@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/manifest/canonical.js

@@ -1,313 +0,0 @@
-/**
- * Vibes Secrets Import Manifest (canonical, value-free)
- *
- * Read by `vibes secrets import` to discover which keys to pull from which
- * local root env files when bootstrapping the encrypted Vibes store. The
- * manifest is reconciled against ground truth: every entry corresponds to a
- * real `secret: true` env var declared by an app's deployment config (or, in
- * auth-web's case, by its sub-manifest files).
- *
- * Sources:
- *   - `local-env` (`.env.local`) is the canonical machine-local store of
- *     every actual production-quality secret value: auth secrets, OAuth
- *     client secrets (GitHub / Google / Discord / Microsoft), Resend, the
- *     internal auth token, Stripe billing keys, etc.
- *   - `production-env` (`.env.production`) holds production-flavored
- *     non-secret config plus the operator's CF coordinates. Value-free here.
- *   - `manual` is a pseudo-source for keys that must be set through another
- *     channel (`vibes secrets set`, generated tokens, or pasted from a vault).
- *     The import command skips `manual` entries with a notice.
- *
- * Operator credentials (`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`,
- * `CLOUDFLARE_SECRETS_STORE_ID`) are intentionally NOT in this manifest.
- * They authenticate the operator's machine to push secrets into the store;
- * they are never themselves pushed into the store.
- */
-import { SecretsImportManifestSchema } from './import-manifest.schema';
-const manifest = SecretsImportManifestSchema.parse({
-    version: 1,
-    sources: {
-        'local-env': {
-            path: '.env.local',
-            purpose: 'Canonical machine-local secret values: auth, OAuth, billing, internal tokens'
-        },
-        'production-env': {
-            path: '.env.production',
-            purpose: 'Production-flavored non-secret config + CF operator coordinates'
-        },
-        'manual': {
-            purpose: "Set via `vibes secrets set <KEY>` or generated by ops; not sourced from a local file"
-        }
-    },
-    secrets: [
-        // --- Auth gateway (auth-web) — sourced from .env.local ----------------------
-        {
-            key: 'VIBES_AUTH_SECRET',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: true,
-            description: 'Better Auth signing secret (auth-web)'
-        },
-        // `VIBES_AUTH_DATABASE_URL` / `VIBES_AUTH_DATABASE_AUTH_TOKEN` are
-        // dev-only: production auth-web binds its own D1 database (`vibes-auth-db`)
-        // via the `DB` binding in `wrangler.jsonc`. The libsql/file fallback in
-        // `auth-web/src/server/persistence.ts` is for local dev only. We keep
-        // them in the manifest so `vibes secrets import` still picks them up
-        // for a working local store, but they're optional and never pushed to
-        // the production Secrets Store.
-        {
-            key: 'VIBES_AUTH_DATABASE_URL',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'LibSQL/Turso connection URL for auth persistence (DEV ONLY — production uses D1)'
-        },
-        {
-            key: 'VIBES_AUTH_DATABASE_AUTH_TOKEN',
-            category: 'vibes-auth',
-            source: 'local-env',
-            aliases: ['DATABASE_AUTH_TOKEN'],
-            required: false,
-            description: 'LibSQL/Turso auth token for auth persistence (DEV ONLY — production uses D1)'
-        },
-        {
-            key: 'VIBES_AUTH_RESEND_API_KEY',
-            category: 'vibes-auth',
-            source: 'local-env',
-            aliases: ['RESEND_API_KEY'],
-            required: false,
-            description: 'Resend API key for auth email delivery'
-        },
-        {
-            key: 'VIBES_AUTH_TWILIO_ACCOUNT_SID',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Twilio account SID for phone OTP delivery'
-        },
-        {
-            key: 'VIBES_AUTH_TWILIO_AUTH_TOKEN',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Twilio auth token for phone OTP delivery'
-        },
-        {
-            key: 'VIBES_AUTH_GITHUB_CLIENT_ID',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'GitHub OAuth client ID'
-        },
-        {
-            key: 'VIBES_AUTH_GITHUB_CLIENT_SECRET',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'GitHub OAuth client secret'
-        },
-        {
-            key: 'VIBES_AUTH_GOOGLE_CLIENT_ID',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Google OAuth client ID'
-        },
-        {
-            key: 'VIBES_AUTH_GOOGLE_CLIENT_SECRET',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Google OAuth client secret'
-        },
-        {
-            key: 'VIBES_AUTH_DISCORD_CLIENT_ID',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Discord OAuth client ID'
-        },
-        {
-            key: 'VIBES_AUTH_DISCORD_CLIENT_SECRET',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Discord OAuth client secret'
-        },
-        {
-            key: 'VIBES_AUTH_MICROSOFT_CLIENT_ID',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Microsoft (Azure AD) OAuth client ID'
-        },
-        {
-            key: 'VIBES_AUTH_MICROSOFT_CLIENT_SECRET',
-            category: 'vibes-auth',
-            source: 'local-env',
-            required: false,
-            description: 'Microsoft (Azure AD) OAuth client secret'
-        },
-        // --- Internal cross-app bearer tokens (account-web, ai-web) ------------------
-        {
-            key: 'VIBES_AUTH_INTERNAL_TOKEN',
-            category: 'vibes-internal',
-            source: 'local-env',
-            required: true,
-            description: 'Bearer token for internal/admin auth API calls'
