@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/surfaces/cli/commands/store/reveal.command.descriptor.js

@@ -0,0 +1,38 @@
+/**
+ * `vibes secrets reveal <key>` — reveal a single secret value.
+ *
+ * Per the working-memory note, `vibes secrets export` is broken and the
+ * canonical one-off access path is `vibes secrets reveal KEY --force`.
+ * The value is written to STDOUT exactly once so scripts can capture it
+ * via `$(vibes secrets reveal KEY --force)`; notice + audit messaging
+ * stays on STDERR.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const revealCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'secrets.reveal',
+    name: 'reveal',
+    description: 'Reveal a single secret value to STDOUT (audited)',
+    group: 'secrets',
+    arguments: [
+        { name: 'key', description: 'Secret key to reveal', required: true }
+    ],
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--backend <id>', description: 'Read from a specific backend' },
+        { flags: '--force', description: 'Skip the confirmation prompt; the only override (required without a terminal)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 20,
+    examples: [
+        {
+            command: 'vibes secrets reveal VIBES_AUTH_SECRET --force',
+            description: 'Print the value of VIBES_AUTH_SECRET (no prompt)',
+            expectExit: 0
+        }
+    ]
+});
+export default revealCommandDescriptor;
+//# sourceMappingURL=reveal.command.descriptor.js.map

package/dist/surfaces/cli/commands/store/reveal.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.command.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;IACzD,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE;KACpE;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE;QACxE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,+EAA+E,EAAE;KAClH;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,gDAAgD;YACzD,WAAW,EAAE,kDAAkD;YAC/D,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,uBAAuB,CAAC"}

package/dist/surfaces/cli/commands/store/reveal.command.impl.d.ts

@@ -0,0 +1,10 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type RevealArgs, type RevealOptionsInput } from "../../../../schemas/cli/commands/store/reveal.schema.ts";
+export { revealArgsSchema, revealOptionsSchema, type RevealArgs, type RevealOptionsInput } from "../../../../schemas/cli/commands/store/reveal.schema.ts";
+export { emitAudit, logger, tryCheckKeyInListing } from "./reveal-audit.ts";
+export declare function execute(args: RevealArgs, opts: RevealOptionsInput, commandContext: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=reveal.command.impl.d.ts.map

package/dist/surfaces/cli/commands/store/reveal.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.command.impl.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAuC,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,yDAAyD,CAAC;AAEvJ,OAAO,EAAE,gBAAgB,EAAC,mBAAmB,EAAC,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,yDAAyD,CAAC;AACvJ,OAAO,EAAE,SAAS,EAAC,MAAM,EAAC,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AA6C1E,wBAAsB,OAAO,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmHf;;;;AAED,wBAA2B"}

