@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/surfaces/cli/shared/app-target.js

@@ -0,0 +1,28 @@
+/**
+ * A targeted `--app <id>` must name a declared secret-requirement target. A typo
+ * or an undiscoverable target is an invalid request, never a successful
+ * zero-item result: `check --app` and `push --app` refuse it the same way
+ * (`INVALID_INPUT` `unknown-secret-requirement-app`).
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+/**
+ * The requirements declared for `appId`, or the typed refusal naming the known
+ * ids. `discoveryFailures` is how many requirement configs failed to load: the
+ * list of known ids is then incomplete, which the refusal says.
+ */
+export function requirementsForApp(appId, allRequirements, discoveryFailures = 0) {
+    const requirements = allRequirements.filter((requirement) => requirement.appId === appId);
+    if (requirements.length > 0)
+        return requirements;
+    const knownAppIds = [...new Set(allRequirements.map((requirement) => requirement.appId))].sort();
+    const incomplete = discoveryFailures > 0 ? ` (${discoveryFailures} requirement config(s) failed to load, so this list may be incomplete)` : '';
+    const message = knownAppIds.length > 0
+        ? `Unknown secret-requirement app id: ${appId}. Known app ids: ${knownAppIds.join(', ')}${incomplete}`
+        : `Cannot validate app id ${appId}: no secret-requirement targets were discovered${incomplete}.`;
+    throw new CapabilityError(message, 'INVALID_INPUT', {
+        reason: 'unknown-secret-requirement-app',
+        retryable: false,
+        details: { appId, knownAppIds, discoveryFailures }
+    });
+}
+//# sourceMappingURL=app-target.js.map

package/dist/surfaces/cli/shared/app-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-target.js","sourceRoot":"","sources":["../../../../src/surfaces/cli/shared/app-target.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAa,EACb,eAA6C,EAC7C,iBAAiB,GAAG,CAAC;IAErB,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,MAAM,UAAU,GACf,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,iBAAiB,wEAAwE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7H,MAAM,OAAO,GACZ,WAAW,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,sCAAsC,KAAK,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE;QACtG,CAAC,CAAC,0BAA0B,KAAK,kDAAkD,UAAU,GAAG,CAAC;IACnG,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE;QACnD,MAAM,EAAE,gCAAgC;QACxC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE;KAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/surfaces/cli/shared/output/command-output.d.ts

@@ -0,0 +1,14 @@
+import { type CommandOutput } from "../../../../schemas/cli/output.schema.ts";
+export { type CommandOutput } from "../../../../schemas/cli/output.schema.ts";
+/**
+ * A `vibes secrets` command's user output. Every line goes through the handed
+ * runtime's selected host text output (`runtime/stdio`), never the process
+ * console: results on stdout, diagnostics on stderr. A host without text
+ * output refuses `UNAVAILABLE stdio-unavailable` before the command does any
+ * work. Exit status is not this module's: a command requests it through
+ * `requestCLIExit`, or throws its typed `CapabilityError`.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** Resolve the handed runtime's host text output for one command run. */
+export declare function openCommandOutput(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>): Promise<CommandOutput>;
+//# sourceMappingURL=command-output.d.ts.map

package/dist/surfaces/cli/shared/output/command-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-output.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/command-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAC9E;;;;;;;GAOG;AACH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtE,yEAAyE;AACzE,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAO9G"}

package/dist/surfaces/cli/shared/output/command-output.js

@@ -0,0 +1,21 @@
+import {} from "../../../../schemas/cli/output.schema.js";
+export {} from "../../../../schemas/cli/output.schema.js";
+/**
+ * A `vibes secrets` command's user output. Every line goes through the handed
+ * runtime's selected host text output (`runtime/stdio`), never the process
+ * console: results on stdout, diagnostics on stderr. A host without text
+ * output refuses `UNAVAILABLE stdio-unavailable` before the command does any
+ * work. Exit status is not this module's: a command requests it through
+ * `requestCLIExit`, or throws its typed `CapabilityError`.
+ */
+import { getRuntimeStdio } from '@vibesdotdev/kernel';
+/** Resolve the handed runtime's host text output for one command run. */
+export async function openCommandOutput(runtime) {
+    const stdio = await getRuntimeStdio(runtime);
+    return {
+        line: (text = '') => stdio.write('stdout', `${text}\n`),
+        warn: (text) => stdio.write('stderr', `${text}\n`),
+        write: (channel, text) => stdio.write(channel, text)
+    };
+}
+//# sourceMappingURL=command-output.js.map