-        },
-        {
-            key: 'VIBES_INTERNAL_SERVICE_TOKEN',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: true,
-            description: 'Shared internal bearer token for platform/account internal RPCs'
-        },
-        {
-            key: 'VIBES_PLATFORM_INTERNAL_TOKEN',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: false,
-            description: 'Platform-specific internal bearer token; falls back to VIBES_INTERNAL_SERVICE_TOKEN'
-        },
-        {
-            key: 'VIBES_EMAIL_INGRESS_TOKEN',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: false,
-            description: 'Bearer token for inbound email webhooks (auth-web /api/email)'
-        },
-        // --- Billing (account-web) ---------------------------------------------------
-        // `.env.production` stores Stripe under a `VIBES_ACCOUNT_STRIPE_*` prefix;
-        // `.env.local` uses the canonical names directly. Either source resolves.
-        {
-            key: 'STRIPE_SECRET_KEY',
-            category: 'provider-billing',
-            source: 'local-env',
-            aliases: ['VIBES_ACCOUNT_STRIPE_SECRET_KEY'],
-            required: false,
-            description: 'Stripe secret key for billing sync and checkout'
-        },
-        {
-            key: 'STRIPE_WEBHOOK_SECRET',
-            category: 'provider-billing',
-            source: 'local-env',
-            required: false,
-            description: 'Stripe webhook signing secret for /api/webhooks/stripe'
-        },
-        {
-            key: 'STRIPE_PUB_KEY',
-            category: 'provider-billing',
-            source: 'local-env',
-            aliases: ['PUBLIC_STRIPE_KEY', 'VIBES_ACCOUNT_STRIPE_PUB_KEY'],
-            required: false,
-            description: 'Stripe publishable key (pk_live_*/pk_test_*); safe to expose to clients but tracked here so live/test mode stays aligned with STRIPE_SECRET_KEY'
-        },
-        {
-            key: 'STRIPE_RESTRICTED_KEY',
-            category: 'provider-billing',
-            source: 'local-env',
-            aliases: ['VIBES_ACCOUNT_STRIPE_RESTRICTED_KEY'],
-            required: false,
-            description: 'Stripe restricted live key (rk_live_*) for narrow-scope ops/CI usage; not consumed at runtime — runtime uses STRIPE_SECRET_KEY'
-        },
-        {
-            key: 'CF_BILLING_SECRET',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: false,
-            description: 'Cloudflare-side billing webhook secret'
-        },
-        {
-            key: 'RESEND_API_KEY',
-            category: 'provider-other',
-            source: 'manual',
-            required: false,
-            description: 'Resend API key used by account-web to send invoice receipt emails'
-        },
-        // --- LLM / voice / search providers (ai-web, ai-web) ----------------------
-        {
-            key: 'OPENAI_API_KEY',
-            category: 'provider-llm',
-            source: 'manual',
-            required: false,
-            description: 'OpenAI provider key (ai-web)'
-        },
-        {
-            key: 'ANTHROPIC_API_KEY',
-            category: 'provider-llm',
-            source: 'manual',
-            required: false,
-            description: 'Anthropic provider key (ai-web)'
-        },
-        {
-            key: 'GOOGLE_API_KEY',
-            category: 'provider-llm',
-            source: 'manual',
-            required: false,
-            description: 'Google provider key (ai-web)'
-        },
-        {
-            key: 'GEMINI_API_KEY',
-            category: 'provider-llm',
-            source: 'manual',
-            required: false,
-            description: 'Gemini-named provider key alias (ai-web)'
-        },
-        {
-            key: 'DEEPGRAM_API_KEY',
-            category: 'provider-voice',
-            source: 'manual',
-            required: false,
-            description: 'Deepgram transcription provider key (ai-web)'
-        },
-        {
-            key: 'ELEVENLABS_API_KEY',
-            category: 'provider-voice',
-            source: 'manual',
-            required: false,
-            description: 'ElevenLabs TTS provider key (ai-web)'
-        },
-        {
-            key: 'FIRECRAWL_API_KEY',
-            category: 'provider-search',
-            source: 'manual',
-            required: false,
-            description: 'Firecrawl crawl/scrape provider key (ai-web)'
-        },
-        {
-            key: 'VIBES_API_TOKEN',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: false,
-            description: 'Tools-web internal API token'
-        },
-        {
-            key: 'VIBES_TOOL_REGISTRY_TOKEN',
-            category: 'vibes-internal',
-            source: 'manual',
-            required: false,
-            description: 'Tools-web tool-registry access token'
-        },
-        // --- Other provider creds (referenced by deployment configs but not in
-        //     a Pages app's secrets list yet — included so they round-trip if
-        //     they end up in `.env.local`) -----------------------------------------
-        {
-            key: 'DIGITALOCEAN_API_TOKEN',
-            category: 'provider-other',
-            source: 'local-env',
-            required: false,
-            description: 'DigitalOcean API token for DOKS / DO Spaces tooling'
-        },
-        {
-            key: 'NPM_TOKEN',
-            category: 'provider-other',
-            source: 'manual',
-            required: false,
-            description: 'npm publish token used by `vibes infra npm publish`'
-        }
-    ]
-});
-export const canonicalImportManifest = manifest;
-export default manifest;
-//# sourceMappingURL=canonical.js.map

