@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/domain/manifest/authentication.js

@@ -0,0 +1,119 @@
+/** Authentication import entries, validated by the canonical manifest owner. */
+export const authenticationSecrets = [
+    // --- Auth gateway (auth-web) — sourced from .env.local ----------------------
+    {
+        key: 'VIBES_AUTH_SECRET',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: true,
+        description: 'Better Auth signing secret (auth-web)'
+    },
+    // `VIBES_AUTH_DATABASE_URL` / `VIBES_AUTH_DATABASE_AUTH_TOKEN` are
+    // dev-only: production auth-web binds its own D1 database (`vibes-auth-db`)
+    // via the `DB` binding in `wrangler.jsonc`. The libsql/file fallback in
+    // `auth-web/src/server/persistence.ts` is for local dev only. We keep
+    // them in the manifest so `vibes secrets import` still picks them up
+    // for a working local store, but they're optional and never pushed to
+    // the production Secrets Store.
+    {
+        key: 'VIBES_AUTH_DATABASE_URL',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'LibSQL/Turso connection URL for auth persistence (DEV ONLY — production uses D1)'
+    },
+    {
+        key: 'VIBES_AUTH_DATABASE_AUTH_TOKEN',
+        category: 'vibes-auth',
+        source: 'local-env',
+        aliases: ['DATABASE_AUTH_TOKEN'],
+        required: false,
+        description: 'LibSQL/Turso auth token for auth persistence (DEV ONLY — production uses D1)'
+    },
+    {
+        key: 'VIBES_AUTH_RESEND_API_KEY',
+        category: 'vibes-auth',
+        source: 'local-env',
+        aliases: ['RESEND_API_KEY'],
+        required: false,
+        description: 'Resend API key for auth email delivery'
+    },
+    {
+        key: 'VIBES_AUTH_TWILIO_ACCOUNT_SID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Twilio account SID for phone OTP delivery'
+    },
+    {
+        key: 'VIBES_AUTH_TWILIO_AUTH_TOKEN',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Twilio auth token for phone OTP delivery'
+    },
+    {
+        key: 'VIBES_AUTH_GITHUB_CLIENT_ID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'GitHub OAuth client ID'
+    },
+    {
+        key: 'VIBES_AUTH_GITHUB_CLIENT_SECRET',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'GitHub OAuth client secret'
+    },
+    {
+        key: 'VIBES_AUTH_GOOGLE_CLIENT_ID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Google OAuth client ID'
+    },
+    {
+        key: 'VIBES_AUTH_GOOGLE_CLIENT_SECRET',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Google OAuth client secret'
+    },
+    {
+        key: 'VIBES_AUTH_DISCORD_CLIENT_ID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Discord OAuth client ID'
+    },
+    {
+        key: 'VIBES_AUTH_DISCORD_CLIENT_SECRET',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Discord OAuth client secret'
+    },
+    {
+        key: 'VIBES_AUTH_MICROSOFT_CLIENT_ID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Microsoft (Azure AD) OAuth client ID'
+    },
+    {
+        key: 'VIBES_AUTH_MICROSOFT_CLIENT_SECRET',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Microsoft (Azure AD) OAuth client secret'
+    },
+    {
+        key: 'VIBES_AUTH_MICROSOFT_TENANT_ID',
+        category: 'vibes-auth',
+        source: 'local-env',
+        required: false,
+        description: 'Microsoft (Azure AD) directory/tenant GUID. Required for app-only (client-credentials) Graph flows — SharePoint/OneDrive via platform-web + integrations-microsoft. Delegated sign-in (auth-web) uses the `common` authority and does not need it.'
+    }
+];
+//# sourceMappingURL=authentication.js.map

