@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/schemas/transport/credential-use.schema.d.ts

@@ -0,0 +1,200 @@
+import * as z from 'zod/v4';
+/** Delegated account data is preserved; using it requires an admitted Auth owner. */
+export declare const OAuthAccountCredentialReferenceSchema: z.ZodObject<{
+    source: z.ZodLiteral<"oauth-account">;
+    providerId: z.ZodString;
+    token: z.ZodDefault<z.ZodEnum<{
+        accessToken: "accessToken";
+        refreshToken: "refreshToken";
+    }>>;
+}, z.core.$strict>;
+export declare const CredentialUseReferenceSchema: z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"secret">;
+    key: z.ZodString;
+    store: z.ZodOptional<z.ZodString>;
+    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+}, z.core.$strict>], "source">, z.ZodObject<{
+    source: z.ZodLiteral<"oauth-account">;
+    providerId: z.ZodString;
+    token: z.ZodDefault<z.ZodEnum<{
+        accessToken: "accessToken";
+        refreshToken: "refreshToken";
+    }>>;
+}, z.core.$strict>]>;
+export declare const CredentialCandidatesSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"secret">;
+    key: z.ZodString;
+    store: z.ZodOptional<z.ZodString>;
+    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+}, z.core.$strict>], "source">, z.ZodObject<{
+    source: z.ZodLiteral<"oauth-account">;
+    providerId: z.ZodString;
+    token: z.ZodDefault<z.ZodEnum<{
+        accessToken: "accessToken";
+        refreshToken: "refreshToken";
+    }>>;
+}, z.core.$strict>]>>;
+export type CredentialCandidates = z.infer<typeof CredentialCandidatesSchema>;
+export declare const credentialPresenceInputSchema: z.ZodObject<{
+    key: z.ZodString;
+    store: z.ZodOptional<z.ZodString>;
+    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+}, z.core.$strict>;
+export declare const credentialPresenceSchema: z.ZodObject<{
+    set: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type CredentialPresenceInputInput = z.input<typeof credentialPresenceInputSchema>;
+export type CredentialPresence = z.infer<typeof credentialPresenceSchema>;
+/** HMAC-SHA256 uses an ordered credential reference list without returning key material. */
+export declare const credentialPayloadSignatureInputSchema: z.ZodObject<{
+    credentials: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    message: z.ZodString;
+    prefix: z.ZodDefault<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type CredentialPayloadSignatureInput = z.input<typeof credentialPayloadSignatureInputSchema>;
+export declare const OAuthTokenRequestHeadersSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+export declare const OAuthClientAuthenticationSchema: z.ZodEnum<{
+    form: "form";
+    basic: "basic";
+}>;
+export declare const OAuthTokenBodyEncodingSchema: z.ZodEnum<{
+    json: "json";
+    form: "form";
+}>;
+export declare const oauthAuthorizationCodeExchangeSchema: z.ZodObject<{
+    code: z.ZodString;
+    redirectUri: z.ZodURL;
+    tokenEndpoint: z.ZodURL;
+    clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    clientSecret: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    clientAuthentication: z.ZodDefault<z.ZodEnum<{
+        form: "form";
+        basic: "basic";
+    }>>;
+    bodyEncoding: z.ZodDefault<z.ZodEnum<{
+        json: "json";
+        form: "form";
+    }>>;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const oauthRefreshTokenExchangeSchema: z.ZodObject<{
+    refreshToken: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    tokenEndpoint: z.ZodURL;
+    clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    clientSecret: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+    clientAuthentication: z.ZodDefault<z.ZodEnum<{
+        form: "form";
+        basic: "basic";
+    }>>;
+    bodyEncoding: z.ZodDefault<z.ZodEnum<{
+        json: "json";
+        form: "form";
+    }>>;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type OAuthAuthorizationCodeExchangeInputInput = z.input<typeof oauthAuthorizationCodeExchangeSchema>;
+export type OAuthRefreshTokenExchangeInputInput = z.input<typeof oauthRefreshTokenExchangeSchema>;
+export declare const OAuthAuthorizationCodeTokenResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+    x_refresh_token_expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+    refresh_token_expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+}, z.core.$catchall<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+export type OAuthAuthorizationCodeTokenResponse = z.infer<typeof OAuthAuthorizationCodeTokenResponseSchema>;
+export declare const oauthAuthorizationUrlResolveSchema: z.ZodObject<{
+    authorizationUrl: z.ZodURL;
+    placeholder: z.ZodString;
+    parameter: z.ZodDefault<z.ZodLiteral<"client_id">>;
+    clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export type OAuthAuthorizationUrlResolveInput = z.input<typeof oauthAuthorizationUrlResolveSchema>;
+//# sourceMappingURL=credential-use.schema.d.ts.map