package/dist/manifest/canonical.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/manifest/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACN,2BAA2B,EAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,QAAQ,GAA0B,2BAA2B,CAAC,KAAK,CAAC;IACzE,OAAO,EAAE,CAAC;IACV,OAAO,EAAE;QACR,WAAW,EAAE;YACZ,IAAI,EAAE,YAAY;YAClB,OAAO,EACN,8EAA8E;SAC/E;QACD,gBAAgB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,iEAAiE;SAC1E;QACD,QAAQ,EAAE;YACT,OAAO,EACN,sFAAsF;SACvF;KACD;IACD,OAAO,EAAE;QACR,+EAA+E;QAC/E;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,uCAAuC;SACpD;QACD,mEAAmE;QACnE,4EAA4E;QAC5E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,gCAAgC;QAChC;YACC,GAAG,EAAE,yBAAyB;YAC9B,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,kFAAkF;SAC/F;QACD;YACC,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,qBAAqB,CAAC;YAChC,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8EAA8E;SAC3F;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wCAAwC;SACrD;QACD;YACC,GAAG,EAAE,+BAA+B;YACpC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,2CAA2C;SACxD;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,GAAG,EAAE,6BAA6B;YAClC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wBAAwB;SACrC;QACD;YACC,GAAG,EAAE,iCAAiC;YACtC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,4BAA4B;SACzC;QACD;YACC,GAAG,EAAE,6BAA6B;YAClC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wBAAwB;SACrC;QACD;YACC,GAAG,EAAE,iCAAiC;YACtC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,4BAA4B;SACzC;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,yBAAyB;SACtC;QACD;YACC,GAAG,EAAE,kCAAkC;YACvC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,6BAA6B;SAC1C;QACD;YACC,GAAG,EAAE,gCAAgC;YACrC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,GAAG,EAAE,oCAAoC;YACzC,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QAED,gFAAgF;QAChF;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,gDAAgD;SAC7D;QACD;YACC,GAAG,EAAE,8BAA8B;YACnC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,iEAAiE;SAC9E;QACD;YACC,GAAG,EAAE,+BAA+B;YACpC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qFAAqF;SAClG;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,+DAA+D;SAC5E;QAED,gFAAgF;QAChF,2EAA2E;QAC3E,0EAA0E;QAC1E;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,iCAAiC,CAAC;YAC5C,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,GAAG,EAAE,uBAAuB;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wDAAwD;SACrE;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;YAC9D,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iJAAiJ;SAC9J;QACD;YACC,GAAG,EAAE,uBAAuB;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,qCAAqC,CAAC;YAChD,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,gIAAgI;SAC7I;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,wCAAwC;SACrD;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,mEAAmE;SAChF;QAED,6EAA6E;QAC7E;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iCAAiC;SAC9C;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,GAAG,EAAE,kBAAkB;YACvB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8CAA8C;SAC3D;QACD;YACC,GAAG,EAAE,oBAAoB;YACzB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8CAA8C;SAC3D;QACD;YACC,GAAG,EAAE,iBAAiB;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,8BAA8B;SAC3C;QACD;YACC,GAAG,EAAE,2BAA2B;YAChC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sCAAsC;SACnD;QAED,wEAAwE;QACxE,sEAAsE;QACtE,6EAA6E;QAC7E;YACC,GAAG,EAAE,wBAAwB;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qDAAqD;SAClE;QACD;YACC,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qDAAqD;SAClE;KACD;CACD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAA0B,QAAQ,CAAC;AACvE,eAAe,QAAQ,CAAC"}

