@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/exec/spawn-with-credentials.js

@@ -0,0 +1,145 @@
+import {} from "../schemas/execution/prepared.schema.js";
+import {} from "../schemas/execution/result.schema.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { credentialEnvRequestSchema, resolvedSpawnOptionsSchema, spawnOptionsSchema } from "../schemas/execution/spawn.schema.js";
+import { auditRefusal, refusalRecord } from "./attempt-audit.js";
+import { admitLeases, composeCredentialedEnv, parseOptions, resolveCredentialLeases, validateNames } from "./credential-leases.js";
+import { spawnPrepared } from "./credential-process.js";
+export {} from "../schemas/execution/prepared.schema.js";
+export {} from "../schemas/execution/result.schema.js";
+export { AUDIT_ACTIONS, auditHintSchema, auditOverrideSchema, credentialEnvRequestSchema, credentialFields, leaseCollectionSchema, leaseSchema, requestFields, resolvedSpawnFields, resolvedSpawnOptionsSchema, sinkSchema, spawnOptionsSchema } from "../schemas/execution/spawn.schema.js";
+export { auditRefusal, refusalRecord } from "./attempt-audit.js";
+export { ENV_NAME, LEASE_MALFORMED_MESSAGE, admitLeases, composeCredentialedEnv, invalidOptions, leaseMalformed, manifestReserved, nameInvalid, parseOptions, resolveCredentialLeases, validateNames } from "./credential-leases.js";
+export { STDIN_WRITE_DEADLINE_MS, redactStream, spawnPrepared } from "./credential-process.js";
+/**
+ * `@vibesdotdev/secrets/exec` — the one way a child process receives a
+ * credential (rc05 §2.4, D-RC05).
+ *
+ * - **Resolve first.** Every `CredentialReference` resolves through
+ *   `runtime.resolveCredential`, and every caller-held lease is checked
+ *   unexpired, before anything spawns; any failure throws its typed error and
+ *   nothing spawns.
+ * - **Replace, never inherit.** The child's environment is composed by the
+ *   kernel (`composeChildEnv`, C16): the host set (base allowlist, the handed
+ *   runtime's path roots and re-entry facts) < the names the child inherits
+ *   (`pass` plus the host's declared protocol pass set, `runtime.hostProtocolEnv`)
+ *   < the declared credentials and leases. Then, only when the caller publishes
+ *   them, the `VIBES_HOST_CREDENTIALS` manifest naming them with this process
+ *   as the live publisher. An ambient variable nobody named never reaches the
+ *   child, credential or not.
+ * - **Options are parsed.** A malformed option, reference or lease is
+ *   `INVALID_INPUT` (`spawn-options-invalid`, `credential-lease-invalid`), never
+ *   a `TypeError` from a field read.
+ * - **Values never in argv**, and every byte the child prints passes through
+ *   one redactor (credentials and leases, in every redacted form) before
+ *   reaching the caller's sinks. A value too short to redact is refused
+ *   (`secret-value-invalid`).
+ * - **One audit line per attempt** names the keys, the stores and the tier, and
+ *   each lease by name, id and expiry; never a value. A refusal before spawn is
+ *   an attempt: it is audited `failure` with its typed reason. The line goes to
+ *   the handed runtime's `runtime/stdio`.
+ * - **The stdin write is bounded** by `stdinTimeoutMs` (default
+ *   `STDIN_WRITE_DEADLINE_MS`): a child that never reads is killed and the spawn
+ *   fails `TIMEOUT` `stdin-write-timeout`.
+ */
+import { runtimeProcessPublisher, serializeHostCredentialsManifest } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { openLeverageAudit, writeLeverageAudit } from "./audit.js";
+import { assertRedactableValues } from "./redactor.js";
+/** Compose the environment for already-resolved values (the manifest when published). */
+async function prepare(runtime, pass, resolved, publishHostCredentials, env = {}) {
+    validateNames(pass, 'pass');
+    validateNames(Object.keys(resolved.values), 'credential');
+    // A value too short to redact never reaches a child: its echo could not be masked.
+    assertRedactableValues(resolved.values);
+    let manifest = null;
+    if (publishHostCredentials) {
+        // The publisher's identity is its process id and start time, read through
+        // the runtime's process service; resolved only when a manifest is published.
+        manifest = serializeHostCredentialsManifest({
+            keys: Object.keys(resolved.values),
