@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/exec/credential-leases.js

@@ -0,0 +1,170 @@
+import { parseUntrusted } from '@vibesdotdev/filesystem';
+import { CapabilityError, HOST_CREDENTIAL_MANIFEST_KEY as HOST_CREDENTIALS_MANIFEST_KEY, composeChildEnv, composeExecutionEnv, readEnv } from '@vibesdotdev/kernel';
+import {} from '@vibesdotdev/kernel/credentials';
+import * as z from 'zod/v4';
+import {} from "../schemas/execution/result.schema.js";
+import {} from "../schemas/execution/spawn.schema.js";
+import {} from "./audit.js";
+export const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * What a failed parse of the options refuses with. A failure confined to the
+ * `leases` member is `credential-lease-invalid` naming the lease; any other is
+ * `spawn-options-invalid` naming the fields, or, for a getter that throws or a
+ * Proxy that traps, the throw as the cause.
+ */
+export function invalidOptions(cause) {
+    if (cause instanceof z.ZodError && cause.issues.every((issue) => issue.path[0] === 'leases')) {
+        return leaseMalformed([...new Set(cause.issues.flatMap((issue) => issue.path.slice(1, 2).map(String)))]);
+    }
+    const fields = cause instanceof z.ZodError ? [...new Set(cause.issues.map((issue) => issue.path.join('.') || '(options)'))] : ['(options)'];
+    return new CapabilityError(`The credentialed spawn options are invalid (${fields.join(', ')}).`, 'INVALID_INPUT', {
+        reason: 'spawn-options-invalid',
+        retryable: false,
+        cause,
+        details: { fields }
+    });
+}
+/**
+ * Read an untrusted options object ONCE: the parsed copy is what the attempt
+ * uses, and a getter that throws or a Proxy that traps is the typed refusal
+ * `spawn-options-invalid` (cause kept), never an escape past the audit.
+ */
+export function parseOptions(schema, options) {
+    return parseUntrusted(schema, options, invalidOptions);
+}
+export function nameInvalid(name, role) {
+    return new CapabilityError(`'${name}' is not an environment variable name.`, 'INVALID_INPUT', {
+        reason: `${role}-name-invalid`,
+        details: { name }
+    });
+}
+export function manifestReserved(name, role) {
+    return new CapabilityError(`${HOST_CREDENTIALS_MANIFEST_KEY} is written by spawnWithCredentials, never ${role === 'pass' ? 'passed through' : 'carried as a credential'}.`, 'INVALID_INPUT', { reason: `${role}-name-reserved`, details: { name } });
+}
+export function validateNames(names, role) {
+    for (const name of names) {
+        if (!ENV_NAME.test(name))
+            throw nameInvalid(name, role);
+        if (name.toUpperCase() === HOST_CREDENTIALS_MANIFEST_KEY)
+            throw manifestReserved(name, role);
+    }
+}
+/**
+ * A lease that is null, or lacks its value or its `expiresAt`, or a collection
+ * that is not a record of leases, is `INVALID_INPUT` `credential-lease-invalid`;
+ * the lease is named, its value never.
+ */
+export function leaseMalformed(names) {
+    return new CapabilityError(LEASE_MALFORMED_MESSAGE, 'INVALID_INPUT', {
+        reason: 'credential-lease-invalid',
+        retryable: false,
+        details: { names: [...names] }
+    });
+}
+export const LEASE_MALFORMED_MESSAGE = 'A caller-held lease is malformed: it needs a string value and a lease with an expiresAt.';
+/**
+ * The caller-held leases, admitted: names valid and colliding with no
+ * credential or pass name (`lease-name-conflict`), each `expiresAt` a date in
+ * the future (`credential-lease-invalid` when it is not a date,
+ * `lease-expired`). Returns their values and their audit entries.
+ */
+export function admitLeases(leases, taken, now) {
+    validateNames(Object.keys(leases), 'lease');
+    const values = {};
+    const audit = [];
+    for (const [name, held] of Object.entries(leases)) {
+        if (taken.has(name)) {
+            throw new CapabilityError(`Lease '${name}' collides with a credential or pass name of the same child.`, 'INVALID_INPUT', {
+                reason: 'lease-name-conflict',
+                details: { name }
+            });
+        }
+        const expiresAt = Date.parse(held.lease.expiresAt);
+        if (Number.isNaN(expiresAt))
+            throw leaseMalformed([name]);
+        if (expiresAt <= now) {
+            const details = held.lease.id !== undefined
+                ? { name, expiresAt: held.lease.expiresAt, leaseId: held.lease.id }
+                : { name, expiresAt: held.lease.expiresAt };
+            throw new CapabilityError(`Lease '${name}' expired at ${held.lease.expiresAt}.`, 'UNAVAILABLE', {
+                reason: 'lease-expired',
+                details
+            });
+        }
+        values[name] = held.value;
+        const entry = {
+            name,
+            source: 'lease',
+            expiresAt: held.lease.expiresAt
+        };
+        if (held.lease.id !== undefined) {
+            entry.id = held.lease.id;
+        }
+        audit.push(entry);
+    }
+    return { values, audit };
+}
+/**
+ * The child's whole environment, composed by the kernel under the host
+ * platform's key policy (`composeChildEnv`, C16): the host set, then the
+ * inherited `pass` and `runtime.hostProtocolEnv` names, then the credential
+ * values, which win; then the manifest when published.
+ */
+export function composeCredentialedEnv(runtime, pass, values, manifest, env = {}) {
+    validateNames(Object.keys(env), 'env');
+    const host = { platform: runtime.localEnvironment.getPlatform?.(), snapshot: env };
+    for (const name of Object.keys(values)) {
+        if (readEnv(host, name) !== undefined) {
+            throw new CapabilityError('A declared environment variable collides with a credential or lease.', 'INVALID_INPUT', {
+                reason: 'env-name-conflict', details: { name }
+            });
+        }
+    }
+    const declared = composeChildEnv(runtime, { inheritEnv: [...pass, ...runtime.hostProtocolEnv], env });
+    // Credential insertion is this owner's authorized layer. Ordinary declarations
+    // still pass through the kernel's host-credential and reserved-name checks.
+    const child = composeExecutionEnv(host, { envMode: 'replace', env: declared }, values);
+    if (manifest === null)
+        return child;
+    // The manifest is never a child's declared variable (the kernel refuses it
+    // there); it is the publisher's own layer, composed under the same policy.
+    return composeExecutionEnv({ platform: runtime.localEnvironment.getPlatform?.(), snapshot: {} }, { envMode: 'replace', env: child }, { [HOST_CREDENTIALS_MANIFEST_KEY]: manifest });
+}
+/**
+ * Resolve every reference through `runtime.resolveCredential`, in order; the
+ * first failure throws its typed error. With `skipNotSet`, a reference the
+ * store confirms is not set (`credential-not-set`) is reported in `notSet`
+ * instead (the caller asked to run without it); every other failure still
+ * throws. The audit names each key's store and the tier.
+ */
+export async function resolveCredentialLeases(runtime, credentials, command, audit, skipNotSet = false) {
+    const values = {};
+    const notSet = [];
+    const stores = new Set();
+    const tiers = new Set();
+    for (const [name, reference] of Object.entries(credentials)) {
+        const resolution = await runtime.resolveCredential(reference);
+        if (!resolution.ok) {
+            if (skipNotSet && resolution.error.reason === 'credential-not-set') {
+                notSet.push(name);
+                continue;
+            }
+            throw resolution.error;
+        }
+        values[name] = resolution.value;
+        stores.add(resolution.provenance.store);
+        tiers.add(resolution.provenance.tier);
+    }
+    return {
+        values,
+        notSet,
+        audit: {
+            action: audit?.action ?? 'secrets.spawn',
+            keys: Object.keys(values),
+            environment: [...tiers].join(','),
+            backend: [...stores].join(','),
+            target: audit?.target ?? command
+        }
+    };
+}
+//# sourceMappingURL=credential-leases.js.map

