@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/domain/client/credential-use.js

@@ -0,0 +1,224 @@
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { credentialPresenceInputSchema, credentialPayloadSignatureInputSchema, oauthAuthorizationCodeExchangeSchema, oauthRefreshTokenExchangeSchema, oauthAuthorizationUrlResolveSchema, OAuthAuthorizationCodeTokenResponseSchema } from "../../schemas/transport/credential-use.schema.js";
+import { isDevelopmentHost, parseSecureUrl } from "../../transport/secure-url.js";
+import { readBoundedText } from "../../transport/bounded-body.js";
+function parse(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success)
+        throw new CapabilityError('Credential operation input is invalid.', 'INVALID_INPUT', { reason: 'credential-use-input-invalid', retryable: false });
+    return result.data;
+}
+/** Only a confirmed absence advances the declared list; every other owner refusal survives. */
+export async function resolveCredentialCandidates(runtime, candidates) {
+    for (const reference of candidates) {
+        if (reference.source === 'oauth-account') {
+            throw new CapabilityError('An admitted OAuth account credential provider is required.', 'UNAVAILABLE', { reason: 'oauth-account-owner-unavailable', retryable: false });
+        }
+        const result = await runtime.resolveCredential(reference);
+        if (result.ok) {
+            if (result.value.trim().length > 0)
+                return result.value;
+            continue;
+        }
+        if (result.error.code === 'NOT_FOUND' && result.error.reason === 'credential-not-set')
+            continue;
+        throw result.error;
+    }
+    return undefined;
+}
+export async function checkCredentialPresence(runtime, input) {
+    const reference = parse(credentialPresenceInputSchema, input);
+    if (await resolveCredentialCandidates(runtime, [{ source: 'secret', ...reference }]) === undefined) {
+        throw new CapabilityError('Secret is not set.', 'NOT_FOUND', { reason: 'credential-not-set', retryable: false });
+    }
+    return { set: true };
+}
+/** Return only the HMAC receipt; key resolution and cryptographic use stay in Secrets. */
+export async function signCredentialPayload(runtime, input) {
+    const request = parse(credentialPayloadSignatureInputSchema, input);
+    const resource = Promise.withResolvers();
+    void runtime.lifecycle.own(() => resource.promise);
+    let started = false;
+    try {
+        return await runtime.lifecycle.wait(async (signal) => {
+            started = true;
+            try {
+                const secret = await resolveCredentialCandidates(runtime, request.credentials);
+                signal.throwIfAborted();
+                if (secret === undefined) {
+                    if (!request.required)
+                        return undefined;
+                    throw new CapabilityError('Secret is not set.', 'NOT_FOUND', { reason: 'credential-not-set', retryable: false });
+                }
+                let signature;
+                try {
+                    const encoder = new TextEncoder();
+                    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+                    signal.throwIfAborted();
+                    signature = await crypto.subtle.sign('HMAC', key, encoder.encode(request.message));
+                }
+                catch (error) {
+                    if (signal.aborted && error === signal.reason)
+                        throw error;
+                    throw new CapabilityError('Credential signing failed.', 'INTERNAL', {
+                        reason: 'credential-signature-failed', retryable: false, cause: valueFreeFailure(CaughtFailureSchema.parse(error))
+                    });
+                }
+                signal.throwIfAborted();
+                const hex = Array.from(new Uint8Array(signature), byte => byte.toString(16).padStart(2, '0')).join('');
+                return request.prefix + hex;
+            }
+            finally {
+                resource.resolve();
+            }
+        }, { timeoutMs: request.timeoutMs, reason: 'credential-payload-signature', signal: runtime.invocationSignal });
+    }
+    finally {
+        if (!started)
+            resource.resolve();
+    }
+}
+function secureTarget(runtime, raw) {
+    const parsed = parseSecureUrl(raw, { allowLoopbackHttp: isDevelopmentHost(runtime) });
+    if (!parsed.ok)
+        throw new CapabilityError('OAuth destination is invalid.', 'INVALID_INPUT', { reason: 'oauth-destination-invalid', retryable: false });
+    return parsed.url;
+}
+export async function resolveOAuthAuthorizationUrl(runtime, input) {
+    const request = parse(oauthAuthorizationUrlResolveSchema, input);
+    const url = secureTarget(runtime, request.authorizationUrl);
+    if (url.searchParams.getAll(request.parameter).length !== 1 || url.searchParams.get(request.parameter) !== request.placeholder) {
+        throw new CapabilityError('OAuth authorization URL must carry one client identifier placeholder.', 'INVALID_INPUT', { reason: 'oauth-authorization-url-placeholder-missing', retryable: false });
+    }
+    const value = await resolveCredentialCandidates(runtime, request.clientId);
+    if (value === undefined)
+        throw unsetClient();
+    url.searchParams.set(request.parameter, value);
+    return url.toString();
+}
+function unsetClient() {
+    return new CapabilityError('OAuth client credentials are not set.', 'NOT_FOUND', { reason: 'oauth-client-credential-unset', retryable: false });
+}
+async function exchange(runtime, grant) {
+    const target = secureTarget(runtime, grant.tokenEndpoint);
+    const environment = runtime.environment;
+    const transport = environment.httpFetch;
+    if (!transport)
+        throw new CapabilityError('The host has no HTTP transport.', 'UNAVAILABLE', { reason: 'http-fetch-unavailable', retryable: false });
+    const resource = Promise.withResolvers();
+    void runtime.lifecycle.own(() => resource.promise);
+    let started = false;
+    try {
+        return await runtime.lifecycle.wait(async (signal) => {
+            started = true;
+            try {
+                const clientId = await resolveCredentialCandidates(runtime, grant.clientId);
+                const clientSecret = await resolveCredentialCandidates(runtime, grant.clientSecret);