package/dist/domain/manifest/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/domain/manifest/authentication.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IAEpC,+EAA+E;IAC/E;QACC,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uCAAuC;KACpD;IAED,mEAAmE;IACnE,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,gCAAgC;IAChC;QACC,GAAG,EAAE,yBAAyB;QAC9B,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EACV,kFAAkF;KACnF;IAED;QACC,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,qBAAqB,CAAC;QAChC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8EAA8E;KAC3F;IAED;QACC,GAAG,EAAE,2BAA2B;QAChC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wCAAwC;KACrD;IAED;QACC,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,2CAA2C;KACxD;IAED;QACC,GAAG,EAAE,8BAA8B;QACnC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0CAA0C;KACvD;IAED;QACC,GAAG,EAAE,6BAA6B;QAClC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wBAAwB;KACrC;IAED;QACC,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4BAA4B;KACzC;IAED;QACC,GAAG,EAAE,6BAA6B;QAClC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wBAAwB;KACrC;IAED;QACC,GAAG,EAAE,iCAAiC;QACtC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4BAA4B;KACzC;IAED;QACC,GAAG,EAAE,8BAA8B;QACnC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,yBAAyB;KACtC;IAED;QACC,GAAG,EAAE,kCAAkC;QACvC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,6BAA6B;KAC1C;IAED;QACC,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,sCAAsC;KACnD;IAED;QACC,GAAG,EAAE,oCAAoC;QACzC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0CAA0C;KACvD;IAED;QACC,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EACV,oPAAoP;KACrP;CACD,CAAC"}

package/dist/domain/manifest/canonical.d.ts

@@ -0,0 +1,6 @@
+/** Canonical value-free import manifest. Operator delivery credentials remain outside it. */
+import { type SecretsImportManifest } from './import-manifest.schema.ts';
+declare const manifest: SecretsImportManifest;
+export declare const canonicalImportManifest: SecretsImportManifest;
+export default manifest;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/domain/manifest/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/canonical.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,OAAO,EAA8B,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAErG,QAAA,MAAM,QAAQ,EAAE,qBAiFd,CAAC;AAEH,eAAO,MAAM,uBAAuB,EAAE,qBAAgC,CAAC;AACvE,eAAe,QAAQ,CAAC"}

package/dist/domain/manifest/canonical.js

@@ -0,0 +1,86 @@
+import { authenticationSecrets } from "./authentication.js";
+import { billingSecrets, publishingProviderSecrets, serviceProviderSecrets } from "./providers.js";
+/** Canonical value-free import manifest. Operator delivery credentials remain outside it. */
+import { SecretsImportManifestSchema } from "./import-manifest.schema.js";
+const manifest = SecretsImportManifestSchema.parse({
+    version: 1,
+    sources: {
+        'local-env': {
+            path: '.env.local',
+            purpose: 'Canonical machine-local secret values: auth, OAuth, billing, internal tokens'
+        },
+        'production-env': {
+            path: '.env.production',
+            purpose: 'Production-flavored non-secret config + CF operator coordinates'
+        },
+        manual: {
+            purpose: 'Set via `vibes secrets set <KEY>` or generated by ops; not sourced from a local file'
+        }
+    },
+    secrets: [
+        ...authenticationSecrets,
+        // --- Internal cross-app bearer tokens (account-web, ai-web) ------------------
+        {
+            key: 'VIBES_AUTH_INTERNAL_TOKEN',
+            category: 'vibes-internal',
+            source: 'local-env',
+            required: true,
+            description: 'Bearer token for internal/admin auth API calls'
+        },
+        {
+            key: 'VIBES_INTERNAL_SERVICE_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: true,
+            description: 'Shared internal bearer token for platform/account internal RPCs'
+        },
+        {
+            key: 'VIBES_PLATFORM_INTERNAL_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'DEPRECATED legacy duplicate of VIBES_INTERNAL_SERVICE_TOKEN; no longer sent or accepted. Safe to delete from stores.'
+        },
+        {
+            key: 'VIBES_EMAIL_INGRESS_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: true,
+            description: 'Bearer token for callers invoking the internal vibes-email Worker'
+        },
+        ...billingSecrets,
+        {
+            key: 'CF_BILLING_SECRET',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Cloudflare-side billing webhook secret'
+        },
+        ...serviceProviderSecrets,
+        {
+            key: 'VIBES_API_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Tools-web internal API token'
+        },
+        {
+            key: 'VIBES_TOOL_REGISTRY_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'Tools-web tool-registry access token'
+        },
+        ...publishingProviderSecrets,
+        {
+            key: 'VIBES_NPM_TOKEN',
+            category: 'vibes-internal',
+            source: 'manual',
+            required: false,
+            description: 'packages.vibes.dev publish token used by `vibes infra npm publish`'
+        }
+    ]
+});
+export const canonicalImportManifest = manifest;
+export default manifest;
+//# sourceMappingURL=canonical.js.map