package/dist/schemas/transport/credential-use.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-use.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/credential-use.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,qFAAqF;AACrF,eAAO,MAAM,qCAAqC;;;;;;;kBAIhD,CAAC;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;oBAA8E,CAAC;AACxH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;qBAA+C,CAAC;AACvF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;kBAAyD,CAAC;AACpG,eAAO,MAAM,wBAAwB;;iBAAqC,CAAC;AAC3E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACzF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,4FAA4F;AAC5F,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;kBAMhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAGpG,eAAO,MAAM,8BAA8B,uCAOzC,CAAC;AACH,eAAO,MAAM,+BAA+B;;;EAA4B,CAAC;AACzE,eAAO,MAAM,4BAA4B;;;EAA2B,CAAC;AAWrE,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAI/C,CAAC;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG1C,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAC5G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGlG,eAAO,MAAM,yCAAyC;;;;;;qQAM1B,CAAC;AAC7B,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;kBAK7C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/schemas/transport/credential-use.schema.js

@@ -0,0 +1,64 @@
+import * as z from 'zod/v4';
+import { CredentialReferenceSchema, SecretCredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+/** Delegated account data is preserved; using it requires an admitted Auth owner. */
+export const OAuthAccountCredentialReferenceSchema = z.strictObject({
+    source: z.literal('oauth-account'),
+    providerId: z.string().min(1),
+    token: z.enum(['accessToken', 'refreshToken']).default('accessToken')
+});
+export const CredentialUseReferenceSchema = z.union([CredentialReferenceSchema, OAuthAccountCredentialReferenceSchema]);
+export const CredentialCandidatesSchema = z.array(CredentialUseReferenceSchema).min(1);
+export const credentialPresenceInputSchema = SecretCredentialReferenceSchema.omit({ source: true });
+export const credentialPresenceSchema = z.object({ set: z.literal(true) });
+/** HMAC-SHA256 uses an ordered credential reference list without returning key material. */
+export const credentialPayloadSignatureInputSchema = z.strictObject({
+    credentials: CredentialCandidatesSchema,
+    message: z.string(),
+    prefix: z.string().refine(value => !/[\r\n]/u.test(value), 'A signature prefix cannot contain line breaks.').default(''),
+    required: z.boolean().default(true),
+    timeoutMs: z.number().int().positive().default(30_000)
+});
+const reservedHeaders = new Set(['authorization', 'content-type', 'host', 'content-length', 'cookie', 'origin', 'referer', 'transfer-encoding', 'proxy-authorization']);
+export const OAuthTokenRequestHeadersSchema = z.record(z.string().regex(/^[A-Za-z0-9!#$%&'*+.^_|~-]+$/), z.string().refine(value => !/[\r\n]/u.test(value), 'Header values cannot contain line breaks.')).superRefine((headers, context) => {
+    for (const name of Object.keys(headers)) {
+        if (reservedHeaders.has(name.toLowerCase()))
+            context.addIssue({ code: 'custom', path: [name], message: 'This header belongs to the Secrets transport.' });
+    }
+});
+export const OAuthClientAuthenticationSchema = z.enum(['basic', 'form']);
+export const OAuthTokenBodyEncodingSchema = z.enum(['form', 'json']);
+const grantFields = {
+    tokenEndpoint: z.url(),
+    clientId: CredentialCandidatesSchema,
+    clientSecret: CredentialCandidatesSchema,
+    clientAuthentication: OAuthClientAuthenticationSchema.default('basic'),
+    bodyEncoding: OAuthTokenBodyEncodingSchema.default('form'),
+    headers: OAuthTokenRequestHeadersSchema.default({}),
+    /** One owned wait covers credential resolution, transport and the complete body. */
+    timeoutMs: z.number().int().positive().default(30_000)
+};
+export const oauthAuthorizationCodeExchangeSchema = z.strictObject({
+    ...grantFields,
+    code: z.string().min(1),
+    redirectUri: z.url()
+});
+export const oauthRefreshTokenExchangeSchema = z.strictObject({
+    ...grantFields,
+    refreshToken: CredentialCandidatesSchema
+});
+const expirySeconds = z.union([z.number().finite().nonnegative(), z.string().regex(/^\d+$/)]).transform(Number);
+export const OAuthAuthorizationCodeTokenResponseSchema = z.object({
+    access_token: z.string().min(1),
+    refresh_token: z.string().optional(),
+    expires_in: expirySeconds.optional(),
+    x_refresh_token_expires_in: expirySeconds.optional(),
+    refresh_token_expires_in: expirySeconds.optional()
+}).catchall(JsonValueSchema);
+export const oauthAuthorizationUrlResolveSchema = z.strictObject({
+    authorizationUrl: z.url(),
+    placeholder: z.string().min(1),
+    parameter: z.literal('client_id').default('client_id'),
+    clientId: CredentialCandidatesSchema
+});
+//# sourceMappingURL=credential-use.schema.js.map

