@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/schemas/ui/svelte/layout.schema.d.ts

@@ -0,0 +1,128 @@
+import * as z from 'zod/v4';
+export declare const SecretsLayoutDataSchema: z.ZodObject<{
+    secrets: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>>;
+    scope: z.ZodUnion<readonly [z.ZodEnum<{
+        user: "user";
+        env: "env";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>, z.ZodNull]>;
+    scopeId: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
+}, z.core.$strip>;
+export type SecretsLayoutData = z.infer<typeof SecretsLayoutDataSchema>;
+export declare const SecretsLayoutFetchersSchema: z.ZodObject<{
+    listSecrets: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        userId: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            env: "env";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodOptional<z.ZodString>;
+        limit: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
+export type SecretsLayoutFetchers = z.infer<typeof SecretsLayoutFetchersSchema>;
+export declare const LoadSecretsLayoutDataInputSchema: z.ZodObject<{
+    user: z.ZodUnion<readonly [z.ZodObject<{
+        id: z.ZodString;
+        isSuperuser: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>, z.ZodNull]>;
+    scope: z.ZodUnion<readonly [z.ZodEnum<{
+        user: "user";
+        env: "env";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>, z.ZodNull]>;
+    scopeId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+    fetchers: z.ZodObject<{
+        listSecrets: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            userId: z.ZodString;
+            scope: z.ZodEnum<{
+                user: "user";
+                env: "env";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            limit: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            scope: z.ZodEnum<{
+                user: "user";
+                platform: "platform";
+                project: "project";
+                org: "org";
+            }>;
+            scopeId: z.ZodString;
+            providerType: z.ZodString;
+            createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+            updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+            lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+            lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+            rotationPolicy: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                manual: "manual";
+                monthly: "monthly";
+                quarterly: "quarterly";
+                yearly: "yearly";
+            }>>;
+            metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+        }, z.core.$strip>>>>;
+    }, z.core.$strip>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type LoadSecretsLayoutDataInput = z.infer<typeof LoadSecretsLayoutDataInputSchema>;
+//# sourceMappingURL=layout.schema.d.ts.map

package/dist/schemas/ui/svelte/layout.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/layout.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAStC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/schemas/ui/svelte/layout.schema.js

@@ -0,0 +1,29 @@
+import * as z from 'zod/v4';
+import { secretSummarySchema } from "../../managed/account-client.schema.js";
+import { secretScopeSchema } from "../../managed/secret.schema.js";
+export const SecretsLayoutDataSchema = z.object({
+    secrets: z.array(secretSummarySchema),
+    scope: z.union([secretScopeSchema, z.null()]),
+    scopeId: z.union([z.string(), z.null()]),
+});
+export const SecretsLayoutFetchersSchema = z.object({
+    listSecrets: z.function({
+        input: [z.object({
+                userId: z.string(),
+                scope: secretScopeSchema,
+                scopeId: z.string().optional(),
+                limit: z.number().optional(),
+            })], output: z.promise(z.array(secretSummarySchema))
+    }),
+});
+export const LoadSecretsLayoutDataInputSchema = z.object({
+    user: z.union([z.object({
+            id: z.string(),
+            isSuperuser: z.boolean().optional(),
+        }), z.null()]),
+    scope: z.union([secretScopeSchema, z.null()]),
+    scopeId: z.union([z.string(), z.null()]).optional(),
+    fetchers: SecretsLayoutFetchersSchema,
+    limit: z.number().optional(),
+});
+//# sourceMappingURL=layout.schema.js.map

package/dist/schemas/ui/svelte/layout.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/layout.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;gBAClB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;gBAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC5B,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;KACpD,CAAC;CACF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,QAAQ,EAAE,2BAA2B;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC"}

