@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,22 +1,25 @@
 # @vibesdotdev/secrets
 
-Secret store contracts, encrypted local secret support, and runtime descriptors for Vibes packages.
-
-This package is part of the public Vibes framework package set. The source repository is private while the public repository split is being prepared, so package documentation is published on the Vibes docs site.
-
-## Install
+Runtime-resolved secret stores, managed-vault contracts, and credential use.
 
 ```sh
 bun add @vibesdotdev/secrets
-# or
-npm install @vibesdotdev/secrets
 ```
 
-## Documentation
+Compose the core plugin and the backends your host supports. Consumers resolve stores through the runtime; the active tier and descriptor priority choose the store. Missing capabilities fail closed.
+
+The root exports the portable contract. Use explicit `/client`, `/exec`, `/attestation`, `/schemas`, `/cli`, `/svelte`, and `/tui` entrypoints for those capabilities. See [package.json](package.json) for compatible export keys and [SPEC](SPEC.md) for ownership and refusals.
+
+Resolve attestation with `getSecretsAttestation(runtime)`, available from the root and `/attestation`. The runtime owns provider selection. The concrete `LocalSecretsAttestationProvider` is retained at `/attestation` for implementation compatibility and is not a root export.
+
+Mounted-file hosts compose `@vibesdotdev/secrets/backends/mounted-files/plugin` and declare `VIBES_SECRETS_MOUNT_DIR`. Each filename is a credential key; the store is read-only and registers nothing without a declared directory.
+
+Managed create/update requests validate before transport with schema-owned editor mapping and value-free diagnostics. List/get summaries exclude values; unusable dates refuse `INTERNAL secret-record-date-invalid`. The inspector reveals values only after confirmation, clears them on exit or expiry, and discards late asynchronous completion.
+
+The [detailed contracts](docs/contracts.md) describe backends, CLI commands, and typed failures. [SPEC verification](SPEC.md#proof-and-limitations) lists the source and built-export checks.
 
-- Package guide: https://docs.vibes.dev/packages/secrets
-- Vibes docs: https://docs.vibes.dev
+Package guide: [docs.vibes.dev/secrets](https://docs.vibes.dev/secrets).
 
-## License
+Business Source License 1.1. See [LICENSE](LICENSE) for terms and conversion to MIT.
 
-MIT
+Svelte state is scoped to the enclosing runtime surface, with lifecycle ownership through the `secrets.svelte` runtime client. Standalone factories and browser document adapters remain supported. Failures render fixed messages; logs never serialize caught payloads or mutation metadata. See [the state contract](SPEC.md#svelte-state-lifecycle).

package/dist/backends/encrypted-local/encrypted-local.descriptor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Encrypted Local Backend Descriptor
+ *
+ * Stores secrets in an AES-encrypted JSON file at ~/.vibes/config/secrets.enc.json.
+ * Higher priority than env-file. Encryption key optional but recommended.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=encrypted-local.descriptor.d.ts.map

package/dist/backends/encrypted-local/encrypted-local.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.descriptor.d.ts","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,QAAA,MAAM,UAAU,EAAE,sBAejB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/encrypted-local/encrypted-local.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * Encrypted Local Backend Descriptor
+ *
+ * Stores secrets in an AES-encrypted JSON file at ~/.vibes/config/secrets.enc.json.
+ * Higher priority than env-file. Encryption key optional but recommended.
+ */
+const descriptor = {
+    id: 'encrypted-local',
+    kind: 'secrets/store',
+    name: 'Encrypted Local Store',
+    description: 'AES-encrypted secrets stored in ~/.vibes/config/secrets.enc.json',
+    tags: ['local', 'encrypted'],
+    enabled: true,
+    backend: 'encrypted-local',
+    selection: 'scope',
+    // Consumer/local backend only — staging and production are served by
+    // `infra-cloudflare`'s `cloudflare-secrets-store` and `cloudflare-api`
+    // backends (see infra-cloudflare/src/secrets/). Adding cloud
+    // tiers here would silently misroute prod reads to the local FS.
+    tiers: ['local', 'dev', 'staging'],
+    priority: 10
+};
+export default descriptor;
+//# sourceMappingURL=encrypted-local.descriptor.js.map

