@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/backends/vault/vault-kv.js

@@ -0,0 +1,108 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { KvListSchema, KvReadSchema, LoginSchema } from "../../schemas/backends/vault.schema.js";
+import { VAULT_REQUEST_TIMEOUT_MS } from "./secrets-vault.client.js";
+import { failure, statusFailure, vaultPathAbsent } from "./vault-failures.js";
+import { assertSendableToken, fetchVault, readVaultJson, vaultRequestUrl } from "./vault-transport.js";
+export const K8S_AUTH_MOUNT = 'kubernetes';
+export function timeoutOf(config) {
+    return config.requestTimeoutMs ?? VAULT_REQUEST_TIMEOUT_MS;
+}
+export async function getVaultToken(config) {
+    const resolvedToken = (await config.resolveToken?.())?.trim() ?? config.token;
+    if (resolvedToken)
+        return resolvedToken;
+    const hint = config.tokenEnvVar
+        ? `Configure ${config.tokenEnvVar} in a credential store or run inside Kubernetes.`
+        : 'Configure a token credential reference on the vault descriptor or run inside Kubernetes.';
+    if (!config.readServiceAccountToken) {
+        throw failure(`Cannot authenticate to Vault: no token is configured. ${hint}`, 'AUTH_REQUIRED', 'vault-unauthenticated', {
+            retryable: false
+        });
+    }
+    let jwt;
+    try {
+        jwt = (await config.readServiceAccountToken()).trim();
+    }
+    catch (thrown) {
+        throw new CapabilityError(`Cannot authenticate to Vault: the Kubernetes service-account token could not be read. ${hint}`, 'AUTH_REQUIRED', {
+            reason: 'vault-unauthenticated',
+            retryable: false,
+            cause: CaughtFailureSchema.parse(thrown)
+        });
+    }
+    const role = config.k8sRole ?? 'staging-app';
+    const res = await fetchVault(vaultRequestUrl(config.address, config.allowLoopbackHttp, `/v1/auth/${K8S_AUTH_MOUNT}/login`), { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ jwt, role }) }, timeoutOf(config), 'Vault Kubernetes login');
+    if (!res.ok) {
+        await res.body?.cancel();
+        throw statusFailure('Vault Kubernetes login', res.status);
+    }
+    return (await readVaultJson(res, LoginSchema, 'Vault Kubernetes login')).auth.client_token;
+}
+export async function vaultFetchResponse(config, path, operation, init) {
+    // The address is checked before the token is read or any credential is touched.
+    const target = vaultRequestUrl(config.address, config.allowLoopbackHttp, path);
+    const token = await getVaultToken(config);
+    assertSendableToken(token);
+    const headers = {
+        'X-Vault-Token': token,
+        'Content-Type': 'application/json',
+        ...init?.headers
+    };
+    return fetchVault(target, { ...init, headers }, timeoutOf(config), operation);
+}
+/**
+ * The key/value data at one KV path, as own properties. A missing path is the
+ * typed absence (`isAbsenceOf(error, 'secrets/vault', path)`); every other
+ * failure is typed with its own reason.
+ */
+export async function readKVSecret(config, path) {
+    const operation = 'Vault KV read';
+    const res = await vaultFetchResponse(config, `/v1/${config.mount}/data/${path}`, operation);
+    if (res.status === 404) {
+        await res.body?.cancel();
+        throw vaultPathAbsent(path);
+    }
+    if (!res.ok) {
+        await res.body?.cancel();
+        throw statusFailure(operation, res.status);
+    }
+    const body = await readVaultJson(res, KvReadSchema, operation);
+    // `fromEntries` defines own properties: a stored `__proto__` key stays data.
+    return Object.fromEntries(Object.entries(body.data.data));
+}
+export async function writeKVSecret(config, path, data) {
+    const operation = 'Vault KV write';
+    const res = await vaultFetchResponse(config, `/v1/${config.mount}/data/${path}`, operation, {
+        method: 'POST',
+        body: JSON.stringify({ data })
+    });
+    await res.body?.cancel();
+    if (!res.ok)
+        throw statusFailure(operation, res.status);
+}
+export async function deleteKVKey(config, path, key) {
+    const current = await readKVSecret(config, path);
+    if (!Object.hasOwn(current, key))
+        return;
+    await writeKVSecret(config, path, Object.fromEntries(Object.entries(current).filter(([name]) => name !== key)));
+}
+/**
+ * The child keys under one KV metadata path. A path with no metadata lists as
+ * empty (confirmed absence); every other failure is typed and propagates, never
+ * an empty list.
+ */
+export async function listKVPaths(config, path) {
+    const operation = 'Vault KV list';
+    // Vault's LIST verb is `GET ?list=true`: a runtime's fetch may rewrite an unknown method to GET (Bun does).
+    const res = await vaultFetchResponse(config, `/v1/${config.mount}/metadata/${path}?list=true`, operation);
+    if (res.status === 404) {
+        await res.body?.cancel();
+        return [];
+    }
+    if (!res.ok) {
+        await res.body?.cancel();
+        throw statusFailure(operation, res.status);
+    }
+    return (await readVaultJson(res, KvListSchema, operation)).data.keys;
+}
+//# sourceMappingURL=vault-kv.js.map