package/dist/surfaces/cli/shared/output/command-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-output.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/command-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAsB,MAAM,0CAA0C,CAAC;AAC9E;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AAEtE,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA8C;IACrF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACN,IAAI,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC;QACvD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC;QAClD,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;KACpD,CAAC;AACH,CAAC"}

package/dist/surfaces/cli/shared/output/payload-redaction.d.ts

@@ -0,0 +1,29 @@
+import { type RedactedPayloadOutcome } from "../../../../schemas/cli/redaction.schema.ts";
+export { type RedactedPayloadOutcome } from "../../../../schemas/cli/redaction.schema.ts";
+/**
+ * Sensitive JSON / query field names — aligned with infra-deploy log redaction
+ * (`infra-deploy/src/cli/logs/infra-logs.cli-command.impl.ts`). Used so minted
+ * response fields like `client_secret` never print even when the value was not
+ * previously known to the local store (and therefore cannot be value-matched).
+ */
+export declare const SENSITIVE_FIELD_NAMES: Set<string>;
+export declare const SENSITIVE_QUERY_PARAM_NAMES: Set<string>;
+export declare function normalizeSecretName(name: string): string;
+export declare function shouldRedactFieldName(name: string): boolean;
+export declare function shouldRedactQueryParamName(name: string): boolean;
+export declare function redactUrlLikeText(text: string): string;
+export declare function tryRedactJson(text: string): RedactedPayloadOutcome;
+/**
+ * Redact sensitive field names / query params in a response body (or any
+ * printable text). Prefer JSON parse when the whole body is JSON; otherwise
+ * fall back to `"field":"…"` regex replacement so partial/non-JSON bodies
+ * still scrub `client_secret` / `clientSecret`.
+ */
+export declare function redactSensitivePayload(text: string): string;
+/**
+ * Full print-path redaction for leverage commands: first scrub known injected
+ * store values, then scrub sensitive response field names the store never saw
+ * (e.g. a freshly minted `client_secret`).
+ */
+export declare function redactForPrint(text: string, values: Record<string, string>): string;
+//# sourceMappingURL=payload-redaction.d.ts.map

package/dist/surfaces/cli/shared/output/payload-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-redaction.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/payload-redaction.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAgBhC,CAAC;AAEH,eAAO,MAAM,2BAA2B,aAatC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmBtD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAgBlE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAEnF"}