package/dist/surfaces/cli/commands/store/reveal.command.impl.js

@@ -0,0 +1,147 @@
+import { revealArgsSchema, revealOptionsSchema } from "../../../../schemas/cli/commands/store/reveal.schema.js";
+import { emitAudit, logger, tryCheckKeyInListing } from "./reveal-audit.js";
+export { revealArgsSchema, revealOptionsSchema } from "../../../../schemas/cli/commands/store/reveal.schema.js";
+export { emitAudit, logger, tryCheckKeyInListing } from "./reveal-audit.js";
+/**
+ * `vibes secrets reveal <key>` implementation.
+ *
+ * Security contract:
+ *   - The value is printed to STDOUT exactly once.
+ *   - Audit + notice text goes to STDERR, never to STDOUT, so consumers
+ *     capturing the output via `$(...)` get a clean value.
+ *   - The value is NEVER passed through console.log or any logger.
+ *   - Confirmation is required when running on a real TTY unless --force is
+ *     passed. `--force` is the only override: no environment variable (an
+ *     agent can set one) and no `--yes` alias toggles this safety gate (S26).
+ *   - When NOT running on a TTY (agents, scripts, CI), the reveal is REFUSED
+ *     unless --force is passed. A bare, non-interactive
+ *     `$(vibes secrets reveal KEY)` is the banned injection-bypass pattern (see
+ *     request.command.descriptor.ts): it must fail loudly, not silently print a
+ *     live secret to stdout with no human in the loop. Automation should prefer
+ *     `vibes secrets exec` / `vibes secrets request`, where the value never
+ *     touches stdout.
+ *   - The key is validated (`assertSecretKey`) before any store is resolved,
+ *     and every line goes through the handed runtime's `runtime/stdio`.
+ *
+ * Exit codes (all through `requestCLIExit`): 0 = revealed (or interactive
+ * cancel), 1 = key not set, 2 = key set but the backend is write-only and
+ * cannot return the value (e.g. Cloudflare Secrets Store), 3 = reveal refused
+ * (non-interactive without an explicit override). Every other refusal (bad
+ * key, unknown or ambiguous store, a store failure) is a typed
+ * `CapabilityError`.
+ */
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { assertSecretKey } from "../../../../domain/kinds/secret-key.js";
+import { outcomeOf } from "../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../environment.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { secretsTerminal } from "../../shared/output/terminal-facts.js";
+import { resolveUI } from "../../shared/output/ui-context.js";
+import { parseCommandInput } from "../../shared/parse-options.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore, typedStoreFailure } from "../../shared/stores/store-selection.js";
+export async function execute(args, opts, commandContext) {
+    const { runtime } = commandContext;
+    const out = await openCommandOutput(runtime);
+    const parsedArgs = parseCommandInput(revealArgsSchema, args, 'reveal');
+    const options = parseCommandInput(revealOptionsSchema, opts, 'reveal');
+    const key = parsedArgs.key;
+    if (!key) {
+        out.warn('Usage: vibes secrets reveal <KEY>');
+        requestCLIExit(1);
+    }
+    // The key is checked before any store is resolved or read; a refusal never carries it.
+    assertSecretKey(key);
+    // An unregistered kind, an unregistered `--backend`, a tied tier and a tier with no store are typed refusals.
+    const descriptors = listStoreDescriptors(runtime);
+    const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+    const target = selectStore(descriptors, envTier, options.backend);
+    const impl = await resolveStoreImplementation(runtime, target.id);
+    const read = await outcomeOf(() => impl.get(envName, key));
+    if (!read.ok)
+        throw typedStoreFailure(read.failure, 'read', target.id);
+    const value = read.value;
+    if (value === undefined) {
+        // get() returning undefined is ambiguous: the key may be absent, or the
+        // backend may be write-only (e.g. Cloudflare Secrets Store, whose API
+        // never returns values). Consult the same listing `vibes secrets list`
+        // uses to tell the two apart.
+        const listingResult = await tryCheckKeyInListing(impl, envName, key);
+        let keyExistsInListing = false;
+        if (listingResult.ok) {
+            keyExistsInListing = listingResult.exists;
+        }
+        else {
+            logger.warn('Could not verify key presence via listing', {
+                key,
+                error: listingResult.error
+            });
+            const msg = listingResult.error instanceof Error
+                ? listingResult.error.message
+                : String(listingResult.error);
+            out.warn(`[REVEAL] Could not verify key presence via listing (${msg}); reporting as not set.`);
+        }
+        if (keyExistsInListing) {
+            out.warn(`[REVEAL] Secret "${key}" IS set in environment "${envName}", but backend "${target.id}" is write-only — stored values cannot be read back.\n` +
+                `Rotate the secret (vibes secrets set ${key}) if you need to know its value.`);
+            emitAudit(out, {
+                key,
+                environment: envName,
+                backend: target.id,
+                outcome: 'failure',
+                reason: 'value_unreadable'
+            });
+            requestCLIExit(2);
+        }
+        out.warn(`[REVEAL] Secret "${key}" is not set in environment "${envName}" (backend: ${target.id}).\n` +
+            `If a routine captured this via $(vibes secrets reveal ${key}), it received an empty string.`);
+        emitAudit(out, { key, environment: envName, backend: target.id, outcome: 'failure', reason: 'not_set' });
+        requestCLIExit(1);
+    }
+    if (value === '') {
+        // Legitimately-stored empty value: warn on stderr but DO NOT fail —
+        // preserve callers that intentionally read empty secrets. stdout still
+        // receives exactly the (empty) value below.
+        out.warn(`[REVEAL] Secret "${key}" is set to an empty value.`);
+    }
+    const terminal = secretsTerminal(runtime);
+    const interactive = terminal.stdinIsTerminal && terminal.stderrIsTerminal;
+    if (!options.force) {
+        if (!interactive) {
+            // Non-interactive reveal without an explicit override is the banned
+            // `$(vibes secrets reveal KEY)` injection-bypass pattern: it would print a
+            // live secret to stdout with no human in the loop. Previously this branch
+            // SKIPPED the confirmation and revealed silently — the safety gate protected
+            // only the human-present case and waved through the more dangerous
+            // human-absent one. Refuse loudly instead. Automation that genuinely needs
+            // the raw value must opt in with --force;
+            // agents should use `vibes secrets exec` / `vibes secrets request`, where the
+            // value never touches stdout.
+            out.warn(`\n[REVEAL] Refusing to reveal "${key}" without a terminal.\n` +
+                `A non-interactive $(vibes secrets reveal ${key}) is the banned injection-bypass pattern.\n` +
+                `Use \`vibes secrets exec\` or \`vibes secrets request\` to leverage the value without printing it, ` +
+                `or pass --force to explicitly reveal in automation.`);
+            emitAudit(out, {
+                key,
+                environment: envName,
+                backend: target.id,
+                outcome: 'failure',
+                reason: 'refused_noninteractive'
+            });
+            requestCLIExit(3);
+        }
+        // The terminal's own prompt reads the answer: stdin is neither consumed
+        // here nor destroyed by an early break out of its iterator.
+        const ui = await resolveUI(runtime);
+        const confirmed = await ui.confirm(`About to reveal secret "${key}" to terminal. Continue?`, false);
+        if (!confirmed) {
+            out.warn('Reveal cancelled.');
+            requestCLIExit(0);
+        }
+    }
+    emitAudit(out, { key, environment: envName, backend: target.id, outcome: 'success' });
+    // Value goes to STDOUT once; nothing else does.
+    out.line(value);
+    out.warn(`\n[REVEAL] ${key} revealed (logged to audit trail).`);
+}
+export default { execute };
+//# sourceMappingURL=reveal.command.impl.js.map