package/dist/exec/credential-leases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-leases.js","sourceRoot":"","sources":["../../src/exec/credential-leases.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACP,eAAe,EACf,4BAA4B,IAAI,6BAA6B,EAC7D,eAAe,EACf,mBAAmB,EACnB,OAAO,EAEN,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA4B,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAgC,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAyD,MAAM,sCAAsC,CAAC;AAC7G,OAAO,EAEN,MAAM,YAAY,CAAC;AAGpB,MAAM,CAAC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY;IAC1C,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9F,OAAO,cAAc,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5I,OAAO,IAAI,eAAe,CAAC,+CAA+C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;QACjH,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,KAAK;QAChB,KAAK;QACL,OAAO,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAmD,MAAc,EAAE,OAAgB;IAC9G,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAc;IACvD,OAAO,IAAI,eAAe,CAAC,IAAI,IAAI,wCAAwC,EAAE,eAAe,EAAE;QAC7F,MAAM,EAAE,GAAG,IAAI,eAAe;QAC9B,OAAO,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAc;IAC5D,OAAO,IAAI,eAAe,CACzB,GAAG,6BAA6B,8CAA8C,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,yBAAyB,GAAG,EAC/I,eAAe,EACf,EAAE,MAAM,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,IAAc;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,6BAA6B;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9F,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwB;IACtD,OAAO,IAAI,eAAe,CAAC,uBAAuB,EAAE,eAAe,EAAE;QACpE,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE;KAC9B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,0FAA0F,CAAC;AAElI;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAC1B,MAAiD,EACjD,KAA0B,EAC1B,GAAW;IAEX,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,UAAU,IAAI,8DAA8D,EAAE,eAAe,EAAE;gBACxH,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE;aACjB,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,MAAM,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,OAAO,GACZ,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,UAAU,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,aAAa,EAAE;gBAC/F,MAAM,EAAE,eAAe;gBACvB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,KAAK,GAAuB;YACjC,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;SAC/B,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAAqB,EACrB,IAAuB,EACvB,MAAwC,EACxC,QAAuB,EACvB,MAAwC,EAAE;IAE1C,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,sEAAsE,EAAE,eAAe,EAAE;gBAClH,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;aAC9C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,mBAAmB,CACzB,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EACpE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAClC,EAAE,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAqB,EACrB,WAA0D,EAC1D,OAAe,EACf,KAA2C,EAC3C,UAAU,GAAG,KAAK;IAElB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,SAAS;YACV,CAAC;YACD,MAAM,UAAU,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO;QACN,MAAM;QACN,MAAM;QACN,KAAK,EAAE;YACN,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,eAAe;YACxC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACzB,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,OAAO;SAChC;KACD,CAAC;AACH,CAAC"}

