@vibesdotdev/secrets 0.0.1

package/dist/manifest/import-manifest.schema.js

@@ -0,0 +1,55 @@
+/**
+ * Secrets Import Manifest Schema
+ *
+ * Catalogs the secrets the platform expects to receive from local root env
+ * files at bootstrap time. Carries no values — only key identity, source
+ * preference, and intent. The manifest is the contract a `vibes secrets
+ * import` command (phase 5) reads against.
+ */
+import * as z from 'zod/v4';
+/**
+ * Where a secret value is expected to originate from when running
+ * `vibes secrets import`. Sources with a `path` are repo-relative .env-shaped
+ * files; they are read-only inputs and never committed. Sources without a
+ * `path` (e.g. the canonical `manual` source) describe entries that are not
+ * importable from disk and must be set through other means
+ * (`vibes secrets set`, generated tokens, Cloudflare dashboard, etc.).
+ */
+export const SecretSourceSchema = z.object({
+    /** Repo-relative path to the .env file. Omit for non-importable sources. */
+    path: z.string().min(1).optional(),
+    /** Why this source owns this category of secrets (Vibes internals, providers, etc.) */
+    purpose: z.string().min(1)
+});
+export const SecretCategorySchema = z.enum([
+    'vibes-internal',
+    'vibes-auth',
+    'cloudflare',
+    'provider-llm',
+    'provider-voice',
+    'provider-search',
+    'provider-billing',
+    'provider-other'
+]);
+export const SecretManifestEntrySchema = z.object({
+    /** Canonical key in Cloudflare Secrets Store. Matches env var name unless renamed. */
+    key: z.string().regex(/^[_A-Z0-9]+$/),
+    /** Category this secret belongs to (drives source-file routing) */
+    category: SecretCategorySchema,
+    /** Preferred source file id (must exist in `sources`) */
+    source: z.string().min(1),
+    /** Alternate names this secret may appear under in the source file */
+    aliases: z.array(z.string().regex(/^[_A-Z0-9]+$/)).default([]),
+    /** Whether the secret is required for a production push */
+    required: z.boolean().default(true),
+    /** Human-readable description of what this secret unlocks */
+    description: z.string().min(1)
+});
+export const SecretsImportManifestSchema = z.object({
+    version: z.literal(1),
+    /** Map of source id → file path + purpose */
+    sources: z.record(z.string().min(1), SecretSourceSchema),
+    /** Catalog of expected secrets, keyed by canonical name */
+    secrets: z.array(SecretManifestEntrySchema)
+});
+//# sourceMappingURL=import-manifest.schema.js.map

package/dist/manifest/import-manifest.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-manifest.schema.js","sourceRoot":"","sources":["../../src/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,uFAAuF;IACvF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IACrC,mEAAmE;IACnE,QAAQ,EAAE,oBAAoB;IAC9B,yDAAyD;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,6DAA6D;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC;IACxD,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAC"}

package/dist/manifest/index.d.ts

@@ -0,0 +1,3 @@
+export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema, type SecretsImportManifest, type SecretManifestEntry, type SecretSource, type SecretCategory } from './import-manifest.schema';
+export { canonicalImportManifest } from './canonical';
+//# sourceMappingURL=index.d.ts.map

package/dist/manifest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/manifest/index.js

@@ -0,0 +1,3 @@
+export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema } from './import-manifest.schema.js';
+export { canonicalImportManifest } from './canonical.js';
+//# sourceMappingURL=index.js.map

package/dist/manifest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EAKpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/requirements/index.d.ts

@@ -0,0 +1,2 @@
+export { resolveSecretRequirements, groupRequirementsByApp, uniqueSecretKeys, type SecretRequirement } from './resolver';
+//# sourceMappingURL=index.d.ts.map

package/dist/requirements/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,MAAM,YAAY,CAAC"}

package/dist/requirements/index.js

@@ -0,0 +1,2 @@
+export { resolveSecretRequirements, groupRequirementsByApp, uniqueSecretKeys } from './resolver.js';
+//# sourceMappingURL=index.js.map

package/dist/requirements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAEhB,MAAM,YAAY,CAAC"}