package/dist/backends/encrypted-local/encrypted-local.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.descriptor.js","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,kEAAkE;IAC/E,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;IAC5B,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,iBAAiB;IAC1B,SAAS,EAAE,OAAO;IAClB,qEAAqE;IACrE,uEAAuE;IACvE,6DAA6D;IAC7D,iEAAiE;IACjE,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;IAClC,QAAQ,EAAE,EAAE;CACZ,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/encrypted-local/encrypted-local.impl.local.d.ts

@@ -0,0 +1,49 @@
+export type { KeychainRuntime } from '../../schemas/backends/host.schema.ts';
+export { VAULT_DIRECTORY_MODE, corrupt, fromBase64, loadVault, parseVault, readVaultText, saveVault, toBase64, unreadable, vaultDocument } from "./vault-document.ts";
+/**
+ * Encrypted Local Backend Implementation
+ *
+ * Stores all secrets in a single encrypted JSON file.
+ * Write-time encryption failures are hard failures; there is no plaintext fallback.
+ *
+ * File: {base}/config/secrets.enc.json (encrypted). Secrets are the user's ONE
+ * keychain: {base} defaults to ~/.vibes for BOTH the installed binary and
+ * from-source runs. Isolation is opt-in only through the surface-selected
+ * paths/roots descriptor (normally sourced from VIBES_HOME/VIBES_CONFIG_DIR).
+ *
+ * The decrypted vault is parsed with a schema (a document that is not a vault
+ * is `INTERNAL encrypted-local-corrupt`), held as Maps so a lookup answers by
+ * own entry only, and published atomically owner-private (0600). Writers in one
+ * process are serialized per file, so concurrent sets all land.
+ */
+import { type FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type PathRoots } from '@vibesdotdev/paths';
+import type { SecretEntry, SecretsStoreImplementation } from '@vibesdotdev/secrets/kinds/store.interface';
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+/**
+ * Resolve the secrets keychain base dir synchronously from the roots of the
+ * runtime the caller was handed.
+ */
+export declare function resolveSecretsBaseDir(runtime: RuntimeRef): string;
+export declare function getConfigDir(roots: PathRoots): string;
+export declare function getStorePath(fs: FileSystemAdapterInterface, roots: PathRoots): string;
+declare class EncryptedLocalStore implements SecretsStoreImplementation {
+    readonly id = "encrypted-local";
+    readonly descriptor: SecretsStoreDescriptor;
+    private readonly roots;
+    private readonly runtime;
+    constructor(desc: SecretsStoreDescriptor, runtime: RuntimeRef);
+    /** Read the vault, in line behind any write in flight for the same file. */
+    private read;
+    /** Read-modify-write the vault as one step; `change` answers whether it changed anything. */
+    private modify;
+    list(environment: string): Promise<SecretEntry[]>;
+    get(environment: string, key: string): Promise<string | undefined>;
+    set(environment: string, key: string, value: string): Promise<void>;
+    unset(environment: string, key: string): Promise<void>;
+    getAll(environment: string): Promise<Record<string, string>>;
+    setAll(environment: string, secrets: Record<string, string>): Promise<void>;
+}
+export declare function createEncryptedLocalStore(runtime: RuntimeRef): import("@vibesdotdev/kernel").RuntimeImplementationWrapper<EncryptedLocalStore>;
+//# sourceMappingURL=encrypted-local.impl.local.d.ts.map

package/dist/backends/encrypted-local/encrypted-local.impl.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.impl.local.d.ts","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.impl.local.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAC,OAAO,EAAC,UAAU,EAAC,SAAS,EAAC,UAAU,EAAC,aAAa,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7J;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EACZ,WAAW,EACX,0BAA0B,EACzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAQtF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAEjE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAErD;AAOD,wBAAgB,YAAY,CAAC,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAErF;AAED,cAAM,mBAAoB,YAAW,0BAA0B;IAC9D,QAAQ,CAAC,EAAE,qBAAqB;IAChC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAE9B,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU;IAM7D,4EAA4E;YAC9D,IAAI;IAOlB,6FAA6F;YAC/E,MAAM;IAQd,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAWjD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IASlE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtD,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAO5D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAejF;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,UAAU,mFAQ5D"}