package/dist/manifest/import-manifest.schema.d.ts

@@ -1,77 +0,0 @@
-/**
- * Secrets Import Manifest Schema
- *
- * Catalogs the secrets the platform expects to receive from local root env
- * files at bootstrap time. Carries no values — only key identity, source
- * preference, and intent. The manifest is the contract a `vibes secrets
- * import` command (phase 5) reads against.
- */
-import * as z from 'zod/v4';
-/**
- * Where a secret value is expected to originate from when running
- * `vibes secrets import`. Sources with a `path` are repo-relative .env-shaped
- * files; they are read-only inputs and never committed. Sources without a
- * `path` (e.g. the canonical `manual` source) describe entries that are not
- * importable from disk and must be set through other means
- * (`vibes secrets set`, generated tokens, Cloudflare dashboard, etc.).
- */
-export declare const SecretSourceSchema: z.ZodObject<{
-    path: z.ZodOptional<z.ZodString>;
-    purpose: z.ZodString;
-}, z.core.$strip>;
-export type SecretSource = z.infer<typeof SecretSourceSchema>;
-export declare const SecretCategorySchema: z.ZodEnum<{
-    "vibes-internal": "vibes-internal";
-    "vibes-auth": "vibes-auth";
-    cloudflare: "cloudflare";
-    "provider-llm": "provider-llm";
-    "provider-voice": "provider-voice";
-    "provider-search": "provider-search";
-    "provider-billing": "provider-billing";
-    "provider-other": "provider-other";
-}>;
-export type SecretCategory = z.infer<typeof SecretCategorySchema>;
-export declare const SecretManifestEntrySchema: z.ZodObject<{
-    key: z.ZodString;
-    category: z.ZodEnum<{
-        "vibes-internal": "vibes-internal";
-        "vibes-auth": "vibes-auth";
-        cloudflare: "cloudflare";
-        "provider-llm": "provider-llm";
-        "provider-voice": "provider-voice";
-        "provider-search": "provider-search";
-        "provider-billing": "provider-billing";
-        "provider-other": "provider-other";
-    }>;
-    source: z.ZodString;
-    aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    required: z.ZodDefault<z.ZodBoolean>;
-    description: z.ZodString;
-}, z.core.$strip>;
-export type SecretManifestEntry = z.infer<typeof SecretManifestEntrySchema>;
-export declare const SecretsImportManifestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    sources: z.ZodRecord<z.ZodString, z.ZodObject<{
-        path: z.ZodOptional<z.ZodString>;
-        purpose: z.ZodString;
-    }, z.core.$strip>>;
-    secrets: z.ZodArray<z.ZodObject<{
-        key: z.ZodString;
-        category: z.ZodEnum<{
-            "vibes-internal": "vibes-internal";
-            "vibes-auth": "vibes-auth";
-            cloudflare: "cloudflare";
-            "provider-llm": "provider-llm";
-            "provider-voice": "provider-voice";
-            "provider-search": "provider-search";
-            "provider-billing": "provider-billing";
-            "provider-other": "provider-other";
-        }>;
-        source: z.ZodString;
-        aliases: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        required: z.ZodDefault<z.ZodBoolean>;
-        description: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type SecretsImportManifest = z.infer<typeof SecretsImportManifestSchema>;
-//# sourceMappingURL=import-manifest.schema.d.ts.map