package/dist/requirements/resolver.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Secret Requirements Resolver
+ *
+ * Resolves secret requirements from two intentional sources:
+ *
+ * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
+ *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
+ *    declare secrets here because they are infrastructure resources, not web apps.
+ *    The `infra/web-app` path is kept for completeness but no longer discovers
+ *    vestigial descriptors (deleted 2026-05-20).
+ *
+ * 2. `deployment.config.ts` files — the canonical per-app deployment system.
+ *    Loads each config via `@vibesdotdev/infra-deploy` and extracts `secret: true`
+ *    env entries from the `AppDeployment.env` array. This is the authoritative
+ *    source for web-app secrets.
+ *
+ * The two-system split is intentional, not transitional:
+ * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
+ * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
+ *
+ * Used by `vibes secrets check` to cross-reference stored secrets against
+ * declared requirements.
+ */
+import type { SecretRequirement, SecretRequirementsRuntime } from './schemas/requirements';
+export type { SecretRequirement } from './schemas/requirements';
+/**
+ * Resolve all secret requirements from infra descriptors and deployment configs.
+ *
+ * Queries two sources:
+ * 1. Runtime for `infra/worker` descriptors (`.infra.ts` — workers + infrastructure)
+ * 2. `deployment.config.ts` files via `@vibesdotdev/infra-deploy` (web apps)
+ *
+ * These two sources are mutually exclusive by app type, so there should be no
+ * overlap. Both are queried to cover the full surface:
+ * - Workers declare secrets in `.infra.ts` (job-workers, ai-workers, etc.)
+ * - Web apps declare secrets in `deployment.config.ts` (auth-web, ai-web, etc.)
+ *
+ * Deployment config entries are appended after descriptor entries.
+ * Duplicates are harmless for check reporting.
+ */
+export declare function resolveSecretRequirements(runtime: SecretRequirementsRuntime, options?: {
+    deploymentConfigRoot?: string;
+}): Promise<SecretRequirement[]>;
+/**
+ * Group requirements by app/worker ID for per-app reporting.
+ */
+export declare function groupRequirementsByApp(requirements: SecretRequirement[]): Map<string, SecretRequirement[]>;
+/**
+ * Get unique secret keys across all apps (deduped).
+ */
+export declare function uniqueSecretKeys(requirements: SecretRequirement[]): string[];
+//# sourceMappingURL=resolver.d.ts.map

package/dist/requirements/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/requirements/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAEX,iBAAiB,EACjB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA2GhE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoC9B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,YAAY,EAAE,iBAAiB,EAAE,GAC/B,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAQlC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE5E"}