package/dist/backends/encrypted-local/encrypted-local.impl.local.js

@@ -0,0 +1,139 @@
+import { loadVault, saveVault } from "./vault-document.js";
+export { VAULT_DIRECTORY_MODE, corrupt, fromBase64, loadVault, parseVault, readVaultText, saveVault, toBase64, unreadable, vaultDocument } from "./vault-document.js";
+/**
+ * Encrypted Local Backend Implementation
+ *
+ * Stores all secrets in a single encrypted JSON file.
+ * Write-time encryption failures are hard failures; there is no plaintext fallback.
+ *
+ * File: {base}/config/secrets.enc.json (encrypted). Secrets are the user's ONE
+ * keychain: {base} defaults to ~/.vibes for BOTH the installed binary and
+ * from-source runs. Isolation is opt-in only through the surface-selected
+ * paths/roots descriptor (normally sourced from VIBES_HOME/VIBES_CONFIG_DIR).
+ *
+ * The decrypted vault is parsed with a schema (a document that is not a vault
+ * is `INTERNAL encrypted-local-corrupt`), held as Maps so a lookup answers by
+ * own entry only, and published atomically owner-private (0600). Writers in one
+ * process are serialized per file, so concurrent sets all land.
+ */
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import {} from '@vibesdotdev/kernel';
+import { createRuntimeImplementation } from '@vibesdotdev/kernel/factory/implementation';
+import { getPathRoots } from '@vibesdotdev/paths';
+import { assertSecretKey } from "../../domain/kinds/secret-key.js";
+import { serializeByPath } from "../../support/path-queue.js";
+import { assertSecretValue } from "../../support/secret-value.js";
+import { parseStoreEnvironment } from "../../support/store-environment.js";
+import descriptor from "./encrypted-local.descriptor.js";
+import {} from "./schemas/internal.js";
+/**
+ * Resolve the secrets keychain base dir synchronously from the roots of the
+ * runtime the caller was handed.
+ */
+export function resolveSecretsBaseDir(runtime) {
+    return getPathRoots(runtime).vibesHome;
+}
+export function getConfigDir(roots) {
+    return roots.configDir;
+}
+/** The host's own files (the keychain home), never a workspace-rooted view of them. */
+function resolveHostFileSystem(runtime) {
+    return resolveFileSystemAdapter(runtime, { binding: false });
+}
+export function getStorePath(fs, roots) {
+    return fs.join(getConfigDir(roots), 'secrets.enc.json');
+}
+class EncryptedLocalStore {
+    id = 'encrypted-local';
+    descriptor;
+    roots;
+    runtime;
+    constructor(desc, runtime) {
+        this.descriptor = desc;
+        this.runtime = runtime;
+        this.roots = getPathRoots(runtime);
+    }
+    /** Read the vault, in line behind any write in flight for the same file. */
+    async read(use) {
+        const fs = await resolveHostFileSystem(this.runtime);
+        return serializeByPath(getStorePath(fs, this.roots), async () => use(await loadVault(this.runtime, this.roots, fs)));
+    }
+    /** Read-modify-write the vault as one step; `change` answers whether it changed anything. */
+    async modify(change) {
+        const fs = await resolveHostFileSystem(this.runtime);
+        await serializeByPath(getStorePath(fs, this.roots), async () => {
+            const vault = await loadVault(this.runtime, this.roots, fs);
+            if (change(vault))
+                await saveVault(this.runtime, this.roots, fs, vault);
+        });
+    }
+    async list(environment) {
+        const tier = parseStoreEnvironment(environment);
+        return this.read((vault) => [...(vault.get(tier) ?? [])].map(([key, value]) => ({
+            key,
+            hasValue: String(value) !== '',
+            source: this.id
+        })));
+    }
+    async get(environment, key) {
+        const tier = parseStoreEnvironment(environment);
+        assertSecretKey(key);
+        return this.read((vault) => {
+            const value = vault.get(tier)?.get(key);
+            return value === undefined ? undefined : String(value);
+        });
+    }
+    async set(environment, key, value) {
+        const tier = parseStoreEnvironment(environment);
+        assertSecretKey(key);
+        assertSecretValue(value);
+        await this.modify((vault) => {
+            const secrets = vault.get(tier) ?? new Map();
+            secrets.set(key, value);
+            vault.set(tier, secrets);
+            return true;
+        });
+    }
+    async unset(environment, key) {
+        const tier = parseStoreEnvironment(environment);
+        assertSecretKey(key);
+        await this.modify((vault) => {
+            const secrets = vault.get(tier);
+            if (!secrets?.delete(key))
+                return false;
+            if (secrets.size === 0)
+                vault.delete(tier);
+            return true;
+        });
+    }
+    async getAll(environment) {
+        const tier = parseStoreEnvironment(environment);
+        return this.read((vault) => Object.fromEntries([...(vault.get(tier) ?? [])].map(([key, value]) => [key, String(value)])));
+    }
+    async setAll(environment, secrets) {
+        const tier = parseStoreEnvironment(environment);
+        // Every entry is checked before the vault is touched: all land or none do.
+        const entries = Object.entries(secrets);
+        for (const [key, value] of entries) {
+            assertSecretKey(key);
+            assertSecretValue(value);
+        }
+        await this.modify((vault) => {
+            const current = vault.get(tier) ?? new Map();
+            for (const [key, value] of entries)
+                current.set(key, value);
+            vault.set(tier, current);
+            return true;
+        });
+    }
+}
+export function createEncryptedLocalStore(runtime) {
+    const store = new EncryptedLocalStore(descriptor, runtime);
+    return createRuntimeImplementation({
+        id: 'encrypted-local',
+        kind: 'secrets/store',
+        priority: 10,
+        implementation: store
+    });
+}
+//# sourceMappingURL=encrypted-local.impl.local.js.map