package/dist/schemas/ui/svelte/state.schema.d.ts

@@ -0,0 +1,59 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { type AccountSecretsClient } from '../../managed/account-client.schema.ts';
+export declare const secretsStateInitDataSchema: z.ZodObject<{
+    accountOrigin: z.ZodOptional<z.ZodString>;
+    authorization: z.ZodOptional<z.ZodString>;
+    filter: z.ZodOptional<z.ZodObject<{
+        scope: z.ZodOptional<z.ZodEnum<{
+            user: "user";
+            env: "env";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>>;
+        scopeId: z.ZodOptional<z.ZodString>;
+        providerType: z.ZodOptional<z.ZodString>;
+        limit: z.ZodOptional<z.ZodNumber>;
+        offset: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    initialSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        scope: z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>;
+        scopeId: z.ZodString;
+        providerType: z.ZodString;
+        createdAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        updatedAt: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        lastRotatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>>>;
+        rotationPolicy: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            manual: "manual";
+            monthly: "monthly";
+            quarterly: "quarterly";
+            yearly: "yearly";
+        }>>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>>;
+    }, z.core.$strip>>>;
+    activeBackend: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        user: "user";
+        env: "env";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>>>;
+}, z.core.$strip>;
+/** Host and client references keep their owner's callable contract and receiver. */
+export type SecretsStateInitOptions = z.infer<typeof secretsStateInitDataSchema> & {
+    runtime?: VibesRuntime | null;
+    client?: AccountSecretsClient;
+};
+/** Preserve the caller's object identity; a symbol has no surface lifetime to own an adapter. */
+export declare const secretsStateScopeSchema: z.ZodCustom<object, object>;
+//# sourceMappingURL=state.schema.d.ts.map

package/dist/schemas/ui/svelte/state.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/state.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAA8C,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAG/H,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMrC,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,GAAG;IAClF,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,6BAEnC,CAAC"}

package/dist/schemas/ui/svelte/state.schema.js

@@ -0,0 +1,13 @@
+import * as z from 'zod/v4';
+import { listSecretsFilterSchema, secretSummarySchema } from "../../managed/account-client.schema.js";
+import { secretScopeSchema } from "../../managed/secret.schema.js";
+export const secretsStateInitDataSchema = z.object({
+    accountOrigin: z.string().optional(),
+    authorization: z.string().optional(),
+    filter: listSecretsFilterSchema.optional(),
+    initialSecrets: z.array(secretSummarySchema).optional(),
+    activeBackend: secretScopeSchema.nullable().optional()
+});
+/** Preserve the caller's object identity; a symbol has no surface lifetime to own an adapter. */
+export const secretsStateScopeSchema = z.custom(value => z.union([z.object({}), z.function()]).safeParse(value).success);
+//# sourceMappingURL=state.schema.js.map

package/dist/schemas/ui/svelte/state.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/svelte/state.schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAC,mBAAmB,EAA4B,MAAM,wCAAwC,CAAC;AAC/H,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACvD,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAQH,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAA2B,KAAK,CAAC,EAAE,CACjF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAC9D,CAAC"}

package/dist/schemas/ui/tui/list.schema.d.ts

@@ -0,0 +1,45 @@
+import * as z from 'zod/v4';
+export declare const SecretDescriptorEntrySchema: z.ZodReadonly<z.ZodObject<{
+    id: z.ZodString;
+    key: z.ZodString;
+    source: z.ZodString;
+    hasValue: z.ZodBoolean;
+    backend: z.ZodString;
+    backendId: z.ZodString;
+    tier: z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>;
+}, z.core.$strip>>;
+export type SecretDescriptorEntry = z.infer<typeof SecretDescriptorEntrySchema>;
+export declare const SecretsListStateSchema: z.ZodObject<{
+    environment: z.ZodString;
+    tier: z.ZodNullable<z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>>;
+    secrets: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+        id: z.ZodString;
+        key: z.ZodString;
+        source: z.ZodString;
+        hasValue: z.ZodBoolean;
+        backend: z.ZodString;
+        backendId: z.ZodString;
+        tier: z.ZodEnum<{
+            local: "local";
+            dev: "dev";
+            staging: "staging";
+            production: "production";
+        }>;
+    }, z.core.$strip>>>>;
+    loaded: z.ZodBoolean;
+    loading: z.ZodBoolean;
+    error: z.ZodNullable<z.ZodString>;
+    lastUpdated: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type SecretsListState = z.infer<typeof SecretsListStateSchema>;
+//# sourceMappingURL=list.schema.d.ts.map

package/dist/schemas/ui/tui/list.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/list.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;kBAU5B,CAAC;AAEb,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/ui/tui/list.schema.js