+            publisher: await runtimeProcessPublisher(runtime)
+        });
+    }
+    return {
+        env: composeCredentialedEnv(runtime, pass, resolved.values, manifest, env),
+        values: resolved.values,
+        audit: resolved.audit
+    };
+}
+async function resolveRequest(runtime, request, target) {
+    validateNames(request.pass, 'pass');
+    validateNames(Object.keys(request.credentials), 'credential');
+    const optionalCredentials = request.optionalCredentials ?? {};
+    validateNames(Object.keys(optionalCredentials), 'credential');
+    for (const name of Object.keys(optionalCredentials)) {
+        if (Object.hasOwn(request.credentials, name)) {
+            throw new CapabilityError('A credential cannot be both required and optional.', 'INVALID_INPUT', {
+                reason: 'credential-name-conflict', details: { name }
+            });
+        }
+    }
+    const taken = new Set([...request.pass, ...Object.keys(request.credentials), ...Object.keys(optionalCredentials)]);
+    const leases = admitLeases(request.leases ?? {}, taken, Date.now());
+    const resolved = await resolveCredentialLeases(runtime, request.credentials, target, request.audit);
+    const optional = await resolveCredentialLeases(runtime, optionalCredentials, target, request.audit, true);
+    const audit = {
+        ...resolved.audit,
+        keys: [...resolved.audit.keys, ...optional.audit.keys],
+        environment: [...new Set([resolved.audit.environment, optional.audit.environment].filter(Boolean))].join(','),
+        backend: [...new Set([resolved.audit.backend, optional.audit.backend].filter(Boolean))].join(',')
+    };
+    if (leases.audit.length > 0) {
+        audit.leases = leases.audit;
+    }
+    return prepare(runtime, request.pass, {
+        values: { ...resolved.values, ...optional.values, ...leases.values },
+        audit
+    }, request.publishHostCredentials, request.env);
+}
+/**
+ * The lower-level step for a caller that spawns through its own supervised
+ * `runtime/execution` (PM: output to capture files through inherited fds):
+ * resolve every reference and admit every lease, then compose the child's
+ * environment exactly as `spawnWithCredentials` does. Nothing is spawned.
+ */
+export async function resolveCredentialEnv(runtime, request) {
+    const output = await openLeverageAudit(runtime);
+    const prepared = await auditRefusal(output, refusalRecord(request, false), async () => {
+        const parsed = parseOptions(credentialEnvRequestSchema, request);
+        return resolveRequest(runtime, parsed, parsed.audit?.target ?? '');
+    });
+    return {
+        env: prepared.env,
+        redact: Object.freeze(Object.values(prepared.values)),
+        audit: (outcome = 'success') => writeLeverageAudit(output, { ...prepared.audit, outcome })
+    };
+}
+/**
+ * Spawn `options.command` with `options.credentials` and `options.leases`
+ * (see the module header for the guarantees): `resolveCredentialEnv`, then a
+ * spawn whose output is redacted into `options.output`. Returns once the child
+ * is started.
+ */
+export async function spawnWithCredentials(runtime, options) {
+    const output = await openLeverageAudit(runtime);
+    const attempt = await auditRefusal(output, refusalRecord(options, true), async () => {
+        const parsed = parseOptions(spawnOptionsSchema, options);
+        return { parsed, prepared: await resolveRequest(runtime, parsed, parsed.audit?.target ?? parsed.command) };
+    });
+    return spawnPrepared(runtime, attempt.parsed, attempt.prepared, output);
+}
+/**
+ * The spawn half, for a caller in this package that resolved its values
+ * itself (`vibes secrets exec --environment T`, the secrets owner's cross-tier
+ * read, rc05 :62-63). Not exported from `@vibesdotdev/secrets/exec`.
+ */
+export async function spawnResolvedCredentials(runtime, options, resolved) {
+    const output = await openLeverageAudit(runtime);
+    const attempt = await auditRefusal(output, resolved.audit, async () => {
+        const parsed = parseOptions(resolvedSpawnOptionsSchema, options);
+        return { parsed, prepared: await prepare(runtime, parsed.pass, resolved, parsed.publishHostCredentials, parsed.env) };
+    });
+    return spawnPrepared(runtime, attempt.parsed, attempt.prepared, output);
+}
+//# sourceMappingURL=spawn-with-credentials.js.map

