@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/schemas/execution/leverage.schema.d.ts

@@ -0,0 +1,17 @@
+import * as z from 'zod/v4';
+export declare const ResolvedSecretsSchema: z.ZodObject<{
+    environment: z.ZodString;
+    backendId: z.ZodString;
+    values: z.ZodRecord<z.ZodString, z.ZodString>;
+    unreadable: z.ZodArray<z.ZodString>;
+    missing: z.ZodArray<z.ZodString>;
+    hops: z.ZodArray<z.ZodObject<{
+        backend: z.ZodString;
+        environment: z.ZodString;
+        resolved: z.ZodArray<z.ZodString>;
+        writeOnly: z.ZodArray<z.ZodString>;
+        missing: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ResolvedSecrets = z.infer<typeof ResolvedSecretsSchema>;
+//# sourceMappingURL=leverage.schema.d.ts.map

package/dist/schemas/execution/leverage.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leverage.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/leverage.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAOhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/execution/leverage.schema.js

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+import { LeverageHopSchema } from "./audit.schema.js";
+export const ResolvedSecretsSchema = z.object({
+    environment: z.string(),
+    backendId: z.string(),
+    values: z.record(z.string(), z.string()),
+    unreadable: z.array(z.string()),
+    missing: z.array(z.string()),
+    hops: z.array(LeverageHopSchema),
+});
+//# sourceMappingURL=leverage.schema.js.map

package/dist/schemas/execution/leverage.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leverage.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/leverage.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CAChC,CAAC,CAAC"}

package/dist/schemas/execution/prepared.schema.d.ts

@@ -0,0 +1,28 @@
+import * as z from 'zod/v4';
+export declare const PreparedSpawnSchema: z.ZodObject<{
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+    audit: z.ZodObject<{
+        backend: z.ZodString;
+        keys: z.ZodArray<z.ZodString>;
+        target: z.ZodString;
+        reason: z.ZodOptional<z.ZodString>;
+        environment: z.ZodString;
+        action: z.ZodUnion<readonly [z.ZodLiteral<"secrets.exec">, z.ZodLiteral<"secrets.request">, z.ZodLiteral<"secrets.oauth-client.mint">, z.ZodLiteral<"secrets.spawn">]>;
+        leases: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            source: z.ZodLiteral<"lease">;
+            id: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>>>;
+        hops: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            backend: z.ZodString;
+            environment: z.ZodString;
+            resolved: z.ZodArray<z.ZodString>;
+            writeOnly: z.ZodArray<z.ZodString>;
+            missing: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PreparedSpawn = z.infer<typeof PreparedSpawnSchema>;
+//# sourceMappingURL=prepared.schema.d.ts.map

package/dist/schemas/execution/prepared.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepared.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/prepared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/execution/prepared.schema.js

@@ -0,0 +1,8 @@
+import * as z from 'zod/v4';
+import { LeverageAuditRecordSchema } from "./audit.schema.js";
+export const PreparedSpawnSchema = z.object({
+    env: z.record(z.string(), z.string()),
+    values: z.record(z.string(), z.string()).readonly(),
+    audit: LeverageAuditRecordSchema.omit({ outcome: true }),
+});
+//# sourceMappingURL=prepared.schema.js.map

package/dist/schemas/execution/prepared.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepared.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/prepared.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC;CACrD,CAAC,CAAC"}

package/dist/schemas/execution/redactor.schema.d.ts

@@ -0,0 +1,7 @@
+import * as z from 'zod/v4';
+export declare const StreamRedactorSchema: z.ZodObject<{
+    push: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodString>;
+    flush: z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodString>;
+}, z.core.$strip>;
+export type StreamRedactor = z.infer<typeof StreamRedactorSchema>;
+//# sourceMappingURL=redactor.schema.d.ts.map

package/dist/schemas/execution/redactor.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/redactor.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/schemas/execution/redactor.schema.js