package/dist/surfaces/cli/commands/store/reveal.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/reveal.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAC,mBAAmB,EAA0C,MAAM,yDAAyD,CAAC;AACvJ,OAAO,EAAE,SAAS,EAAC,MAAM,EAAC,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAC,mBAAmB,EAA0C,MAAM,yDAAyD,CAAC;AACvJ,OAAO,EAAE,SAAS,EAAC,MAAM,EAAC,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EAChB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAgB,EAChB,IAAwB,EACxB,cAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC9C,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,uFAAuF;IACvF,eAAe,CAAC,GAAG,CAAC,CAAC;IAErB,8GAA8G;IAC9G,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACxD,GAAG;gBACH,KAAK,EAAE,aAAa,CAAC,KAAK;aAC1B,CAAC,CAAC;YACH,MAAM,GAAG,GACR,aAAa,CAAC,KAAK,YAAY,KAAK;gBACnC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO;gBAC7B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,uDAAuD,GAAG,0BAA0B,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,kBAAkB,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CACP,oBAAoB,GAAG,4BAA4B,OAAO,mBAAmB,MAAM,CAAC,EAAE,wDAAwD;gBAC9I,wCAAwC,GAAG,kCAAkC,CAC7E,CAAC;YACF,SAAS,CAAC,GAAG,EAAE;gBACd,GAAG;gBACH,WAAW,EAAE,OAAO;gBACpB,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,kBAAkB;aAC1B,CAAC,CAAC;YACH,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,GAAG,CAAC,IAAI,CACP,oBAAoB,GAAG,gCAAgC,OAAO,eAAe,MAAM,CAAC,EAAE,MAAM;YAC5F,yDAAyD,GAAG,iCAAiC,CAC7F,CAAC;QACF,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAClB,oEAAoE;QACpE,uEAAuE;QACvE,4CAA4C;QAC5C,GAAG,CAAC,IAAI,CAAC,oBAAoB,GAAG,6BAA6B,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,gBAAgB,CAAC;IAE1E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,6EAA6E;YAC7E,mEAAmE;YACnE,2EAA2E;YAC3E,0CAA0C;YAC1C,8EAA8E;YAC9E,8BAA8B;YAC9B,GAAG,CAAC,IAAI,CACP,kCAAkC,GAAG,yBAAyB;gBAC9D,4CAA4C,GAAG,6CAA6C;gBAC5F,qGAAqG;gBACrG,qDAAqD,CACrD,CAAC;YACF,SAAS,CAAC,GAAG,EAAE;gBACd,GAAG;gBACH,WAAW,EAAE,OAAO;gBACpB,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,wBAAwB;aAChC,CAAC,CAAC;YACH,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,GAAG,0BAA0B,EAAE,KAAK,CAAC,CAAC;QACpG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC9B,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;IAED,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAEtF,gDAAgD;IAChD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,CAAC;AACjE,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/commands/store/secrets.list.command.descriptor.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `vibes secrets list` — list secret descriptors registered for the current
+ * environment.
+ *
+ * IMPORTANT: this command lists DESCRIPTORS (key, source, hasValue) — it
+ * NEVER prints secret values. Use `vibes secrets reveal <key>` for that.
+ */
+export declare const listCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "secrets.list";
+    /**
+     * Cross-surface operation identity — the same list-descriptors-only
+     * operation the secrets TUI projects via its `secrets.list` tui/state
+     * slice. Tracked by `scripts/check-capability-parity.ts`.
+     */
+    readonly capabilityId: "secrets.list";
+    readonly name: "list";
+    readonly description: "List secret keys for the current environment (no values)";
+    readonly group: "secrets";
+    readonly arguments: [];
+    readonly options: [{
+        readonly flags: "--environment <name>";
+        readonly description: "Target environment (default: current)";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Filter to a specific backend";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 10;
+    readonly examples: [{
+        readonly command: "vibes secrets list";
+        readonly description: "List secret keys for the current environment";
+        readonly expectExit: 0;
+        readonly slow: true;
+    }, {
+        readonly command: "vibes secrets list --json";
+        readonly description: "Emit secret descriptors as JSON (no values)";
+        readonly expectExit: 0;
+        readonly slow: true;
+    }];
+};
+export default listCommandDescriptor;
+//# sourceMappingURL=secrets.list.command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/store/secrets.list.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.list.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/secrets.list.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,eAAO,MAAM,qBAAqB;;;IAGjC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BF,CAAC;AAEH,eAAe,qBAAqB,CAAC"}