@@ -0,0 +1,23 @@
+import * as z from 'zod/v4';
+import { EnvironmentTierSchema, SecretsBackendSchema } from "../../../domain/kinds/schemas/store.schema.js";
+export const SecretDescriptorEntrySchema = z
+    .object({
+    id: z.string(),
+    key: z.string(),
+    source: z.string(),
+    hasValue: z.boolean(),
+    backend: SecretsBackendSchema,
+    backendId: z.string(),
+    tier: EnvironmentTierSchema
+})
+    .readonly();
+export const SecretsListStateSchema = z.object({
+    environment: z.string(),
+    tier: EnvironmentTierSchema.nullable(),
+    secrets: z.array(SecretDescriptorEntrySchema).readonly(),
+    loaded: z.boolean(),
+    loading: z.boolean(),
+    error: z.string().nullable(),
+    lastUpdated: z.number().nullable()
+});
+//# sourceMappingURL=list.schema.js.map

package/dist/schemas/ui/tui/list.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/list.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAC,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAE3G,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,OAAO,EAAE,oBAAoB;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,qBAAqB;CAC3B,CAAC;KACD,QAAQ,EAAE,CAAC;AAIb,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IACxD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/schemas/ui/tui/metadata.schema.d.ts

@@ -0,0 +1,20 @@
+import * as z from 'zod/v4';
+export declare const SecretMetadataPanePropsSchema: z.ZodObject<{
+    entry: z.ZodUnion<readonly [z.ZodReadonly<z.ZodObject<{
+        id: z.ZodString;
+        key: z.ZodString;
+        source: z.ZodString;
+        hasValue: z.ZodBoolean;
+        backend: z.ZodString;
+        backendId: z.ZodString;
+        tier: z.ZodEnum<{
+            local: "local";
+            dev: "dev";
+            staging: "staging";
+            production: "production";
+        }>;
+    }, z.core.$strip>>, z.ZodNull]>;
+    environment: z.ZodString;
+}, z.core.$strip>;
+export type SecretMetadataPaneProps = z.infer<typeof SecretMetadataPanePropsSchema>;
+//# sourceMappingURL=metadata.schema.d.ts.map

package/dist/schemas/ui/tui/metadata.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/metadata.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/ui/tui/metadata.schema.js

@@ -0,0 +1,7 @@
+import * as z from 'zod/v4';
+import { SecretDescriptorEntrySchema } from "./list.schema.js";
+export const SecretMetadataPanePropsSchema = z.object({
+    entry: z.union([SecretDescriptorEntrySchema, z.null()]),
+    environment: z.string(),
+});
+//# sourceMappingURL=metadata.schema.js.map

package/dist/schemas/ui/tui/metadata.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/metadata.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC"}

package/dist/schemas/ui/tui/pane.schema.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/v4';
+export declare const SecretsListPanePropsSchema: z.ZodObject<{
+    entries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+        id: z.ZodString;
+        key: z.ZodString;
+        source: z.ZodString;
+        hasValue: z.ZodBoolean;
+        backend: z.ZodString;
+        backendId: z.ZodString;
+        tier: z.ZodEnum<{
+            local: "local";
+            dev: "dev";
+            staging: "staging";
+            production: "production";
+        }>;
+    }, z.core.$strip>>>>;
+    totalCount: z.ZodNumber;
+    filter: z.ZodString;
+    onFilterChange: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+    selectedId: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
+    onSelect: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+}, z.core.$strip>;
+export type SecretsListPaneProps = z.infer<typeof SecretsListPanePropsSchema>;
+//# sourceMappingURL=pane.schema.d.ts.map

package/dist/schemas/ui/tui/pane.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/pane.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;iBAOrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/ui/tui/pane.schema.js

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+import { SecretDescriptorEntrySchema } from "./list.schema.js";
+export const SecretsListPanePropsSchema = z.object({
+    entries: z.array(SecretDescriptorEntrySchema).readonly(),
+    totalCount: z.number(),
+    filter: z.string(),
+    onFilterChange: z.function({ input: [z.string()], output: z.void() }),
+    selectedId: z.union([z.string(), z.null()]),
+    onSelect: z.function({ input: [z.string()], output: z.void() }),
+});
+//# sourceMappingURL=pane.schema.js.map

package/dist/schemas/ui/tui/pane.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane.schema.js","sourceRoot":"","sources":["../../../../src/schemas/ui/tui/pane.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;CAC/D,CAAC,CAAC"}