package/dist/requirements/resolver.js

@@ -0,0 +1,196 @@
+/**
+ * Secret Requirements Resolver
+ *
+ * Resolves secret requirements from two intentional sources:
+ *
+ * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
+ *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
+ *    declare secrets here because they are infrastructure resources, not web apps.
+ *    The `infra/web-app` path is kept for completeness but no longer discovers
+ *    vestigial descriptors (deleted 2026-05-20).
+ *
+ * 2. `deployment.config.ts` files — the canonical per-app deployment system.
+ *    Loads each config via `@vibesdotdev/infra-deploy` and extracts `secret: true`
+ *    env entries from the `AppDeployment.env` array. This is the authoritative
+ *    source for web-app secrets.
+ *
+ * The two-system split is intentional, not transitional:
+ * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
+ * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
+ *
+ * Used by `vibes secrets check` to cross-reference stored secrets against
+ * declared requirements.
+ */
+import { loadDeploymentConfig } from '@vibesdotdev/infra-deploy';
+const BAKED_SECRET_REQUIREMENTS_JSON = typeof __VIBES_BAKED_SECRET_REQUIREMENTS__ !== 'undefined'
+    ? __VIBES_BAKED_SECRET_REQUIREMENTS__
+    : '[]';
+function readBakedRequirements() {
+    if (!BAKED_SECRET_REQUIREMENTS_JSON || BAKED_SECRET_REQUIREMENTS_JSON === '[]') {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(BAKED_SECRET_REQUIREMENTS_JSON);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function extractRequirements(descriptors) {
+    const results = [];
+    for (const desc of descriptors) {
+        if (!desc.env)
+            continue;
+        for (const entry of desc.env) {
+            if (!entry.secret)
+                continue;
+            results.push({
+                key: entry.name,
+                appId: desc.id,
+                required: entry.required ?? true,
+                description: entry.description
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Resolve secret requirements from deployment.config.ts files.
+ *
+ * Walks the workspace for `deployment.config.ts` files (same discovery logic
+ * as `infra-deploy regenerate`), loads each via subprocess, and extracts
+ * `secret: true` env entries from the `AppDeployment.env` array.
+ */
+async function resolveFromDeploymentConfigs(rootDir) {
+    const { readdirSync, statSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const IGNORED = new Set([
+        'node_modules', '.git', '.svelte-kit', 'dist', '.next', '.turbo', '.vite', '.wrangler'
+    ]);
+    const CONFIG_NAMES = new Set([
+        'deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'
+    ]);
+    // Discover deployment.config.ts files (mirrors infra-deploy's findDeploymentConfigs)
+    const configs = [];
+    function walk(dir, depth) {
+        if (depth > 4)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (CONFIG_NAMES.has(entry))
+                configs.push(join(dir, entry));
+        }
+        for (const entry of entries) {
+            if (IGNORED.has(entry) || entry.startsWith('.'))
+                continue;
+            const full = join(dir, entry);
+            let info;
+            try {
+                info = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (info.isDirectory())
+                walk(full, depth + 1);
+        }
+    }
+    walk(rootDir, 0);
+    const requirements = [];
+    for (const configPath of configs) {
+        const appDir = configPath.replace(/\/deployment\.config\.(ts|js|mjs)$/, '');
+        try {
+            const loaded = await loadDeploymentConfig(appDir);
+            for (const entry of loaded.deployment.env) {
+                if (!entry.secret)
+                    continue;
+                requirements.push({
+                    key: entry.name,
+                    appId: loaded.deployment.appId,
+                    required: entry.required ?? true,
+                    description: entry.description
+                });
+            }
+        }
+        catch {
+            // Config load failures are non-fatal for secret resolution.
+            // The regen pipeline catches these separately.
+        }
+    }
+    return requirements;
+}
+/**
+ * Resolve all secret requirements from infra descriptors and deployment configs.
+ *
+ * Queries two sources:
+ * 1. Runtime for `infra/worker` descriptors (`.infra.ts` — workers + infrastructure)
+ * 2. `deployment.config.ts` files via `@vibesdotdev/infra-deploy` (web apps)
+ *
+ * These two sources are mutually exclusive by app type, so there should be no
+ * overlap. Both are queried to cover the full surface:
+ * - Workers declare secrets in `.infra.ts` (job-workers, ai-workers, etc.)
+ * - Web apps declare secrets in `deployment.config.ts` (auth-web, ai-web, etc.)
+ *
+ * Deployment config entries are appended after descriptor entries.
+ * Duplicates are harmless for check reporting.
+ */
+export async function resolveSecretRequirements(runtime, options) {
+    const requirements = [];
+    if (runtime.hasKind('infra/web-app')) {
+        const webApps = runtime.assets('infra/web-app').descriptors();
+        requirements.push(...extractRequirements(webApps));
+    }
+    if (runtime.hasKind('infra/worker')) {
+        const workers = runtime.assets('infra/worker').descriptors();
+        requirements.push(...extractRequirements(workers));
+    }
+    // Load web-app secrets from deployment.config.ts — the canonical source.
+    // Falls back to process.cwd() when no root is explicitly provided.
+    let liveDeployReqs = [];
+    if (options?.deploymentConfigRoot || typeof process !== 'undefined') {
+        const root = options?.deploymentConfigRoot ?? process.cwd();
+        try {
+            liveDeployReqs = await resolveFromDeploymentConfigs(root);
+        }
+        catch {
+            // infra-deploy subprocess failures shouldn't block the check.
+        }
+    }
+    // In compiled binaries, `resolveFromDeploymentConfigs` returns [] because
+    // the standalone executable can't import workspace deployment.config.ts
+    // files at runtime. Fall back to the build-time snapshot captured by
+    // `apps/cli-bin/scripts/build.ts` so `--app <id>` filtering still works.
+    if (liveDeployReqs.length === 0) {
+        requirements.push(...readBakedRequirements());
+    }
+    else {
+        requirements.push(...liveDeployReqs);
+    }
+    return requirements;
+}
+/**
+ * Group requirements by app/worker ID for per-app reporting.
+ */
+export function groupRequirementsByApp(requirements) {
+    const grouped = new Map();
+    for (const req of requirements) {
+        const existing = grouped.get(req.appId) ?? [];
+        existing.push(req);
+        grouped.set(req.appId, existing);
+    }
+    return grouped;
+}
+/**
+ * Get unique secret keys across all apps (deduped).
+ */
+export function uniqueSecretKeys(requirements) {
+    return [...new Set(requirements.map((r) => r.key))];
+}
+//# sourceMappingURL=resolver.js.map