package/dist/backends/vault/vault-kv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-kv.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-kv.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EAAC,mBAAmB,EAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAC,YAAY,EAAC,WAAW,EAAyB,MAAM,wCAAwC,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,OAAO,EAAC,aAAa,EAAC,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAC,UAAU,EAAC,aAAa,EAAC,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEpG,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,UAAU,SAAS,CAAC,MAAqC;IAC9D,OAAO,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAyB;IAC5D,MAAM,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC;IAC9E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW;QAC9B,CAAC,CAAC,aAAa,MAAM,CAAC,WAAW,kDAAkD;QACnF,CAAC,CAAC,0FAA0F,CAAC;IAC9F,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,yDAAyD,IAAI,EAAE,EAAE,eAAe,EAAE,uBAAuB,EAAE;YACxH,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,yFAAyF,IAAI,EAAE,EAAE,eAAe,EAAE;YAC3I,MAAM,EAAE,uBAAuB;YAC/B,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC;SACxC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,YAAY,cAAc,QAAQ,CAAC,EAC7F,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EACxG,SAAS,CAAC,MAAM,CAAC,EACjB,wBAAwB,CACxB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,MAAyB,EACzB,IAAY,EACZ,SAAiB,EACjB,IAAkB;IAElB,gFAAgF;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG;QACf,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,kBAAkB;QAClC,GAAG,IAAI,EAAE,OAAO;KAChB,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAyB,EAAE,IAAY;IACzE,MAAM,SAAS,GAAG,eAAe,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,SAAS,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,6EAA6E;IAC7E,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAyB,EACzB,IAAY,EACZ,IAA4B;IAE5B,MAAM,SAAS,GAAG,gBAAgB,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,SAAS,IAAI,EAAE,EAAE,SAAS,EAAE;QAC3F,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,MAAyB,EACzB,IAAY,EACZ,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;QAAE,OAAO;IACzC,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,EAAE,IAAY;IACxE,MAAM,SAAS,GAAG,eAAe,CAAC;IAClC,4GAA4G;IAC5G,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,aAAa,IAAI,YAAY,EAAE,SAAS,CAAC,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/backends/vault/vault-transport.d.ts

@@ -0,0 +1,22 @@
+import * as z from 'zod/v4';
+/**
+ * The base URL (no trailing slash) of a Vault address, parsed as `https` or, on a
+ * development host, `http` to loopback. A token, a service-account JWT and unseal
+ * keys ride every request to it, so any other address (plain `http`, userinfo, a
+ * query or fragment, text that is not a URL) is refused BEFORE a request exists.
+ */
+export declare function vaultBase(address: string, allowLoopbackHttp: boolean | undefined): string;
+export declare function vaultRequestUrl(address: string, allowLoopbackHttp: boolean | undefined, path: string): string;
+/** A token no header can carry is refused by shape: the runtime's own TypeError would quote it. */
+export declare function assertSendableToken(token: string): void;
+export declare function isRedirectStatus(status: number): boolean;
+export declare function sameVaultUrl(left: string, right: string): boolean;
+/**
+ * One Vault request with its deadline. A redirect is refused (the token would
+ * ride it); a transport failure is `UNAVAILABLE vault-unreachable`, a deadline
+ * `vault-timeout`, both retryable. The body is not read here.
+ */
+export declare function fetchVault(url: string, init: RequestInit, timeoutMs: number, operation: string): Promise<Response>;
+/** The parsed JSON body of an answered request; a body that is not the expected shape is `INTERNAL vault-response-invalid`. */
+export declare function readVaultJson<S extends z.ZodType>(response: Response, schema: S, operation: string): Promise<z.output<S>>;
+//# sourceMappingURL=vault-transport.d.ts.map