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export const StreamRedactorSchema = z.object({
+    push: z.function({ input: [z.string()], output: z.string() }),
+    flush: z.function({ input: [], output: z.string() }),
+});
+//# sourceMappingURL=redactor.schema.js.map

package/dist/schemas/execution/redactor.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/redactor.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACpD,CAAC,CAAC"}

package/dist/schemas/execution/result.schema.d.ts

@@ -0,0 +1,55 @@
+import * as z from 'zod/v4';
+export declare const CredentialedChildSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    exited: z.ZodPromise<z.ZodNumber>;
+}, z.core.$strip>;
+export type CredentialedChild = z.infer<typeof CredentialedChildSchema>;
+export declare const ResolvedCredentialSpawnSchema: z.ZodObject<{
+    values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+    audit: z.ZodObject<{
+        backend: z.ZodString;
+        keys: z.ZodArray<z.ZodString>;
+        target: z.ZodString;
+        reason: z.ZodOptional<z.ZodString>;
+        environment: z.ZodString;
+        action: z.ZodUnion<readonly [z.ZodLiteral<"secrets.exec">, z.ZodLiteral<"secrets.request">, z.ZodLiteral<"secrets.oauth-client.mint">, z.ZodLiteral<"secrets.spawn">]>;
+        leases: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            source: z.ZodLiteral<"lease">;
+            id: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>>>;
+        hops: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            backend: z.ZodString;
+            environment: z.ZodString;
+            resolved: z.ZodArray<z.ZodString>;
+            writeOnly: z.ZodArray<z.ZodString>;
+            missing: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ResolvedCredentialSpawn = z.infer<typeof ResolvedCredentialSpawnSchema>;
+export declare const CredentialEnvSchema: z.ZodObject<{
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    redact: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    audit: z.ZodFunction<z.ZodTuple<readonly [z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"success">, z.ZodLiteral<"failure">]>>], null>, z.ZodVoid>;
+}, z.core.$strip>;
+export type CredentialEnv = z.infer<typeof CredentialEnvSchema>;
+export declare const NameRoleSchema: z.ZodEnum<{
+    env: "env";
+    credential: "credential";
+    pass: "pass";
+    lease: "lease";
+}>;
+export type NameRole = z.infer<typeof NameRoleSchema>;
+export declare const AdmittedLeasesSchema: z.ZodObject<{
+    values: z.ZodRecord<z.ZodString, z.ZodString>;
+    audit: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        source: z.ZodLiteral<"lease">;
+        id: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AdmittedLeases = z.infer<typeof AdmittedLeasesSchema>;
+//# sourceMappingURL=result.schema.d.ts.map

package/dist/schemas/execution/result.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/result.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;iBAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,cAAc;;;;;EAAiD,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,oBAAoB;;;;;;;;iBAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/schemas/execution/result.schema.js

@@ -0,0 +1,21 @@
+import * as z from 'zod/v4';
+import { LeverageAuditRecordSchema, LeverageLeaseAuditSchema } from "./audit.schema.js";
+export const CredentialedChildSchema = z.object({
+    pid: z.number(),
+    exited: z.promise(z.number()),
+});
+export const ResolvedCredentialSpawnSchema = z.object({
+    values: z.record(z.string(), z.string()).readonly(),
+    audit: LeverageAuditRecordSchema.omit({ outcome: true }),
+});
+export const CredentialEnvSchema = z.object({
+    env: z.record(z.string(), z.string()),
+    redact: z.array(z.string()).readonly(),
+    audit: z.function({ input: [z.union([z.literal('success'), z.literal('failure')]).optional()], output: z.void() }),
+});
+export const NameRoleSchema = z.enum(['pass', 'credential', 'lease', 'env']);
+export const AdmittedLeasesSchema = z.object({
+    values: z.record(z.string(), z.string()),
+    audit: z.array(LeverageLeaseAuditSchema)
+});
+//# sourceMappingURL=result.schema.js.map

package/dist/schemas/execution/result.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/result.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAC,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;CACxD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;CAClH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAG7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC"}