package/dist/surfaces/cli/shared/output/payload-redaction.js

@@ -0,0 +1,116 @@
+import * as z from 'zod/v4';
+import { redactValues } from "../../../../exec/redactor.js";
+import {} from "../../../../schemas/cli/redaction.schema.js";
+export {} from "../../../../schemas/cli/redaction.schema.js";
+/**
+ * Sensitive JSON / query field names — aligned with infra-deploy log redaction
+ * (`infra-deploy/src/cli/logs/infra-logs.cli-command.impl.ts`). Used so minted
+ * response fields like `client_secret` never print even when the value was not
+ * previously known to the local store (and therefore cannot be value-matched).
+ */
+export const SENSITIVE_FIELD_NAMES = new Set([
+    'accesscode',
+    'accesstoken',
+    'apikey',
+    'authorization',
+    'authorizationcode',
+    'bearer',
+    'clientsecret',
+    'code',
+    'idtoken',
+    'oauthcode',
+    'refreshtoken',
+    'secret',
+    'signature',
+    'state',
+    'token'
+]);
+export const SENSITIVE_QUERY_PARAM_NAMES = new Set([
+    'access_token',
+    'api_key',
+    'authorization',
+    'client_secret',
+    'code',
+    'id_token',
+    'key',
+    'oauth_token',
+    'refresh_token',
+    'signature',
+    'state',
+    'token'
+]);
+export function normalizeSecretName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+export function shouldRedactFieldName(name) {
+    return SENSITIVE_FIELD_NAMES.has(normalizeSecretName(name));
+}
+export function shouldRedactQueryParamName(name) {
+    return SENSITIVE_QUERY_PARAM_NAMES.has(name.toLowerCase());
+}
+export function redactUrlLikeText(text) {
+    let redacted = text.replace(/([?&](?:access_token|api_key|authorization|client_secret|code|id_token|key|oauth_token|refresh_token|signature|state|token)=)[^&#\s"']+/gi, '$1[REDACTED]');
+    if (URL.canParse(redacted)) {
+        const parsed = new URL(redacted);
+        let changed = false;
+        for (const key of Array.from(parsed.searchParams.keys())) {
+            if (shouldRedactQueryParamName(key)) {
+                parsed.searchParams.set(key, '[REDACTED]');
+                changed = true;
+            }
+        }
+        if (changed)
+            redacted = parsed.toString();
+    }
+    return redacted;
+}
+export function tryRedactJson(text) {
+    try {
+        const parsed = JSON.parse(text, (key, val) => {
+            if (key.length > 0 && shouldRedactFieldName(key)) {
+                return `[REDACTED:${key}]`;
+            }
+            const parsedStr = z.string().safeParse(val);
+            if (parsedStr.success) {
+                return redactUrlLikeText(parsedStr.data);
+            }
+            return val;
+        });
+        return { ok: true, json: JSON.stringify(parsed) };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+/**
+ * Redact sensitive field names / query params in a response body (or any
+ * printable text). Prefer JSON parse when the whole body is JSON; otherwise
+ * fall back to `"field":"…"` regex replacement so partial/non-JSON bodies
+ * still scrub `client_secret` / `clientSecret`.
+ */
+export function redactSensitivePayload(text) {
+    let out = redactUrlLikeText(text);
+    const trimmed = out.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) ||
+        (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        const outcome = tryRedactJson(trimmed);
+        if (outcome.ok) {
+            return outcome.json;
+        }
+    }
+    out = out.replace(/"([^"\\]+)"(\s*:\s*)(?:"((?:\\.|[^"\\])*)"|null|true|false|-?\d+(?:\.\d+)?)/g, (match, fieldName, sep) => {
+        if (!shouldRedactFieldName(fieldName))
+            return match;
+        return `"${fieldName}"${sep}"[REDACTED:${fieldName}]"`;
+    });
+    return out;
+}
+/**
+ * Full print-path redaction for leverage commands: first scrub known injected
+ * store values, then scrub sensitive response field names the store never saw
+ * (e.g. a freshly minted `client_secret`).
+ */
+export function redactForPrint(text, values) {
+    return redactSensitivePayload(redactValues(text, values));
+}
+//# sourceMappingURL=payload-redaction.js.map

package/dist/surfaces/cli/shared/output/payload-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-redaction.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/payload-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAA+B,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAA+B,MAAM,6CAA6C,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,eAAe;IACf,mBAAmB;IACnB,QAAQ;IACR,cAAc;IACd,MAAM;IACN,SAAS;IACT,WAAW;IACX,cAAc;IACd,QAAQ;IACR,WAAW;IACX,OAAO;IACP,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAClD,cAAc;IACd,SAAS;IACT,eAAe;IACf,eAAe;IACf,MAAM;IACN,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,WAAW;IACX,OAAO;IACP,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IACjD,OAAO,qBAAqB,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC7C,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC1B,2IAA2I,EAC3I,cAAc,CACd,CAAC;IAEF,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC3C,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,aAAa,GAAG,GAAG,CAAC;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,IAAI,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IACC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACjD,CAAC;QACF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;IACF,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAChB,8EAA8E,EAC9E,CAAC,KAAK,EAAE,SAAiB,EAAE,GAAW,EAAE,EAAE;QACzC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,IAAI,SAAS,IAAI,GAAG,cAAc,SAAS,IAAI,CAAC;IACxD,CAAC,CACD,CAAC;IACF,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAA8B;IAC1E,OAAO,sBAAsB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/surfaces/cli/shared/output/terminal-facts.d.ts