package/dist/exec/credential-process.d.ts

@@ -0,0 +1,12 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { type CredentialedChild } from "../schemas/execution/result.schema.ts";
+import { resolvedSpawnOptionsSchema } from '../schemas/execution/spawn.schema.ts';
+import { type LeverageAuditOutput } from './audit.ts';
+import { createStreamRedactor } from './redactor.ts';
+import { type PreparedSpawn } from "./spawn-with-credentials.ts";
+/** How long a child may take to accept the stdin a caller handed it, unless the caller declares another. */
+export declare const STDIN_WRITE_DEADLINE_MS = 10000;
+export declare function spawnPrepared(runtime: VibesRuntime, options: z.output<typeof resolvedSpawnOptionsSchema>, prepared: PreparedSpawn, auditOutput: LeverageAuditOutput): Promise<CredentialedChild>;
+export declare function redactStream(stream: ReadableStream<Uint8Array> | null, redactor: ReturnType<typeof createStreamRedactor>, write: (text: string) => void): Promise<void>;
+//# sourceMappingURL=credential-process.d.ts.map

package/dist/exec/credential-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-process.d.ts","sourceRoot":"","sources":["../../src/exec/credential-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAGP,KAAK,YAAY,EAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEP,KAAK,mBAAmB,EACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,4GAA4G;AAC5G,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,wBAAsB,aAAa,CAClC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,EACpD,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,mBAAmB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAqF5B;AAED,wBAAsB,YAAY,CACjC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EACzC,QAAQ,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,EACjD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/exec/credential-process.js