package/dist/schemas/execution/spawn.schema.d.ts

@@ -0,0 +1,218 @@
+import * as z from 'zod/v4';
+export declare const AUDIT_ACTIONS: readonly ["secrets.exec", "secrets.request", "secrets.oauth-client.mint", "secrets.spawn"];
+export declare const auditOverrideSchema: z.ZodOptional<z.ZodObject<{
+    action: z.ZodOptional<z.ZodEnum<{
+        "secrets.exec": "secrets.exec";
+        "secrets.request": "secrets.request";
+        "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+        "secrets.spawn": "secrets.spawn";
+    }>>;
+    target: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export declare const leaseSchema: z.ZodObject<{
+    value: z.ZodString;
+    lease: z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** Every caller-held lease, each parsed; a malformed one names itself in the refusal. */
+export declare const leaseCollectionSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+    value: z.ZodString;
+    lease: z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>>>;
+/** What a request names besides its credentials and leases; shared by a credential environment request and a spawn. */
+export declare const requestFields: {
+    pass: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    /** Declared noncredential variables. Credentials and leases use their dedicated ports. */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    publishHostCredentials: z.ZodOptional<z.ZodBoolean>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+};
+/** An output sink as given: the function itself, so the parsed copy carries the caller's sink and not a wrapper. */
+export declare const sinkSchema: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+/** The caller's credentials and the leases it already holds. */
+export declare const credentialFields: {
+    credentials: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    /** Skip only references whose selected store confirms credential-not-set. */
+    optionalCredentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>>;
+    leases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        lease: z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+};
+export declare const credentialEnvRequestSchema: z.ZodObject<{
+    credentials: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    optionalCredentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>>;
+    leases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        lease: z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    pass: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    publishHostCredentials: z.ZodOptional<z.ZodBoolean>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** The pre-resolved spawn (`spawnResolvedCredentials`) carries no credential references or leases. */
+export declare const resolvedSpawnFields: {
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    stdin: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"inherit">, z.ZodLiteral<"ignore">, z.ZodObject<{
+        data: z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<Uint8Array<ArrayBuffer>>]>;
+    }, z.core.$strip>]>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    stdinTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    output: z.ZodObject<{
+        stdout: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+        stderr: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+    }, z.core.$strip>;
+    pass: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    /** Declared noncredential variables. Credentials and leases use their dedicated ports. */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    publishHostCredentials: z.ZodOptional<z.ZodBoolean>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+};
+export declare const spawnOptionsSchema: z.ZodObject<{
+    credentials: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    optionalCredentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>>;
+    leases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodString;
+        lease: z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    stdin: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"inherit">, z.ZodLiteral<"ignore">, z.ZodObject<{
+        data: z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<Uint8Array<ArrayBuffer>>]>;
+    }, z.core.$strip>]>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    stdinTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    output: z.ZodObject<{
+        stdout: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+        stderr: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+    }, z.core.$strip>;
+    pass: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    publishHostCredentials: z.ZodOptional<z.ZodBoolean>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const resolvedSpawnOptionsSchema: z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    stdin: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"inherit">, z.ZodLiteral<"ignore">, z.ZodObject<{
+        data: z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<Uint8Array<ArrayBuffer>>]>;
+    }, z.core.$strip>]>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    stdinTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    output: z.ZodObject<{
+        stdout: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+        stderr: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+    }, z.core.$strip>;
+    pass: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    publishHostCredentials: z.ZodOptional<z.ZodBoolean>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** The few fields a refused attempt audits (names only: never a credential's content). */
+export declare const auditHintSchema: z.ZodObject<{
+    credentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    audit: z.ZodOptional<z.ZodObject<{
+        action: z.ZodOptional<z.ZodEnum<{
+            "secrets.exec": "secrets.exec";
+            "secrets.request": "secrets.request";
+            "secrets.oauth-client.mint": "secrets.oauth-client.mint";
+            "secrets.spawn": "secrets.spawn";
+        }>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    command: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CredentialedOutput = z.infer<typeof resolvedSpawnOptionsSchema>['output'];
+export type CallerHeldLease = z.infer<typeof leaseSchema>;
+export type SpawnWithCredentialsOptions = z.input<typeof spawnOptionsSchema>;
+export type CredentialEnvRequest = z.input<typeof credentialEnvRequestSchema>;
+//# sourceMappingURL=spawn.schema.d.ts.map