package/dist/surfaces/cli/commands/store/secrets.list.command.descriptor.js

@@ -0,0 +1,46 @@
+/**
+ * `vibes secrets list` — list secret descriptors registered for the current
+ * environment.
+ *
+ * IMPORTANT: this command lists DESCRIPTORS (key, source, hasValue) — it
+ * NEVER prints secret values. Use `vibes secrets reveal <key>` for that.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const listCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'secrets.list',
+    /**
+     * Cross-surface operation identity — the same list-descriptors-only
+     * operation the secrets TUI projects via its `secrets.list` tui/state
+     * slice. Tracked by `scripts/check-capability-parity.ts`.
+     */
+    capabilityId: 'secrets.list',
+    name: 'list',
+    description: 'List secret keys for the current environment (no values)',
+    group: 'secrets',
+    arguments: [],
+    options: [
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--backend <id>', description: 'Filter to a specific backend' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 10,
+    examples: [
+        {
+            command: 'vibes secrets list',
+            description: 'List secret keys for the current environment',
+            expectExit: 0,
+            slow: true
+        },
+        {
+            command: 'vibes secrets list --json',
+            description: 'Emit secret descriptors as JSON (no values)',
+            expectExit: 0,
+            slow: true
+        }
+    ]
+});
+export default listCommandDescriptor;
+//# sourceMappingURL=secrets.list.command.descriptor.js.map

package/dist/surfaces/cli/commands/store/secrets.list.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.list.command.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/secrets.list.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;IACvD,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB;;;;OAIG;IACH,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,0DAA0D;IACvE,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE;KACxE;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,8CAA8C;YAC3D,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,IAAI;SACV;QACD;YACC,OAAO,EAAE,2BAA2B;YACpC,WAAW,EAAE,6CAA6C;YAC1D,UAAU,EAAE,CAAC;YACb,IAAI,EAAE,IAAI;SACV;KACD;CACD,CAAC,CAAC;AAEH,eAAe,qBAAqB,CAAC"}