package/dist/requirements/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/requirements/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAmBjE,MAAM,8BAA8B,GACnC,OAAO,mCAAmC,KAAK,WAAW;IACzD,CAAC,CAAC,mCAAmC;IACrC,CAAC,CAAC,IAAI,CAAC;AAET,SAAS,qBAAqB;IAC7B,IAAI,CAAC,8BAA8B,IAAI,8BAA8B,KAAK,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAyC;IACrE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,SAAS;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACZ,GAAG,EAAE,KAAK,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,EAAE;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC9B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,4BAA4B,CAC1C,OAAe;IAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW;KACtF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC5B,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB;KACvE,CAAC,CAAC;IAEH,qFAAqF;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACvC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEjB,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,SAAS;gBAC5B,YAAY,CAAC,IAAI,CAAC;oBACjB,GAAG,EAAE,KAAK,CAAC,IAAI;oBACf,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;oBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,4DAA4D;YAC5D,+CAA+C;QAChD,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAkC,EAClC,OAA2C;IAE3C,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAwB,CAAC;QACpF,YAAY,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAwB,CAAC;QACnF,YAAY,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,cAAc,GAAwB,EAAE,CAAC;IAC7C,IAAI,OAAO,EAAE,oBAAoB,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC;YACJ,cAAc,GAAG,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACR,8DAA8D;QAC/D,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CAAC,GAAG,qBAAqB,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACP,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,YAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAiC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/requirements/schemas/requirements.d.ts

@@ -0,0 +1,27 @@
+export interface SecretRequirement {
+    /** Secret key name (e.g., VIBES_AUTH_SECRET) */
+    key: string;
+    /** App or worker ID that requires this secret */
+    appId: string;
+    /** Whether the secret is required for the app to function */
+    required: boolean;
+    /** Human-readable description of the secret's purpose */
+    description: string | undefined;
+}
+export interface RequirementEnvEntry {
+    name: string;
+    secret?: boolean;
+    required?: boolean;
+    description?: string;
+}
+export interface RequirementInfraDescriptor {
+    id: string;
+    env?: RequirementEnvEntry[];
+}
+export interface SecretRequirementsRuntime {
+    hasKind(kind: string): boolean;
+    assets(kind: string): {
+        descriptors(): RequirementInfraDescriptor[];
+    };
+}
+//# sourceMappingURL=requirements.d.ts.map

package/dist/requirements/schemas/requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.d.ts","sourceRoot":"","sources":["../../../src/requirements/schemas/requirements.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,QAAQ,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;QACrB,WAAW,IAAI,0BAA0B,EAAE,CAAC;KAC5C,CAAC;CACF"}

package/dist/requirements/schemas/requirements.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=requirements.js.map

package/dist/requirements/schemas/requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../src/requirements/schemas/requirements.ts"],"names":[],"mappings":""}

package/dist/secrets.plugin.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Secrets Runtime Plugin
+ *
+ * Registers the secrets/store kind and CLI backend loaders.
+ */
+declare const _default: import("@vibesdotdev/runtime").RuntimePlugin;
+export default _default;
+//# sourceMappingURL=secrets.plugin.d.ts.map

package/dist/secrets.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.plugin.d.ts","sourceRoot":"","sources":["../src/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;AAwBH,wBAoCG"}