package/dist/schemas/transport/credential-use.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-use.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/credential-use.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,qFAAqF;AACrF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;CACrE,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,CAAC,CAAC;AACxH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAGvF,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACpG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAI3E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC,CAAC;AAGH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACxK,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAChD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,2CAA2C,CAAC,CAC/F,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;IAC3J,CAAC;AACF,CAAC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,MAAM,WAAW,GAAG;IACnB,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE;IACtB,QAAQ,EAAE,0BAA0B;IACpC,YAAY,EAAE,0BAA0B;IACxC,oBAAoB,EAAE,+BAA+B,CAAC,OAAO,CAAC,OAAO,CAAC;IACtE,YAAY,EAAE,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC;AACF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,GAAG,WAAW;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;CACpB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,GAAG,WAAW;IACd,YAAY,EAAE,0BAA0B;CACxC,CAAC,CAAC;AAIH,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE;IACpC,0BAA0B,EAAE,aAAa,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACtD,QAAQ,EAAE,0BAA0B;CACpC,CAAC,CAAC"}

package/dist/schemas/transport/file.schema.d.ts

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export declare const HostFileSubjectSchema: z.ZodObject<{
+    label: z.ZodString;
+}, z.core.$strip>;
+export type HostFileSubject = z.infer<typeof HostFileSubjectSchema>;
+//# sourceMappingURL=file.schema.d.ts.map

package/dist/schemas/transport/file.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/file.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/transport/file.schema.js

@@ -0,0 +1,5 @@
+import * as z from 'zod/v4';
+export const HostFileSubjectSchema = z.object({
+    label: z.string(),
+});
+//# sourceMappingURL=file.schema.js.map

package/dist/schemas/transport/file.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/file.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC"}

package/dist/schemas/transport/header.schema.d.ts

@@ -0,0 +1,17 @@
+import * as z from 'zod/v4';
+export declare const HeaderSetOutcomeSchema: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    problem: z.ZodLiteral<"value-not-sendable">;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    problem: z.ZodLiteral<"value-rejected">;
+    failure: z.ZodObject<{
+        name: z.ZodString;
+        code: z.ZodOptional<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>]>;
+export type HeaderSetOutcome = z.infer<typeof HeaderSetOutcomeSchema>;
+//# sourceMappingURL=header.schema.d.ts.map

package/dist/schemas/transport/header.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/header.schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;mBAS/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/transport/header.schema.js

@@ -0,0 +1,13 @@
+import { ValueFreeFailureSchema } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export const HeaderSetOutcomeSchema = z.union([z.object({
+        ok: z.literal(true),
+    }), z.object({
+        ok: z.literal(false),
+        problem: z.literal('value-not-sendable'),
+    }), z.object({
+        ok: z.literal(false),
+        problem: z.literal('value-rejected'),
+        failure: ValueFreeFailureSchema,
+    })]);
+//# sourceMappingURL=header.schema.js.map

package/dist/schemas/transport/header.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/header.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;KACnB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;KACxC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACpC,OAAO,EAAE,sBAAsB;KAC/B,CAAC,CAAC,CAAC,CAAC"}

package/dist/schemas/transport/json.schema.d.ts

@@ -0,0 +1,10 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+export type JsonBodyOutcome<T> = {
+    readonly ok: true;
+    readonly data: T;
+} | {
+    readonly ok: false;
+    readonly problem: 'not-json' | 'schema-mismatch';
+    readonly failure?: CaughtFailure;
+};
+//# sourceMappingURL=json.schema.d.ts.map