package/dist/exec/spawn-with-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-with-credentials.js","sourceRoot":"","sources":["../../src/exec/spawn-with-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAA0E,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAC,0BAA0B,EAAC,kBAAkB,EAA6D,MAAM,sCAAsC,CAAC;AAC3L,OAAO,EAAE,YAAY,EAAC,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAC,sBAAsB,EAAC,YAAY,EAAC,uBAAuB,EAAC,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAsB,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAA0E,MAAM,uCAAuC,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAC,eAAe,EAAC,mBAAmB,EAAC,0BAA0B,EAAC,gBAAgB,EAAC,qBAAqB,EAAC,WAAW,EAAC,aAAa,EAAC,mBAAmB,EAAC,0BAA0B,EAAC,UAAU,EAAC,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAElR,OAAO,EAAE,YAAY,EAAC,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAC,uBAAuB,EAAC,WAAW,EAAC,sBAAsB,EAAC,cAAc,EAAC,cAAc,EAAC,gBAAgB,EAAC,WAAW,EAAC,YAAY,EAAC,uBAAuB,EAAC,aAAa,EAAoC,MAAM,wBAAwB,CAAC;AAC7P,OAAO,EAAE,uBAAuB,EAAC,YAAY,EAAC,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACP,uBAAuB,EACvB,gCAAgC,EAE/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACP,iBAAiB,EACjB,kBAAkB,EAEjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,yFAAyF;AACzF,KAAK,UAAU,OAAO,CACrB,OAAqB,EACrB,IAAuB,EACvB,QAAiC,EACjC,sBAA2C,EAC3C,MAAwC,EAAE;IAE1C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,mFAAmF;IACnF,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,sBAAsB,EAAE,CAAC;QAC5B,0EAA0E;QAC1E,6EAA6E;QAC7E,QAAQ,GAAG,gCAAgC,CAAC;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClC,SAAS,EAAE,MAAM,uBAAuB,CAAC,OAAO,CAAC;SACjD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO;QACN,GAAG,EAAE,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC;QAC1E,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;KACrB,CAAC;AACH,CAAC;AAKD,KAAK,UAAU,cAAc,CAAC,OAAqB,EAAE,OAAsB,EAAE,MAAc;IAC1F,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC9D,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,oDAAoD,EAAE,eAAe,EAAE;gBAChG,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;aACrD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAyC;QACnD,GAAG,QAAQ,CAAC,KAAK;QACjB,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACtD,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7G,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KACjG,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CACb,OAAO,EACP,OAAO,CAAC,IAAI,EACZ;QACC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QACpE,KAAK;KACL,EACD,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,GAAG,CACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAqB,EAAE,OAA6B;IAC9F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO;QACN,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,EAAE,CAAC,OAAO,GAAG,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;KAC1F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAqB,EACrB,OAAoC;IAEpC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5G,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAqB,EACrB,OAA4F,EAC5F,QAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvH,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC"}