package/dist/manifest/import-manifest.schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"import-manifest.schema.d.ts","sourceRoot":"","sources":["../../src/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAapC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;iBAMtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/manifest/import-manifest.schema.js

@@ -1,55 +0,0 @@
-/**
- * Secrets Import Manifest Schema
- *
- * Catalogs the secrets the platform expects to receive from local root env
- * files at bootstrap time. Carries no values — only key identity, source
- * preference, and intent. The manifest is the contract a `vibes secrets
- * import` command (phase 5) reads against.
- */
-import * as z from 'zod/v4';
-/**
- * Where a secret value is expected to originate from when running
- * `vibes secrets import`. Sources with a `path` are repo-relative .env-shaped
- * files; they are read-only inputs and never committed. Sources without a
- * `path` (e.g. the canonical `manual` source) describe entries that are not
- * importable from disk and must be set through other means
- * (`vibes secrets set`, generated tokens, Cloudflare dashboard, etc.).
- */
-export const SecretSourceSchema = z.object({
-    /** Repo-relative path to the .env file. Omit for non-importable sources. */
-    path: z.string().min(1).optional(),
-    /** Why this source owns this category of secrets (Vibes internals, providers, etc.) */
-    purpose: z.string().min(1)
-});
-export const SecretCategorySchema = z.enum([
-    'vibes-internal',
-    'vibes-auth',
-    'cloudflare',
-    'provider-llm',
-    'provider-voice',
-    'provider-search',
-    'provider-billing',
-    'provider-other'
-]);
-export const SecretManifestEntrySchema = z.object({
-    /** Canonical key in Cloudflare Secrets Store. Matches env var name unless renamed. */
-    key: z.string().regex(/^[_A-Z0-9]+$/),
-    /** Category this secret belongs to (drives source-file routing) */
-    category: SecretCategorySchema,
-    /** Preferred source file id (must exist in `sources`) */
-    source: z.string().min(1),
-    /** Alternate names this secret may appear under in the source file */
-    aliases: z.array(z.string().regex(/^[_A-Z0-9]+$/)).default([]),
-    /** Whether the secret is required for a production push */
-    required: z.boolean().default(true),
-    /** Human-readable description of what this secret unlocks */
-    description: z.string().min(1)
-});
-export const SecretsImportManifestSchema = z.object({
-    version: z.literal(1),
-    /** Map of source id → file path + purpose */
-    sources: z.record(z.string().min(1), SecretSourceSchema),
-    /** Catalog of expected secrets, keyed by canonical name */
-    secrets: z.array(SecretManifestEntrySchema)
-});
-//# sourceMappingURL=import-manifest.schema.js.map

package/dist/manifest/import-manifest.schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"import-manifest.schema.js","sourceRoot":"","sources":["../../src/manifest/import-manifest.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,uFAAuF;IACvF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IACrC,mEAAmE;IACnE,QAAQ,EAAE,oBAAoB;IAC9B,yDAAyD;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,6DAA6D;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC;IACxD,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAC"}

package/dist/manifest/index.d.ts

@@ -1,3 +0,0 @@
-export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema, type SecretsImportManifest, type SecretManifestEntry, type SecretSource, type SecretCategory } from './import-manifest.schema';
-export { canonicalImportManifest } from './canonical';
-//# sourceMappingURL=index.d.ts.map

package/dist/manifest/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/manifest/index.js