+                if (clientId === undefined || clientSecret === undefined)
+                    throw unsetClient();
+                let form;
+                if ('code' in grant) {
+                    form = new URLSearchParams({ grant_type: 'authorization_code', code: grant.code, redirect_uri: grant.redirectUri });
+                }
+                else {
+                    const refreshToken = await resolveCredentialCandidates(runtime, grant.refreshToken);
+                    if (refreshToken === undefined)
+                        throw new CapabilityError('OAuth refresh token is not set.', 'NOT_FOUND', { reason: 'oauth-refresh-token-unset', retryable: false });
+                    form = new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken });
+                }
+                let headers;
+                try {
+                    headers = new Headers({ accept: 'application/json', ...grant.headers });
+                }
+                catch (error) {
+                    throw new CapabilityError('OAuth request headers cannot be sent.', 'INVALID_INPUT', { reason: 'oauth-token-header-invalid', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                headers.set('content-type', grant.bodyEncoding === 'json' ? 'application/json' : 'application/x-www-form-urlencoded');
+                if (grant.clientAuthentication === 'basic') {
+                    // RFC 6749 section 2.3.1: encode each component before joining with a colon.
+                    const encode = (value) => new URLSearchParams({ value }).toString().slice('value='.length);
+                    headers.set('authorization', `Basic ${btoa(`${encode(clientId)}:${encode(clientSecret)}`)}`);
+                }
+                else {
+                    form.set('client_id', clientId);
+                    form.set('client_secret', clientSecret);
+                }
+                const body = grant.bodyEncoding === 'json' ? JSON.stringify(Object.fromEntries(form)) : form;
+                let response;
+                try {
+                    response = await transport.call(environment, target, { method: 'POST', headers, body, redirect: 'manual', signal });
+                }
+                catch (error) {
+                    if (signal.aborted && error === signal.reason)
+                        throw error;
+                    if (signal.aborted && error instanceof Error && error.name === 'AbortError')
+                        throw signal.reason;
+                    throw new CapabilityError('OAuth token transport failed.', 'UNAVAILABLE', { reason: 'oauth-token-transport-failed', retryable: true, cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                if (signal.aborted) {
+                    try {
+                        await response.body?.cancel();
+                    }
+                    catch (error) {
+                        const failure = new CapabilityError('OAuth response could not be closed.', 'UNAVAILABLE', { reason: 'oauth-token-response-read-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                        runtime.diagnostics.error('OAuth response cleanup failed', { scope: 'secrets', plugin: 'oauth-token-exchange', error: failure });
+                        throw failure;
+                    }
+                    throw signal.reason;
+                }
+                if (!response.ok) {
+                    try {
+                        await response.body?.cancel();
+                    }
+                    catch (error) {
+                        throw new CapabilityError('OAuth response could not be closed.', 'UNAVAILABLE', { reason: 'oauth-token-response-read-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                    }
+                    throw new CapabilityError('OAuth token endpoint refused the exchange.', response.status === 400 || response.status === 401 ? 'AUTH_REQUIRED' : 'UNAVAILABLE', {
+                        reason: 'oauth-authorization-code-refused', retryable: response.status >= 500, details: { status: response.status }
+                    });
+                }
+                let answer;
+                try {
+                    answer = await readBoundedText(response, 1024 * 1024);
+                }
+                catch (error) {
+                    if (signal.aborted && error === signal.reason)
+                        throw error;
+                    if (signal.aborted && error instanceof Error && error.name === 'AbortError')
+                        throw signal.reason;
+                    throw new CapabilityError('OAuth token response could not be read.', 'UNAVAILABLE', { reason: 'oauth-token-response-read-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                if (answer.truncated)
+                    throw new CapabilityError('OAuth token response exceeds the read limit.', 'UNAVAILABLE', { reason: 'oauth-token-response-invalid', retryable: false });
+                let decoded;
+                try {
+                    decoded = JSON.parse(answer.text);
+                }
+                catch (error) {
+                    throw new CapabilityError('OAuth token response is invalid.', 'UNAVAILABLE', { reason: 'oauth-token-response-invalid', retryable: false, cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                const parsed = OAuthAuthorizationCodeTokenResponseSchema.safeParse(decoded);
+                if (!parsed.success)
+                    throw new CapabilityError('OAuth token response is invalid.', 'UNAVAILABLE', { reason: 'oauth-token-response-invalid', retryable: false, cause: valueFreeFailure(parsed.error) });
+                return parsed.data;
+            }
+            finally {
+                resource.resolve();
+            }
+        }, { timeoutMs: grant.timeoutMs, reason: 'oauth-token-exchange' });
+    }
+    finally {
+        if (!started)
+            resource.resolve();
+    }
+}
+export async function exchangeOAuthAuthorizationCode(runtime, input) {
+    const grant = parse(oauthAuthorizationCodeExchangeSchema, input);
+    return exchange(runtime, grant);
+}
+export async function exchangeOAuthRefreshToken(runtime, input) {
+    const grant = parse(oauthRefreshTokenExchangeSchema, input);
+    return exchange(runtime, grant);
+}
+//# sourceMappingURL=credential-use.js.map

