@vibesdotdev/secrets 0.0.1

package/dist/kinds/schemas/store.schema.js

@@ -0,0 +1,34 @@
+/**
+ * Secrets Store Descriptor Schema
+ *
+ * Defines the structure for secrets/store kind descriptors.
+ * Each descriptor represents a secrets storage backend
+ * (env-file, encrypted-local, cloudflare-api, vault).
+ */
+import * as z from 'zod/v4';
+export const EnvironmentTierSchema = z.enum(['local', 'dev', 'staging', 'production']);
+export const SecretsBackendSchema = z.enum([
+    'env-file',
+    'encrypted-local',
+    'cloudflare-api',
+    'cloudflare-secrets-store',
+    'vault'
+]);
+export const SecretsStoreDescriptorSchema = z.object({
+    id: z.string().min(1),
+    kind: z.literal('secrets/store'),
+    name: z.string().optional(),
+    description: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+    hardware: z.array(z.string()).optional(),
+    /** Backend type for this store */
+    backend: SecretsBackendSchema,
+    /** Environment tiers this store operates on */
+    tiers: z.array(EnvironmentTierSchema).min(1),
+    /** Resolution priority (higher wins for write ops) */
+    priority: z.number().int().default(0),
+    /** Backend-specific configuration key-value pairs */
+    config: z.record(z.string(), z.string()).optional()
+});
+//# sourceMappingURL=store.schema.js.map

package/dist/kinds/schemas/store.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.js","sourceRoot":"","sources":["../../../src/kinds/schemas/store.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAIvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,UAAU;IACV,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,OAAO;CACP,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC,kCAAkC;IAClC,OAAO,EAAE,oBAAoB;IAE7B,+CAA+C;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAErC,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC"}

package/dist/kinds/schemas/store.types.d.ts

@@ -0,0 +1,28 @@
+import type { SecretsStoreDescriptor } from './store.schema';
+/** A single entry in a secrets listing */
+export interface SecretEntry {
+    /** Secret key name (e.g., VIBES_AUTH_SECRET) */
+    key: string;
+    /** Whether a value is stored for this key */
+    hasValue: boolean;
+    /** Backend source identifier */
+    source: string;
+}
+/** Interface all secrets store backends must implement */
+export interface SecretsStoreImplementation {
+    readonly id: string;
+    readonly descriptor: SecretsStoreDescriptor;
+    /** List all secret keys stored for an environment */
+    list(environment: string): Promise<SecretEntry[]>;
+    /** Get a single secret value (undefined if not found) */
+    get(environment: string, key: string): Promise<string | undefined>;
+    /** Set a secret value for an environment */
+    set(environment: string, key: string, value: string): Promise<void>;
+    /** Remove a secret from an environment */
+    unset(environment: string, key: string): Promise<void>;
+    /** Get all secret key-value pairs for an environment */
+    getAll(environment: string): Promise<Record<string, string>>;
+    /** Set multiple secrets at once (merges with existing) */
+    setAll(environment: string, secrets: Record<string, string>): Promise<void>;
+}
+//# sourceMappingURL=store.types.d.ts.map

package/dist/kinds/schemas/store.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.d.ts","sourceRoot":"","sources":["../../../src/kinds/schemas/store.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;CACf;AAED,0DAA0D;AAC1D,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE5C,qDAAqD;IACrD,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAElD,yDAAyD;IACzD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEnE,4CAA4C;IAC5C,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,0CAA0C;IAC1C,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,wDAAwD;IACxD,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7D,0DAA0D;IAC1D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E"}

package/dist/kinds/schemas/store.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.types.js.map

package/dist/kinds/schemas/store.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.js","sourceRoot":"","sources":["../../../src/kinds/schemas/store.types.ts"],"names":[],"mappings":""}

package/dist/kinds/store.interface.d.ts

@@ -0,0 +1,2 @@
+export type { SecretEntry, SecretsStoreImplementation } from './schemas/store.types';
+//# sourceMappingURL=store.interface.d.ts.map

package/dist/kinds/store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.interface.d.ts","sourceRoot":"","sources":["../../src/kinds/store.interface.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/kinds/store.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.interface.js.map

package/dist/kinds/store.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.interface.js","sourceRoot":"","sources":["../../src/kinds/store.interface.ts"],"names":[],"mappings":""}