package/dist/backends/vault/vault-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-transport.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-transport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAQ5B;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAKzF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7G;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKvD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQjE;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BxH;AAED,+HAA+H;AAC/H,wBAAsB,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EACtD,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAuBtB"}

package/dist/backends/vault/vault-transport.js

@@ -0,0 +1,104 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { isDeadlineFailure, readBoundedText } from "../../transport/bounded-body.js";
+import { isSendableHeaderValue } from "../../transport/header-value.js";
+import { parseJsonBody } from "../../transport/json-body.js";
+import { parseSecureUrl, redactUrlForDisplay } from "../../transport/secure-url.js";
+import { VAULT_MAX_BODY_BYTES } from "./secrets-vault.client.js";
+import { addressInvalid, failure } from "./vault-failures.js";
+/**
+ * The base URL (no trailing slash) of a Vault address, parsed as `https` or, on a
+ * development host, `http` to loopback. A token, a service-account JWT and unseal
+ * keys ride every request to it, so any other address (plain `http`, userinfo, a
+ * query or fragment, text that is not a URL) is refused BEFORE a request exists.
+ */
+export function vaultBase(address, allowLoopbackHttp) {
+    const parsed = parseSecureUrl(address, { allowLoopbackHttp: allowLoopbackHttp === true });
+    if (!parsed.ok)
+        throw addressInvalid(parsed.problem);
+    if (parsed.url.search.length > 0 || parsed.url.hash.length > 0)
+        throw addressInvalid('query-or-fragment-not-allowed');
+    return `${parsed.url.origin}${parsed.url.pathname.replace(/\/+$/, '')}`;
+}
+export function vaultRequestUrl(address, allowLoopbackHttp, path) {
+    return `${vaultBase(address, allowLoopbackHttp)}${path.startsWith('/') ? path : `/${path}`}`;
+}
+/** A token no header can carry is refused by shape: the runtime's own TypeError would quote it. */
+export function assertSendableToken(token) {
+    if (isSendableHeaderValue(token))
+        return;
+    throw failure('The Vault token is not a value a header can carry; nothing was sent.', 'INVALID_INPUT', 'vault-token-invalid', {
+        retryable: false
+    });
+}
+export function isRedirectStatus(status) {
+    return status >= 300 && status < 400;
+}
+export function sameVaultUrl(left, right) {
+    if (!URL.canParse(left) || !URL.canParse(right)) {
+        return left.replace(/\/+$/, '') === right.replace(/\/+$/, '');
+    }
+    const a = new URL(left);
+    const b = new URL(right);
+    const path = (value) => (value === '/' ? '' : value.replace(/\/+$/, ''));
+    return a.origin === b.origin && path(a.pathname) === path(b.pathname);
+}
+/**
+ * One Vault request with its deadline. A redirect is refused (the token would
+ * ride it); a transport failure is `UNAVAILABLE vault-unreachable`, a deadline
+ * `vault-timeout`, both retryable. The body is not read here.
+ */
+export async function fetchVault(url, init, timeoutMs, operation) {
+    let res;
+    try {
+        res = await fetch(url, { ...init, redirect: 'manual', signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (thrown) {
+        const cause = CaughtFailureSchema.parse(thrown);
+        if (isDeadlineFailure(cause)) {
+            throw new CapabilityError(`${operation} timed out after ${timeoutMs} ms.`, 'UNAVAILABLE', { reason: 'vault-timeout', retryable: true, cause });
+        }
+        throw new CapabilityError(`${operation} could not reach Vault.`, 'UNAVAILABLE', { reason: 'vault-unreachable', retryable: true, cause });
+    }
+    if (!isRedirectStatus(res.status))
+        return res;
+    await res.body?.cancel();
+    const location = res.headers.get('location');
+    const target = location && URL.canParse(location, url) ? new URL(location, url).toString() : '';
+    // Only whether the redirect points back at the configured address is said: where else it points
+    // is the server's text, and is never echoed (a host or path there may carry a token).
+    const selfRedirect = target !== '' && sameVaultUrl(url, target);
+    throw failure(`Vault at ${redactUrlForDisplay(url)} returned HTTP ${res.status} — ` +
+        (selfRedirect
+            ? 'that hostname 308-redirects to itself and is not a Vault API.'
+            : 'the Vault client does not follow redirects.') +
+        ' Use `--backend vault` only against a real Vault. Operator keys are in `vibes secrets --environment local`.', 'UNAVAILABLE', 'vault-unexpected-redirect', { retryable: false, details: { status: res.status, selfRedirect } });
+}
+/** The parsed JSON body of an answered request; a body that is not the expected shape is `INTERNAL vault-response-invalid`. */
+export async function readVaultJson(response, schema, operation) {
+    let read;
+    try {
+        read = await readBoundedText(response, VAULT_MAX_BODY_BYTES);
+    }
+    catch (thrown) {
+        const cause = CaughtFailureSchema.parse(thrown);
+        if (isDeadlineFailure(cause)) {
+            throw new CapabilityError(`${operation} timed out reading the response.`, 'UNAVAILABLE', { reason: 'vault-timeout', retryable: true, cause });
+        }
+        throw new CapabilityError(`${operation} could not read the response.`, 'UNAVAILABLE', { reason: 'vault-unreachable', retryable: true, cause });
+    }
+    if (read.truncated) {
+        throw failure(`${operation} returned a body larger than ${VAULT_MAX_BODY_BYTES} bytes.`, 'INTERNAL', 'vault-response-too-large', {
+            retryable: false
+        });
+    }
+    const outcome = parseJsonBody(read.text, schema);
+    if (outcome.ok)
+        return outcome.data;
+    // The parser's own error quotes the body, which may hold a secret: the refusal carries the problem, not the failure.
+    throw failure(`${operation} returned a body that is not the expected shape.`, 'INTERNAL', 'vault-response-invalid', {
+        retryable: false,
+        details: { problem: outcome.problem }
+    });
+}
+//# sourceMappingURL=vault-transport.js.map