@@ -0,0 +1,108 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import * as z from 'zod/v4';
+import {} from "../schemas/execution/result.schema.js";
+import { resolvedSpawnOptionsSchema } from "../schemas/execution/spawn.schema.js";
+import { writeLeverageAudit } from "./audit.js";
+import { createStreamRedactor } from "./redactor.js";
+import {} from "./spawn-with-credentials.js";
+/** How long a child may take to accept the stdin a caller handed it, unless the caller declares another. */
+export const STDIN_WRITE_DEADLINE_MS = 10_000;
+export async function spawnPrepared(runtime, options, prepared, auditOutput) {
+    const stdin = options.stdin ?? 'inherit';
+    const execution = await getRuntimeExecution(runtime);
+    let child;
+    const spawnOptions = {
+        command: options.command,
+        args: [...(options.args ?? [])],
+        env: prepared.env,
+        envMode: 'replace',
+        stdin: stdin === 'inherit' || stdin === 'ignore' ? stdin : 'pipe',
+        stdout: 'pipe',
+        stderr: 'pipe'
+    };
+    if (options.cwd !== undefined) {
+        spawnOptions.cwd = options.cwd;
+    }
+    if (options.timeoutMs !== undefined) {
+        spawnOptions.timeout = options.timeoutMs;
+    }
+    try {
+        child = await execution.spawn(spawnOptions);
+    }
+    catch (error) {
+        writeLeverageAudit(auditOutput, {
+            ...prepared.audit,
+            outcome: 'failure',
+            reason: CapabilityError.from(CaughtFailureSchema.parse(error)).reason
+        });
+        throw error;
+    }
+    if (stdin !== 'inherit' && stdin !== 'ignore') {
+        const stdinPipe = child.stdin;
+        const data = stdin.data instanceof Uint8Array ? stdin.data : new TextEncoder().encode(stdin.data);
+        const deadlineMs = options.stdinTimeoutMs ?? STDIN_WRITE_DEADLINE_MS;
+        try {
+            if (!stdinPipe) {
+                throw new CapabilityError('The execution provider gave no stdin pipe for the child.', 'INTERNAL', {
+                    reason: 'stdin-unavailable'
+                });
+            }
+            await runtime.lifecycle.wait(async () => {
+                const writer = stdinPipe.getWriter();
+                await writer.write(data);
+                await writer.close();
+            }, { timeoutMs: deadlineMs, reason: 'the child to accept its stdin' });
+        }
+        catch (error) {
+            // The child must not run on without the input it was started for.
+            await child.kill();
+            const failure = CapabilityError.from(CaughtFailureSchema.parse(error));
+            writeLeverageAudit(auditOutput, { ...prepared.audit, outcome: 'failure', reason: failure.reason });
+            if (failure.reason === 'wait-timeout') {
+                throw new CapabilityError(`The child did not accept its stdin within ${deadlineMs}ms.`, 'TIMEOUT', {
+                    reason: 'stdin-write-timeout',
+                    retryable: false,
+                    cause: error,
+                    details: { timeoutMs: deadlineMs }
+                });
+            }
+            throw error;
+        }
+    }
+    const outRedactor = createStreamRedactor(prepared.values);
+    const errRedactor = createStreamRedactor(prepared.values);
+    const exited = (async () => {
+        let outcome = 'failure';
+        try {
+            const drained = Promise.all([
+                redactStream(child.stdout, outRedactor, (text) => options.output.stdout(text)),
+                redactStream(child.stderr, errRedactor, (text) => options.output.stderr(text))
+            ]);
+            const code = (await child.exited).code ?? 1;
+            await drained;
+            outcome = code === 0 ? 'success' : 'failure';
+            return code;
+        }
+        finally {
+            options.output.stdout(outRedactor.flush());
+            options.output.stderr(errRedactor.flush());
+            writeLeverageAudit(auditOutput, { ...prepared.audit, outcome });
+        }
+    })();
+    return { pid: child.pid, exited };
+}
+export async function redactStream(stream, redactor, write) {
+    if (!stream)
+        return;
+    const decoder = new TextDecoder();
+    for await (const chunk of stream) {
+        const text = decoder.decode(chunk, { stream: true });
+        if (text)
+            write(redactor.push(text));
+    }
+    const trailing = decoder.decode();
+    if (trailing)
+        write(redactor.push(trailing));
+}
+//# sourceMappingURL=credential-process.js.map