package/dist/kinds/store.kind.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Secrets Store Kind Definition
+ *
+ * Registers the secrets/store kind with the runtime.
+ * Resolution selects backends by environment tier and priority.
+ */
+import type { RuntimeKindDescriptorRecord } from '@vibesdotdev/runtime/schemas/kind';
+import type { SecretsStoreImplementation } from './store.interface';
+export declare const secretsStoreKind: RuntimeKindDescriptorRecord<SecretsStoreImplementation>;
+//# sourceMappingURL=store.kind.d.ts.map

package/dist/kinds/store.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/store.kind.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAe,2BAA2B,EAAqB,MAAM,mCAAmC,CAAC;AAOrH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA2BpE,eAAO,MAAM,gBAAgB,yDAS3B,CAAC"}

package/dist/kinds/store.kind.js

@@ -0,0 +1,36 @@
+/**
+ * Secrets Store Kind Definition
+ *
+ * Registers the secrets/store kind with the runtime.
+ * Resolution selects backends by environment tier and priority.
+ */
+import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
+import { SecretsStoreDescriptorSchema } from './store.schema.js';
+/**
+ * Resolve the best secrets store for the current scope.
+ *
+ * Filters candidates by environment tier (from scope qualifiers),
+ * then picks the highest-priority match.
+ *
+ * No defaultImplementation — missing backends cause hard failure at resolve()
+ * time per the SPEC hard rule: "Missing-backend means hard failure."
+ */
+function resolveSecretsStore(candidates, scope, _context) {
+    const typed = candidates;
+    if (typed.length === 0)
+        return undefined;
+    if (typed.length === 1)
+        return typed[0];
+    const envTier = (scope.qualifiers?.environmentTier ?? 'local');
+    const tierMatches = typed.filter((d) => d.tiers.includes(envTier));
+    const pool = tierMatches.length > 0 ? tierMatches : typed;
+    pool.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+    return pool[0];
+}
+export const secretsStoreKind = createRuntimeKind({
+    id: 'secrets/store',
+    descriptorSchema: SecretsStoreDescriptorSchema,
+    resolve: resolveSecretsStore,
+    contexts: []
+});
+//# sourceMappingURL=store.kind.js.map

package/dist/kinds/store.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.kind.js","sourceRoot":"","sources":["../../src/kinds/store.kind.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,EACN,4BAA4B,EAG5B,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC3B,UAA+B,EAC/B,KAAmB,EACnB,QAAqB;IAErB,MAAM,KAAK,GAAG,UAAsC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,IAAI,OAAO,CAAoB,CAAC;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAE1D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAI/C;IACD,EAAE,EAAE,eAAe;IACnB,gBAAgB,EAAE,4BAA4B;IAC9C,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,EAAE;CACZ,CAAC,CAAC"}

package/dist/kinds/store.schema.d.ts

@@ -0,0 +1,2 @@
+export { SecretsStoreDescriptorSchema, EnvironmentTierSchema, SecretsBackendSchema, type SecretsStoreDescriptor, type EnvironmentTier, type SecretsBackend } from './schemas/store.schema';
+//# sourceMappingURL=store.schema.d.ts.map

package/dist/kinds/store.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.d.ts","sourceRoot":"","sources":["../../src/kinds/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,4BAA4B,EAC5B,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,MAAM,wBAAwB,CAAC"}

package/dist/kinds/store.schema.js

@@ -0,0 +1,2 @@
+export { SecretsStoreDescriptorSchema, EnvironmentTierSchema, SecretsBackendSchema } from './schemas/store.schema.js';
+//# sourceMappingURL=store.schema.js.map

package/dist/kinds/store.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.js","sourceRoot":"","sources":["../../src/kinds/store.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,4BAA4B,EAC5B,qBAAqB,EACrB,oBAAoB,EAIpB,MAAM,wBAAwB,CAAC"}