package/dist/domain/client/credential-use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-use.js","sourceRoot":"","sources":["../../../src/domain/client/credential-use.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAChH,OAAO,EACN,6BAA6B,EAC7B,qCAAqC,EACrC,oCAAoC,EACpC,+BAA+B,EAC/B,kCAAkC,EAClC,yCAAyC,EAOzC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,SAAS,KAAK,CAAsB,MAAS,EAAE,KAAiB;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxK,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAqB,EAAE,UAAgC;IACxG,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACzK,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACxD,SAAS;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB;YAAE,SAAS;QAChG,MAAM,MAAM,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAqB,EAAE,KAAmC;IACvG,MAAM,SAAS,GAAG,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,2BAA2B,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACpG,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAqB,EAAE,KAAsC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC/C,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC/E,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,IAAI,CAAC,OAAO,CAAC,QAAQ;wBAAE,OAAO,SAAS,CAAC;oBACxC,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClH,CAAC;gBAED,IAAI,SAAsB,CAAC;gBAC3B,IAAI,CAAC;oBACJ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7H,MAAM,CAAC,cAAc,EAAE,CAAC;oBACxB,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM;wBAAE,MAAM,KAAK,CAAC;oBAC3D,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE,UAAU,EAAE;wBACnE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;qBAClH,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACvG,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;YAC7B,CAAC;oBAAS,CAAC;gBACV,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;QACF,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChH,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB,EAAE,GAAW;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvJ,OAAO,MAAM,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAqB,EAAE,KAAwC;IACjH,MAAM,OAAO,GAAG,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAChI,MAAM,IAAI,eAAe,CAAC,uEAAuE,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,6CAA6C,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClM,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,WAAW,EAAE,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,WAAW;IACnB,OAAO,IAAI,eAAe,CAAC,uCAAuC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AACjJ,CAAC;AAID,KAAK,UAAU,QAAQ,CAAC,OAAqB,EAAE,KAAiB;IAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACpJ,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC/C,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACL,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC5E,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpF,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;oBAAE,MAAM,WAAW,EAAE,CAAC;gBAC9E,IAAI,IAAqB,CAAC;gBAC1B,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;oBACrB,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrH,CAAC;qBAAM,CAAC;oBACP,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;oBACpF,IAAI,YAAY,KAAK,SAAS;wBAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrK,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1F,CAAC;gBACA,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAC/F,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1L,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC;gBACtH,IAAI,KAAK,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;oBAC5C,6EAA6E;oBAC7E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,CAAC;qBAAM,CAAC;oBACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;oBAChC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7F,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM;wBAAE,MAAM,KAAK,CAAC;oBAC3D,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;wBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;oBACjG,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnM,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,IAAI,CAAC;wBAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACrD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;wBACrM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;wBACjI,MAAM,OAAO,CAAC;oBACf,CAAC;oBACD,MAAM,MAAM,CAAC,MAAM,CAAC;gBACrB,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAClB,IAAI,CAAC;wBAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACrD,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5L,CAAC;oBACD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE;wBAC7J,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;qBACnH,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBAAC,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAC7E,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM;wBAAE,MAAM,KAAK,CAAC;oBAC3D,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;wBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;oBACjG,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,IAAI,MAAM,CAAC,SAAS;oBAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7K,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACzD,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvM,CAAC;gBACD,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvM,OAAO,MAAM,CAAC,IAAI,CAAC;YACnB,CAAC;oBAAS,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QAClC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAqB,EAAE,KAA+C;IAC1H,MAAM,KAAK,GAAG,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAqB,EAAE,KAA0C;IAChH,MAAM,KAAK,GAAG,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/domain/client/env-handle.d.ts