package/dist/support/credential-signatures.d.ts

@@ -0,0 +1,17 @@
+import { type SecretFinding, type SecretPattern } from "../schemas/discovery/signatures.schema.ts";
+export { type SecretFinding, type SecretPattern } from "../schemas/discovery/signatures.schema.ts";
+/**
+ * Live-credential signatures.
+ *
+ * Only prefixes distinctive enough to be a credential and nothing else. A
+ * shape like a bare 40-char hex string (Cloudflare) or an AWS *secret* key has
+ * no marker, so matching it would flag hashes and base64 blobs and train
+ * everyone to bypass the hook — a scanner people disable protects nothing.
+ *
+ * Test-mode keys (`sk_test_`) are deliberately absent: they are publishable by
+ * design, and blocking them is the noise that gets a guard turned off.
+ */
+export declare const SECRET_PATTERNS: readonly SecretPattern[];
+/** Pure: scan one file's text. Exported so the signature set is testable without git or a filesystem. */
+export declare function scanTextForSecretPatterns(file: string, content: string): SecretFinding[];
+//# sourceMappingURL=credential-signatures.d.ts.map

package/dist/support/credential-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-signatures.d.ts","sourceRoot":"","sources":["../../src/support/credential-signatures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAC,KAAK,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,KAAK,aAAa,EAAC,KAAK,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAGlG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EA2BnD,CAAC;AAEF,yGAAyG;AACzG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAcxF"}

package/dist/support/credential-signatures.js

@@ -0,0 +1,58 @@
+import {} from "../schemas/discovery/signatures.schema.js";
+export {} from "../schemas/discovery/signatures.schema.js";
+/**
+ * Live-credential signatures.
+ *
+ * Only prefixes distinctive enough to be a credential and nothing else. A
+ * shape like a bare 40-char hex string (Cloudflare) or an AWS *secret* key has
+ * no marker, so matching it would flag hashes and base64 blobs and train
+ * everyone to bypass the hook — a scanner people disable protects nothing.
+ *
+ * Test-mode keys (`sk_test_`) are deliberately absent: they are publishable by
+ * design, and blocking them is the noise that gets a guard turned off.
+ */
+export const SECRET_PATTERNS = [
+    // Anthropic and OpenAI were MISSING while this platform's primary keys are
+    // exactly these two. A staged `sk-ant-api03-…` passed the check silently.
+    { pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{24,}/, name: 'Anthropic API key (sk-ant-api)' },
+    { pattern: /sk-ant-admin\d{2}-[A-Za-z0-9_-]{24,}/, name: 'Anthropic admin key (sk-ant-admin)' },
+    { pattern: /sk-proj-[A-Za-z0-9_-]{24,}/, name: 'OpenAI project key (sk-proj-)' },
+    { pattern: /sk-svcacct-[A-Za-z0-9_-]{24,}/, name: 'OpenAI service-account key (sk-svcacct-)' },
+    { pattern: /sk-[A-Za-z0-9]{48}/, name: 'OpenAI legacy secret key (sk-)' },
+    { pattern: /fw_[A-Za-z0-9]{24,}/, name: 'Fireworks API key (fw_)' },
+    { pattern: /gsk_[A-Za-z0-9]{40,}/, name: 'Groq API key (gsk_)' },
+    { pattern: /r8_[A-Za-z0-9]{35,}/, name: 'Replicate API token (r8_)' },
+    { pattern: /hf_[A-Za-z0-9]{30,}/, name: 'Hugging Face token (hf_)' },
+    { pattern: /AIza[0-9A-Za-z_-]{35}/, name: 'Google API key (AIza)' },
+    { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/, name: 'Slack token (xox*)' },
+    { pattern: /npm_[A-Za-z0-9]{36}/, name: 'npm access token (npm_)' },
+    { pattern: /sk_live_[a-zA-Z0-9]{24,}/, name: 'Stripe live secret key (sk_live_)' },
+    { pattern: /rk_live_[a-zA-Z0-9]{24,}/, name: 'Stripe live restricted key (rk_live_)' },
+    { pattern: /pk_live_[a-zA-Z0-9]{24,}/, name: 'Stripe live public key (pk_live_)' },
+    { pattern: /do_[a-zA-Z0-9]{32,}/, name: 'DigitalOcean API key (do_)' },
+    { pattern: /dop_v1_[a-f0-9]{64}/, name: 'DigitalOcean personal token (dop_v1_)' },
+    { pattern: /AKIA[a-zA-Z0-9]{16,}/, name: 'AWS access key ID (AKIA)' },
+    { pattern: /gh[pousr]_[A-Za-z0-9]{36}/, name: 'GitHub token (ghp_/gho_/ghu_/ghs_/ghr_)' },
+    { pattern: /github_pat_[A-Za-z0-9_]{60,}/, name: 'GitHub fine-grained PAT (github_pat_)' },
+    {
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/,
+        name: 'Private key block'
+    }
+];
+/** Pure: scan one file's text. Exported so the signature set is testable without git or a filesystem. */
+export function scanTextForSecretPatterns(file, content) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index] ?? '';
+        for (const { pattern, name } of SECRET_PATTERNS) {
+            const match = pattern.exec(line);
+            if (match) {
+                findings.push({ file, name, lineNumber: index + 1, matchLength: match[0].length });
+                break;
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=credential-signatures.js.map