package/dist/schemas/execution/spawn.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/spawn.schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,aAAa,4FAA6F,CAAC;AAExH,eAAO,MAAM,mBAAmB;;;;;;;;kBAEpB,CAAC;AAEb,eAAO,MAAM,WAAW;;;;;;iBAGtB,CAAC;AAEH,yFAAyF;AACzF,eAAO,MAAM,qBAAqB;;;;;;mBAA+C,CAAC;AAElF,uHAAuH;AACvH,eAAO,MAAM,aAAa;;IAEzB,0FAA0F;;;;;;;;;;;;CAI1F,CAAC;AAEF,oHAAoH;AACpH,eAAO,MAAM,UAAU,oEAAwD,CAAC;AAEhF,gEAAgE;AAChE,eAAO,MAAM,gBAAgB;;;;;;;IAE5B,6EAA6E;;;;;;;;;;;;;;CAG7E,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAsD,CAAC;AAE9F,sGAAsG;AACtG,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;IApB/B,0FAA0F;;;;;;;;;;;;CA+B1F,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA4D,CAAC;AAE5F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;iBAAgC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAI1B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEtF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE1D,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE7E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/execution/spawn.schema.js

@@ -0,0 +1,52 @@
+import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import * as z from 'zod/v4';
+export const AUDIT_ACTIONS = ['secrets.exec', 'secrets.request', 'secrets.oauth-client.mint', 'secrets.spawn'];
+export const auditOverrideSchema = z
+    .object({ action: z.enum(AUDIT_ACTIONS).optional(), target: z.string().optional() })
+    .optional();
+export const leaseSchema = z.object({
+    value: z.string(),
+    lease: z.object({ id: z.string().optional(), expiresAt: z.string() })
+});
+/** Every caller-held lease, each parsed; a malformed one names itself in the refusal. */
+export const leaseCollectionSchema = z.record(z.string(), leaseSchema).optional();
+/** What a request names besides its credentials and leases; shared by a credential environment request and a spawn. */
+export const requestFields = {
+    pass: z.array(z.string()).readonly(),
+    /** Declared noncredential variables. Credentials and leases use their dedicated ports. */
+    env: z.record(z.string(), z.string()).optional(),
+    publishHostCredentials: z.boolean().optional(),
+    audit: auditOverrideSchema
+};
+/** An output sink as given: the function itself, so the parsed copy carries the caller's sink and not a wrapper. */
+export const sinkSchema = z.function({ input: [z.string()], output: z.void() });
+/** The caller's credentials and the leases it already holds. */
+export const credentialFields = {
+    credentials: z.record(z.string(), CredentialReferenceSchema),
+    /** Skip only references whose selected store confirms credential-not-set. */
+    optionalCredentials: z.record(z.string(), CredentialReferenceSchema).optional(),
+    leases: leaseCollectionSchema
+};
+export const credentialEnvRequestSchema = z.object({ ...requestFields, ...credentialFields });
+/** The pre-resolved spawn (`spawnResolvedCredentials`) carries no credential references or leases. */
+export const resolvedSpawnFields = {
+    ...requestFields,
+    command: z.string().min(1),
+    args: z.array(z.string()).readonly().optional(),
+    cwd: z.string().optional(),
+    stdin: z
+        .union([z.literal('inherit'), z.literal('ignore'), z.object({ data: z.union([z.string(), z.instanceof(Uint8Array)]) })])
+        .optional(),
+    timeoutMs: z.number().int().positive().optional(),
+    stdinTimeoutMs: z.number().int().positive().optional(),
+    output: z.object({ stdout: sinkSchema, stderr: sinkSchema })
+};
+export const spawnOptionsSchema = z.object({ ...resolvedSpawnFields, ...credentialFields });
+export const resolvedSpawnOptionsSchema = z.object(resolvedSpawnFields);
+/** The few fields a refused attempt audits (names only: never a credential's content). */
+export const auditHintSchema = z.object({
+    credentials: z.record(z.string(), z.unknown()).optional(),
+    audit: auditOverrideSchema,
+    command: z.string().optional()
+});
+//# sourceMappingURL=spawn.schema.js.map