package/dist/backends/vault/vault-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-transport.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EAAC,mBAAmB,EAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAC,eAAe,EAAmB,MAAM,iCAAiC,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAC,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAC,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,iBAAsC;IAChF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,cAAc,CAAC,+BAA+B,CAAC,CAAC;IACtH,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,iBAAsC,EAAE,IAAY;IACpG,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,MAAM,OAAO,CAAC,sEAAsE,EAAE,eAAe,EAAE,qBAAqB,EAAE;QAC7H,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACvD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAiB,EAAE,SAAiB,EAAE,SAAiB;IACpG,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,oBAAoB,SAAS,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,yBAAyB,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1I,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,gGAAgG;IAChG,sFAAsF;IACtF,MAAM,YAAY,GAAG,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,OAAO,CACZ,YAAY,mBAAmB,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK;QACrE,CAAC,YAAY;YACZ,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,6CAA6C,CAAC;QACjD,6GAA6G,EAC7G,aAAa,EACb,2BAA2B,EAC3B,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CACnE,CAAC;AACH,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,QAAkB,EAClB,MAAS,EACT,SAAiB;IAEjB,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,kCAAkC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,+BAA+B,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,SAAS,gCAAgC,oBAAoB,SAAS,EAAE,UAAU,EAAE,0BAA0B,EAAE;YAChI,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpC,qHAAqH;IACrH,MAAM,OAAO,CAAC,GAAG,SAAS,kDAAkD,EAAE,UAAU,EAAE,wBAAwB,EAAE;QACnH,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC"}