package/dist/backends/encrypted-local/encrypted-local.impl.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.impl.local.js","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.impl.local.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAC,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAC,OAAO,EAAC,UAAU,EAAC,SAAS,EAAC,UAAU,EAAC,aAAa,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7J;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,wBAAwB,EAAkC,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAmB,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAC;AAMjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,UAAU,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAqB,MAAM,uBAAuB,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACxD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC5C,OAAO,KAAK,CAAC,SAAS,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,SAAS,qBAAqB,CAAC,OAAwB;IACtD,OAAO,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAA8B,EAAE,KAAgB;IAC5E,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,mBAAmB;IACf,EAAE,GAAG,iBAAiB,CAAC;IACvB,UAAU,CAAyB;IAC3B,KAAK,CAAY;IACjB,OAAO,CAAkB;IAE1C,YAAY,IAA4B,EAAE,OAAmB;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,IAAI,CAAI,GAA+B;QACpD,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAC/D,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAClD,CAAC;IACH,CAAC;IAED,6FAA6F;IACrF,KAAK,CAAC,MAAM,CAAC,MAAwC;QAC5D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,eAAe,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG;YACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;SACf,CAAC,CAAC,CACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW;QACzC,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,GAAW;QAC3C,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,OAA+B;QAChE,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,eAAe,CAAC,GAAG,CAAC,CAAC;YACrB,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;YAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmB;IAC5D,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,2BAA2B,CAAC;QAClC,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,KAAK;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/backends/encrypted-local/encrypted-local.plugin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Secrets Backend Encrypted-Local Plugin
+ *
+ * Registers the encrypted-local secrets/store backend with the runtime.
+ * Stores secrets in an AES-256-GCM encrypted JSON vault. Consumer hardware only (Node/Bun).
+ */
+export declare const secretsBackendEncryptedLocalPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsBackendEncryptedLocalPlugin;
+//# sourceMappingURL=encrypted-local.plugin.d.ts.map