package/dist/surfaces/cli/commands/store/secrets.list.command.impl.d.ts

@@ -0,0 +1,9 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type ListArgs, type ListOptionsInput } from "../../../../schemas/cli/commands/store/list.schema.ts";
+export { listOptionsSchema, type ListArgs, type ListOptionsInput } from "../../../../schemas/cli/commands/store/list.schema.ts";
+export declare function execute(_args: ListArgs, opts: ListOptionsInput, commandContext: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=secrets.list.command.impl.d.ts.map

package/dist/surfaces/cli/commands/store/secrets.list.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.list.command.impl.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/secrets.list.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAoB,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,uDAAuD,CAAC;AAC9H,OAAO,EAAE,iBAAiB,EAAC,KAAK,QAAQ,EAAC,KAAK,gBAAgB,EAAE,MAAM,uDAAuD,CAAC;AAiE9H,wBAAsB,OAAO,CAC5B,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Gf;;;;AAED,wBAA2B"}

package/dist/surfaces/cli/commands/store/secrets.list.command.impl.js

@@ -0,0 +1,128 @@
+import { listOptionsSchema } from "../../../../schemas/cli/commands/store/list.schema.js";
+export { listOptionsSchema } from "../../../../schemas/cli/commands/store/list.schema.js";
+/**
+ * `vibes secrets list` implementation.
+ *
+ * Lists secret descriptors (key, source, hasValue) for the current
+ * environment. NEVER emits secret values — that's `vibes secrets reveal`.
+ *
+ * Every store serving the tier is listed and merged (the highest priority
+ * answers a key two stores both hold). A store that cannot be resolved or
+ * listed is a partial result, never an abort: it is reported on stderr (text)
+ * and in `backendFailures` (JSON); only when no store could list at all does
+ * the command fail typed.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { isGenericSecretsStoreDescriptor } from "../../../../domain/kinds/store.schema.js";
+import { outcomeOf } from "../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../environment.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { parseCommandInput } from "../../shared/parse-options.js";
+import { listStoreDescriptors, requireNamedStore, resolveStoreImplementation } from "../../shared/stores/store-selection.js";
+const logger = getLogger('secrets.list');
+/** Resolve one store and list its environment; a failure at either step is the store's, not the command's. */
+function tryListStore(runtime, id, envName) {
+    return outcomeOf(async () => {
+        const impl = await resolveStoreImplementation(runtime, id);
+        return impl.list(envName);
+    });
+}
+function describeFailure(id, caught) {
+    const failure = CapabilityError.from(caught);
+    const described = { id, message: failure.message };
+    if (failure.reason !== 'untyped')
+        described.reason = failure.reason;
+    return { described, cause: failure };
+}
+export async function execute(_args, opts, commandContext) {
+    const { runtime } = commandContext;
+    const out = await openCommandOutput(runtime);
+    const parsedOpts = parseCommandInput(listOptionsSchema, opts, 'list');
+    const options = {
+        environment: parsedOpts.environment,
+        backend: parsedOpts.backend,
+        // Global --json sets opts.json; --format json sets opts.format
+        format: parsedOpts.json === true ? 'json' : parsedOpts.format
+    };
+    const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+    // Missing backend is not an empty inventory — fail closed so --json scripts
+    // never treat "no secrets/store kind" as { secrets: [] } success (exit 0).
+    const descriptors = listStoreDescriptors(runtime);
+    // A typo'd --backend must not masquerade as an empty result. Validate the id
+    // against the registered stores before filtering silently drops everything.
+    if (options.backend !== undefined)
+        requireNamedStore(descriptors, options.backend);
+    const matching = descriptors.filter((d) => {
+        if (options.backend !== undefined && d.id !== options.backend)
+            return false;
+        return (options.backend !== undefined || isGenericSecretsStoreDescriptor(d)) && d.tiers.includes(envTier);
+    });
+    // Kind registered but nothing covers this tier — also not an empty key list.
+    if (matching.length === 0) {
+        throw new CapabilityError(`No secrets store covers environment tier '${envTier}' for ${envName}.`, 'UNAVAILABLE', {
+            reason: 'secrets-store-unavailable',
+            retryable: false,
+            details: { tier: envTier },
+            recoveryHint: options.backend
+                ? `Backend '${options.backend}' is not available for tier ${envTier}.`
+                : 'Configure a secrets store that includes this environment tier.'
+        });
+    }
+    const aggregated = new Map();
+    const storesByPriority = [...matching].sort((a, b) => a.priority - b.priority);
+    const backendFailures = [];
+    const failureCauses = [];
+    let storesListed = 0;
+    for (const desc of storesByPriority) {
+        const listOutcome = await tryListStore(runtime, desc.id, envName);
+        if (listOutcome.ok) {
+            storesListed += 1;
+            for (const entry of listOutcome.value) {
+                aggregated.set(entry.key, entry);
+            }
+        }
+        else {
+            const { described, cause } = describeFailure(desc.id, listOutcome.failure);
+            // The log keeps the failure itself (Logging redacts by key and known secret value); the report stays value-free.
+            logger.warn('Failed to list secrets from backend', { backendId: desc.id, error: cause });
+            backendFailures.push(described);
+            failureCauses.push(cause);
+        }
+    }
+    // Only when no store could list at all is the result a failure; one empty store beside a failing one is partial.
+    if (storesListed === 0) {
+        const detail = backendFailures.map((f) => `${f.id}: ${f.message}`).join('; ');
+        throw new CapabilityError(`No secrets store could list environment '${envName}'. ${detail}`, 'UNAVAILABLE', {
+            reason: 'secrets-store-unavailable',
+            details: { failures: backendFailures.map((f) => ({ id: f.id, reason: f.reason ?? null })) },
+            // Each store's failure itself, so `-v` prints every one in full.
+            cause: new AggregateError(failureCauses, `${failureCauses.length} secrets store(s) could not list '${envName}'`),
+            recoveryHint: 'Operator keys live in the local encrypted store (`vibes secrets list --environment local`). Vault is opt-in (`--backend vault`) and is not a generic production store.'
+        });
+    }
+    const rows = [...aggregated.values()]
+        .map((e) => ({ key: e.key, hasValue: e.hasValue, source: e.source }))
+        .sort((a, b) => a.key.localeCompare(b.key));
+    if (options.format === 'json') {
+        out.line(JSON.stringify({ environment: envName, secrets: rows, backendFailures }, null, 2));
+        return;
+    }
+    for (const failure of backendFailures) {
+        out.warn(`secrets list: skipped ${failure.id}: ${failure.message}`);
+    }
+    if (rows.length === 0) {
+        out.line(`No secrets found for environment: ${envName}`);
+        return;
+    }
+    out.line(`\nSecrets for environment: ${envName}\n`);
+    out.line(`  ${'KEY'.padEnd(43)} ${'SOURCE'.padEnd(18)} STATUS`);
+    out.line('  ' + '─'.repeat(70));
+    for (const row of rows) {
+        const status = row.hasValue ? 'set' : 'empty';
+        out.line(`  ${row.key.padEnd(43)} ${row.source.padEnd(18)} ${status}`);
+    }
+    out.line();
+}
+export default { execute };
+//# sourceMappingURL=secrets.list.command.impl.js.map