package/dist/domain/manifest/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/domain/manifest/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAC,yBAAyB,EAAC,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACjG,6FAA6F;AAC7F,OAAO,EAAE,2BAA2B,EAA6B,MAAM,6BAA6B,CAAC;AAErG,MAAM,QAAQ,GAA0B,2BAA2B,CAAC,KAAK,CAAC;IACzE,OAAO,EAAE,CAAC;IACV,OAAO,EAAE;QACR,WAAW,EAAE;YACZ,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,8EAA8E;SACvF;QACD,gBAAgB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,iEAAiE;SAC1E;QACD,MAAM,EAAE;YACP,OAAO,EACN,sFAAsF;SACvF;KACD;IACD,OAAO,EAAE;QACR,GAAG,qBAAqB;QAExB,gFAAgF;QAChF;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,gDAAgD;SAC7D;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,iEAAiE;SAC9E;QACD;YACC,GAAG,EAAE,+BAA+B;YACpC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EACV,sHAAsH;SACvH;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,mEAAmE;SAChF;QACD,GAAG,cAAc;QACjB;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wCAAwC;SACrD;QACD,GAAG,sBAAsB;QACzB;YACC,GAAG,EAAE,iBAAiB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QACD,GAAG,yBAAyB;QAC5B;YACC,GAAG,EAAE,iBAAiB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,oEAAoE;SACjF;KACD;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAA0B,QAAQ,CAAC;AACvE,eAAe,QAAQ,CAAC"}

package/dist/domain/manifest/dotenv.d.ts

@@ -0,0 +1,13 @@
+import { type DotenvLine } from "../../schemas/discovery/dotenv.schema.ts";
+export { type DotenvLine } from "../../schemas/discovery/dotenv.schema.ts";
+/** Parse `.env` text into lines, each keeping its raw text so an unchanged line is written back as it was. */
+export declare function parseDotenv(text: string): DotenvLine[];
+/** The key to value map of parsed lines (the last of a repeated key wins). A `__proto__` key stays an own entry. */
+export declare function dotenvValues(lines: readonly DotenvLine[]): Map<string, string>;
+/** `value` as it is written after `KEY=`: one line, quoted so that reading gives back exactly `value`. */
+export declare function formatDotenvValue(value: string): string;
+/** One `KEY=value` line. The key must be environment-variable shaped; the value one line. */
+export declare function formatDotenvEntry(key: string, value: string): string;
+/** `KEY=value` lines for `secrets`, sorted by key, ending in a newline. Refuses a key or value a `.env` file cannot hold. */
+export declare function serializeDotenv(secrets: Readonly<Record<string, string>>): string;
+//# sourceMappingURL=dotenv.d.ts.map

package/dist/domain/manifest/dotenv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/dotenv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAuF3E,8GAA8G;AAC9G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAEtD;AAED,oHAAoH;AACpH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI9E;AAED,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED,6HAA6H;AAC7H,wBAAgB,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAcjF"}