package/dist/backends/encrypted-local/encrypted-local.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.plugin.d.ts","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,eAAO,MAAM,kCAAkC,6CAoB7C,CAAC;AAEH,eAAe,kCAAkC,CAAC"}

package/dist/backends/encrypted-local/encrypted-local.plugin.js

@@ -0,0 +1,23 @@
+/**
+ * Secrets Backend Encrypted-Local Plugin
+ *
+ * Registers the encrypted-local secrets/store backend with the runtime.
+ * Stores secrets in an AES-256-GCM encrypted JSON vault. Consumer hardware only (Node/Bun).
+ */
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import descriptor from "./encrypted-local.descriptor.js";
+export const secretsBackendEncryptedLocalPlugin = createRuntimePlugin({
+    id: '@vibesdotdev/secrets/backends/encrypted-local',
+    name: 'Secrets Backend: Encrypted-Local',
+    description: 'Encrypted local secrets backend. Stores secrets in an AES-encrypted JSON vault for local, dev, and staging tiers.',
+    dependencies: ['secrets'],
+    descriptors: [descriptor],
+    onRegister: async (runtime) => {
+        runtime.registerLoader('secrets/store', 'encrypted-local', async () => {
+            const { createEncryptedLocalStore } = await import("./encrypted-local.impl.local.js");
+            return createEncryptedLocalStore(runtime);
+        }, { priority: 10, origin: 'secrets-backend-encrypted-local' });
+    }
+});
+export default secretsBackendEncryptedLocalPlugin;
+//# sourceMappingURL=encrypted-local.plugin.js.map

package/dist/backends/encrypted-local/encrypted-local.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-local.plugin.js","sourceRoot":"","sources":["../../../src/backends/encrypted-local/encrypted-local.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,UAAU,MAAM,iCAAiC,CAAC;AAEzD,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;IACrE,EAAE,EAAE,+CAA+C;IACnD,IAAI,EAAE,kCAAkC;IACxC,WAAW,EACV,mHAAmH;IACpH,YAAY,EAAE,CAAC,SAAS,CAAC;IAEzB,WAAW,EAAE,CAAC,UAAU,CAAC;IAEzB,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,cAAc,CACrB,eAAe,EACf,iBAAiB,EACjB,KAAK,IAAI,EAAE;YACV,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACtF,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,EACD,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAC3D,CAAC;IACH,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,kCAAkC,CAAC"}

package/dist/backends/encrypted-local/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @vibesdotdev/secrets/backends/encrypted-local
+ *
+ * Encrypted local secrets backend. Stores secrets in an AES-256-GCM
+ * encrypted JSON vault at ~/.vibes/config/secrets.enc.json.
+ */
+export { default, secretsBackendEncryptedLocalPlugin } from './encrypted-local.plugin.ts';
+export { default as encryptedLocalDescriptor } from './encrypted-local.descriptor.ts';
+export { createEncryptedLocalStore } from './encrypted-local.impl.local.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/encrypted-local/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/encrypted-local/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAC,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAGzF,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/backends/encrypted-local/index.js

@@ -0,0 +1,13 @@
+/**
+ * @vibesdotdev/secrets/backends/encrypted-local
+ *
+ * Encrypted local secrets backend. Stores secrets in an AES-256-GCM
+ * encrypted JSON vault at ~/.vibes/config/secrets.enc.json.
+ */
+// Plugin
+export { default, secretsBackendEncryptedLocalPlugin } from "./encrypted-local.plugin.js";
+// Descriptor
+export { default as encryptedLocalDescriptor } from "./encrypted-local.descriptor.js";
+// Implementation factory
+export { createEncryptedLocalStore } from "./encrypted-local.impl.local.js";
+//# sourceMappingURL=index.js.map