@@ -0,0 +1,33 @@
+/**
+ * EnvSecretsHandle — the env-keyed facet of the unified secrets client.
+ *
+ * A thin, typed wrapper over a resolved `secrets/store` backend for one environment
+ * tier (encrypted-local / env-file / vault / cloudflare-secrets-store). This is the
+ * `env` scope of the unified model: key-addressed get/set/unset + bulk getAll/setAll —
+ * exactly the SecretsStoreImplementation surface, never id-addressed (env secrets have
+ * no id/rotation). See docs/superpowers/specs/2026-06-03-unified-secrets-architecture-design.md §5.
+ *
+ * CONSUME, don't reimplement: all reads/writes delegate to the registered backend via
+ * `resolveSecretsStore` — this handle adds no storage logic of its own.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { EnvironmentTier, SecretEntry } from '../kinds/index.ts';
+export declare class EnvSecretsHandle {
+    private readonly runtime;
+    readonly tier: EnvironmentTier;
+    constructor(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>, tier: EnvironmentTier);
+    private store;
+    /** Resolve a single env secret value; `undefined` if the key is unset. */
+    get(key: string): Promise<string | undefined>;
+    /** List the keys present in this tier (key + presence only — never values). */
+    list(): Promise<SecretEntry[]>;
+    /** Read every secret in this tier as a flat key→value map (drives `vibes secrets pull`). */
+    getAll(): Promise<Record<string, string>>;
+    /** Set a single env secret. */
+    set(key: string, value: string): Promise<void>;
+    /** Remove a single env secret. */
+    unset(key: string): Promise<void>;
+    /** Bulk-write a tier (drives `vibes secrets push`). */
+    setAll(secrets: Record<string, string>): Promise<void>;
+}
+//# sourceMappingURL=env-handle.d.ts.map

package/dist/domain/client/env-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-handle.d.ts","sourceRoot":"","sources":["../../../src/domain/client/env-handle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAC,WAAW,EAA6B,MAAM,mBAAmB,CAAC;AAEhG,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,QAAQ,CAAC,IAAI,EAAE,eAAe;gBADb,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,EACtD,IAAI,EAAE,eAAe;YAGjB,KAAK;IAanB,0EAA0E;IACpE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAInD,+EAA+E;IACzE,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpC,4FAA4F;IACtF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/C,+BAA+B;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,kCAAkC;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,uDAAuD;IACjD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5D"}