package/dist/domain/manifest/dotenv.js

@@ -0,0 +1,132 @@
+import {} from "../../schemas/discovery/dotenv.schema.js";
+export {} from "../../schemas/discovery/dotenv.schema.js";
+/**
+ * The one `.env` grammar of this package: `vibes secrets import` reads with it,
+ * the `env-file` store reads and writes with it, `vibes secrets export` writes
+ * with it, so what one writes the others read back.
+ *
+ * Reading, one line at a time (split on `\n`; a `\r` before it is whitespace):
+ * - blank lines and lines starting `#` are comments, kept verbatim; so is any
+ *   other line with no `=`;
+ * - `KEY=value` and `export KEY=value` are entries; the key is what precedes the
+ *   first `=`, trimmed. Reading never judges a key (a store judges the keys it
+ *   is asked to write), and a repeated key is last-wins;
+ * - a value after `=` (leading whitespace dropped) is
+ *   - `'single quoted'`: literal up to the closing `'`, no escapes;
+ *   - `"double quoted"`: up to the first unescaped `"`, where `\\` is `\` and
+ *     `\"` is `"`; any other `\` stays as written (`\n` is a backslash and an
+ *     `n`, never a line break);
+ *   - otherwise unquoted: up to a whitespace-then-`#` comment, trimmed.
+ *   A quoted value may be followed by whitespace or a `#` comment. A quote that
+ *   does not close cleanly is read as the legacy writer meant it: the outer pair
+ *   of identical quotes stripped, content as written.
+ * - nothing is expanded: `$` and `${NAME}` are plain text.
+ *
+ * Writing: a value is one line. A line break, `\r` or NUL is refused
+ * (`INVALID_INPUT secret-value-invalid`) because it would become a second line.
+ * An empty value or one of `A-Z a-z 0-9 _ @ % + , . / : -` is written bare;
+ * any other value is single-quoted when it holds no `'` (so a shell or a
+ * dotenv-expand reader does not expand `$` either), else double-quoted with `\`
+ * and `"` escaped.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { assertSingleLineSecretValue } from "../../support/secret-value.js";
+import { assertEnvironmentSecretKey } from "../kinds/secret-key.js";
+const EXPORT_PREFIX = /^export\s+/;
+const TRAILING_OK = /^\s*(#.*)?$/;
+const INLINE_COMMENT = /\s#.*$/;
+const BARE_VALUE = /^[A-Za-z0-9_@%+,./:-]*$/;
+/** A quote that did not close cleanly: the outer pair of identical quotes stripped, as the legacy writer meant it. */
+function legacyUnquote(text) {
+    const trimmed = text.trim();
+    const quote = trimmed[0];
+    if (trimmed.length >= 2 && (quote === '"' || quote === "'") && trimmed.endsWith(quote))
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+/** The value of a double-quoted run (`text` starts at the opening quote), or undefined when it does not close cleanly. */
+function readDoubleQuoted(text) {
+    let value = '';
+    for (let index = 1; index < text.length; index += 1) {
+        const char = text.charAt(index);
+        const next = text.charAt(index + 1);
+        if (char === '\\' && (next === '\\' || next === '"')) {
+            value += next;
+            index += 1;
+        }
+        else if (char === '"') {
+            return TRAILING_OK.test(text.slice(index + 1)) ? value : undefined;
+        }
+        else {
+            value += char;
+        }
+    }
+    return undefined;
+}
+function readValue(afterEquals) {
+    const text = afterEquals.replace(/^\s+/, '');
+    if (text.startsWith('"'))
+        return readDoubleQuoted(text) ?? legacyUnquote(text);
+    if (text.startsWith("'")) {
+        const close = text.indexOf("'", 1);