package/dist/secrets.plugin.js

@@ -0,0 +1,59 @@
+/**
+ * Secrets Runtime Plugin
+ *
+ * Registers the secrets/store kind and CLI backend loaders.
+ */
+import { createRuntimePlugin, loader } from '@vibesdotdev/runtime';
+import { secretsStoreKind } from './kinds/store.kind';
+// CLI
+import secretsGroup from "./cli/secrets.cli-group.descriptor.js";
+import secretsCheck from "./cli/check/secrets.check.cli-command.descriptor.js";
+import secretsImport from "./cli/import/secrets.import.cli-command.descriptor.js";
+import secretsExport from "./cli/export/secrets.export.cli-command.descriptor.js";
+import secretsList from "./cli/list/secrets.list.cli-command.descriptor.js";
+import secretsPull from "./cli/pull/secrets.pull.cli-command.descriptor.js";
+import secretsPush from "./cli/push/secrets.push.cli-command.descriptor.js";
+import secretsSet from "./cli/set/secrets.set.cli-command.descriptor.js";
+import secretsUnset from "./cli/unset/secrets.unset.cli-command.descriptor.js";
+import secretsReveal from "./cli/reveal/secrets.reveal.cli-command.descriptor.js";
+import secretsPreCommitCheck from "./cli/pre-commit/secrets.pre-commit-check.cli-command.descriptor.js";
+// Docs
+import secretsBackendsDescriptor from "./docs/backends.docs.descriptor.js";
+import secretsEncryptionDescriptor from "./docs/encryption.docs.descriptor.js";
+import secretsEnvFileDescriptor from "./docs/env-file.docs.descriptor.js";
+export default createRuntimePlugin({
+    id: 'secrets',
+    name: 'Secrets Management',
+    description: 'Environment-aware secrets storage with multiple backends',
+    dependencies: ['config'],
+    kinds: [secretsStoreKind],
+    descriptors: [
+        secretsGroup,
+        secretsCheck,
+        secretsImport,
+        secretsExport,
+        secretsList,
+        secretsPull,
+        secretsPush,
+        secretsSet,
+        secretsUnset,
+        secretsReveal,
+        secretsPreCommitCheck,
+        secretsBackendsDescriptor,
+        secretsEncryptionDescriptor,
+        secretsEnvFileDescriptor
+    ],
+    loaders: [
+        loader('secrets.check', () => import('./cli/check/secrets.check.cli-command.impl.js')),
+        loader('secrets.import', () => import('./cli/import/secrets.import.cli-command.impl.js')),
+        loader('secrets.export', () => import('./cli/export/secrets.export.cli-command.impl.js')),
+        loader('secrets.list', () => import('./cli/list/secrets.list.cli-command.impl.js')),
+        loader('secrets.pull', () => import('./cli/pull/secrets.pull.cli-command.impl.js')),
+        loader('secrets.push', () => import('./cli/push/secrets.push.cli-command.impl.js')),
+        loader('secrets.set', () => import('./cli/set/secrets.set.cli-command.impl.js')),
+        loader('secrets.unset', () => import('./cli/unset/secrets.unset.cli-command.impl.js')),
+        loader('secrets.reveal', () => import('./cli/reveal/secrets.reveal.cli-command.impl.js')),
+        loader('dev.secrets.pre-commit-check', () => import('./cli/pre-commit/secrets.pre-commit-check.cli-command.impl.js'))
+    ]
+});
+//# sourceMappingURL=secrets.plugin.js.map