package/dist/domain/client/env-handle.js

@@ -0,0 +1,55 @@
+/**
+ * EnvSecretsHandle — the env-keyed facet of the unified secrets client.
+ *
+ * A thin, typed wrapper over a resolved `secrets/store` backend for one environment
+ * tier (encrypted-local / env-file / vault / cloudflare-secrets-store). This is the
+ * `env` scope of the unified model: key-addressed get/set/unset + bulk getAll/setAll —
+ * exactly the SecretsStoreImplementation surface, never id-addressed (env secrets have
+ * no id/rotation). See docs/superpowers/specs/2026-06-03-unified-secrets-architecture-design.md §5.
+ *
+ * CONSUME, don't reimplement: all reads/writes delegate to the registered backend via
+ * `resolveSecretsStore` — this handle adds no storage logic of its own.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { resolveSecretsStore } from "../../support/runtime-resolver.js";
+export class EnvSecretsHandle {
+    runtime;
+    tier;
+    constructor(runtime, tier) {
+        this.runtime = runtime;
+        this.tier = tier;
+    }
+    async store() {
+        const store = await resolveSecretsStore(this.runtime, this.tier);
+        if (!store) {
+            throw new CapabilityError(`No secrets/store backend is registered for tier '${this.tier}'. ` +
+                `Register a backend (e.g. @vibesdotdev/secrets/backends/encrypted-local) in this scope.`, 'UNAVAILABLE', { reason: 'secrets-store-unavailable', retryable: false, details: { tier: this.tier } });
+        }
+        return store;
+    }
+    /** Resolve a single env secret value; `undefined` if the key is unset. */
+    async get(key) {
+        return (await this.store()).get(this.tier, key);
+    }
+    /** List the keys present in this tier (key + presence only — never values). */
+    async list() {
+        return (await this.store()).list(this.tier);
+    }
+    /** Read every secret in this tier as a flat key→value map (drives `vibes secrets pull`). */
+    async getAll() {
+        return (await this.store()).getAll(this.tier);
+    }
+    /** Set a single env secret. */
+    async set(key, value) {
+        await (await this.store()).set(this.tier, key, value);
+    }
+    /** Remove a single env secret. */
+    async unset(key) {
+        await (await this.store()).unset(this.tier, key);
+    }
+    /** Bulk-write a tier (drives `vibes secrets push`). */
+    async setAll(secrets) {
+        await (await this.store()).setAll(this.tier, secrets);
+    }
+}
+//# sourceMappingURL=env-handle.js.map

package/dist/domain/client/env-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-handle.js","sourceRoot":"","sources":["../../../src/domain/client/env-handle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,MAAM,OAAO,gBAAgB;IAEV;IACR;IAFV,YACkB,OAA8C,EACtD,IAAqB;QADb,YAAO,GAAP,OAAO,CAAuC;QACtD,SAAI,GAAJ,IAAI,CAAiB;IAC3B,CAAC;IAEG,KAAK,CAAC,KAAK;QAClB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,eAAe,CACxB,oDAAoD,IAAI,CAAC,IAAI,KAAK;gBAClE,wFAAwF,EACxF,aAAa,EACb,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,IAAI;QACT,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,MAAM;QACX,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QACnC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,KAAK,CAAC,GAAW;QACtB,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,MAAM,CAAC,OAA+B;QAC3C,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;CACD"}

package/dist/domain/client/helper.d.ts

@@ -0,0 +1,10 @@
+/**
+ * getVibesSecretsClient — resolves the canonical secrets client from a handed runtime.
+ *
+ * The runtime must have the secrets plugin composed in (it registers the
+ * `runtime/client` descriptor + loader for id `secrets`).
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsClient } from './secrets-client.ts';
+export declare function getVibesSecretsClient(runtime: RuntimeRef): Promise<SecretsClient>;
+//# sourceMappingURL=helper.d.ts.map

package/dist/domain/client/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../src/domain/client/helper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAEjF"}

package/dist/domain/client/helper.js

@@ -0,0 +1,11 @@
+/**
+ * getVibesSecretsClient — resolves the canonical secrets client from a handed runtime.
+ *
+ * The runtime must have the secrets plugin composed in (it registers the
+ * `runtime/client` descriptor + loader for id `secrets`).
+ */
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+export function getVibesSecretsClient(runtime) {
+    return getVibesClient('secrets', runtime);
+}
+//# sourceMappingURL=helper.js.map

package/dist/domain/client/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../../src/domain/client/helper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACxD,OAAO,cAAc,CAAgB,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/domain/client/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @vibesdotdev/secrets/client — the unified secrets client + its facets.
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { EnvSecretsHandle } from './env-handle.ts';
+export { getVibesSecretsClient } from './helper.ts';
+export { ManagedSecretsHandle, type ManagedSecretCreate, type SecretRecordStore } from './managed-handle.ts';
+export { SecretsClient } from './secrets-client.ts';
+export type { AuthenticatedRequestOptionsInput } from '../../schemas/transport/authenticated-request.schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/client/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAC,KAAK,mBAAmB,EAAC,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,YAAY,EAAE,gCAAgC,EAAE,MAAM,yDAAyD,CAAC"}

package/dist/domain/client/index.js

@@ -0,0 +1,10 @@
+/**
+ * @vibesdotdev/secrets/client — the unified secrets client + its facets.
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { EnvSecretsHandle } from "./env-handle.js";
+export { getVibesSecretsClient } from "./helper.js";
+export { ManagedSecretsHandle } from "./managed-handle.js";
+export { SecretsClient } from "./secrets-client.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/client/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAkD,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/domain/client/managed-handle.d.ts