+        return close !== -1 && TRAILING_OK.test(text.slice(close + 1)) ? text.slice(1, close) : legacyUnquote(text);
+    }
+    return text.replace(INLINE_COMMENT, '').trim();
+}
+function parseLine(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return { type: 'blank', raw };
+    if (trimmed.startsWith('#'))
+        return { type: 'comment', raw };
+    const equals = raw.indexOf('=');
+    if (equals === -1)
+        return { type: 'comment', raw };
+    const key = raw.slice(0, equals).trim().replace(EXPORT_PREFIX, '').trim();
+    if (key === '')
+        return { type: 'comment', raw };
+    return { type: 'entry', raw, key, value: readValue(raw.slice(equals + 1)) };
+}
+/** Parse `.env` text into lines, each keeping its raw text so an unchanged line is written back as it was. */
+export function parseDotenv(text) {
+    return text.split('\n').map(parseLine);
+}
+/** The key to value map of parsed lines (the last of a repeated key wins). A `__proto__` key stays an own entry. */
+export function dotenvValues(lines) {
+    const values = new Map();
+    for (const line of lines)
+        if (line.type === 'entry')
+            values.set(line.key, line.value);
+    return values;
+}
+/** `value` as it is written after `KEY=`: one line, quoted so that reading gives back exactly `value`. */
+export function formatDotenvValue(value) {
+    assertSingleLineSecretValue(value);
+    if (BARE_VALUE.test(value))
+        return value;
+    if (!value.includes("'"))
+        return `'${value}'`;
+    return `"${value.replace(/[\\"]/g, '\\$&')}"`;
+}
+/** One `KEY=value` line. The key must be environment-variable shaped; the value one line. */
+export function formatDotenvEntry(key, value) {
+    assertEnvironmentSecretKey(key);
+    return `${key}=${formatDotenvValue(value)}`;
+}
+/** `KEY=value` lines for `secrets`, sorted by key, ending in a newline. Refuses a key or value a `.env` file cannot hold. */
+export function serializeDotenv(secrets) {
+    const lines = Object.keys(secrets)
+        .sort()
+        .map((key) => {
+        const value = secrets[key];
+        if (value === undefined) {
+            throw new CapabilityError('The secret value is not acceptable.', 'INVALID_INPUT', {
+                reason: 'secret-value-invalid',
+                details: { problem: 'not-a-string' }
+            });
+        }
+        return formatDotenvEntry(key, value);
+    });
+    return lines.length === 0 ? '' : `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/domain/manifest/dotenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.js","sourceRoot":"","sources":["../../../src/domain/manifest/dotenv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAmB,MAAM,0CAA0C,CAAC;AAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,sHAAsH;AACtH,SAAS,aAAa,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,0HAA0H;AAC1H,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,IAAI,IAAI,CAAC;YACd,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,CAAC;aAAM,CAAC;YACP,KAAK,IAAI,IAAI,CAAC;QACf,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,YAAY,CAAC,KAA4B;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IAC9C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC3D,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,GAAG,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,eAAe,CAAC,OAAyC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;gBACjF,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;aACpC,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1D,CAAC"}