package/dist/manifest/canonical.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Vibes Secrets Import Manifest (canonical, value-free)
+ *
+ * Read by `vibes secrets import` to discover which keys to pull from which
+ * local root env files when bootstrapping the encrypted Vibes store. The
+ * manifest is reconciled against ground truth: every entry corresponds to a
+ * real `secret: true` env var declared by an app's deployment config (or, in
+ * auth-web's case, by its sub-manifest files).
+ *
+ * Sources:
+ *   - `local-env` (`.env.local`) is the canonical machine-local store of
+ *     every actual production-quality secret value: auth secrets, OAuth
+ *     client secrets (GitHub / Google / Discord / Microsoft), Resend, the
+ *     internal auth token, Stripe billing keys, etc.
+ *   - `production-env` (`.env.production`) holds production-flavored
+ *     non-secret config plus the operator's CF coordinates. Value-free here.
+ *   - `manual` is a pseudo-source for keys that must be set through another
+ *     channel (`vibes secrets set`, generated tokens, or pasted from a vault).
+ *     The import command skips `manual` entries with a notice.
+ *
+ * Operator credentials (`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`,
+ * `CLOUDFLARE_SECRETS_STORE_ID`) are intentionally NOT in this manifest.
+ * They authenticate the operator's machine to push secrets into the store;
+ * they are never themselves pushed into the store.
+ */
+import { type SecretsImportManifest } from './import-manifest.schema';
+declare const manifest: SecretsImportManifest;
+export declare const canonicalImportManifest: SecretsImportManifest;
+export default manifest;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/manifest/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/manifest/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAEN,KAAK,qBAAqB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,QAAA,MAAM,QAAQ,EAAE,qBAiSd,CAAC;AAEH,eAAO,MAAM,uBAAuB,EAAE,qBAAgC,CAAC;AACvE,eAAe,QAAQ,CAAC"}