@@ -0,0 +1,24 @@
+import { type ManagedSecretCreate, type SecretRecordStore } from "../../schemas/managed/managed-handle.schema.ts";
+export { type ManagedSecretCreate, type SecretRecordStore } from "../../schemas/managed/managed-handle.schema.ts";
+import { type ManagedSecretScope, type PublicSecret, type UpdateSecretInput } from '../../schemas/index.ts';
+export declare class ManagedSecretsHandle {
+    private readonly record;
+    readonly scope: ManagedSecretScope;
+    readonly scopeId: string;
+    constructor(record: SecretRecordStore, scope: ManagedSecretScope, scopeId: string);
+    /**
+     * List the managed secrets for this scope (PublicSecret projections — never values). The
+     * scope is asked of the store (`where`), which narrows it where the store can; the answer is
+     * still checked, so a store that ignores the filter cannot hand another scope's secrets out.
+     */
+    list(): Promise<PublicSecret[]>;
+    /** Fetch one managed secret by id, scoped to this (scope, scopeId). */
+    get(id: string): Promise<PublicSecret | null>;
+    /** Create a managed secret in this scope. `value` is plaintext, encrypted server-side. */
+    create(input: ManagedSecretCreate): Promise<PublicSecret>;
+    /** Patch a managed secret (name / value / metadata). */
+    update(id: string, patch: UpdateSecretInput): Promise<PublicSecret>;
+    /** Delete a managed secret by id. */
+    remove(id: string): Promise<void>;
+}
+//# sourceMappingURL=managed-handle.d.ts.map

package/dist/domain/client/managed-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-handle.d.ts","sourceRoot":"","sources":["../../../src/domain/client/managed-handle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAC,KAAK,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACjH,OAAO,EAAE,KAAK,mBAAmB,EAAC,KAAK,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAcjH,OAAO,EAEP,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACrB,MAAM,wBAAwB,CAAC;AAmChC,qBAAa,oBAAoB;IAE/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM;gBAFP,MAAM,EAAE,iBAAiB,EACjC,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,MAAM;IAGzB;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAOrC,uEAAuE;IACjE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAMnD,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC;IAO/D,wDAAwD;IAClD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAOzE,qCAAqC;IAC/B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvC"}