package/dist/domain/manifest/import-manifest.schema.d.ts

@@ -0,0 +1,2 @@
+export * from '../../schemas/discovery/import.schema.ts';
+//# sourceMappingURL=import-manifest.schema.d.ts.map

package/dist/domain/manifest/import-manifest.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-manifest.schema.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC"}

package/dist/domain/manifest/import-manifest.schema.js

@@ -0,0 +1,2 @@
+export * from "../../schemas/discovery/import.schema.js";
+//# sourceMappingURL=import-manifest.schema.js.map

package/dist/domain/manifest/import-manifest.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-manifest.schema.js","sourceRoot":"","sources":["../../../src/domain/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC"}

package/dist/domain/manifest/index.d.ts

@@ -0,0 +1,4 @@
+export { SecretCategorySchema, SecretManifestEntrySchema, SecretSourceSchema, SecretsImportManifestSchema, type SecretCategory, type SecretManifestEntry, type SecretSource, type SecretsImportManifest } from './import-manifest.schema.ts';
+export { canonicalImportManifest } from './canonical.ts';
+export { dotenvValues, formatDotenvEntry, formatDotenvValue, parseDotenv, serializeDotenv, type DotenvLine } from './dotenv.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/manifest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,oBAAoB,EAAC,yBAAyB,EAC9C,kBAAkB,EAAC,2BAA2B,EAAC,KAAK,cAAc,EAAC,KAAK,mBAAmB,EAC3F,KAAK,YAAY,EAAC,KAAK,qBAAqB,EAC3C,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,KAAK,UAAU,EACd,MAAM,aAAa,CAAC"}

package/dist/domain/manifest/index.js

@@ -0,0 +1,4 @@
+export { SecretCategorySchema, SecretManifestEntrySchema, SecretSourceSchema, SecretsImportManifestSchema } from "./import-manifest.schema.js";
+export { canonicalImportManifest } from "./canonical.js";
+export { dotenvValues, formatDotenvEntry, formatDotenvValue, parseDotenv, serializeDotenv } from "./dotenv.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/manifest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/domain/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,oBAAoB,EAAC,yBAAyB,EAC9C,kBAAkB,EAAC,2BAA2B,EAE7C,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EAEd,MAAM,aAAa,CAAC"}

package/dist/domain/manifest/providers.d.ts

@@ -0,0 +1,31 @@
+/** Provider import entries; the canonical manifest validates the complete ordered document. */
+export declare const billingSecrets: ({
+    key: string;
+    category: string;
+    source: string;
+    aliases: string[];
+    required: boolean;
+    description: string;
+} | {
+    key: string;
+    category: string;
+    source: string;
+    required: boolean;
+    description: string;
+    aliases?: undefined;
+})[];
+export declare const serviceProviderSecrets: {
+    key: string;
+    category: string;
+    source: string;
+    required: boolean;
+    description: string;
+}[];
+export declare const publishingProviderSecrets: {
+    key: string;
+    category: string;
+    source: string;
+    required: boolean;
+    description: string;
+}[];
+//# sourceMappingURL=providers.d.ts.map

package/dist/domain/manifest/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/domain/manifest/providers.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,eAAO,MAAM,cAAc;;;;;;;;;;;;;;IA8C1B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;GAqFlC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;GAuBrC,CAAC"}