package/dist/exec/credential-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-process.js","sourceRoot":"","sources":["../../src/exec/credential-process.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EACf,mBAAmB,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAA0B,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACP,kBAAkB,EAEjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAsB,MAAM,6BAA6B,CAAC;AAEjE,4GAA4G;AAC5G,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAqB,EACrB,OAAoD,EACpD,QAAuB,EACvB,WAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,KAAkD,CAAC;IACvD,MAAM,YAAY,GAA0C;QAC3D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC/B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACjE,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;KACd,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACJ,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,kBAAkB,CAAC,WAAW,EAAE;YAC/B,GAAG,QAAQ,CAAC,KAAK;YACjB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SACrE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACrE,IAAI,CAAC;YACJ,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,UAAU,EAAE;oBACjG,MAAM,EAAE,mBAAmB;iBAC3B,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC3B,KAAK,IAAI,EAAE;gBACV,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,EACD,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAClE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,kEAAkE;YAClE,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,kBAAkB,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnG,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACvC,MAAM,IAAI,eAAe,CAAC,6CAA6C,UAAU,KAAK,EAAE,SAAS,EAAE;oBAClG,MAAM,EAAE,qBAAqB;oBAC7B,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;iBAClC,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO,GAA0B,SAAS,CAAC;QAC/C,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;gBAC3B,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9E,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAC9E,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC5C,MAAM,OAAO,CAAC;YACd,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,OAAO,IAAI,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3C,kBAAkB,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,MAAyC,EACzC,QAAiD,EACjD,KAA6B;IAE7B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,IAAI;YAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,QAAQ;QAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/exec/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@vibesdotdev/secrets/exec`: a child process receives credentials only
+ * through `spawnWithCredentials` (rc05 §2.4, D-RC05).
+ */
+export { MIN_REDACTABLE_VALUE_LENGTH, assertRedactableValues, createStreamRedactor, redactValues, redactionForms, type StreamRedactor } from './redactor.ts';
+export { STDIN_WRITE_DEADLINE_MS, composeCredentialedEnv, resolveCredentialEnv, spawnWithCredentials, type CallerHeldLease, type CredentialEnv, type CredentialEnvRequest, type CredentialedChild, type CredentialedOutput, type SpawnWithCredentialsOptions } from './spawn-with-credentials.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/exec/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/exec/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACP,2BAA2B,EAAC,sBAAsB,EAClD,oBAAoB,EAAC,YAAY,EAAC,cAAc,EAAC,KAAK,cAAc,EACnE,MAAM,eAAe,CAAC;AACvB,OAAO,EACP,uBAAuB,EAAC,sBAAsB,EAAC,oBAAoB,EAAC,oBAAoB,EAAC,KAAK,eAAe,EAAC,KAAK,aAAa,EAChI,KAAK,oBAAoB,EAAC,KAAK,iBAAiB,EAChD,KAAK,kBAAkB,EAAC,KAAK,2BAA2B,EACvD,MAAM,6BAA6B,CAAC"}

package/dist/exec/index.js

@@ -0,0 +1,7 @@
+/**
+ * `@vibesdotdev/secrets/exec`: a child process receives credentials only
+ * through `spawnWithCredentials` (rc05 §2.4, D-RC05).
+ */
+export { MIN_REDACTABLE_VALUE_LENGTH, assertRedactableValues, createStreamRedactor, redactValues, redactionForms } from "./redactor.js";
+export { STDIN_WRITE_DEADLINE_MS, composeCredentialedEnv, resolveCredentialEnv, spawnWithCredentials } from "./spawn-with-credentials.js";
+//# sourceMappingURL=index.js.map

package/dist/exec/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/exec/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACP,2BAA2B,EAAC,sBAAsB,EAClD,oBAAoB,EAAC,YAAY,EAAC,cAAc,EAC/C,MAAM,eAAe,CAAC;AACvB,OAAO,EACP,uBAAuB,EAAC,sBAAsB,EAAC,oBAAoB,EAAC,oBAAoB,EAGvF,MAAM,6BAA6B,CAAC"}