package/dist/domain/client/managed-handle.js

@@ -0,0 +1,93 @@
+import {} from "../../schemas/managed/managed-handle.schema.js";
+export {} from "../../schemas/managed/managed-handle.schema.js";
+/**
+ * ManagedSecretsHandle — the managed multi-tenant vault facet of the unified secrets client.
+ *
+ * CRUD over the cloud-api storage adapter's `record()` store for one (scope, scopeId). Returns
+ * `PublicSecret` projections — NEVER the value (the plaintext on create is encrypted
+ * server-side). See docs/superpowers/specs/2026-06-03-unified-secrets-architecture-design.md §5.
+ *
+ * Inputs are parsed with `createSecretInputSchema` / `updateSecretInputSchema` before anything
+ * is sent, and every record the store returns is parsed with the wire schema; a malformed
+ * input is `INVALID_INPUT`, a malformed record `INTERNAL`, never a silent default.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { updateSecretInputSchema } from "../../schemas/index.js";
+import { managedRecordProjectionSchema } from "../../schemas/managed/managed-record.schema.js";
+import { managedCreateTransportSchema } from "../../schemas/managed/secret.schema.js";
+function recordInvalid(problem, field) {
+    return new CapabilityError('The managed secret record is not the shape the vault serves.', 'INTERNAL', {
+        reason: 'managed-secret-record-invalid',
+        retryable: false,
+        details: { problem, field }
+    });
+}
+function inputInvalid() {
+    return new CapabilityError('The managed secret input is invalid.', 'INVALID_INPUT', {
+        reason: 'managed-secret-input-invalid', retryable: false
+    });
+}
+function dateInvalid() {
+    return new CapabilityError('A managed secret record carries an unusable date.', 'INTERNAL', {
+        reason: 'secret-record-date-invalid', retryable: false
+    });
+}
+function recordToPublic(raw) {
+    const parsed = managedRecordProjectionSchema.safeParse(raw);
+    if (!parsed.success) {
+        const dates = new Set(['createdAt', 'updatedAt', 'lastUsedAt', 'lastRotatedAt']);
+        if (parsed.error.issues.some(issue => dates.has(String(issue.path[0]))))
+            throw dateInvalid();
+        throw recordInvalid('schema-mismatch', undefined);
+    }
+    return parsed.data;
+}
+export class ManagedSecretsHandle {
+    record;
+    scope;
+    scopeId;
+    constructor(record, scope, scopeId) {
+        this.record = record;
+        this.scope = scope;
+        this.scopeId = scopeId;
+    }
+    /**
+     * List the managed secrets for this scope (PublicSecret projections — never values). The
+     * scope is asked of the store (`where`), which narrows it where the store can; the answer is
+     * still checked, so a store that ignores the filter cannot hand another scope's secrets out.
+     */
+    async list() {
+        const result = await this.record.list({ where: { scope: this.scope, scopeId: this.scopeId } });
+        return result.items
+            .filter((r) => r.scope === this.scope && r.scopeId === this.scopeId)
+            .map(recordToPublic);
+    }
+    /** Fetch one managed secret by id, scoped to this (scope, scopeId). */
+    async get(id) {
+        const record = await this.record.get(id);
+        if (!record || record.scope !== this.scope || record.scopeId !== this.scopeId)
+            return null;
+        return recordToPublic(record);
+    }
+    /** Create a managed secret in this scope. `value` is plaintext, encrypted server-side. */
+    async create(input) {
+        const parsed = managedCreateTransportSchema.safeParse({ ...input, scope: this.scope, scopeId: this.scopeId });
+        if (!parsed.success)
+            throw inputInvalid();
+        const created = await this.record.create(parsed.data);
+        return recordToPublic(created);
+    }
+    /** Patch a managed secret (name / value / metadata). */
+    async update(id, patch) {
+        const parsed = updateSecretInputSchema.safeParse(patch);
+        if (!parsed.success)
+            throw inputInvalid();
+        const updated = await this.record.update(id, parsed.data);
+        return recordToPublic(updated);
+    }
+    /** Delete a managed secret by id. */
+    async remove(id) {
+        await this.record.delete(id);
+    }
+}
+//# sourceMappingURL=managed-handle.js.map

package/dist/domain/client/managed-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-handle.js","sourceRoot":"","sources":["../../../src/domain/client/managed-handle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmD,MAAM,gDAAgD,CAAC;AACjH,OAAO,EAAmD,MAAM,gDAAgD,CAAC;AACjH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACP,uBAAuB,EAItB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAGtF,SAAS,aAAa,CAAC,OAAe,EAAE,KAAyB;IAChE,OAAO,IAAI,eAAe,CAAC,8DAA8D,EAAE,UAAU,EAAE;QACtG,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAC3B,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACpB,OAAO,IAAI,eAAe,CAAC,sCAAsC,EAAE,eAAe,EAAE;QACnF,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK;KACxD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IACnB,OAAO,IAAI,eAAe,CAAC,mDAAmD,EAAE,UAAU,EAAE;QAC3F,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK;KACtD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAwB;IAC/C,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,WAAW,EAAE,CAAC;QAC7F,MAAM,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,oBAAoB;IAEd;IACR;IACA;IAHV,YACkB,MAAyB,EACjC,KAAyB,EACzB,OAAe;QAFP,WAAM,GAAN,MAAM,CAAmB;QACjC,UAAK,GAAL,KAAK,CAAoB;QACzB,YAAO,GAAP,OAAO,CAAQ;IACrB,CAAC;IAEL;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,KAAK;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;aACnE,GAAG,CAAC,cAAc,CAAC,CAAC;IACvB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,GAAG,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,MAAM,CAAC,KAA0B;QACtC,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAwB;QAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,MAAM,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;CACD"}