package/dist/index.d.ts

@@ -2,12 +2,17 @@
  * @vibesdotdev/secrets
  *
  * Environment-aware secrets management with pluggable backends.
- * Provides the secrets/store runtime kind. Backends live in sibling packages.
+ * Provides the secrets/store runtime kind. Backend implementations live under explicit package subpaths.
  *
  * Hard rule: missing-backend means hard failure. resolve() throws if no
  * backend has registered for the current scope.
  */
-export { SecretsStoreDescriptorSchema, EnvironmentTierSchema, SecretsBackendSchema, type SecretsStoreDescriptor, type EnvironmentTier, type SecretsBackend, type SecretEntry, type SecretsStoreImplementation, secretsStoreKind } from './kinds/index';
-export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema, canonicalImportManifest, type SecretsImportManifest, type SecretManifestEntry, type SecretSource, type SecretCategory } from './manifest/index';
-export { default as secretsPlugin } from './secrets.plugin';
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor, parseSecretsStoreDescriptors, pickTierSecretsStore, secretsStoreKind, type EnvironmentTier, type ResolvedSecretsStoreDescriptor, type SecretEntry, type SecretsBackend, type SecretsStoreDescriptor, type SecretsStoreImplementation, type SecretsStoreSelection, type StoreOperationContext, } from './domain/kinds/index.ts';
+export { SecretCategorySchema, SecretManifestEntrySchema, SecretSourceSchema, SecretsImportManifestSchema, canonicalImportManifest, type SecretCategory, type SecretManifestEntry, type SecretSource, type SecretsImportManifest, } from './domain/manifest/index.ts';
+export { default as secretsPlugin } from './domain/secrets.plugin.ts';
+export { SECRET_PATTERNS, scanTextForSecretPatterns, type SecretFinding, type SecretPattern, } from './support/credential-signatures.ts';
+export { resolveSecretsEnvironment } from './support/environment.ts';
+export type { ResolvedSecretsEnvironment, SecretsEnvironmentReporter, } from './support/environment.ts';
+export { resolveSecretsStore } from './support/runtime-resolver.ts';
+export { LOCAL_ATTESTATION_CLAIM_INSECURE, LOCAL_ATTESTATION_CLAIM_INVALID, LOCAL_ATTESTATION_CLAIM_MISSING, LOCAL_ATTESTATION_CLAIM_PATH_INVALID, SECRETS_ATTESTATION_KIND, SecretsAttestationDescriptorSchema, createAttestationOptionsSchema, createLocalAttestation, defaultSecretsAttestationDescriptor, getSecretsAttestation, readLocalAttestation, secretsAttestationKind, secretsAttestationPlugin, secretsAttestationPluginDefault, type CreateAttestationOptions, type LocalAttestationHandle, type SecretsAttestationDescriptor, type SecretsAttestationProvider, } from './domain/attestation/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,4BAA4B,EAC5B,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAC/B,gBAAgB,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,qBAAqB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACN,eAAe,EACf,yBAAyB,EACzB,KAAK,aAAa,EAClB,KAAK,aAAa,GAClB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,YAAY,EACX,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EACN,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,kCAAkC,EAClC,8BAA8B,EAC9B,sBAAsB,EACtB,mCAAmC,EACnC,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,+BAA+B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAC/B,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -2,12 +2,16 @@
  * @vibesdotdev/secrets
  *
  * Environment-aware secrets management with pluggable backends.
- * Provides the secrets/store runtime kind. Backends live in sibling packages.
+ * Provides the secrets/store runtime kind. Backend implementations live under explicit package subpaths.
  *
  * Hard rule: missing-backend means hard failure. resolve() throws if no
  * backend has registered for the current scope.
  */
-export { SecretsStoreDescriptorSchema, EnvironmentTierSchema, SecretsBackendSchema, secretsStoreKind } from './kinds/index.js';
-export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema, canonicalImportManifest } from './manifest/index.js';
-export { default as secretsPlugin } from './secrets.plugin.js';
+export { EnvironmentTierSchema, SecretsBackendSchema, SecretsStoreDescriptorSchema, SecretsStoreSelectionSchema, isGenericSecretsStoreDescriptor, isIdentityScopedSecretsStoreDescriptor, isOptInSecretsStoreDescriptor, parseSecretsStoreDescriptors, pickTierSecretsStore, secretsStoreKind, } from "./domain/kinds/index.js";
+export { SecretCategorySchema, SecretManifestEntrySchema, SecretSourceSchema, SecretsImportManifestSchema, canonicalImportManifest, } from "./domain/manifest/index.js";
+export { default as secretsPlugin } from "./domain/secrets.plugin.js";
+export { SECRET_PATTERNS, scanTextForSecretPatterns, } from "./support/credential-signatures.js";
+export { resolveSecretsEnvironment } from "./support/environment.js";
+export { resolveSecretsStore } from "./support/runtime-resolver.js";
+export { LOCAL_ATTESTATION_CLAIM_INSECURE, LOCAL_ATTESTATION_CLAIM_INVALID, LOCAL_ATTESTATION_CLAIM_MISSING, LOCAL_ATTESTATION_CLAIM_PATH_INVALID, SECRETS_ATTESTATION_KIND, SecretsAttestationDescriptorSchema, createAttestationOptionsSchema, createLocalAttestation, defaultSecretsAttestationDescriptor, getSecretsAttestation, readLocalAttestation, secretsAttestationKind, secretsAttestationPlugin, secretsAttestationPluginDefault, } from "./domain/attestation/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,4BAA4B,EAC5B,qBAAqB,EACrB,oBAAoB,EAMpB,gBAAgB,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EAKvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GAShB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,GAKvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACN,eAAe,EACf,yBAAyB,GAGzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAKrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EACN,gCAAgC,EAChC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,kCAAkC,EAClC,8BAA8B,EAC9B,sBAAsB,EACtB,mCAAmC,EACnC,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,+BAA+B,GAK/B,MAAM,+BAA+B,CAAC"}