package/dist/schemas/execution/spawn.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/spawn.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,eAAe,CAAU,CAAC;AAExH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACnF,QAAQ,EAAE,CAAC;AAEb,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACrE,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AAElF,uHAAuH;AACvH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,0FAA0F;IAC1F,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,mBAAmB;CAC1B,CAAC;AAEF,oHAAoH;AACpH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAEhF,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC;IAC5D,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC/E,MAAM,EAAE,qBAAqB;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;AAE9F,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,GAAG,aAAa;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACvH,QAAQ,EAAE;IACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;CAC5D,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,mBAAmB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @vibesdotdev/secrets/schemas — the canonical, browser-safe unified secret model.
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { createSecretInputSchema, managedSecretScopeSchema, publicSecretSchema, secretCollectionEnvelopeSchema, secretEditorInputSchema, secretItemEnvelopeSchema, secretMetadataSchema, secretMetadataValueSchema, secretRefSchema, secretRotationPolicySchema, secretScopeSchema, secretWireDateSchema, secretWireRecordSchema, updateSecretInputSchema, type CreateSecretInput, type ManagedSecretScope, type PublicSecret, type SecretEditorInput, type SecretMetadata, type SecretMetadataValue, type SecretRef, type SecretRotationPolicy, type SecretScope, type SecretWireRecord, type UpdateSecretInput } from './managed/secret.schema.ts';
+export { DEFAULT_REVEAL_SECONDS, revealPhaseSchema, revealSecondsSchema, type RevealPhase, type RevealSeconds } from './ui/reveal.schema.ts';
+export { managedSecretRecordSchema, managedSecretRowSchema, type ManagedSecretRecord, type ManagedSecretRow } from './managed/managed-record.schema.ts';
+export { CredentialCandidatesSchema, CredentialUseReferenceSchema, OAuthAccountCredentialReferenceSchema, credentialPresenceInputSchema, credentialPresenceSchema, credentialPayloadSignatureInputSchema, OAuthClientAuthenticationSchema, OAuthTokenBodyEncodingSchema, OAuthTokenRequestHeadersSchema, oauthAuthorizationCodeExchangeSchema, oauthRefreshTokenExchangeSchema, oauthAuthorizationUrlResolveSchema, OAuthAuthorizationCodeTokenResponseSchema, type CredentialCandidates, type CredentialPresence, type CredentialPresenceInputInput, type CredentialPayloadSignatureInput, type OAuthAuthorizationCodeExchangeInputInput, type OAuthRefreshTokenExchangeInputInput, type OAuthAuthorizationUrlResolveInput, type OAuthAuthorizationCodeTokenResponse } from './transport/credential-use.schema.ts';
+export { REQUEST_METHODS, RequestMethodSchema, RequestBodySchema, RequestHeadersSchema, CredentialUseBindingSchema, authenticatedRequestOptionsSchema, authenticatedRequestInputSchema, type RequestMethod, type CredentialUseBinding, type AuthenticatedRequestInputInput, type AuthenticatedRequestInput, type AuthenticatedRequestOptionsInput, type AuthenticatedRequestOptions } from './transport/authenticated-request.schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACP,uBAAuB,EAAC,wBAAwB,EAAC,kBAAkB,EAAC,8BAA8B,EAAC,uBAAuB,EAAC,wBAAwB,EAAC,oBAAoB,EAAC,yBAAyB,EAAC,eAAe,EAAC,0BAA0B,EAAC,iBAAiB,EAAC,oBAAoB,EACpR,sBAAsB,EAAC,uBAAuB,EAAC,KAAK,iBAAiB,EAAC,KAAK,kBAAkB,EAAC,KAAK,YAAY,EAAC,KAAK,iBAAiB,EAAC,KAAK,cAAc,EAAC,KAAK,mBAAmB,EAAC,KAAK,SAAS,EAAC,KAAK,oBAAoB,EAAC,KAAK,WAAW,EAAC,KAAK,gBAAgB,EAAC,KAAK,iBAAiB,EACzR,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACP,sBAAsB,EAAC,iBAAiB,EACxC,mBAAmB,EAAC,KAAK,WAAW,EACpC,KAAK,aAAa,EACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yBAAyB,EAAC,sBAAsB,EAAC,KAAK,mBAAmB,EAAC,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAErJ,OAAO,EACN,0BAA0B,EAAE,4BAA4B,EAAE,qCAAqC,EAC/F,6BAA6B,EAAE,wBAAwB,EAAE,qCAAqC,EAAE,+BAA+B,EAC/H,4BAA4B,EAAE,8BAA8B,EAAE,oCAAoC,EAClG,+BAA+B,EAAE,kCAAkC,EAAE,yCAAyC,EAC9G,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,KAAK,4BAA4B,EAAE,KAAK,+BAA+B,EAC3H,KAAK,wCAAwC,EAAE,KAAK,mCAAmC,EACvF,KAAK,iCAAiC,EAAE,KAAK,mCAAmC,EAChF,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACN,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,0BAA0B,EACzG,iCAAiC,EAAE,+BAA+B,EAClE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,KAAK,8BAA8B,EAAE,KAAK,yBAAyB,EAClH,KAAK,gCAAgC,EAAE,KAAK,2BAA2B,EACvE,MAAM,6CAA6C,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,11 @@
+/**
+ * @vibesdotdev/secrets/schemas — the canonical, browser-safe unified secret model.
+ *
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { createSecretInputSchema, managedSecretScopeSchema, publicSecretSchema, secretCollectionEnvelopeSchema, secretEditorInputSchema, secretItemEnvelopeSchema, secretMetadataSchema, secretMetadataValueSchema, secretRefSchema, secretRotationPolicySchema, secretScopeSchema, secretWireDateSchema, secretWireRecordSchema, updateSecretInputSchema } from "./managed/secret.schema.js";
+export { DEFAULT_REVEAL_SECONDS, revealPhaseSchema, revealSecondsSchema } from "./ui/reveal.schema.js";
+export { managedSecretRecordSchema, managedSecretRowSchema } from "./managed/managed-record.schema.js";
+export { CredentialCandidatesSchema, CredentialUseReferenceSchema, OAuthAccountCredentialReferenceSchema, credentialPresenceInputSchema, credentialPresenceSchema, credentialPayloadSignatureInputSchema, OAuthClientAuthenticationSchema, OAuthTokenBodyEncodingSchema, OAuthTokenRequestHeadersSchema, oauthAuthorizationCodeExchangeSchema, oauthRefreshTokenExchangeSchema, oauthAuthorizationUrlResolveSchema, OAuthAuthorizationCodeTokenResponseSchema } from "./transport/credential-use.schema.js";
+export { REQUEST_METHODS, RequestMethodSchema, RequestBodySchema, RequestHeadersSchema, CredentialUseBindingSchema, authenticatedRequestOptionsSchema, authenticatedRequestInputSchema } from "./transport/authenticated-request.schema.js";
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACP,uBAAuB,EAAC,wBAAwB,EAAC,kBAAkB,EAAC,8BAA8B,EAAC,uBAAuB,EAAC,wBAAwB,EAAC,oBAAoB,EAAC,yBAAyB,EAAC,eAAe,EAAC,0BAA0B,EAAC,iBAAiB,EAAC,oBAAoB,EACpR,sBAAsB,EAAC,uBAAuB,EAC7C,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACP,sBAAsB,EAAC,iBAAiB,EACxC,mBAAmB,EAElB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yBAAyB,EAAC,sBAAsB,EAAiD,MAAM,oCAAoC,CAAC;AAErJ,OAAO,EACN,0BAA0B,EAAE,4BAA4B,EAAE,qCAAqC,EAC/F,6BAA6B,EAAE,wBAAwB,EAAE,qCAAqC,EAAE,+BAA+B,EAC/H,4BAA4B,EAAE,8BAA8B,EAAE,oCAAoC,EAClG,+BAA+B,EAAE,kCAAkC,EAAE,yCAAyC,EAI9G,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACN,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,0BAA0B,EACzG,iCAAiC,EAAE,+BAA+B,EAGlE,MAAM,6CAA6C,CAAC"}