package/dist/exec/redactor.core.d.ts

@@ -0,0 +1,7 @@
+import type { StreamRedactor } from '../schemas/execution/redactor.schema.ts';
+export type { StreamRedactor } from '../schemas/execution/redactor.schema.ts';
+export declare const MIN_REDACTABLE_VALUE_LENGTH = 4;
+export declare function redactionForms(value: string): string[];
+export declare function redactValues(text: string, values: Readonly<Record<string, string>>): string;
+export declare function createStreamRedactor(values: Readonly<Record<string, string>>): StreamRedactor;
+//# sourceMappingURL=redactor.core.d.ts.map

package/dist/exec/redactor.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.core.d.ts","sourceRoot":"","sources":["../../src/exec/redactor.core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAE9E,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAY7C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBtD;AAyCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAE3F;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,cAAc,CAiB7F"}

package/dist/exec/redactor.core.js

@@ -0,0 +1,81 @@
+export const MIN_REDACTABLE_VALUE_LENGTH = 4;
+function toBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function toHex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+export function redactionForms(value) {
+    const bytes = new TextEncoder().encode(value);
+    const base64 = toBase64(bytes);
+    const base64Url = base64.replaceAll('+', '-').replaceAll('/', '_');
+    const hex = toHex(bytes);
+    const candidates = [
+        value,
+        base64,
+        base64.replace(/=+$/, ''),
+        base64Url,
+        base64Url.replace(/=+$/, ''),
+        encodeURIComponent(value),
+        new URLSearchParams({ v: value }).toString().slice(2),
+        hex,
+        hex.toUpperCase()
+    ];
+    const forms = new Set(candidates.filter((form) => form.length >= MIN_REDACTABLE_VALUE_LENGTH));
+    return [...forms].sort((a, b) => b.length - a.length);
+}
+function replacementTable(values) {
+    const table = [];
+    for (const [key, value] of Object.entries(values)) {
+        for (const form of redactionForms(value))
+            table.push({ form, marker: '[REDACTED:' + key + ']' });
+    }
+    return table.sort((a, b) => b.form.length - a.form.length);
+}
+function scan(text, table, stopAt) {
+    const heads = new Set(table.map(({ form }) => form[0]));
+    let emitted = '';
+    let plainFrom = 0;
+    let index = 0;
+    while (index < stopAt) {
+        const head = text[index];
+        const hit = head !== undefined && heads.has(head) ? table.find(({ form }) => text.startsWith(form, index)) : undefined;
+        if (hit === undefined) {
+            index += 1;
+            continue;
+        }
+        emitted += text.slice(plainFrom, index) + hit.marker;
+        index += hit.form.length;
+        plainFrom = index;
+    }
+    emitted += text.slice(plainFrom, index);
+    return { emitted, next: index };
+}
+function redactWith(text, table) {
+    return scan(text, table, text.length).emitted;
+}
+export function redactValues(text, values) {
+    return redactWith(text, replacementTable(values));
+}
+export function createStreamRedactor(values) {
+    const table = replacementTable(values);
+    const holdback = Math.max(0, ...table.map(({ form }) => form.length - 1));
+    let carry = '';
+    return {
+        push(chunk) {
+            const combined = carry + chunk;
+            const { emitted, next } = scan(combined, table, Math.max(0, combined.length - holdback));
+            carry = combined.slice(next);
+            return emitted;
+        },
+        flush() {
+            const rest = redactWith(carry, table);
+            carry = '';
+            return rest;
+        }
+    };
+}
+//# sourceMappingURL=redactor.core.js.map

package/dist/exec/redactor.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.core.js","sourceRoot":"","sources":["../../src/exec/redactor.core.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,SAAS,QAAQ,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,UAAU,GAAG;QAClB,KAAK;QACL,MAAM;QACN,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACzB,SAAS;QACT,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,CAAC;QACzB,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,GAAG;QACH,GAAG,CAAC,WAAW,EAAE;KACjB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwC;IACjE,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AASD,SAAS,IAAI,CAAC,IAAY,EAAE,KAAuB,EAAE,MAAc;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvH,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrD,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,SAAS,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAuB;IACxD,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAwC;IAClF,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwC;IAC5E,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,OAAO;QACN,IAAI,CAAC,KAAa;YACjB,MAAM,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;YAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;YACzF,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,KAAK;YACJ,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtC,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/exec/redactor.d.ts