package/dist/backends/encrypted-local/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/encrypted-local/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS;AACT,OAAO,EAAE,OAAO,EAAC,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAEzF,aAAa;AACb,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEtF,yBAAyB;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/backends/encrypted-local/schemas/internal.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/v4';
+/**
+ * The decrypted vault file: environments, each a map of key to value. A
+ * `__proto__` name is not checked here (a record schema skips it silently): the
+ * parse refuses it while reading the JSON, because an object cannot hold it as
+ * data and a vault this package wrote never contains it.
+ */
+export declare const SecretsVaultSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    environments: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+}, z.core.$strip>;
+export type SecretsVaultFile = z.infer<typeof SecretsVaultSchema>;
+/** Any JSON value: what a `JSON.parse` reviver is handed. */
+export type JsonValue = z.infer<ReturnType<typeof z.json>>;
+/**
+ * A value as the file holds it. Vaults written before the schema existed hold
+ * numbers and booleans beside the strings (a `set` of `5` or `true`); reading
+ * accepts them and answers their text, and writing leaves each entry exactly as
+ * it was found, so reading a vault never changes what is stored.
+ */
+export type StoredSecretValue = string | number | boolean;
+/** The vault as the store holds it: Maps, so a lookup answers by own entry only. */
+export type SecretsVault = Map<string, Map<string, StoredSecretValue>>;
+//# sourceMappingURL=internal.d.ts.map

package/dist/backends/encrypted-local/schemas/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../../../src/backends/encrypted-local/schemas/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1D,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC"}

package/dist/backends/encrypted-local/schemas/internal.js

@@ -0,0 +1,12 @@
+import * as z from 'zod/v4';
+/**
+ * The decrypted vault file: environments, each a map of key to value. A
+ * `__proto__` name is not checked here (a record schema skips it silently): the
+ * parse refuses it while reading the JSON, because an object cannot hold it as
+ * data and a vault this package wrote never contains it.
+ */
+export const SecretsVaultSchema = z.object({
+    version: z.literal(1),
+    environments: z.record(z.string(), z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])))
+});
+//# sourceMappingURL=internal.js.map

package/dist/backends/encrypted-local/schemas/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../../../../src/backends/encrypted-local/schemas/internal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;CACxG,CAAC,CAAC"}

package/dist/backends/encrypted-local/vault-document.d.ts

@@ -0,0 +1,19 @@
+import { type FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+import { CapabilityError, type CaughtFailure } from '@vibesdotdev/kernel';
+import { type PathRoots } from '@vibesdotdev/paths';
+import { type KeychainRuntime } from "./encrypted-local.impl.local.ts";
+import { type SecretsVault } from './schemas/internal.ts';
+/** The vault is the owner's alone, and so is the directory this store creates for it. */
+export declare const VAULT_DIRECTORY_MODE = 448;
+export declare function unreadable(path: string, cause: CaughtFailure): CapabilityError;
+export declare function corrupt(path: string, cause: CaughtFailure): CapabilityError;
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function fromBase64(text: string): Uint8Array;
+/** The decrypted vault text as a vault: parsed with the schema, never cast. */
+export declare function parseVault(path: string, decrypted: string): SecretsVault;
+/** The vault as the file holds it: own data properties only, built without assigning through `__proto__`. */
+export declare function vaultDocument(vault: SecretsVault): string;
+export declare function readVaultText(fs: FileSystemAdapterInterface, storePath: string): Promise<string | undefined>;
+export declare function loadVault(runtime: KeychainRuntime, roots: PathRoots, fs: FileSystemAdapterInterface): Promise<SecretsVault>;
+export declare function saveVault(runtime: KeychainRuntime, roots: PathRoots, fs: FileSystemAdapterInterface, vault: SecretsVault): Promise<void>;
+//# sourceMappingURL=vault-document.d.ts.map

package/dist/backends/encrypted-local/vault-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-document.d.ts","sourceRoot":"","sources":["../../../src/backends/encrypted-local/vault-document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE5F,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAE1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,CAM9E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,CAQ3E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIlD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKnD;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAgBxE;AAED,6GAA6G;AAC7G,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAKzD;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,0BAA0B,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQlH;AAED,wBAAsB,SAAS,CAC9B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,0BAA0B,GAC5B,OAAO,CAAC,YAAY,CAAC,CA2BvB;AAED,wBAAsB,SAAS,CAC9B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,0BAA0B,EAC9B,KAAK,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/backends/encrypted-local/vault-document.js