package/dist/schemas/transport/json.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/json.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,eAAe,CAAC,CAAC,IAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;CAAE,CAAC"}

package/dist/schemas/transport/json.schema.js

@@ -0,0 +1,2 @@
+import {} from '@vibesdotdev/kernel';
+//# sourceMappingURL=json.schema.js.map

package/dist/schemas/transport/json.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/json.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,qBAAqB,CAAC"}

package/dist/schemas/transport/outcome.schema.d.ts

@@ -0,0 +1,10 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+/** An operation's outcome: its value, or the failure it threw, kept whole. */
+export type Outcome<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly failure: CaughtFailure;
+};
+//# sourceMappingURL=outcome.schema.d.ts.map

package/dist/schemas/transport/outcome.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/outcome.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC"}

package/dist/schemas/transport/outcome.schema.js

@@ -0,0 +1,2 @@
+import {} from '@vibesdotdev/kernel';
+//# sourceMappingURL=outcome.schema.js.map

package/dist/schemas/transport/outcome.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/outcome.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,qBAAqB,CAAC"}

package/dist/schemas/transport/url.schema.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/v4';
+export declare const DevelopmentHostRuntimeSchema: z.ZodObject<{
+    scope: z.ZodObject<{
+        qualifiers: z.ZodObject<{
+            dev: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DevelopmentHostRuntime = z.infer<typeof DevelopmentHostRuntimeSchema>;
+export declare const SecureUrlPolicySchema: z.ZodObject<{
+    allowLoopbackHttp: z.ZodBoolean;
+}, z.core.$strip>;
+export type SecureUrlPolicy = z.infer<typeof SecureUrlPolicySchema>;
+export declare const SecureUrlProblemSchema: z.ZodUnion<readonly [z.ZodLiteral<"unparseable">, z.ZodLiteral<"scheme-not-allowed">, z.ZodLiteral<"userinfo-not-allowed">, z.ZodLiteral<"host-missing">]>;
+export type SecureUrlProblem = z.infer<typeof SecureUrlProblemSchema>;
+export declare const SecureUrlResultSchema: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    url: z.ZodInstanceOf<URL>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    problem: z.ZodUnion<readonly [z.ZodLiteral<"unparseable">, z.ZodLiteral<"scheme-not-allowed">, z.ZodLiteral<"userinfo-not-allowed">, z.ZodLiteral<"host-missing">]>;
+}, z.core.$strip>]>;
+export type SecureUrlResult = z.infer<typeof SecureUrlResultSchema>;
+//# sourceMappingURL=url.schema.d.ts.map

package/dist/schemas/transport/url.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/transport/url.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,4BAA4B;;;;;;iBAMvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB,4JAAqI,CAAC;AACzK,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;;;;;;mBAM9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/transport/url.schema.js

@@ -0,0 +1,20 @@
+import * as z from 'zod/v4';
+export const DevelopmentHostRuntimeSchema = z.object({
+    scope: z.object({
+        qualifiers: z.object({
+            dev: z.boolean().optional(),
+        }),
+    }),
+});
+export const SecureUrlPolicySchema = z.object({
+    allowLoopbackHttp: z.boolean(),
+});
+export const SecureUrlProblemSchema = z.union([z.literal('unparseable'), z.literal('scheme-not-allowed'), z.literal('userinfo-not-allowed'), z.literal('host-missing')]);
+export const SecureUrlResultSchema = z.union([z.object({
+        ok: z.literal(true),
+        url: z.instanceof(URL),
+    }), z.object({
+        ok: z.literal(false),
+        problem: SecureUrlProblemSchema,
+    })]);
+//# sourceMappingURL=url.schema.js.map

package/dist/schemas/transport/url.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.schema.js","sourceRoot":"","sources":["../../../src/schemas/transport/url.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC3B,CAAC;KACF,CAAC;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAGzK,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtD,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;KACtB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,EAAE,sBAAsB;KAC/B,CAAC,CAAC,CAAC,CAAC"}