@@ -0,0 +1,3 @@
+export { MIN_REDACTABLE_VALUE_LENGTH, createStreamRedactor, redactValues, redactionForms, type StreamRedactor } from './redactor.core.ts';
+export declare function assertRedactableValues(values: Readonly<Record<string, string>>): void;
+//# sourceMappingURL=redactor.d.ts.map

package/dist/exec/redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.d.ts","sourceRoot":"","sources":["../../src/exec/redactor.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAE5B,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAUrF"}

package/dist/exec/redactor.js

@@ -0,0 +1,11 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { MIN_REDACTABLE_VALUE_LENGTH } from "./redactor.core.js";
+export { MIN_REDACTABLE_VALUE_LENGTH, createStreamRedactor, redactValues, redactionForms } from "./redactor.core.js";
+export function assertRedactableValues(values) {
+    for (const [key, value] of Object.entries(values)) {
+        if (value.length > 0 && value.length < MIN_REDACTABLE_VALUE_LENGTH) {
+            throw new CapabilityError("The credential '" + key + "' is shorter than " + MIN_REDACTABLE_VALUE_LENGTH + " characters, so its output cannot be redacted; it is refused as a credential value.", 'INVALID_INPUT', { reason: 'secret-value-invalid', retryable: false, details: { key, problem: 'too-short', minLength: MIN_REDACTABLE_VALUE_LENGTH } });
+        }
+    }
+}
+//# sourceMappingURL=redactor.js.map

package/dist/exec/redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.js","sourceRoot":"","sources":["../../src/exec/redactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACN,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,cAAc,EAEd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,UAAU,sBAAsB,CAAC,MAAwC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACpE,MAAM,IAAI,eAAe,CACxB,kBAAkB,GAAG,GAAG,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,qFAAqF,EACrK,eAAe,EACf,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,EAAE,CACpI,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/exec/spawn-with-credentials.d.ts