@@ -0,0 +1,122 @@
+import { publishPrivateFile } from '@vibesdotdev/filesystem';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/paths';
+import * as z from 'zod/v4';
+import { attemptOf, isAbsentEntry, outcomeOf } from "../../support/file-failure.js";
+import { getConfigDir, getStorePath } from "./encrypted-local.impl.local.js";
+import { SecretsVaultSchema } from "./schemas/internal.js";
+/** The vault is the owner's alone, and so is the directory this store creates for it. */
+export const VAULT_DIRECTORY_MODE = 0o700;
+export function unreadable(path, cause) {
+    return new CapabilityError('The encrypted-local secrets store file could not be read.', 'UNAVAILABLE', {
+        reason: 'encrypted-local-unreadable',
+        cause,
+        details: { store: 'encrypted-local', path }
+    });
+}
+export function corrupt(path, cause) {
+    return new CapabilityError('The encrypted-local secrets store decrypted, but is not a secrets vault.', 'INTERNAL', {
+        reason: 'encrypted-local-corrupt',
+        retryable: false,
+        cause,
+        details: { store: 'encrypted-local', path },
+        recoveryHint: 'Move the vault file aside and re-enter the secrets; it holds content this package did not write.'
+    });
+}
+export function toBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+export function fromBase64(text) {
+    const binary = atob(text.trim());
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+/** The decrypted vault text as a vault: parsed with the schema, never cast. */
+export function parseVault(path, decrypted) {
+    const read = attemptOf(() => JSON.parse(decrypted, (name, value) => {
+        // A reviver sees every own property, `__proto__` included.
+        if (name === '__proto__')
+            throw new TypeError('The vault holds a __proto__ name.');
+        return value;
+    }));
+    if (!read.ok)
+        throw corrupt(path, read.failure);
+    const parsed = SecretsVaultSchema.safeParse(read.value);
+    if (!parsed.success)
+        throw corrupt(path, parsed.error);
+    const vault = new Map();
+    for (const [environment, secrets] of Object.entries(parsed.data.environments)) {
+        vault.set(environment, new Map(Object.entries(secrets)));
+    }
+    return vault;
+}
+/** The vault as the file holds it: own data properties only, built without assigning through `__proto__`. */
+export function vaultDocument(vault) {
+    const environments = Object.fromEntries([...vault].map(([environment, secrets]) => [environment, Object.fromEntries(secrets)]));
+    return JSON.stringify({ version: 1, environments }, null, 2);
+}
+export async function readVaultText(fs, storePath) {
+    const read = await outcomeOf(() => fs.readFile(storePath, 'utf-8'));
+    // Asked for utf-8, the adapter answers text.
+    if (read.ok)
+        return z.string().parse(read.value);
+    // An absent store file is normal: a fresh vault. Any other failure
+    // (a denied read, a directory in the file's place) is not absence.
+    if (isAbsentEntry(read.failure))
+        return undefined;
+    throw unreadable(storePath, read.failure);
+}
+export async function loadVault(runtime, roots, fs) {
+    const storePath = getStorePath(fs, roots);
+    const raw = await readVaultText(fs, storePath);
+    if (raw === undefined)
+        return new Map();
+    let decrypted;
+    try {
+        const { decryptToStringWithKey, resolveEncryptionKeyHexForBase } = await import('@vibesdotdev/security/encryption');
+        // Decrypt with the key co-located with the store (resolveSecretsBaseDir),
+        // NOT the global dev-isolated key — secrets are the shared keychain.
+        const keyHex = resolveEncryptionKeyHexForBase(runtime, roots.vibesHome);
+        decrypted = decryptToStringWithKey(fromBase64(raw), keyHex);
+    }
+    catch (error) {
+        // A vault whose bytes do not decrypt is `secrets-vault-undecryptable`
+        // (SPEC: a wrong key or truncated ciphertext), carrying the cipher's refusal as
+        // its cause. The cipher's own `ciphertext-invalid` is an input-domain answer
+        // about bytes; the vault's is about stored content, so the reason is remapped
+        // rather than leaked. Every other typed refusal passes through unchanged — a
+        // malformed key hex is a configuration fault, not a corrupt vault.
+        if (error instanceof CapabilityError && error.reason !== 'ciphertext-invalid')
+            throw error;
+        throw new CapabilityError('Failed to decrypt encrypted-local secrets store.', 'INTERNAL', {
+            reason: 'secrets-vault-undecryptable',
+            cause: error
+        });
+    }
+    return parseVault(storePath, decrypted);
+}
+export async function saveVault(runtime, roots, fs, vault) {
+    await fs.mkdir(getConfigDir(roots), { recursive: true, mode: VAULT_DIRECTORY_MODE });
+    let encoded;
+    try {
+        const { encryptStringWithKey, resolveEncryptionKeyHexForBase } = await import('@vibesdotdev/security/encryption');
+        // Encrypt with the key co-located with the store, matching loadVault.
+        const keyHex = resolveEncryptionKeyHexForBase(runtime, roots.vibesHome);
+        encoded = toBase64(encryptStringWithKey(vaultDocument(vault), keyHex));
+    }
+    catch (error) {
+        if (error instanceof CapabilityError)
+            throw error;
+        throw new CapabilityError('Failed to encrypt/save encrypted-local secrets store.', 'INTERNAL', {
+            reason: 'secrets-vault-unwritable',
+            cause: error
+        });
+    }
+    await publishPrivateFile(fs, getStorePath(fs, roots), encoded);
+}
+//# sourceMappingURL=vault-document.js.map