package/dist/domain/client/secrets-client.d.ts

@@ -0,0 +1,60 @@
+/**
+ * SecretsClient — the unified, runtime-resolved entry point to all secrets.
+ *
+ * One client, scope-routed facets (design §5). `env(tier)` is the env-keyed infra layer
+ * (encrypted-local / env-file / vault / cloudflare-secrets-store, via the secrets/store
+ * backends). `managed(scope, scopeId)` is the multi-tenant vault — CRUD over the cloud-api
+ * storage adapter (the platform secrets DB).
+ *
+ * Resolve anywhere with `getVibesSecretsClient(runtime)`. Built on BaseRuntimeClient and
+ * transport-blind — it composes the runtime's registered backends, never reaching for a
+ * transport itself.
+ */
+import { type KindContext, type VibesRuntime } from '@vibesdotdev/kernel';
+import { type CredentialReference } from '@vibesdotdev/kernel/credentials';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import type { ManagedSecretScope } from '../../schemas/index.ts';
+import type { EnvironmentTier } from '../kinds/index.ts';
+import { EnvSecretsHandle } from './env-handle.ts';
+import { ManagedSecretsHandle } from './managed-handle.ts';
+import type { CredentialPayloadSignatureInput, CredentialPresenceInputInput, OAuthAuthorizationCodeExchangeInputInput, OAuthRefreshTokenExchangeInputInput, OAuthAuthorizationUrlResolveInput } from '../../schemas/transport/credential-use.schema.ts';
+import type { AuthenticatedRequestInputInput } from '../../schemas/transport/authenticated-request.schema.ts';
+export declare class SecretsClient extends BaseRuntimeClient<VibesRuntime> {
+    constructor(descriptor?: RuntimeClientDescriptor, context?: KindContext<VibesRuntime>, runtime?: VibesRuntime);
+    /**
+     * The env-keyed facet for one environment tier — key-addressed get/set/unset + bulk
+     * getAll/setAll over the registered `secrets/store` backend.
+     */
+    env(tier: EnvironmentTier): EnvSecretsHandle;
+    checkCredentialPresence(input: CredentialPresenceInputInput): Promise<{
+        set: true;
+    }>;
+    /** Sign with a referenced credential; the value never leaves Secrets. */
+    signPayload(input: CredentialPayloadSignatureInput): Promise<string | undefined>;
+    sendAuthenticatedRequest(input: AuthenticatedRequestInputInput): Promise<Response>;
+    resolveOAuthAuthorizationUrl(input: OAuthAuthorizationUrlResolveInput): Promise<string>;
+    exchangeOAuthAuthorizationCode(input: OAuthAuthorizationCodeExchangeInputInput): Promise<{
+        [x: string]: import("@vibesdotdev/kernel/bootstrap").JsonValue;
+        access_token: string;
+        refresh_token?: string | undefined;
+        expires_in?: number | undefined;
+        x_refresh_token_expires_in?: number | undefined;
+        refresh_token_expires_in?: number | undefined;
+    }>;
+    exchangeOAuthRefreshToken(input: OAuthRefreshTokenExchangeInputInput): Promise<{
+        [x: string]: import("@vibesdotdev/kernel/bootstrap").JsonValue;
+        access_token: string;
+        refresh_token?: string | undefined;
+        expires_in?: number | undefined;
+        x_refresh_token_expires_in?: number | undefined;
+        refresh_token_expires_in?: number | undefined;
+    }>;
+    /** Build a credential reference for a managed record through its declared value store. */
+    managedCredentialReference(secretId: string): CredentialReference;
+    /**
+     * The managed multi-tenant vault facet for a (scope, scopeId) — id-addressed CRUD over the
+     * cloud-api storage adapter (the platform secrets DB). Requires the storage.cloud-api adapter.
+     */
+    managed(scope: ManagedSecretScope, scopeId: string): Promise<ManagedSecretsHandle>;
+}
+//# sourceMappingURL=secrets-client.d.ts.map

package/dist/domain/client/secrets-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-client.d.ts","sourceRoot":"","sources":["../../../src/domain/client/secrets-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAkB,KAAK,WAAW,EAAC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAErG,OAAO,EAAE,iBAAiB,EAAC,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAE5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,wCAAwC,EAAE,mCAAmC,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACxP,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yDAAyD,CAAC;AAE9G,qBAAa,aAAc,SAAQ,iBAAiB,CAAC,YAAY,CAAC;gBAEhE,UAAU,GAAE,uBAAmE,EAC/E,OAAO,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,EACnC,OAAO,CAAC,EAAE,YAAY;IAKvB;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB;IAItC,uBAAuB,CAAC,KAAK,EAAE,4BAA4B;;;IAKjE,yEAAyE;IACnE,WAAW,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKhF,wBAAwB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKlF,4BAA4B,CAAC,KAAK,EAAE,iCAAiC;IAKrE,8BAA8B,CAAC,KAAK,EAAE,wCAAwC;;;;;;;;IAK9E,yBAAyB,CAAC,KAAK,EAAE,mCAAmC;;;;;;;;IAK1E,0FAA0F;IAC1F,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IA2BjE;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA8BxF"}