@@ -1,3 +0,0 @@
-export { SecretsImportManifestSchema, SecretManifestEntrySchema, SecretSourceSchema, SecretCategorySchema } from './import-manifest.schema.js';
-export { canonicalImportManifest } from './canonical.js';
-//# sourceMappingURL=index.js.map

package/dist/manifest/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manifest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EAKpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/requirements/index.d.ts

@@ -1,2 +0,0 @@
-export { resolveSecretRequirements, groupRequirementsByApp, uniqueSecretKeys, type SecretRequirement } from './resolver';
-//# sourceMappingURL=index.d.ts.map

package/dist/requirements/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,MAAM,YAAY,CAAC"}

package/dist/requirements/index.js

@@ -1,2 +0,0 @@
-export { resolveSecretRequirements, groupRequirementsByApp, uniqueSecretKeys } from './resolver.js';
-//# sourceMappingURL=index.js.map

package/dist/requirements/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/requirements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAEhB,MAAM,YAAY,CAAC"}

package/dist/requirements/resolver.d.ts

@@ -1,52 +0,0 @@
-/**
- * Secret Requirements Resolver
- *
- * Resolves secret requirements from two intentional sources:
- *
- * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
- *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
- *    declare secrets here because they are infrastructure resources, not web apps.
- *    The `infra/web-app` path is kept for completeness but no longer discovers
- *    vestigial descriptors (deleted 2026-05-20).
- *
- * 2. `deployment.config.ts` files — the canonical per-app deployment system.
- *    Loads each config via `@vibesdotdev/infra-deploy` and extracts `secret: true`
- *    env entries from the `AppDeployment.env` array. This is the authoritative
- *    source for web-app secrets.
- *
- * The two-system split is intentional, not transitional:
- * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
- * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
- *
- * Used by `vibes secrets check` to cross-reference stored secrets against
- * declared requirements.
- */
-import type { SecretRequirement, SecretRequirementsRuntime } from './schemas/requirements';
-export type { SecretRequirement } from './schemas/requirements';
-/**
- * Resolve all secret requirements from infra descriptors and deployment configs.
- *
- * Queries two sources:
- * 1. Runtime for `infra/worker` descriptors (`.infra.ts` — workers + infrastructure)
- * 2. `deployment.config.ts` files via `@vibesdotdev/infra-deploy` (web apps)
- *
- * These two sources are mutually exclusive by app type, so there should be no
- * overlap. Both are queried to cover the full surface:
- * - Workers declare secrets in `.infra.ts` (job-workers, ai-workers, etc.)
- * - Web apps declare secrets in `deployment.config.ts` (auth-web, ai-web, etc.)
- *
- * Deployment config entries are appended after descriptor entries.
- * Duplicates are harmless for check reporting.
- */
-export declare function resolveSecretRequirements(runtime: SecretRequirementsRuntime, options?: {
-    deploymentConfigRoot?: string;
-}): Promise<SecretRequirement[]>;
-/**
- * Group requirements by app/worker ID for per-app reporting.
- */
-export declare function groupRequirementsByApp(requirements: SecretRequirement[]): Map<string, SecretRequirement[]>;
-/**
- * Get unique secret keys across all apps (deduped).
- */
-export declare function uniqueSecretKeys(requirements: SecretRequirement[]): string[];
-//# sourceMappingURL=resolver.d.ts.map

package/dist/requirements/resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/requirements/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAEX,iBAAiB,EACjB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA2GhE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoC9B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,YAAY,EAAE,iBAAiB,EAAE,GAC/B,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAQlC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE5E"}