package/dist/backends/encrypted-local/vault-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-document.js","sourceRoot":"","sources":["../../../src/backends/encrypted-local/vault-document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAkC,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAkB,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAC,aAAa,EAAC,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAC,YAAY,EAAuB,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAmC,MAAM,uBAAuB,CAAC;AAE5F,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAoB;IAC5D,OAAO,IAAI,eAAe,CAAC,2DAA2D,EAAE,aAAa,EAAE;QACtG,MAAM,EAAE,4BAA4B;QACpC,KAAK;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE;KAC3C,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAoB;IACzD,OAAO,IAAI,eAAe,CAAC,0EAA0E,EAAE,UAAU,EAAE;QAClH,MAAM,EAAE,yBAAyB;QACjC,SAAS,EAAE,KAAK;QAChB,KAAK;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE;QAC3C,YAAY,EAAE,kGAAkG;KAChH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAC,KAAK,IAAI,CAAC;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,CAC3B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,IAAY,EAAE,KAAgB,EAAa,EAAE;QACnE,2DAA2D;QAC3D,IAAI,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CACF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,GAAiB,IAAI,GAAG,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,aAAa,CAAC,KAAmB;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CACtC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAA8B,EAAE,SAAiB;IACpF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACpE,6CAA6C;IAC7C,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwB,EACxB,KAAgB,EAChB,EAA8B;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAExC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,MAAM,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,GAC/D,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAClD,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxE,SAAS,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,sEAAsE;QACtE,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB;YAAE,MAAM,KAAK,CAAC;QAC3F,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,UAAU,EAAE;YACzF,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwB,EACxB,KAAgB,EAChB,EAA8B,EAC9B,KAAmB;IAEnB,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAErF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,GAC7D,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAClD,sEAAsE;QACtE,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,UAAU,EAAE;YAC9F,MAAM,EAAE,0BAA0B;YAClC,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC"}

package/dist/backends/env-file/env-file.descriptor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Env File Backend Descriptor
+ *
+ * Reads/writes secrets from .env.{environment} files in the bound workspace
+ * root (`runtime/workspace-path`); a relative `basePath` resolves against it.
+ * Default backend for local and dev tiers.
+ */
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds';
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=env-file.descriptor.d.ts.map

package/dist/backends/env-file/env-file.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.descriptor.d.ts","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,QAAA,MAAM,UAAU,EAAE,sBAcjB,CAAC;AAEF,eAAe,UAAU,CAAC"}