package/dist/secrets.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.plugin.js","sourceRoot":"","sources":["../src/secrets.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM;AACN,OAAO,YAAY,MAAM,uCAAuC,CAAC;AACjE,OAAO,YAAY,MAAM,qDAAqD,CAAC;AAC/E,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,WAAW,MAAM,mDAAmD,CAAC;AAC5E,OAAO,UAAU,MAAM,iDAAiD,CAAC;AACzE,OAAO,YAAY,MAAM,qDAAqD,CAAC;AAC/E,OAAO,aAAa,MAAM,uDAAuD,CAAC;AAClF,OAAO,qBAAqB,MAAM,qEAAqE,CAAC;AAExG,OAAO;AACP,OAAO,yBAAyB,MAAM,oCAAoC,CAAC;AAC3E,OAAO,2BAA2B,MAAM,sCAAsC,CAAC;AAC/E,OAAO,wBAAwB,MAAM,oCAAoC,CAAC;AAE1E,eAAe,mBAAmB,CAAC;IAClC,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,0DAA0D;IACvE,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,KAAK,EAAE,CAAC,gBAA+C,CAAC;IAExD,WAAW,EAAE;QACZ,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,aAAa;QACb,WAAW;QACX,WAAW;QACX,WAAW;QACX,UAAU;QACV,YAAY;QACZ,aAAa;QACb,qBAAqB;QACrB,yBAAyB;QACzB,2BAA2B;QAC3B,wBAAwB;KACxB;IAED,OAAO,EAAE;QACR,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACtF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACnF,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAChF,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACtF,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QACzF,MAAM,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAAC;KACrH;CACD,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,108 @@
+{
+  "name": "@vibesdotdev/secrets",
+  "version": "0.0.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./kinds": {
+      "types": "./dist/kinds/index.d.ts",
+      "bun": "./src/kinds/index.ts",
+      "import": "./dist/kinds/index.js",
+      "default": "./dist/kinds/index.js"
+    },
+    "./kinds/*": {
+      "types": "./dist/kinds/*.d.ts",
+      "bun": "./src/kinds/*.ts",
+      "import": "./dist/kinds/*.js",
+      "default": "./dist/kinds/*.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest/index.d.ts",
+      "bun": "./src/manifest/index.ts",
+      "import": "./dist/manifest/index.js",
+      "default": "./dist/manifest/index.js"
+    },
+    "./manifest/*": {
+      "types": "./dist/manifest/*.d.ts",
+      "bun": "./src/manifest/*.ts",
+      "import": "./dist/manifest/*.js",
+      "default": "./dist/manifest/*.js"
+    },
+    "./requirements": {
+      "types": "./dist/requirements/index.d.ts",
+      "bun": "./src/requirements/index.ts",
+      "import": "./dist/requirements/index.js",
+      "default": "./dist/requirements/index.js"
+    },
+    "./plugin": {
+      "types": "./dist/secrets.plugin.d.ts",
+      "bun": "./src/secrets.plugin.ts",
+      "import": "./dist/secrets.plugin.js",
+      "default": "./dist/secrets.plugin.js"
+    }
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vibesdotdev/monorepo.git",
+    "directory": "packages/secrets"
+  },
+  "dependencies": {
+    "@vibesdotdev/runtime": "0.0.1",
+    "@vibesdotdev/config": "0.0.1",
+    "@vibesdotdev/infra-core": "0.0.1",
+    "@vibesdotdev/cli": "0.0.1"
+  },
+  "peerDependencies": {
+    "zod": "^4.3.6",
+    "@vibesdotdev/infra-deploy": "0.0.1"
+  },
+  "peerDependenciesMeta": {
+    "@vibesdotdev/infra-deploy": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "bun --bun tsc -p tsconfig.json --noEmit",
+    "test": "bun test"
+  },
+  "license": "MIT",
+  "files": [
+    "dist",
+    "src",
+    "bin",
+    "README.md",
+    "SPEC.md",
+    "LICENSE",
+    "!src/**/__tests__/**",
+    "!src/**/__stubs__/**",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/*.spec.ts",
+    "!src/**/*.spec.tsx",
+    "!dist/**/__tests__/**",
+    "!dist/**/__stubs__/**",
+    "!dist/**/*.test.js",
+    "!dist/**/*.test.js.map",
+    "!dist/**/*.test.d.ts",
+    "!dist/**/*.test.d.ts.map",
+    "!dist/**/*.spec.js",
+    "!dist/**/*.spec.js.map",
+    "!dist/**/*.spec.d.ts",
+    "!dist/**/*.spec.d.ts.map"
+  ],
+  "vibes": {
+    "visibility": "public-framework"
+  }
+}

package/src/cli/check/schemas/check-result.ts

@@ -0,0 +1,8 @@
+export interface CheckResult {
+	key: string;
+	appId: string;
+	required: boolean;
+	description: string | undefined;
+	status: 'ok' | 'missing' | 'warn';
+	source: string | undefined;
+}

package/src/cli/check/secrets.check.cli-command.descriptor.ts

@@ -0,0 +1,21 @@
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
+
+const descriptor: CLICommandAssetDescriptor = {
+	kind: 'cli/command',
+	id: 'secrets.check',
+	name: 'check',
+	description: 'Validate stored secrets against infra manifest requirements',
+	group: 'secrets',
+	options: [
+		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
+		{ flags: '--app <id>', description: 'Check a specific app or worker only' },
+		{ flags: '--manifest', description: 'Also cross-check against the canonical import manifest' },
+		{ flags: '--json', description: 'Output as JSON' }
+	],
+	surfaces: ['cli'],
+	hardware: ['consumer'],
+	enabled: true,
+	order: 50
+};
+
+export default descriptor;