package/dist/support/credential-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-signatures.js","sourceRoot":"","sources":["../../src/support/credential-signatures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAyC,MAAM,2CAA2C,CAAC;AAGlG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6B;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACzF,EAAE,OAAO,EAAE,sCAAsC,EAAE,IAAI,EAAE,oCAAoC,EAAE;IAC/F,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,+BAA+B,EAAE;IAChF,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,0CAA0C,EAAE;IAC9F,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACzE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnE,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAChE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACrE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpE,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACnE,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACvE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnE,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAClF,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,uCAAuC,EAAE;IACtF,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAClF,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACrE,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,yCAAyC,EAAE;IACzF,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,uCAAuC,EAAE;IAC1F;QACC,OAAO,EAAE,6DAA6D;QACtE,IAAI,EAAE,mBAAmB;KACzB;CACD,CAAC;AAEF,yGAAyG;AACzG,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAC,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,eAAe,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnF,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/support/environment.d.ts

@@ -0,0 +1,19 @@
+import { type EnvironmentSelectionRuntime, type ResolvedSecretsEnvironment, type SecretsEnvironmentReporter } from "../schemas/execution/environment.schema.ts";
+export { type EnvironmentSelectionRuntime, type ResolvedSecretsEnvironment, type SecretsEnvironmentReporter } from "../schemas/execution/environment.schema.ts";
+/**
+ * Resolve the active secrets environment of the runtime the caller was
+ * handed, without depending on any UI surface.
+ *
+ * D1/RC04: the tier is the runtime's own declared
+ * `scope.qualifiers.environmentTier` (fails closed `tier-undeclared`, never a
+ * silent `'local'` default). An `--environment` override is call data naming
+ * one tier (`local`/`dev`/`staging`/`production`, rc04-design §2.2); anything
+ * else is refused `INVALID_INPUT` `scope-invalid`. The deleted
+ * `config/environment` catalog lookup for custom names answered the *current*
+ * selection's tier, not the named one; custom environment ids move through
+ * `vibes config migrate --map` (rc04-design §2.6), never a runtime lookup.
+ */
+export declare function resolveSecretsEnvironment(runtime: EnvironmentSelectionRuntime, environmentOverride?: string): Promise<ResolvedSecretsEnvironment>;
+/** @deprecated The reporter argument is ignored; call `resolveSecretsEnvironment(runtime, environmentOverride?)`. */
+export declare function resolveSecretsEnvironment(runtime: EnvironmentSelectionRuntime, reporter: SecretsEnvironmentReporter | null | undefined, environmentOverride?: string): Promise<ResolvedSecretsEnvironment>;
+//# sourceMappingURL=environment.d.ts.map

package/dist/support/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/support/environment.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,2BAA2B,EAAC,KAAK,0BAA0B,EAAC,KAAK,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC9J,OAAO,EAAE,KAAK,2BAA2B,EAAC,KAAK,0BAA0B,EAAC,KAAK,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkB9J;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,EACpC,mBAAmB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACvC,qHAAqH;AACrH,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,EACpC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,GAAG,SAAS,EACvD,mBAAmB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,0BAA0B,CAAC,CAAC"}

package/dist/support/environment.js

@@ -0,0 +1,28 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { EnvironmentTierSchema } from "../domain/kinds/store.schema.js";
+import {} from "../schemas/execution/environment.schema.js";
+export {} from "../schemas/execution/environment.schema.js";
+function isEnvironmentTier(value) {
+    return EnvironmentTierSchema.safeParse(value).success;
+}
+function declaredTier(runtime) {
+    const tier = runtime.scope.qualifiers.environmentTier;
+    if (!isEnvironmentTier(tier)) {
+        throw new CapabilityError('No environment tier is declared, so the active secrets environment cannot be resolved.', 'INTERNAL', { reason: 'tier-undeclared' });
+    }
+    return tier;
+}
+export async function resolveSecretsEnvironment(runtime, overrideOrReporter, legacyOverride) {
+    const named = z.string().safeParse(overrideOrReporter);
+    const environmentOverride = named.success ? named.data : legacyOverride;
+    if (environmentOverride !== undefined) {
+        if (!isEnvironmentTier(environmentOverride)) {
+            throw new CapabilityError(`Secrets environment '${environmentOverride}' is not a tier; use one of ${EnvironmentTierSchema.options.join(', ')}.`, 'INVALID_INPUT', { reason: 'scope-invalid', details: { environment: environmentOverride } });
+        }
+        return { name: environmentOverride, tier: environmentOverride };
+    }
+    const tier = declaredTier(runtime);
+    return { name: tier, tier };
+}
+//# sourceMappingURL=environment.js.map