package/dist/surfaces/cli/commands/store/secrets.list.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.list.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/secrets.list.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAsC,MAAM,uDAAuD,CAAC;AAC9H,OAAO,EAAE,iBAAiB,EAAsC,MAAM,uDAAuD,CAAC;AAC9H;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAe,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAEzB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;AAezC,8GAA8G;AAC9G,SAAS,YAAY,CAAC,OAA8B,EAAE,EAAU,EAAE,OAAe;IAChF,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACJ,CAAC;AAQD,SAAS,eAAe,CAAC,EAAU,EAAE,MAAqB;IACzD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAmB,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,KAAe,EACf,IAAsB,EACtB,cAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG;QACf,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,+DAA+D;QAC/D,MAAM,EAAE,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;KAC7D,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvG,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAElD,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,+BAA+B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACxB,6CAA6C,OAAO,SAAS,OAAO,GAAG,EACvE,aAAa,EACb;YACC,MAAM,EAAE,2BAA2B;YACnC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,YAAY,EAAE,OAAO,CAAC,OAAO;gBAC5B,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,+BAA+B,OAAO,GAAG;gBACtE,CAAC,CAAC,gEAAgE;SACnE,CACD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,YAAY,IAAI,CAAC,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACvC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3E,iHAAiH;YACjH,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,iHAAiH;IACjH,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,eAAe,CACxB,4CAA4C,OAAO,MAAM,MAAM,EAAE,EACjE,aAAa,EACb;YACC,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;YAC3F,iEAAiE;YACjE,KAAK,EAAE,IAAI,cAAc,CAAC,aAAa,EAAE,GAAG,aAAa,CAAC,MAAM,qCAAqC,OAAO,GAAG,CAAC;YAChH,YAAY,EACX,wKAAwK;SACzK,CACD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAc,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACpE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO;IACR,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,8BAA8B,OAAO,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,GAAG,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/commands/store/set-input.d.ts