package/dist/schemas/backends/bootstrap.schema.d.ts

@@ -0,0 +1,16 @@
+import * as z from 'zod/v4';
+export declare const UnsealStoreGetterSchema: z.ZodObject<{
+    id: z.ZodString;
+    get: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodOptional<z.ZodString>>>;
+}, z.core.$strip>;
+export type UnsealStoreGetter = z.infer<typeof UnsealStoreGetterSchema>;
+export declare const OtherStoreResolverSchema: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    get: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodOptional<z.ZodString>>>;
+}, z.core.$strip>>>>;
+export type OtherStoreResolver = z.infer<typeof OtherStoreResolverSchema>;
+//# sourceMappingURL=bootstrap.schema.d.ts.map

package/dist/schemas/backends/bootstrap.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/backends/bootstrap.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,uBAAuB;;;;;iBAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;oBAGnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/schemas/backends/bootstrap.schema.js

@@ -0,0 +1,14 @@
+import * as z from 'zod/v4';
+import { StoreOperationContextSchema } from "../domain/store/store.types.js";
+export const UnsealStoreGetterSchema = z.object({
+    id: z.string(),
+    get: z.function({
+        input: [z.string(), z.string(), StoreOperationContextSchema.optional()],
+        output: z.promise(z.string().optional())
+    })
+});
+export const OtherStoreResolverSchema = z.function({
+    input: [z.string()],
+    output: z.promise(z.array(UnsealStoreGetterSchema))
+});
+//# sourceMappingURL=bootstrap.schema.js.map

package/dist/schemas/backends/bootstrap.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.schema.js","sourceRoot":"","sources":["../../../src/schemas/backends/bootstrap.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC;QACf,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;KACxC,CAAC;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;CACnD,CAAC,CAAC"}

package/dist/schemas/backends/host.schema.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeRef, VibesRuntime } from '@vibesdotdev/kernel';
+export type HostCredentialsHost = Pick<VibesRuntime, 'declaredScope' | 'getEnvSnapshot'>;
+export type KeychainRuntime = RuntimeRef;
+//# sourceMappingURL=host.schema.d.ts.map

package/dist/schemas/backends/host.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/backends/host.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAC,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,gBAAgB,CAAC,CAAC;AAEzF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC"}

package/dist/schemas/backends/host.schema.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=host.schema.js.map

package/dist/schemas/backends/host.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.schema.js","sourceRoot":"","sources":["../../../src/schemas/backends/host.schema.ts"],"names":[],"mappings":""}

package/dist/schemas/backends/unseal.schema.d.ts

@@ -0,0 +1,30 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+/**
+ * The runtime the store reads: store-resolved credentials,
+ * and the filesystem adapter (the service-account token). Never an ambient host API.
+ */
+export type VaultStoreRuntime = Pick<RuntimeRef, 'hasKind' | 'query' | 'scope'>;
+export declare const UnsealSourceSchema: z.ZodObject<{
+    address: z.ZodString;
+    mount: z.ZodString;
+    path: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    tokenEnvVar: z.ZodOptional<z.ZodString>;
+    keyFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const UnsealSourcesSchema: z.ZodArray<z.ZodObject<{
+    address: z.ZodString;
+    mount: z.ZodString;
+    path: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    tokenEnvVar: z.ZodOptional<z.ZodString>;
+    keyFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>>;
+export declare const UnsealKeyBundleSchema: z.ZodArray<z.ZodString>;
+export declare const UnsealSourceOutcomeSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodString>;
+    failures: z.ZodArray<z.ZodInstanceOf<Error>>;
+}, z.core.$strip>;
+export type UnsealSourceOutcome = z.infer<typeof UnsealSourceOutcomeSchema>;
+//# sourceMappingURL=unseal.schema.d.ts.map

