? ` (${m.storedIn})` : ` <- ${m.source}`;
-				ui.log(`    [${icon}] ${m.key.padEnd(40)} ${label.padEnd(10)} ${m.status}${where}`);
-			}
-			const mOk = manifestChecks.filter((m) => m.status === 'ok').length;
-			manifestMissing = manifestChecks.filter((m) => m.status === 'missing').length;
-			const mWarn = manifestChecks.filter((m) => m.status === 'warn').length;
-			ui.log(`  Manifest summary: ${mOk} ok, ${manifestMissing} missing, ${mWarn} optional not set`);
-			if (manifestMissing > 0) {
-				ui.log(`  Run 'vibes secrets import' to populate from local sources`);
-			}
-			ui.log('');
-		}
-
-		if (missingCount > 0 || manifestMissing > 0) {
-			process.exit(1);
-		}
-	}
-};

package/src/cli/export/secrets.export.cli-command.descriptor.ts

@@ -1,22 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.export',
-	name: 'export',
-	description: 'Export secrets from a local backend to an env-formatted file (audit-logged)',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Source environment (default: current)' },
-		{ flags: '--from <backend>', description: 'Source backend (default: highest-priority local)' },
-		{ flags: '--out <path>', description: 'Output file path (required; created mode 0600)' },
-		{ flags: '--manifest-only', description: 'Limit to keys declared in the canonical manifest' },
-		{ flags: '--force', description: 'Skip the interactive bulk-reveal confirmation' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 35
-};
-
-export default descriptor;