package/dist/schemas/ui/reveal.schema.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Reveal lifecycle boundary shapes: the confirmation-gated, time-limited
+ * secret reveal surface (`src/tui/components/RevealPane.tsx`).
+ *
+ * The phase is the value the TUI app and the pane pass back and forth; the
+ * seconds bound the disclosure window. Both parse through these schemas at
+ * the component boundary. The revealed value itself is never a boundary
+ * value: it lives only in the pane's transient local state.
+ */
+import * as z from 'zod/v4';
+/** The reveal flow phases: idle, confirm, loading, revealed, error. */
+export declare const revealPhaseSchema: z.ZodEnum<{
+    error: "error";
+    confirm: "confirm";
+    idle: "idle";
+    loading: "loading";
+    revealed: "revealed";
+}>;
+export type RevealPhase = z.infer<typeof revealPhaseSchema>;
+/** The disclosure window in seconds: 1 to 60. */
+export declare const revealSecondsSchema: z.ZodNumber;
+export type RevealSeconds = z.infer<typeof revealSecondsSchema>;
+/** Default reveal window in seconds. Keep disclosure brief. */
+export declare const DEFAULT_REVEAL_SECONDS: RevealSeconds;
+//# sourceMappingURL=reveal.schema.d.ts.map

package/dist/schemas/ui/reveal.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/ui/reveal.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,uEAAuE;AACvE,eAAO,MAAM,iBAAiB;;;;;;EAA8D,CAAC;AAC7F,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,aAAkC,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,EAAE,aAAkB,CAAC"}

package/dist/schemas/ui/reveal.schema.js

@@ -0,0 +1,17 @@
+/**
+ * Reveal lifecycle boundary shapes: the confirmation-gated, time-limited
+ * secret reveal surface (`src/tui/components/RevealPane.tsx`).
+ *
+ * The phase is the value the TUI app and the pane pass back and forth; the
+ * seconds bound the disclosure window. Both parse through these schemas at
+ * the component boundary. The revealed value itself is never a boundary
+ * value: it lives only in the pane's transient local state.
+ */
+import * as z from 'zod/v4';
+/** The reveal flow phases: idle, confirm, loading, revealed, error. */
+export const revealPhaseSchema = z.enum(['idle', 'confirm', 'loading', 'revealed', 'error']);
+/** The disclosure window in seconds: 1 to 60. */
+export const revealSecondsSchema = z.number().int().min(1).max(60);
+/** Default reveal window in seconds. Keep disclosure brief. */
+export const DEFAULT_REVEAL_SECONDS = 10;
+//# sourceMappingURL=reveal.schema.js.map

package/dist/schemas/ui/reveal.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.schema.js","sourceRoot":"","sources":["../../../src/schemas/ui/reveal.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAG7F,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAGnE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAkB,EAAE,CAAC"}

package/dist/schemas/ui/svelte/form.schema.d.ts

@@ -0,0 +1,70 @@
+import * as z from 'zod/v4';
+/** Presentation props; mutations are parsed at the managed client boundary. */
+export declare const secretFormPropsSchema: z.ZodObject<{
+    secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>>>;
+    defaultScope: z.ZodOptional<z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>>;
+    defaultScopeId: z.ZodOptional<z.ZodString>;
+    defaultProviderType: z.ZodOptional<z.ZodString>;
+    availableScopes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>>>;
+    onSaved: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>], null>, z.ZodVoid>>;
+    onCancel: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodVoid>>;
+    title: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SecretFormProps = z.infer<typeof secretFormPropsSchema>;
+//# sourceMappingURL=form.schema.d.ts.map

package/dist/schemas/ui/svelte/form.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/form.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAShC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/ui/svelte/form.schema.js

@@ -0,0 +1,15 @@
+import * as z from 'zod/v4';
+import { secretSummarySchema } from "../../managed/account-client.schema.js";
+import { managedSecretScopeSchema } from "../../managed/secret.schema.js";
+/** Presentation props; mutations are parsed at the managed client boundary. */
+export const secretFormPropsSchema = z.object({
+    secret: secretSummarySchema.nullable().optional(),
+    defaultScope: managedSecretScopeSchema.optional(),
+    defaultScopeId: z.string().optional(),
+    defaultProviderType: z.string().optional(),
+    availableScopes: z.array(managedSecretScopeSchema).optional(),
+    onSaved: z.function({ input: [secretSummarySchema], output: z.void() }).optional(),
+    onCancel: z.function({ input: [], output: z.void() }).optional(),
+    title: z.string().optional()
+});
+//# sourceMappingURL=form.schema.js.map

package/dist/schemas/ui/svelte/form.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/form.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC7D,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC"}