package/dist/schemas/backends/unseal.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unseal.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/backends/unseal.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;kBAA8B,CAAC;AAE/D,eAAO,MAAM,qBAAqB,yBAAsB,CAAC;AAEzD,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/schemas/backends/unseal.schema.js

@@ -0,0 +1,17 @@
+import {} from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export const UnsealSourceSchema = z.object({
+    address: z.string().min(1),
+    mount: z.string().min(1),
+    path: z.string().min(1),
+    token: z.string().optional(),
+    tokenEnvVar: z.string().optional(),
+    keyFields: z.array(z.string()).optional()
+});
+export const UnsealSourcesSchema = z.array(UnsealSourceSchema);
+export const UnsealKeyBundleSchema = z.array(z.string());
+export const UnsealSourceOutcomeSchema = z.object({
+    keys: z.array(z.string()),
+    failures: z.array(z.instanceof(Error))
+});
+//# sourceMappingURL=unseal.schema.js.map

package/dist/schemas/backends/unseal.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unseal.schema.js","sourceRoot":"","sources":["../../../src/schemas/backends/unseal.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAQ5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC,CAAC"}

package/dist/schemas/backends/vault.schema.d.ts

@@ -0,0 +1,61 @@
+import * as z from 'zod/v4';
+import { UnsealSourceSchema } from './unseal.schema.ts';
+export declare const VaultClientConfigSchema: z.ZodObject<{
+    address: z.ZodString;
+    mount: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    tokenEnvVar: z.ZodOptional<z.ZodString>;
+    resolveToken: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodUnion<readonly [z.ZodString, z.ZodUndefined]>>>>;
+    k8sRole: z.ZodOptional<z.ZodString>;
+    readServiceAccountToken: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodString>>>;
+    requestTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    allowLoopbackHttp: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type VaultClientConfig = z.infer<typeof VaultClientConfigSchema>;
+export type VaultSealStatus = z.infer<typeof SealStatusSchema>;
+export type VaultUnsealSourceSpec = z.infer<typeof UnsealSourceSchema>;
+export declare const VaultUnsealOptionsSchema: z.ZodObject<{
+    autoUnseal: z.ZodBoolean;
+    allowPrompt: z.ZodBoolean;
+    additionalKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resolveAdditionalKeys: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodArray<z.ZodString>>>>;
+    sourceSpecs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        address: z.ZodString;
+        mount: z.ZodString;
+        path: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+        keyFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    prompt: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodNumber, z.ZodNumber], null>, z.ZodPromise<z.ZodUnion<readonly [z.ZodString, z.ZodUndefined]>>>>;
+}, z.core.$strip>;
+export type VaultUnsealOptions = z.infer<typeof VaultUnsealOptionsSchema>;
+export declare const SealStatusSchema: z.ZodObject<{
+    type: z.ZodOptional<z.ZodString>;
+    initialized: z.ZodBoolean;
+    sealed: z.ZodBoolean;
+    t: z.ZodNumber;
+    n: z.ZodOptional<z.ZodNumber>;
+    progress: z.ZodNumber;
+    nonce: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const UnsealResponseSchema: z.ZodObject<{
+    sealed: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const KvReadSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        data: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const KvListSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        keys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const LoginSchema: z.ZodObject<{
+    auth: z.ZodObject<{
+        client_token: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+//# sourceMappingURL=vault.schema.d.ts.map