@@ -0,0 +1,17 @@
+import { type SecretsTerminal } from "../../../../schemas/cli/terminal.schema.ts";
+export { type SecretsTerminal } from "../../../../schemas/cli/terminal.schema.ts";
+/**
+ * The terminal facts the two commands that prompt or read a piped value
+ * (`secrets set`, `secrets reveal`) decide on, read from the handed runtime's
+ * captured host facts (`localEnvironment.terminal()`), never from the process.
+ *
+ * A host that does not observe a fact omits it, and a prompt must never be
+ * offered on a terminal nobody observed: an omitted fact reads as "not a
+ * terminal", so `set` asks for a piped value and `reveal` refuses without
+ * `--force`. The unsafe direction (an unobserved terminal treated as one) does
+ * not exist here.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+/** What the handed runtime's host observed; every fact it did not observe is `false`. */
+export declare function secretsTerminal(runtime: Pick<RuntimeRef, 'localEnvironment'>): SecretsTerminal;
+//# sourceMappingURL=terminal-facts.d.ts.map

package/dist/surfaces/cli/shared/output/terminal-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-facts.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/terminal-facts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAClF;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,GAAG,eAAe,CAO9F"}

package/dist/surfaces/cli/shared/output/terminal-facts.js

@@ -0,0 +1,12 @@
+import {} from "../../../../schemas/cli/terminal.schema.js";
+export {} from "../../../../schemas/cli/terminal.schema.js";
+/** What the handed runtime's host observed; every fact it did not observe is `false`. */
+export function secretsTerminal(runtime) {
+    const facts = runtime.localEnvironment.terminal?.();
+    return {
+        stdinIsTerminal: facts?.stdinIsTerminal === true,
+        stderrIsTerminal: facts?.stderrIsTerminal === true,
+        stdinCanHideInput: facts?.stdinCanHideInput === true
+    };
+}
+//# sourceMappingURL=terminal-facts.js.map

package/dist/surfaces/cli/shared/output/terminal-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-facts.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/terminal-facts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAwB,MAAM,4CAA4C,CAAC;AAclF,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,OAA6C;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpD,OAAO;QACN,eAAe,EAAE,KAAK,EAAE,eAAe,KAAK,IAAI;QAChD,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI;QAClD,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,KAAK,IAAI;KACpD,CAAC;AACH,CAAC"}

package/dist/surfaces/cli/shared/output/ui-context.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The interactive toolkit (`cli/ui`) a command prompts through: the handed
+ * runtime's own context when it declares one, else the default toolkit. Only
+ * a confirmed absence of the context falls back, writing through the runtime's
+ * text output; any other failure propagates.
+ */
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+export declare function resolveUI(runtime: RuntimeRef): Promise<UIContext>;
+//# sourceMappingURL=ui-context.d.ts.map

package/dist/surfaces/cli/shared/output/ui-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-context.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/ui-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAkC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKtF,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAevE"}

package/dist/surfaces/cli/shared/output/ui-context.js

@@ -0,0 +1,28 @@
+/**
+ * The interactive toolkit (`cli/ui`) a command prompts through: the handed
+ * runtime's own context when it declares one, else the default toolkit. Only
+ * a confirmed absence of the context falls back, writing through the runtime's
+ * text output; any other failure propagates.
+ */
+import { CapabilityError, getRuntimeStdio } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+const logger = getLogger('secrets.ui');
+export async function resolveUI(runtime) {
+    if (runtime.hasKind('context') || 'context' in runtime) {
+        try {
+            return await runtime.context('cli/ui');
+        }
+        catch (error) {
+            if (error instanceof Error && CapabilityError.isAbsenceOf(error, 'context', 'cli/ui')) {
+                logger.debug('cli/ui context unavailable; using default toolkit');
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    const { VibesUIToolkit } = await import('@vibesdotdev/cli/support/ui-toolkit');
+    // The default toolkit writes through the handed runtime's text output.
+    return new VibesUIToolkit({ output: await getRuntimeStdio(runtime) });
+}
+//# sourceMappingURL=ui-context.js.map

package/dist/surfaces/cli/shared/output/ui-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-context.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/output/ui-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,eAAe,EAAC,eAAe,EAAkB,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAmB;IAClD,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACxD,IAAI,CAAC;YACJ,OAAO,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACvF,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAC/E,uEAAuE;IACvE,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/surfaces/cli/shared/parse-options.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A command's options and arguments are untrusted input from the CLI surface:
+ * they are parsed with a schema, and a failure is `INVALID_INPUT`
+ * `command-options-invalid` naming the offending fields (never their values),
+ * not a raw `ZodError`.
+ */
+import * as z from 'zod/v4';
+export declare function parseCommandInput<Schema extends z.ZodType>(schema: Schema, input: z.input<Schema>, command: string): z.output<Schema>;
+//# sourceMappingURL=parse-options.d.ts.map