package/dist/domain/manifest/providers.js

@@ -0,0 +1,123 @@
+/** Provider import entries; the canonical manifest validates the complete ordered document. */
+export const billingSecrets = [
+    // --- Billing (account-web) ---------------------------------------------------
+    // `.env.production` stores Stripe under a `VIBES_ACCOUNT_STRIPE_*` prefix;
+    // `.env.local` uses the canonical names directly. Either source resolves.
+    {
+        key: 'STRIPE_SECRET_KEY',
+        category: 'provider-billing',
+        source: 'local-env',
+        aliases: ['VIBES_ACCOUNT_STRIPE_SECRET_KEY'],
+        required: false,
+        description: 'Stripe secret key for billing sync and checkout'
+    },
+    {
+        key: 'STRIPE_WEBHOOK_SECRET',
+        category: 'provider-billing',
+        source: 'local-env',
+        required: false,
+        description: 'Stripe webhook signing secret for /api/webhooks/stripe'
+    },
+    {
+        key: 'STRIPE_PUB_KEY',
+        category: 'provider-billing',
+        source: 'local-env',
+        aliases: ['PUBLIC_STRIPE_KEY', 'VIBES_ACCOUNT_STRIPE_PUB_KEY'],
+        required: false,
+        description: 'Stripe publishable key (pk_live_*/pk_test_*); safe to expose to clients but tracked here so live/test mode stays aligned with STRIPE_SECRET_KEY'
+    },
+    {
+        key: 'STRIPE_RESTRICTED_KEY',
+        category: 'provider-billing',
+        source: 'local-env',
+        aliases: ['VIBES_ACCOUNT_STRIPE_RESTRICTED_KEY'],
+        required: false,
+        description: 'Stripe restricted live key (rk_live_*) for narrow-scope ops/CI usage; not consumed at runtime — runtime uses STRIPE_SECRET_KEY'
+    }
+];
+export const serviceProviderSecrets = [
+    {
+        key: 'RESEND_API_KEY',
+        category: 'provider-other',
+        source: 'manual',
+        required: false,
+        description: 'Resend API key used by account-web to send invoice receipt emails'
+    },
+    // --- LLM / voice / search providers (ai-web, ai-web) ----------------------
+    {
+        key: 'OPENAI_API_KEY',
+        category: 'provider-llm',
+        source: 'manual',
+        required: false,
+        description: 'OpenAI provider key (ai-web)'
+    },
+    {
+        key: 'ANTHROPIC_API_KEY',
+        category: 'provider-llm',
+        source: 'manual',
+        required: false,
+        description: 'Anthropic provider key (ai-web)'
+    },
+    {
+        key: 'GOOGLE_API_KEY',
+        category: 'provider-llm',
+        source: 'manual',
+        required: false,
+        description: 'Google provider key (ai-web)'
+    },
+    {
+        key: 'GEMINI_API_KEY',
+        category: 'provider-llm',
+        source: 'manual',
+        required: false,
+        description: 'Gemini-named provider key alias (ai-web)'
+    },
+    {
+        key: 'DIGITALOCEAN_MODEL_ACCESS_KEY',
+        category: 'provider-llm',
+        source: 'manual',
+        required: false,
+        description: 'DigitalOcean Gradient serverless-inference model access key (dop_v1_… / inference.do-ai.run). Scoped data-plane credential — NOT the DIGITALOCEAN_API_TOKEN control-plane PAT. Required by the system:provider:digitalocean entry in ai.providers.json; without it the provider is skipped at bootstrap and DO models never reach the selectors.'
+    },
+    {
+        key: 'DEEPGRAM_API_KEY',
+        category: 'provider-voice',
+        source: 'manual',
+        required: false,
+        description: 'Deepgram transcription provider key (ai-web)'
+    },
+    {
+        key: 'ELEVENLABS_API_KEY',
+        category: 'provider-voice',
+        source: 'manual',
+        required: false,
+        description: 'ElevenLabs TTS provider key (ai-web)'
+    },
+    {
+        key: 'FIRECRAWL_API_KEY',
+        category: 'provider-search',
+        source: 'manual',
+        required: false,
+        description: 'Firecrawl crawl/scrape provider key (ai-web)'
+    }
+];
+export const publishingProviderSecrets = [
+    // --- Other provider creds (referenced by deployment configs but not in
+    //     a Pages app's secrets list yet — included so they round-trip if
+    //     they end up in `.env.local`) -----------------------------------------
+    {
+        key: 'DIGITALOCEAN_API_TOKEN',
+        category: 'provider-other',
+        source: 'local-env',
+        required: false,
+        description: 'DigitalOcean API token for DOKS / DO Spaces tooling'
+    },
+    {
+        key: 'NPM_TOKEN',
+        category: 'provider-other',
+        source: 'manual',
+        required: false,
+        description: 'Public npmjs.org publish token used by `vibes infra npm publish`'
+    }
+];
+//# sourceMappingURL=providers.js.map