package/dist/schemas/backends/vault.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/backends/vault.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACvE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,gBAAgB;;;;;;;;;iBAS3B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;iBAAoC,CAAC;AAEtE,eAAO,MAAM,YAAY;;;;iBAA2E,CAAC;AAErG,eAAO,MAAM,YAAY;;;;iBAA8D,CAAC;AAExF,eAAO,MAAM,WAAW;;;;iBAAoE,CAAC"}

package/dist/schemas/backends/vault.schema.js

@@ -0,0 +1,36 @@
+import * as z from 'zod/v4';
+import { UnsealSourceSchema } from "./unseal.schema.js";
+export const VaultClientConfigSchema = z.object({
+    address: z.string(),
+    mount: z.string(),
+    token: z.string().optional(),
+    tokenEnvVar: z.string().optional(),
+    resolveToken: z.function({ input: [], output: z.promise(z.union([z.string(), z.undefined()])) }).optional(),
+    k8sRole: z.string().optional(),
+    readServiceAccountToken: z.function({ input: [], output: z.promise(z.string()) }).optional(),
+    requestTimeoutMs: z.number().optional(),
+    allowLoopbackHttp: z.boolean().optional(),
+});
+export const VaultUnsealOptionsSchema = z.object({
+    autoUnseal: z.boolean(),
+    allowPrompt: z.boolean(),
+    additionalKeys: z.array(z.string()).optional(),
+    resolveAdditionalKeys: z.function({ input: [], output: z.promise(z.array(z.string())) }).optional(),
+    sourceSpecs: z.array(UnsealSourceSchema).optional(),
+    prompt: z.function({ input: [z.number(), z.number()], output: z.promise(z.union([z.string(), z.undefined()])) }).optional(),
+});
+export const SealStatusSchema = z.object({
+    type: z.string().optional(),
+    initialized: z.boolean(),
+    sealed: z.boolean(),
+    t: z.number(),
+    n: z.number().optional(),
+    progress: z.number(),
+    nonce: z.string().optional(),
+    version: z.string().optional()
+});
+export const UnsealResponseSchema = z.object({ sealed: z.boolean() });
+export const KvReadSchema = z.object({ data: z.object({ data: z.record(z.string(), z.string()) }) });
+export const KvListSchema = z.object({ data: z.object({ keys: z.array(z.string()) }) });
+export const LoginSchema = z.object({ auth: z.object({ client_token: z.string().min(1) }) });
+//# sourceMappingURL=vault.schema.js.map

package/dist/schemas/backends/vault.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.schema.js","sourceRoot":"","sources":["../../../src/schemas/backends/vault.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,uBAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnG,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3H,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/cli/commands/check.schema.d.ts

@@ -0,0 +1,15 @@
+import * as z from 'zod/v4';
+export declare const checkArgsSchema: z.ZodObject<{
+    filter: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CheckArgs = z.input<typeof checkArgsSchema>;
+export type CheckOptionsInput = z.input<typeof checkOptionsSchema>;
+export declare const checkOptionsSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    app: z.ZodOptional<z.ZodString>;
+    manifest: z.ZodOptional<z.ZodBoolean>;
+    json: z.ZodOptional<z.ZodBoolean>;
+    drift: z.ZodOptional<z.ZodBoolean>;
+    storeTimeoutMs: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+}, z.core.$strip>;
+//# sourceMappingURL=check.schema.d.ts.map

package/dist/schemas/cli/commands/check.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/check.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,eAAe;;iBAA8C,CAAC;AAC3E,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC"}

package/dist/schemas/cli/commands/check.schema.js

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+export const checkArgsSchema = z.object({ filter: z.string().optional() });
+export const checkOptionsSchema = z.object({
+    environment: z.string().optional(),
+    app: z.string().optional(),
+    manifest: z.boolean().optional(),
+    json: z.boolean().optional(),
+    drift: z.boolean().optional(),
+    storeTimeoutMs: z.union([z.number(), z.string()]).optional()
+});
+//# sourceMappingURL=check.schema.js.map

package/dist/schemas/cli/commands/check.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.schema.js","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/check.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC"}