@@ -0,0 +1,13 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type CommandOutput } from '../../shared/output/command-output.ts';
+/** The most a piped secret value may be: a credential is a short string, so a larger input is a mistake or an attack. */
+export declare const SECRET_STDIN_MAX_BYTES: number;
+/**
+ * The piped value: the handed runtime's stdin read, bounded in the read itself,
+ * without one trailing newline. Over the bound is `INVALID_INPUT`
+ * `secret-value-invalid` (the host's own refusal kept as the cause); the value
+ * is never in an error.
+ */
+export declare function readPipedValue(runtime: RuntimeRef): Promise<string>;
+export declare function readSecretValue(key: string, explicitStdin: boolean, runtime: RuntimeRef, out: CommandOutput): Promise<string>;
+//# sourceMappingURL=set-input.d.ts.map

package/dist/surfaces/cli/commands/store/set-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-input.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set-input.ts"],"names":[],"mappings":"AACA,OAAO,EAAoD,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExG,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAI3E,yHAAyH;AACzH,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBzE;AAED,wBAAsB,eAAe,CACpC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,aAAa,GAChB,OAAO,CAAC,MAAM,CAAC,CAsCjB"}

package/dist/surfaces/cli/commands/store/set-input.js

@@ -0,0 +1,66 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, getRuntimeStdin, isCapabilityError } from '@vibesdotdev/kernel';
+import { outcomeOf } from "../../../../support/file-failure.js";
+import {} from "../../shared/output/command-output.js";
+import { secretsTerminal } from "../../shared/output/terminal-facts.js";
+import { resolveUI } from "../../shared/output/ui-context.js";
+/** The most a piped secret value may be: a credential is a short string, so a larger input is a mistake or an attack. */
+export const SECRET_STDIN_MAX_BYTES = 64 * 1024;
+/**
+ * The piped value: the handed runtime's stdin read, bounded in the read itself,
+ * without one trailing newline. Over the bound is `INVALID_INPUT`
+ * `secret-value-invalid` (the host's own refusal kept as the cause); the value
+ * is never in an error.
+ */
+export async function readPipedValue(runtime) {
+    const stdin = await getRuntimeStdin(runtime);
+    const read = await outcomeOf(() => stdin.readStdin({ maxBytes: SECRET_STDIN_MAX_BYTES }));
+    if (read.ok)
+        return read.value.text.replace(/\r?\n$/, '');
+    const failure = read.failure;
+    // A host's own typed refusal passes (its contract is value-free); anything else is carried as the cause, never as text.
+    if (!isCapabilityError(failure)) {
+        throw new CapabilityError('Reading the secret value from stdin failed.', 'INTERNAL', {
+            reason: 'secret-stdin-read-failed', retryable: false, cause: failure
+        });
+    }
+    if (failure.reason !== 'stdio-stdin-too-large')
+        throw failure;
+    throw new CapabilityError(`The secret value on stdin is larger than ${SECRET_STDIN_MAX_BYTES} bytes.`, 'INVALID_INPUT', {
+        reason: 'secret-value-invalid',
+        retryable: false,
+        details: { problem: 'too-large', maxBytes: SECRET_STDIN_MAX_BYTES },
+        cause: failure
+    });
+}
+export async function readSecretValue(key, explicitStdin, runtime, out) {
+    const terminal = secretsTerminal(runtime);
+    if (explicitStdin) {
+        if (terminal.stdinIsTerminal) {
+            out.warn('Reading from stdin until EOF (Ctrl-D). Input is not hidden.\n' +
+                'Omit --stdin for a hidden prompt, or pipe a value.');
+        }
+        return readPipedValue(runtime);
+    }
+    if (!terminal.stdinIsTerminal) {
+        out.warn('Error: STDIN is not an interactive terminal and no secret value was piped.\n' +
+            'To set a secret non-interactively, pipe the value or pass --stdin:\n' +
+            `  printf %s "$SECRET_VALUE" | vibes secrets set ${key} --stdin\n` +
+            `  echo "$SECRET_VALUE" | vibes secrets set ${key} --stdin`);
+        requestCLIExit(1);
+    }
+    if (!terminal.stdinCanHideInput) {
+        out.warn('This terminal cannot hide input. Pipe a value, for example:\n' +
+            `  printf %s "$SECRET_VALUE" | vibes secrets set ${key} --stdin`);
+        requestCLIExit(1);
+        return '';
+    }
+    const ui = await resolveUI(runtime);
+    const value = await ui.password(`Enter value for ${key}`, { mask: '*' });
+    if (value === null) {
+        requestCLIExit(1);
+        return '';
+    }
+    return value;
+}
+//# sourceMappingURL=set-input.js.map