@@ -0,0 +1,62 @@
+import { type CredentialEnv, type CredentialedChild, type ResolvedCredentialSpawn } from "../schemas/execution/result.schema.ts";
+import { type CredentialEnvRequest, type SpawnWithCredentialsOptions } from '../schemas/execution/spawn.schema.ts';
+export { type PreparedSpawn } from "../schemas/execution/prepared.schema.ts";
+export { type CredentialEnv, type CredentialedChild, type ResolvedCredentialSpawn } from "../schemas/execution/result.schema.ts";
+export { AUDIT_ACTIONS, auditHintSchema, auditOverrideSchema, credentialEnvRequestSchema, credentialFields, leaseCollectionSchema, leaseSchema, requestFields, resolvedSpawnFields, resolvedSpawnOptionsSchema, sinkSchema, spawnOptionsSchema } from "../schemas/execution/spawn.schema.ts";
+export type { CallerHeldLease, CredentialEnvRequest, CredentialedOutput, SpawnWithCredentialsOptions } from '../schemas/execution/spawn.schema.ts';
+export { auditRefusal, refusalRecord } from "./attempt-audit.ts";
+export { ENV_NAME, LEASE_MALFORMED_MESSAGE, admitLeases, composeCredentialedEnv, invalidOptions, leaseMalformed, manifestReserved, nameInvalid, parseOptions, resolveCredentialLeases, validateNames, type AdmittedLeases, type NameRole } from "./credential-leases.ts";
+export { STDIN_WRITE_DEADLINE_MS, redactStream, spawnPrepared } from "./credential-process.ts";
+/**
+ * `@vibesdotdev/secrets/exec` — the one way a child process receives a
+ * credential (rc05 §2.4, D-RC05).
+ *
+ * - **Resolve first.** Every `CredentialReference` resolves through
+ *   `runtime.resolveCredential`, and every caller-held lease is checked
+ *   unexpired, before anything spawns; any failure throws its typed error and
+ *   nothing spawns.
+ * - **Replace, never inherit.** The child's environment is composed by the
+ *   kernel (`composeChildEnv`, C16): the host set (base allowlist, the handed
+ *   runtime's path roots and re-entry facts) < the names the child inherits
+ *   (`pass` plus the host's declared protocol pass set, `runtime.hostProtocolEnv`)
+ *   < the declared credentials and leases. Then, only when the caller publishes
+ *   them, the `VIBES_HOST_CREDENTIALS` manifest naming them with this process
+ *   as the live publisher. An ambient variable nobody named never reaches the
+ *   child, credential or not.
+ * - **Options are parsed.** A malformed option, reference or lease is
+ *   `INVALID_INPUT` (`spawn-options-invalid`, `credential-lease-invalid`), never
+ *   a `TypeError` from a field read.
+ * - **Values never in argv**, and every byte the child prints passes through
+ *   one redactor (credentials and leases, in every redacted form) before
+ *   reaching the caller's sinks. A value too short to redact is refused
+ *   (`secret-value-invalid`).
+ * - **One audit line per attempt** names the keys, the stores and the tier, and
+ *   each lease by name, id and expiry; never a value. A refusal before spawn is
+ *   an attempt: it is audited `failure` with its typed reason. The line goes to
+ *   the handed runtime's `runtime/stdio`.
+ * - **The stdin write is bounded** by `stdinTimeoutMs` (default
+ *   `STDIN_WRITE_DEADLINE_MS`): a child that never reads is killed and the spawn
+ *   fails `TIMEOUT` `stdin-write-timeout`.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * The lower-level step for a caller that spawns through its own supervised
+ * `runtime/execution` (PM: output to capture files through inherited fds):
+ * resolve every reference and admit every lease, then compose the child's
+ * environment exactly as `spawnWithCredentials` does. Nothing is spawned.
+ */
+export declare function resolveCredentialEnv(runtime: VibesRuntime, request: CredentialEnvRequest): Promise<CredentialEnv>;
+/**
+ * Spawn `options.command` with `options.credentials` and `options.leases`
+ * (see the module header for the guarantees): `resolveCredentialEnv`, then a
+ * spawn whose output is redacted into `options.output`. Returns once the child
+ * is started.
+ */
+export declare function spawnWithCredentials(runtime: VibesRuntime, options: SpawnWithCredentialsOptions): Promise<CredentialedChild>;
+/**
+ * The spawn half, for a caller in this package that resolved its values
+ * itself (`vibes secrets exec --environment T`, the secrets owner's cross-tier
+ * read, rc05 :62-63). Not exported from `@vibesdotdev/secrets/exec`.
+ */
+export declare function spawnResolvedCredentials(runtime: VibesRuntime, options: Omit<SpawnWithCredentialsOptions, 'credentials' | 'optionalCredentials' | 'leases'>, resolved: ResolvedCredentialSpawn): Promise<CredentialedChild>;
+//# sourceMappingURL=spawn-with-credentials.d.ts.map

package/dist/exec/spawn-with-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-with-credentials.d.ts","sourceRoot":"","sources":["../../src/exec/spawn-with-credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAC,KAAK,iBAAiB,EAAC,KAAK,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAE/H,OAAO,EAA2E,KAAK,oBAAoB,EAAC,KAAK,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAI3L,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,KAAK,aAAa,EAAC,KAAK,iBAAiB,EAAC,KAAK,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAC,eAAe,EAAC,mBAAmB,EAAC,0BAA0B,EAAC,gBAAgB,EAAC,qBAAqB,EAAC,WAAW,EAAC,aAAa,EAAC,mBAAmB,EAAC,0BAA0B,EAAC,UAAU,EAAC,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAClR,YAAY,EAAE,eAAe,EAAC,oBAAoB,EAAC,kBAAkB,EAAC,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAChJ,OAAO,EAAE,YAAY,EAAC,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAC,uBAAuB,EAAC,WAAW,EAAC,sBAAsB,EAAC,cAAc,EAAC,cAAc,EAAC,gBAAgB,EAAC,WAAW,EAAC,YAAY,EAAC,uBAAuB,EAAC,aAAa,EAAC,KAAK,cAAc,EAAC,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7P,OAAO,EAAE,uBAAuB,EAAC,YAAY,EAAC,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAGP,KAAK,YAAY,EAChB,MAAM,qBAAqB,CAAC;AA6E7B;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWvH;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,aAAa,GAAG,qBAAqB,GAAG,QAAQ,CAAC,EAC5F,QAAQ,EAAE,uBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAO5B"}