package/dist/manifest/canonical.js

@@ -0,0 +1,313 @@
+/**
+ * Vibes Secrets Import Manifest (canonical, value-free)
+ *
+ * Read by `vibes secrets import` to discover which keys to pull from which
+ * local root env files when bootstrapping the encrypted Vibes store. The
+ * manifest is reconciled against ground truth: every entry corresponds to a
+ * real `secret: true` env var declared by an app's deployment config (or, in
+ * auth-web's case, by its sub-manifest files).
+ *
+ * Sources:
+ *   - `local-env` (`.env.local`) is the canonical machine-local store of
+ *     every actual production-quality secret value: auth secrets, OAuth
+ *     client secrets (GitHub / Google / Discord / Microsoft), Resend, the
+ *     internal auth token, Stripe billing keys, etc.
+ *   - `production-env` (`.env.production`) holds production-flavored
+ *     non-secret config plus the operator's CF coordinates. Value-free here.
+ *   - `manual` is a pseudo-source for keys that must be set through another
+ *     channel (`vibes secrets set`, generated tokens, or pasted from a vault).
+ *     The import command skips `manual` entries with a notice.
+ *
+ * Operator credentials (`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`,
+ * `CLOUDFLARE_SECRETS_STORE_ID`) are intentionally NOT in this manifest.
+ * They authenticate the operator's machine to push secrets into the store;
+ * they are never themselves pushed into the store.
+ */
+import { SecretsImportManifestSchema } from './import-manifest.schema';
+const manifest = SecretsImportManifestSchema.parse({
+    version: 1,
+    sources: {
+        'local-env': {
+            path: '.env.local',
+            purpose: 'Canonical machine-local secret values: auth, OAuth, billing, internal tokens'
+        },
+        'production-env': {
+            path: '.env.production',
+            purpose: 'Production-flavored non-secret config + CF operator coordinates'
+        },
+        'manual': {
+            purpose: "Set via `vibes secrets set <KEY>` or generated by ops; not sourced from a local file"
+        }
+    },
+    secrets: [
+        // --- Auth gateway (auth-web) — sourced from .env.local ----------------------
+        {
+            key: 'VIBES_AUTH_SECRET',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: true,
+            description: 'Better Auth signing secret (auth-web)'
+        },
+        // `VIBES_AUTH_DATABASE_URL` / `VIBES_AUTH_DATABASE_AUTH_TOKEN` are
+        // dev-only: production auth-web binds its own D1 database (`vibes-auth-db`)
+        // via the `DB` binding in `wrangler.jsonc`. The libsql/file fallback in
+        // `auth-web/src/server/persistence.ts` is for local dev only. We keep
+        // them in the manifest so `vibes secrets import` still picks them up
+        // for a working local store, but they're optional and never pushed to
+        // the production Secrets Store.
+        {
+            key: 'VIBES_AUTH_DATABASE_URL',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'LibSQL/Turso connection URL for auth persistence (DEV ONLY — production uses D1)'
+        },
+        {
+            key: 'VIBES_AUTH_DATABASE_AUTH_TOKEN',
+            category: 'vibes-auth',
+            source: 'local-env',
+            aliases: ['DATABASE_AUTH_TOKEN'],
+            required: false,
+            description: 'LibSQL/Turso auth token for auth persistence (DEV ONLY — production uses D1)'
+        },
+        {
+            key: 'VIBES_AUTH_RESEND_API_KEY',
+            category: 'vibes-auth',
+            source: 'local-env',
+            aliases: ['RESEND_API_KEY'],
+            required: false,
+            description: 'Resend API key for auth email delivery'
+        },
+        {
+            key: 'VIBES_AUTH_TWILIO_ACCOUNT_SID',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Twilio account SID for phone OTP delivery'
+        },
+        {
+            key: 'VIBES_AUTH_TWILIO_AUTH_TOKEN',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Twilio auth token for phone OTP delivery'
+        },
+        {
+            key: 'VIBES_AUTH_GITHUB_CLIENT_ID',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'GitHub OAuth client ID'
+        },
+        {
+            key: 'VIBES_AUTH_GITHUB_CLIENT_SECRET',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'GitHub OAuth client secret'
+        },
+        {
+            key: 'VIBES_AUTH_GOOGLE_CLIENT_ID',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Google OAuth client ID'
+        },
+        {
+            key: 'VIBES_AUTH_GOOGLE_CLIENT_SECRET',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Google OAuth client secret'
+        },
+        {
+            key: 'VIBES_AUTH_DISCORD_CLIENT_ID',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Discord OAuth client ID'
+        },
+        {
+            key: 'VIBES_AUTH_DISCORD_CLIENT_SECRET',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Discord OAuth client secret'
+        },
+        {
+            key: 'VIBES_AUTH_MICROSOFT_CLIENT_ID',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Microsoft (Azure AD) OAuth client ID'
+        },
+        {
+            key: 'VIBES_AUTH_MICROSOFT_CLIENT_SECRET',
+            category: 'vibes-auth',
+            source: 'local-env',
+            required: false,
+            description: 'Microsoft (Azure AD) OAuth client secret'
+        },
+        // --- Internal cross-app bearer tokens (account-web, ai-web) ------------------
+        {
+            key: 'VIBES_AUTH_INTERNAL_TOKEN',
+            category: 'vibes-internal',
+            source: 'local-env',
+            required: true,
+            description: 'Bearer token for internal/admin auth API calls'
+        },
+        {
+            key: 'VIBES_INTERNAL_SERVICE_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: true,
+            description: 'Shared internal bearer token for platform/account internal RPCs'
+        },
+        {
+            key: 'VIBES_PLATFORM_INTERNAL_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Platform-specific internal bearer token; falls back to VIBES_INTERNAL_SERVICE_TOKEN'
+        },
+        {
+            key: 'VIBES_EMAIL_INGRESS_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Bearer token for inbound email webhooks (auth-web /api/email)'
+        },
+        // --- Billing (account-web) ---------------------------------------------------
+        // `.env.production` stores Stripe under a `VIBES_ACCOUNT_STRIPE_*` prefix;
+        // `.env.local` uses the canonical names directly. Either source resolves.
+        {
+            key: 'STRIPE_SECRET_KEY',
+            category: 'provider-billing',
+            source: 'local-env',
+            aliases: ['VIBES_ACCOUNT_STRIPE_SECRET_KEY'],
+            required: false,
+            description: 'Stripe secret key for billing sync and checkout'
+        },
+        {
+            key: 'STRIPE_WEBHOOK_SECRET',
+            category: 'provider-billing',
+            source: 'local-env',
+            required: false,
+            description: 'Stripe webhook signing secret for /api/webhooks/stripe'
+        },
+        {
+            key: 'STRIPE_PUB_KEY',
+            category: 'provider-billing',
+            source: 'local-env',
+            aliases: ['PUBLIC_STRIPE_KEY', 'VIBES_ACCOUNT_STRIPE_PUB_KEY'],
+            required: false,
+            description: 'Stripe publishable key (pk_live_*/pk_test_*); safe to expose to clients but tracked here so live/test mode stays aligned with STRIPE_SECRET_KEY'
+        },
+        {
+            key: 'STRIPE_RESTRICTED_KEY',
+            category: 'provider-billing',
+            source: 'local-env',
+            aliases: ['VIBES_ACCOUNT_STRIPE_RESTRICTED_KEY'],
+            required: false,
+            description: 'Stripe restricted live key (rk_live_*) for narrow-scope ops/CI usage; not consumed at runtime — runtime uses STRIPE_SECRET_KEY'
+        },
+        {
+            key: 'CF_BILLING_SECRET',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Cloudflare-side billing webhook secret'
+        },
+        {
+            key: 'RESEND_API_KEY',
+            category: 'provider-other',
+            source: 'manual',
+            required: false,
+            description: 'Resend API key used by account-web to send invoice receipt emails'
+        },
+        // --- LLM / voice / search providers (ai-web, ai-web) ----------------------
+        {
+            key: 'OPENAI_API_KEY',
+            category: 'provider-llm',
+            source: 'manual',
+            required: false,
+            description: 'OpenAI provider key (ai-web)'
+        },
+        {
+            key: 'ANTHROPIC_API_KEY',
+            category: 'provider-llm',
+            source: 'manual',
+            required: false,
+            description: 'Anthropic provider key (ai-web)'
+        },
+        {
+            key: 'GOOGLE_API_KEY',
+            category: 'provider-llm',
+            source: 'manual',
+            required: false,
+            description: 'Google provider key (ai-web)'
+        },
+        {
+            key: 'GEMINI_API_KEY',
+            category: 'provider-llm',
+            source: 'manual',
+            required: false,
+            description: 'Gemini-named provider key alias (ai-web)'
+        },
+        {
+            key: 'DEEPGRAM_API_KEY',
+            category: 'provider-voice',
+            source: 'manual',
+            required: false,
+            description: 'Deepgram transcription provider key (ai-web)'
+        },
+        {
+            key: 'ELEVENLABS_API_KEY',
+            category: 'provider-voice',
+            source: 'manual',
+            required: false,
+            description: 'ElevenLabs TTS provider key (ai-web)'
+        },
+        {
+            key: 'FIRECRAWL_API_KEY',
+            category: 'provider-search',
+            source: 'manual',
+            required: false,
+            description: 'Firecrawl crawl/scrape provider key (ai-web)'
+        },
+        {
+            key: 'VIBES_API_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Tools-web internal API token'
+        },
+        {
+            key: 'VIBES_TOOL_REGISTRY_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Tools-web tool-registry access token'
+        },
+        // --- Other provider creds (referenced by deployment configs but not in
+        //     a Pages app's secrets list yet — included so they round-trip if
+        //     they end up in `.env.local`) -----------------------------------------
+        {
+            key: 'DIGITALOCEAN_API_TOKEN',
+            category: 'provider-other',
+            source: 'local-env',
+            required: false,
+            description: 'DigitalOcean API token for DOKS / DO Spaces tooling'
+        },
+        {
+            key: 'NPM_TOKEN',
+            category: 'provider-other',
+            source: 'manual',
+            required: false,
+            description: 'npm publish token used by `vibes infra npm publish`'
+        }
+    ]
+});
+export const canonicalImportManifest = manifest;
+export default manifest;
+//# sourceMappingURL=canonical.js.map