package/dist/surfaces/cli/commands/store/set-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-input.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAC,eAAe,EAAC,iBAAiB,EAAkB,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAsB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAE9D,yHAAyH;AACzH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAmB;IACvD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,wHAAwH;IACxH,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,UAAU,EAAE;YACpF,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;SACpE,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,uBAAuB;QAAE,MAAM,OAAO,CAAC;IAC9D,MAAM,IAAI,eAAe,CAAC,4CAA4C,sBAAsB,SAAS,EAAE,eAAe,EAAE;QACvH,MAAM,EAAE,sBAAsB;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QACnE,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAW,EACX,aAAsB,EACtB,OAAmB,EACnB,GAAkB;IAElB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,aAAa,EAAE,CAAC;QACnB,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CACP,+DAA+D;gBAC/D,oDAAoD,CACpD,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACP,8EAA8E;YAC9E,sEAAsE;YACtE,mDAAmD,GAAG,YAAY;YAClE,8CAA8C,GAAG,UAAU,CAC3D,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CACP,+DAA+D;YAC/D,mDAAmD,GAAG,UAAU,CAChE,CAAC;QACF,cAAc,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,cAAc,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/surfaces/cli/commands/store/set.command.descriptor.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `vibes secrets set <key> [-]` — set/update a secret.
+ *
+ * A TTY uses a hidden prompt. Passing `-` or `--stdin` reads STDIN instead.
+ * Literal positional values are rejected to avoid shell-history leaks.
+ */
+export declare const setCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "secrets.set";
+    readonly name: "set";
+    readonly description: "Set or update a secret from a hidden TTY prompt or stdin";
+    readonly group: "secrets";
+    readonly arguments: [{
+        readonly name: "key";
+        readonly description: "Secret key (1-128 characters; no control character, '/' or '\\', never __proto__, constructor or prototype)";
+        readonly required: true;
+    }, {
+        readonly name: "value";
+        readonly description: "STDIN marker '-' only; literal values are rejected";
+        readonly required: false;
+    }];
+    readonly options: [{
+        readonly flags: "--environment <name>";
+        readonly description: "Target environment (default: current)";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Target backend (default: highest-priority local backend for the tier)";
+    }, {
+        readonly flags: "--stdin";
+        readonly description: "Read the value from STDIN (skip the hidden prompt)";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 30;
+    readonly examples: [{
+        readonly command: "vibes secrets set MY_KEY";
+        readonly description: "Hidden prompt on a TTY (value is not echoed or stored in shell history)";
+    }, {
+        readonly command: "printf %s \"$SECRET_VALUE\" | vibes secrets set MY_KEY --stdin";
+        readonly description: "Set MY_KEY from stdin";
+    }, {
+        readonly command: "echo \"secret\" | vibes secrets set MY_KEY -";
+        readonly description: "Pipe a value from STDIN";
+    }];
+};
+export default setCommandDescriptor;
+//# sourceMappingURL=set.command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/store/set.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/store/set.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC/B,CAAC;AAEH,eAAe,oBAAoB,CAAC"}