package/dist/surfaces/cli/shared/parse-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-options.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/cli/shared/parse-options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,wBAAgB,iBAAiB,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,EACzD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EACtB,OAAO,EAAE,MAAM,GACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CASlB"}

package/dist/surfaces/cli/shared/parse-options.js

@@ -0,0 +1,20 @@
+/**
+ * A command's options and arguments are untrusted input from the CLI surface:
+ * they are parsed with a schema, and a failure is `INVALID_INPUT`
+ * `command-options-invalid` naming the offending fields (never their values),
+ * not a raw `ZodError`.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export function parseCommandInput(schema, input, command) {
+    const parsed = schema.safeParse(input);
+    if (parsed.success)
+        return parsed.data;
+    const fields = [...new Set(parsed.error.issues.map((issue) => issue.path.join('.') || '(input)'))];
+    throw new CapabilityError(`secrets ${command}: invalid options (${fields.join(', ')}).`, 'INVALID_INPUT', {
+        reason: 'command-options-invalid',
+        retryable: false,
+        details: { command, fields }
+    });
+}
+//# sourceMappingURL=parse-options.js.map

package/dist/surfaces/cli/shared/parse-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-options.js","sourceRoot":"","sources":["../../../../src/surfaces/cli/shared/parse-options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,UAAU,iBAAiB,CAChC,MAAc,EACd,KAAsB,EACtB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,eAAe,CAAC,WAAW,OAAO,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;QACzG,MAAM,EAAE,yBAAyB;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;KAC5B,CAAC,CAAC;AACJ,CAAC"}

package/dist/surfaces/cli/shared/stores/drift-backfill.d.ts

@@ -0,0 +1,23 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+import { type GetOutcome, type ListOutcome, type StoreCandidate } from "../../../../schemas/discovery/backfill.schema.ts";
+import { type DriftHome, type DriftRow, type UnreadableKey } from "../../../../schemas/discovery/drift.schema.ts";
+export { type GetOutcome, type ListOutcome, type StoreCandidate } from "../../../../schemas/discovery/backfill.schema.ts";
+export declare const logger: import("@vibesdotdev/logging").LoggerImplementation;
+export declare function tryListStore(store: StoreCandidate, environment: string): Promise<ListOutcome>;
+export declare function tryGetStoreValue(store: StoreCandidate, environment: string, key: string): Promise<GetOutcome>;
+/** The store refused this key by its own rule (`INVALID_INPUT secret-key-invalid`): a fact about the key, not about the store. */
+export declare function isKeyRefusal(failure: CaughtFailure): boolean;
+/**
+ * Record a fingerprint for every key each store lists and returns. A store that
+ * cannot be listed is skipped (the caller's bounded wrapper reports it). Any
+ * key a store will not return keeps its prior fingerprint (a write-only store
+ * is compared from the index); one the store REFUSES by its key rule is answered
+ * as an `UnreadableKey`, and the other keys of that store are still read.
+ */
+export declare function backfillFingerprints(input: {
+    home: DriftHome;
+    environment: string;
+    stores: Array<StoreCandidate>;
+}): Promise<UnreadableKey[]>;
+export declare function compareFingerprints(home: DriftHome, environment?: string): Promise<DriftRow[]>;
+//# sourceMappingURL=drift-backfill.d.ts.map

package/dist/surfaces/cli/shared/stores/drift-backfill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-backfill.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-backfill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE/F,OAAO,EAAE,KAAK,UAAU,EAAC,KAAK,WAAW,EAAC,KAAK,cAAc,EAAE,MAAM,kDAAkD,CAAC;AACxH,OAAO,EAAE,KAAK,SAAS,EAAC,KAAK,QAAQ,EAAC,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAEhH,OAAO,EAAE,KAAK,UAAU,EAAC,KAAK,WAAW,EAAC,KAAK,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAExH,eAAO,MAAM,MAAM,qDAA6B,CAAC;AAEjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAOnG;AAED,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,kIAAkI;AAClI,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAG5D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IACjD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAqC3B;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAmCpG"}