package/dist/manifest/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/manifest/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACN,2BAA2B,EAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,QAAQ,GAA0B,2BAA2B,CAAC,KAAK,CAAC;IACzE,OAAO,EAAE,CAAC;IACV,OAAO,EAAE;QACR,WAAW,EAAE;YACZ,IAAI,EAAE,YAAY;YAClB,OAAO,EACN,8EAA8E;SAC/E;QACD,gBAAgB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,iEAAiE;SAC1E;QACD,QAAQ,EAAE;YACT,OAAO,EACN,sFAAsF;SACvF;KACD;IACD,OAAO,EAAE;QACR,+EAA+E;QAC/E;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,uCAAuC;SACpD;QACD,mEAAmE;QACnE,4EAA4E;QAC5E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,gCAAgC;QAChC;YACC,GAAG,EAAE,yBAAyB;YAC9B,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,kFAAkF;SAC/F;QACD;YACC,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,qBAAqB,CAAC;YAChC,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8EAA8E;SAC3F;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wCAAwC;SACrD;QACD;YACC,GAAG,EAAE,+BAA+B;YACpC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,2CAA2C;SACxD;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,GAAG,EAAE,6BAA6B;YAClC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wBAAwB;SACrC;QACD;YACC,GAAG,EAAE,iCAAiC;YACtC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,4BAA4B;SACzC;QACD;YACC,GAAG,EAAE,6BAA6B;YAClC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wBAAwB;SACrC;QACD;YACC,GAAG,EAAE,iCAAiC;YACtC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,4BAA4B;SACzC;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,yBAAyB;SACtC;QACD;YACC,GAAG,EAAE,kCAAkC;YACvC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,6BAA6B;SAC1C;QACD;YACC,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,GAAG,EAAE,oCAAoC;YACzC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QAED,gFAAgF;QAChF;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,gDAAgD;SAC7D;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,iEAAiE;SAC9E;QACD;YACC,GAAG,EAAE,+BAA+B;YACpC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qFAAqF;SAClG;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,+DAA+D;SAC5E;QAED,gFAAgF;QAChF,2EAA2E;QAC3E,0EAA0E;QAC1E;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,iCAAiC,CAAC;YAC5C,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,GAAG,EAAE,uBAAuB;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wDAAwD;SACrE;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;YAC9D,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iJAAiJ;SAC9J;QACD;YACC,GAAG,EAAE,uBAAuB;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,qCAAqC,CAAC;YAChD,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,gIAAgI;SAC7I;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wCAAwC;SACrD;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,mEAAmE;SAChF;QAED,6EAA6E;QAC7E;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iCAAiC;SAC9C;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,GAAG,EAAE,kBAAkB;YACvB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8CAA8C;SAC3D;QACD;YACC,GAAG,EAAE,oBAAoB;YACzB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8CAA8C;SAC3D;QACD;YACC,GAAG,EAAE,iBAAiB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QAED,wEAAwE;QACxE,sEAAsE;QACtE,6EAA6E;QAC7E;YACC,GAAG,EAAE,wBAAwB;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qDAAqD;SAClE;QACD;YACC,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qDAAqD;SAClE;KACD;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAA0B,QAAQ,CAAC;AACvE,eAAe,QAAQ,CAAC"}