package/dist/backends/vault/vault-unseal.sources.d.ts

@@ -0,0 +1,12 @@
+import type { UnsealSourceOutcome } from '../../schemas/backends/unseal.schema.ts';
+import { type VaultUnsealSourceSpec } from "../../schemas/backends/vault.schema.ts";
+export type { UnsealSourceOutcome } from '../../schemas/backends/unseal.schema.ts';
+export declare function uniqueNonEmpty(values: string[]): string[];
+/**
+ * The numbered unseal keys (`VAULT_UNSEAL_KEY_1` … `_10`) one credential store
+ * holds, read through that store's own `read`. There is no ambient
+ * environment lookup: a key reaches the backend only through a store.
+ */
+export declare function collectStoredUnsealKeys(read: (name: string) => Promise<string | undefined>, prefix?: string, maxKeys?: number): Promise<string[]>;
+export declare function collectUnsealKeysFromSources(specs: VaultUnsealSourceSpec[], allowLoopbackHttp: boolean | undefined, resolveSourceToken?: (tokenRef: string) => Promise<string | undefined>): Promise<UnsealSourceOutcome>;
+//# sourceMappingURL=vault-unseal.sources.d.ts.map

package/dist/backends/vault/vault-unseal.sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-unseal.sources.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/vault-unseal.sources.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAK3G,YAAY,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAUzD;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,EACnD,MAAM,SAAsB,EAC5B,OAAO,SAAK,GACV,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAED,wBAAsB,4BAA4B,CACjD,KAAK,EAAE,qBAAqB,EAAE,EAC9B,iBAAiB,EAAE,OAAO,GAAG,SAAS,EACtC,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GACpE,OAAO,CAAC,mBAAmB,CAAC,CAoD9B"}

package/dist/backends/vault/vault-unseal.sources.js

@@ -0,0 +1,87 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import {} from "../../schemas/backends/vault.schema.js";
+import { redactUrlForDisplay } from "../../transport/secure-url.js";
+import { logger } from "./secrets-vault.client.js";
+import { readKVSecret } from "./vault-kv.js";
+import { vaultBase } from "./vault-transport.js";
+export function uniqueNonEmpty(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        if (!value)
+            continue;
+        if (seen.has(value))
+            continue;
+        seen.add(value);
+        out.push(value);
+    }
+    return out;
+}
+/**
+ * The numbered unseal keys (`VAULT_UNSEAL_KEY_1` … `_10`) one credential store
+ * holds, read through that store's own `read`. There is no ambient
+ * environment lookup: a key reaches the backend only through a store.
+ */
+export async function collectStoredUnsealKeys(read, prefix = 'VAULT_UNSEAL_KEY_', maxKeys = 10) {
+    const keys = [];
+    for (let i = 1; i <= maxKeys; i++) {
+        const value = (await read(`${prefix}${i}`))?.trim();
+        if (value)
+            keys.push(value);
+    }
+    return keys;
+}
+export async function collectUnsealKeysFromSources(specs, allowLoopbackHttp, resolveSourceToken) {
+    const keys = [];
+    const failures = [];
+    // A misconfigured source address is a refusal, not an unreachable source: every address is
+    // checked before ANY source is asked, so no token goes to one of them in the clear.
+    for (const spec of specs)
+        vaultBase(spec.address, allowLoopbackHttp);
+    for (const spec of specs) {
+        const sourceConfig = {
+            address: spec.address,
+            mount: spec.mount,
+            token: spec.token,
+            tokenEnvVar: spec.tokenEnvVar,
+            resolveToken: !spec.token && spec.tokenEnvVar && resolveSourceToken
+                ? () => resolveSourceToken(spec.tokenEnvVar)
+                : undefined,
+            allowLoopbackHttp
+        };
+        // Declared-optional: an unreachable unseal source must not block the others. The read is
+        // settled, not caught: the failure is kept as data, so a Vault that then cannot be
+        // unsealed reports why.
+        const [read] = await Promise.allSettled([readKVSecret(sourceConfig, spec.path)]);
+        if (read.status === 'rejected') {
+            const failed = CapabilityError.from(CaughtFailureSchema.parse(read.reason));
+            failures.push(failed);
+            logger.warn('Vault unseal source failed; continuing to next source', {
+                address: redactUrlForDisplay(spec.address),
+                path: spec.path,
+                error: failed.reason
+            });
+            continue;
+        }
+        const secret = read.value;
+        if (spec.keyFields && spec.keyFields.length > 0) {
+            for (const field of spec.keyFields) {
+                const value = Object.hasOwn(secret, field) ? secret[field] : undefined;
+                if (value)
+                    keys.push(value);
+            }
+        }
+        else {
+            const discovered = Object.keys(secret)
+                .filter((k) => /^VAULT_UNSEAL_KEY_\d+$/.test(k))
+                .sort((a, b) => Number(a.split('_').pop()) - Number(b.split('_').pop()));
+            for (const field of discovered) {
+                const value = secret[field];
+                if (value)
+                    keys.push(value);
+            }
+        }
+    }
+    return { keys: uniqueNonEmpty(keys), failures };
+}
+//# sourceMappingURL=vault-unseal.sources.js.map