package/dist/schemas/cli/commands/exec.schema.d.ts

@@ -0,0 +1,25 @@
+import * as z from 'zod/v4';
+export type ExecArgs = z.input<typeof execArgsSchema>;
+export type ExecOptionsInput = z.input<typeof execOptionsInputSchema>;
+export declare const execArgsSchema: z.ZodObject<{
+    command: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const execOptionsSchema: z.ZodObject<{
+    with: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodString>;
+    backend: z.ZodOptional<z.ZodString>;
+    allowMissing: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    session: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    pass: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExecOptions = z.infer<typeof execOptionsSchema>;
+export declare const stringSchema: z.ZodString;
+export declare const execOptionsInputSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    backend: z.ZodOptional<z.ZodString>;
+    allowMissing: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    session: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    pass: z.ZodOptional<z.ZodString>;
+    with: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+}, z.core.$strip>;
+//# sourceMappingURL=exec.schema.d.ts.map

package/dist/schemas/cli/commands/exec.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/exec.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;iBAO5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,eAAO,MAAM,sBAAsB;;;;;;;iBAA4F,CAAC"}

package/dist/schemas/cli/commands/exec.schema.js

@@ -0,0 +1,15 @@
+import * as z from 'zod/v4';
+export const execArgsSchema = z.object({
+    command: z.array(z.string()).optional()
+});
+export const execOptionsSchema = z.object({
+    with: z.string().optional(),
+    environment: z.string().optional(),
+    backend: z.string().optional(),
+    allowMissing: z.boolean().optional().default(false),
+    session: z.boolean().optional().default(false),
+    pass: z.string().optional()
+});
+export const stringSchema = z.string();
+export const execOptionsInputSchema = execOptionsSchema.extend({ with: z.union([z.string(), z.array(z.string())]).optional() });
+//# sourceMappingURL=exec.schema.js.map

package/dist/schemas/cli/commands/exec.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.schema.js","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/exec.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAEvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC"}

package/dist/schemas/cli/commands/export.schema.d.ts

@@ -0,0 +1,12 @@
+import * as z from 'zod/v4';
+export declare const exportArgsSchema: z.ZodObject<{}, z.core.$strip>;
+export type ExportArgs = z.input<typeof exportArgsSchema>;
+export type ExportOptionsInput = z.input<typeof exportOptionsSchema>;
+export declare const exportOptionsSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+    out: z.ZodOptional<z.ZodString>;
+    manifestOnly: z.ZodOptional<z.ZodBoolean>;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+//# sourceMappingURL=export.schema.d.ts.map

package/dist/schemas/cli/commands/export.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/export.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,gBAAgB,gCAAe,CAAC;AAC7C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAC"}

package/dist/schemas/cli/commands/export.schema.js

@@ -0,0 +1,10 @@
+import * as z from 'zod/v4';
+export const exportArgsSchema = z.object({});
+export const exportOptionsSchema = z.object({
+    environment: z.string().optional(),
+    from: z.string().optional(),
+    out: z.string().optional(),
+    manifestOnly: z.boolean().optional(),
+    force: z.boolean().optional()
+});
+//# sourceMappingURL=export.schema.js.map

package/dist/schemas/cli/commands/export.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.schema.js","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/export.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAI7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC"}

package/dist/schemas/cli/commands/import.schema.d.ts

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+export declare const importArgsSchema: z.ZodObject<{}, z.core.$strip>;
+export type ImportArgs = z.input<typeof importArgsSchema>;
+export type ImportOptionsInput = z.input<typeof importOptionsSchema>;
+export declare const importOptionsSchema: z.ZodObject<{
+    environment: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+//# sourceMappingURL=import.schema.d.ts.map

package/dist/schemas/cli/commands/import.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/import.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,gBAAgB,gCAAe,CAAC;AAC7C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC"}

package/dist/schemas/cli/commands/import.schema.js

@@ -0,0 +1,9 @@
+import * as z from 'zod/v4';
+export const importArgsSchema = z.object({});
+export const importOptionsSchema = z.object({
+    environment: z.string().optional(),
+    to: z.string().optional(),
+    source: z.string().optional(),
+    dryRun: z.boolean().optional()
+});
+//# sourceMappingURL=import.schema.js.map

package/dist/schemas/cli/commands/import.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.schema.js","sourceRoot":"","sources":["../../../../src/schemas/cli/commands/import.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAI7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC"}