package/dist/manifest/import-manifest.schema.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Secrets Import Manifest Schema
+ *
+ * Catalogs the secrets the platform expects to receive from local root env
+ * files at bootstrap time. Carries no values — only key identity, source
+ * preference, and intent. The manifest is the contract a `vibes secrets
+ * import` command (phase 5) reads against.
+ */
+import * as z from 'zod/v4';
+/**
+ * Where a secret value is expected to originate from when running
+ * `vibes secrets import`. Sources with a `path` are repo-relative .env-shaped
+ * files; they are read-only inputs and never committed. Sources without a
+ * `path` (e.g. the canonical `manual` source) describe entries that are not
+ * importable from disk and must be set through other means
+ * (`vibes secrets set`, generated tokens, Cloudflare dashboard, etc.).
+ */
+export declare const SecretSourceSchema: z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodString;
+}, z.core.$strip>;
+export type SecretSource = z.infer<typeof SecretSourceSchema>;
+export declare const SecretCategorySchema: z.ZodEnum<{
+    "vibes-internal": "vibes-internal";
+    "vibes-auth": "vibes-auth";
+    cloudflare: "cloudflare";
+    "provider-llm": "provider-llm";
+    "provider-voice": "provider-voice";
+    "provider-search": "provider-search";
+    "provider-billing": "provider-billing";
+    "provider-other": "provider-other";
+}>;
+export type SecretCategory = z.infer<typeof SecretCategorySchema>;
+export declare const SecretManifestEntrySchema: z.ZodObject<{
+    key: z.ZodString;
+    category: z.ZodEnum<{
+        "vibes-internal": "vibes-internal";
+        "vibes-auth": "vibes-auth";
+        cloudflare: "cloudflare";
+        "provider-llm": "provider-llm";
+        "provider-voice": "provider-voice";
+        "provider-search": "provider-search";
+        "provider-billing": "provider-billing";
+        "provider-other": "provider-other";
+    }>;
+    source: z.ZodString;
+    aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    required: z.ZodDefault<z.ZodBoolean>;
+    description: z.ZodString;
+}, z.core.$strip>;
+export type SecretManifestEntry = z.infer<typeof SecretManifestEntrySchema>;
+export declare const SecretsImportManifestSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    sources: z.ZodRecord<z.ZodString, z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        purpose: z.ZodString;
+    }, z.core.$strip>>;
+    secrets: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        category: z.ZodEnum<{
+            "vibes-internal": "vibes-internal";
+            "vibes-auth": "vibes-auth";
+            cloudflare: "cloudflare";
+            "provider-llm": "provider-llm";
+            "provider-voice": "provider-voice";
+            "provider-search": "provider-search";
+            "provider-billing": "provider-billing";
+            "provider-other": "provider-other";
+        }>;
+        source: z.ZodString;
+        aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        required: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SecretsImportManifest = z.infer<typeof SecretsImportManifestSchema>;
+//# sourceMappingURL=import-manifest.schema.d.ts.map

package/dist/manifest/import-manifest.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-manifest.schema.d.ts","sourceRoot":"","sources":["../../src/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAapC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;iBAMtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}