package/dist/surfaces/cli/shared/stores/drift-backfill.js

@@ -0,0 +1,116 @@
+import { CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import {} from "../../../../schemas/discovery/backfill.schema.js";
+import {} from "../../../../schemas/discovery/drift.schema.js";
+import { loadIndex, recordFingerprint } from "./drift-fingerprints.impl.consumer.js";
+export {} from "../../../../schemas/discovery/backfill.schema.js";
+export const logger = getLogger('secrets.drift');
+export async function tryListStore(store, environment) {
+    try {
+        const entries = await store.list(environment);
+        return { ok: true, entries };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export async function tryGetStoreValue(store, environment, key) {
+    try {
+        const value = await store.get(environment, key);
+        return { ok: true, value };
+    }
+    catch (error) {
+        return { ok: false, error: CaughtFailureSchema.parse(error) };
+    }
+}
+/** The store refused this key by its own rule (`INVALID_INPUT secret-key-invalid`): a fact about the key, not about the store. */
+export function isKeyRefusal(failure) {
+    const caught = CaughtFailureSchema.parse(failure);
+    return isCapabilityError(caught) && caught.code === 'INVALID_INPUT' && caught.reason === 'secret-key-invalid';
+}
+/**
+ * Record a fingerprint for every key each store lists and returns. A store that
+ * cannot be listed is skipped (the caller's bounded wrapper reports it). Any
+ * key a store will not return keeps its prior fingerprint (a write-only store
+ * is compared from the index); one the store REFUSES by its key rule is answered
+ * as an `UnreadableKey`, and the other keys of that store are still read.
+ */
+export async function backfillFingerprints(input) {
+    const home = input.home;
+    const unreadable = [];
+    for (const store of input.stores) {
+        const listResult = await tryListStore(store, input.environment);
+        if (!listResult.ok) {
+            // The caller's bounded store wrapper already records a diagnostic; log and skip this store.
+            logger.warn('Drift backfill could not list a store; skipping it', {
+                store: store.id,
+                error: listResult.error instanceof Error ? listResult.error.message : String(listResult.error)
+            });
+            continue;
+        }
+        for (const entry of listResult.entries) {
+            if (!entry.hasValue)
+                continue;
+            const getResult = await tryGetStoreValue(store, input.environment, entry.key);
+            if (!getResult.ok) {
+                // Write-only stores keep any previously recorded fingerprint.
+                logger.debug('Drift backfill could not read a key; keeping prior fingerprint', {
+                    store: store.id,
+                    key: entry.key,
+                    error: getResult.error instanceof Error ? getResult.error.message : String(getResult.error)
+                });
+                if (isKeyRefusal(getResult.error))
+                    unreadable.push({ store: store.id, key: entry.key });
+                continue;
+            }
+            if (!getResult.value)
+                continue;
+            await recordFingerprint({
+                environment: input.environment,
+                backend: store.id,
+                key: entry.key,
+                value: getResult.value,
+                home
+            });
+        }
+    }
+    return unreadable;
+}
+export async function compareFingerprints(home, environment) {
+    const index = await loadIndex(home);
+    const rows = [];
+    const envs = environment ? [environment] : Object.keys(index.fingerprints);
+    for (const env of envs) {
+        const backends = (Object.hasOwn(index.fingerprints, env) ? index.fingerprints[env] : undefined) ?? {};
+        const keys = new Set();
+        for (const table of Object.values(backends)) {
+            for (const key of Object.keys(table))
+                keys.add(key);
+        }
+        for (const key of [...keys].sort()) {
+            // A store holds a key only as its own entry: `toString` is never read through the table's prototype.
+            const present = Object.entries(backends).flatMap(([id, table]) => {
+                const recorded = Object.hasOwn(table, key) ? table[key] : undefined;
+                return recorded ? [{ id, hmac: recorded.hmac }] : [];
+            });
+            if (present.length < 2) {
+                rows.push({
+                    key,
+                    environment: env,
+                    status: 'single-store',
+                    backends: present.map((entry) => entry.id)
+                });
+                continue;
+            }
+            const first = present[0].hmac;
+            rows.push({
+                key,
+                environment: env,
+                status: present.some((entry) => entry.hmac !== first) ? 'diverge' : 'match',
+                backends: present.map((entry) => entry.id)
+            });
+        }
+    }
+    return rows;
+}
+//# sourceMappingURL=drift-backfill.js.map