package/dist/domain/manifest/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/domain/manifest/providers.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG;IAI7B,gFAAgF;IAChF,2EAA2E;IAC3E,0EAA0E;IAC1E;QACC,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,iCAAiC,CAAC;QAC5C,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iDAAiD;KAC9D;IAGD;QACC,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,wDAAwD;KACrE;IAGD;QACC,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;QAC9D,QAAQ,EAAE,KAAK;QACf,WAAW,EACV,iJAAiJ;KAClJ;IAGD;QACC,GAAG,EAAE,uBAAuB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,CAAC,qCAAqC,CAAC;QAChD,QAAQ,EAAE,KAAK;QACf,WAAW,EACV,gIAAgI;KACjI;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAGrC;QACC,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,mEAAmE;KAChF;IAID,6EAA6E;IAC7E;QACC,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;KAC3C;IAGD;QACC,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iCAAiC;KAC9C;IAGD;QACC,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;KAC3C;IAGD;QACC,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0CAA0C;KACvD;IAGD;QACC,GAAG,EAAE,+BAA+B;QACpC,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EACV,kVAAkV;KACnV;IAGD;QACC,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8CAA8C;KAC3D;IAGD;QACC,GAAG,EAAE,oBAAoB;QACzB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,sCAAsC;KACnD;IAGD;QACC,GAAG,EAAE,mBAAmB;QACxB,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8CAA8C;KAC3D;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IAIxC,wEAAwE;IACxE,sEAAsE;IACtE,6EAA6E;IAC7E;QACC,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qDAAqD;KAClE;IAGD;QACC,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kEAAkE;KAC/E;CACD,CAAC"}

package/dist/domain/requirements/config-requirements.d.ts

@@ -0,0 +1,18 @@
+import type { CaughtFailure, RuntimeLoaderImplementation } from '@vibesdotdev/kernel';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { type RequirementDiscoveryFailure } from "../../schemas/discovery/diagnostics.schema.ts";
+import { requirementEnvEntrySchema } from "../../schemas/discovery/requirements.schema.ts";
+import type { ConfigModule, ConfigOutcome } from '../../schemas/discovery/runtime.schema.ts';
+import type { SecretRequirement } from './schemas/requirements.ts';
+export type { ConfigModule, ConfigOutcome } from '../../schemas/discovery/runtime.schema.ts';
+export declare function secretEntryRequirement(appId: string, entry: z.infer<typeof requirementEnvEntrySchema>): SecretRequirement | undefined;
+/** The requirements of the registered infra descriptors; a malformed descriptor is a failure, never skipped silently. */
+export declare function extractRequirements(kind: string, descriptors: readonly unknown[], failures: RequirementDiscoveryFailure[]): SecretRequirement[];
+export declare function configFailure(path: string, reason: RequirementDiscoveryFailure['reason'], message: string, cause?: CapabilityError): ConfigOutcome;
+/** A caught failure as a discovery entry: the value-free `from()` text beside the failure itself. */
+export declare function caughtDiscoveryFailure(path: string, reason: RequirementDiscoveryFailure['reason'], caught: CaughtFailure): RequirementDiscoveryFailure;
+export declare function deploymentRequirements(path: string, mod: ConfigModule): ConfigOutcome;
+export declare function serviceReleaseRequirements(path: string, mod: ConfigModule): ConfigOutcome;
+export declare function loadConfig(loader: RuntimeLoaderImplementation, configPath: string): Promise<ConfigOutcome>;
+//# sourceMappingURL=config-requirements.d.ts.map

package/dist/domain/requirements/config-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-requirements.d.ts","sourceRoot":"","sources":["../../../src/domain/requirements/config-requirements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAC,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAyB,yBAAyB,EAA8D,MAAM,gDAAgD,CAAC;AAC9K,OAAO,KAAK,EAAE,YAAY,EAAC,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,YAAY,EAAE,YAAY,EAAC,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE5F,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,GAC9C,iBAAiB,GAAG,SAAS,CAa/B;AAED,yHAAyH;AACzH,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,SAAS,OAAO,EAAE,EAC/B,QAAQ,EAAE,2BAA2B,EAAE,GACrC,iBAAiB,EAAE,CAkBrB;AAED,wBAAgB,aAAa,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,EAC7C,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,eAAe,GACrB,aAAa,CAEf;AAED,qGAAqG;AACrG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,GAAG,2BAA2B,CAGtJ;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,aAAa,CAarF;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,aAAa,CAsCzF;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAShH"}