package/dist/support/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/support/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAuB,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAoG,MAAM,4CAA4C,CAAC;AAC9J,OAAO,EAAoG,MAAM,4CAA4C,CAAC;AAE9J,SAAS,iBAAiB,CAAC,KAAyB;IACnD,OAAO,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,OAAoC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;IACtD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CACxB,wFAAwF,EACxF,UAAU,EACV,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAoC,EACpC,kBAA+D,EAC/D,cAAuB;IAEvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACxE,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CACxB,wBAAwB,mBAAmB,+BAA+B,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACrH,eAAe,EACf,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,CAC1E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/support/file-failure.d.ts

@@ -0,0 +1,16 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+import { type Outcome } from "../schemas/transport/outcome.schema.ts";
+export { type Outcome } from "../schemas/transport/outcome.schema.ts";
+/** Run `operation` once and carry what it threw as a value, so each caller decides on the failure it holds. */
+export declare function outcomeOf<T>(operation: () => Promise<T>): Promise<Outcome<T>>;
+/** `outcomeOf` for a synchronous operation. */
+export declare function attemptOf<T>(operation: () => T): Outcome<T>;
+/**
+ * The host errno (`ENOENT`, `EACCES`, ...) a caught filesystem failure carries,
+ * parsed rather than cast; `undefined` for a failure with no code (a typed
+ * `CapabilityError` carries its own `code`, which is never an errno).
+ */
+export declare function errnoOf(failure: CaughtFailure): string | undefined;
+/** Confirmed absence of the entry: the one failure a store may read as "nothing there". */
+export declare function isAbsentEntry(failure: CaughtFailure): boolean;
+//# sourceMappingURL=file-failure.d.ts.map

package/dist/support/file-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-failure.d.ts","sourceRoot":"","sources":["../../src/support/file-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAKtE,+GAA+G;AAC/G,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAMnF;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAM3D;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAE7D"}

package/dist/support/file-failure.js

@@ -0,0 +1,38 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import {} from "../schemas/transport/outcome.schema.js";
+export {} from "../schemas/transport/outcome.schema.js";
+/** A host failure's errno code; nothing else about the native error is read. */
+const NativeFailureSchema = z.object({ code: z.string().max(64).regex(/^[A-Z][A-Z0-9_]+$/) });
+/** Run `operation` once and carry what it threw as a value, so each caller decides on the failure it holds. */
+export async function outcomeOf(operation) {
+    try {
+        return { ok: true, value: await operation() };
+    }
+    catch (thrown) {
+        return { ok: false, failure: CaughtFailureSchema.parse(thrown) };
+    }
+}
+/** `outcomeOf` for a synchronous operation. */
+export function attemptOf(operation) {
+    try {
+        return { ok: true, value: operation() };
+    }
+    catch (thrown) {
+        return { ok: false, failure: CaughtFailureSchema.parse(thrown) };
+    }
+}
+/**
+ * The host errno (`ENOENT`, `EACCES`, ...) a caught filesystem failure carries,
+ * parsed rather than cast; `undefined` for a failure with no code (a typed
+ * `CapabilityError` carries its own `code`, which is never an errno).
+ */
+export function errnoOf(failure) {
+    const parsed = NativeFailureSchema.safeParse(failure);
+    return parsed.success ? parsed.data.code : undefined;
+}
+/** Confirmed absence of the entry: the one failure a store may read as "nothing there". */
+export function isAbsentEntry(failure) {
+    return errnoOf(failure) === 'ENOENT';
+}
+//# sourceMappingURL=file-failure.js.map

package/dist/support/file-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-failure.js","sourceRoot":"","sources":["../../src/support/file-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAgB,MAAM,wCAAwC,CAAC;AAEtE,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;AAE9F,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,SAA2B;IAC7D,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;AACF,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAI,SAAkB;IAC9C,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,OAAsB;IAC7C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,OAAsB;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACtC,CAAC"}