package/dist/surfaces/cli/shared/stores/drift-backfill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-backfill.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-backfill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAC,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAwD,MAAM,kDAAkD,CAAC;AACxH,OAAO,EAAmD,MAAM,+CAA+C,CAAC;AAChH,OAAO,EAAE,SAAS,EAAC,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAwD,MAAM,kDAAkD,CAAC;AAExH,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAqB,EAAE,WAAmB;IAC5E,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAAqB,EACrB,WAAmB,EACnB,GAAW;IAEX,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,CAAC;AACF,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,YAAY,CAAC,OAAsB;IAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC;AAC/G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,4FAA4F;YAC5F,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBACjE,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,KAAK,EAAE,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;aAC9F,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,SAAS;YAC9B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACnB,8DAA8D;gBAC9D,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;oBAC9E,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,SAAS,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC3F,CAAC,CAAC;gBACH,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxF,SAAS;YACV,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,KAAK;gBAAE,SAAS;YAC/B,MAAM,iBAAiB,CAAC;gBACvB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,IAAI;aACJ,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAe,EAAE,WAAoB;IAC9E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,qGAAqG;YACrG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;gBAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC;oBACT,GAAG;oBACH,WAAW,EAAE,GAAG;oBAChB,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;iBAC1C,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC;gBACT,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBAC3E,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.d.ts

@@ -0,0 +1,27 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type DriftHome, type DriftIndex } from "../../../../schemas/discovery/drift.schema.ts";
+export { DRIFT_INDEX_VERSION, driftFingerprintRecordSchema, driftIndexSchema, type DriftFingerprintRecord, type DriftHome, type DriftIndex, type DriftRow, type UnreadableKey } from "../../../../schemas/discovery/drift.schema.ts";
+export { backfillFingerprints, compareFingerprints, isKeyRefusal, logger, tryGetStoreValue, tryListStore, type GetOutcome, type ListOutcome, type StoreCandidate } from "./drift-backfill.ts";
+export declare const CHECKER_KEY_FILE = "drift-checker.key";
+export declare const INDEX_FILE = "drift-fingerprints.json";
+/** The drift home of `runtime`: the host's own files, never a workspace-rooted view. */
+export declare function driftFingerprintHome(runtime: RuntimeRef): Promise<DriftHome>;
+/**
+ * The checker key, created on first use. Creation is exclusive (the adapter's
+ * `createFileExclusive`, 0600): of two creators one wins and both then read the
+ * winner's key. An adapter without the capability refuses typed.
+ */
+export declare function loadCheckerKey(home: DriftHome): Promise<Uint8Array>;
+/** HMAC-SHA256 of `value` under the checker key, hex. */
+export declare function fingerprintValue(value: string, checkerKey: Uint8Array): Promise<string>;
+export declare function loadIndex(home: DriftHome): Promise<DriftIndex>;
+/** Publish the index atomically and owner-private. */
+export declare function saveIndex(home: DriftHome, index: DriftIndex): Promise<void>;
+export declare function recordFingerprint(input: {
+    environment: string;
+    backend: string;
+    key: string;
+    value: string;
+    home: DriftHome;
+}): Promise<string>;
+//# sourceMappingURL=drift-fingerprints.impl.consumer.d.ts.map

package/dist/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-fingerprints.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/shared/stores/drift-fingerprints.impl.consumer.ts"],"names":[],"mappings":"AAMA,OAAO,EAAoC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIxF,OAAO,EAAuC,KAAK,SAAS,EAAC,KAAK,UAAU,EAAE,MAAM,+CAA+C,CAAC;AAGpI,OAAO,EAAE,mBAAmB,EAAC,4BAA4B,EAAC,gBAAgB,EAAC,KAAK,sBAAsB,EAAC,KAAK,SAAS,EAAC,KAAK,UAAU,EAAC,KAAK,QAAQ,EAAC,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9N,OAAO,EAAE,oBAAoB,EAAC,mBAAmB,EAAC,YAAY,EAAC,MAAM,EAAC,gBAAgB,EAAC,YAAY,EAAC,KAAK,UAAU,EAAC,KAAK,WAAW,EAAC,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtL,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AACpD,eAAO,MAAM,UAAU,4BAA4B,CAAC;AAOpD,wFAAwF;AACxF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAGlF;AAmCD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAWzE;AAED,yDAAyD;AACzD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAI7F;AAcD,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA4BpE;AAED,sDAAsD;AACtD,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;AAgBD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBlB"}