package/dist/backends/vault/vault-unseal.sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-unseal.sources.js","sourceRoot":"","sources":["../../../src/backends/vault/vault-unseal.sources.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EACf,mBAAmB,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAqD,MAAM,wCAAwC,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,IAAmD,EACnD,MAAM,GAAG,mBAAmB,EAC5B,OAAO,GAAG,EAAE;IAEZ,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC,IAAI,OAAO,EAAC,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,KAA8B,EAC9B,iBAAsC,EACtC,kBAAsE;IAEtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAY,EAAE,CAAC;IAE7B,2FAA2F;IAC3F,oFAAoF;IACpF,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAErE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAsB;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EACX,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,kBAAkB;gBACpD,CAAC,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAY,CAAC;gBAC7C,CAAC,CAAC,SAAS;YACb,iBAAiB;SACjB,CAAC;QACF,yFAAyF;QACzF,mFAAmF;QACnF,wBAAwB;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACpE,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,MAAM,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvE,IAAI,KAAK;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;iBACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,KAAK;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/docs/backends.docs.descriptor.d.ts

@@ -1,4 +1,4 @@
-import type { DocsTopicDescriptor } from '@vibesdotdev/docs';
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
 declare const descriptor: DocsTopicDescriptor;
 export default descriptor;
 //# sourceMappingURL=backends.docs.descriptor.d.ts.map

package/dist/docs/backends.docs.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backends.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/backends.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,QAAA,MAAM,UAAU,EAAE,mBAkJjB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"backends.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/backends.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBAmFjB,CAAC;AACF,eAAe,UAAU,CAAC"}

package/dist/docs/backends.docs.descriptor.js

@@ -1,149 +1,86 @@
 const descriptor = {
-    kind: 'docs/topic',
-    id: 'secrets.backends',
-    title: 'Secret Backends',
-    summary: 'Pluggable secret storage backends (vault, wrangler, encrypted-local)',
+    kind: 'docs/topic', id: 'secrets.backends', title: 'Secret Backends',
+    summary: 'Runtime-resolved secret stores and explicit provider integrations',
     body: {
-        type: 'markdown',
-        sourceType: 'raw',
-        source: `---
-title: Secret Backends
-summary: Pluggable secret storage backends for different environments
-tags: [secrets, backends, vault, wrangler, encryption]
-parent: secrets
-order: 1
-surfaces: [cli, web, in-app]
-hardware: [consumer, cloud]
----
+        type: 'markdown', sourceType: 'raw',
+        source: `# Secret backends
 
-The secrets package uses a **pluggable backend architecture** to support different secret storage mechanisms across environments. Backends register themselves as \`secrets/store\` descriptors with the runtime.
+Backends register a secrets/store descriptor and a lazy implementation loader.
+The runtime parses descriptors and selects the store for its declared tier.
 
-## Available backends
+## Stores shipped here
 
-### Vault backend (production cloud)
+- **encrypted-local:** encrypted local JSON storage, using the runtime's active home and encryption owner.
+- **env-file:** plaintext environment files; use only where plaintext storage is appropriate.
+- **mounted-files:** read-only credentials in the declared VIBES_SECRETS_MOUNT_DIR. An undeclared directory registers no store.
+- **host-credentials:** the keys named by a live captured publisher manifest. Stale publishers fail closed.
+- **vault:** a generic Vault KV client and store factory. The composing application supplies a descriptor and plugin; this package supplies no default server or account.
 
-HashiCorp Vault backend for production cloud deployments:
+Compose backend plugins through their public subpaths, for example:
 
 \`\`\`ts
-import { vaultBackend } from '@vibesdotdev/secrets-backend-vault';
+import secretsPlugin from '@vibesdotdev/secrets/plugin';
+import encryptedLocalPlugin from '@vibesdotdev/secrets/backends/encrypted-local/plugin';
 
-await runtime.registerPlugin(vaultBackend.plugin({
-  address: process.env.VAULT_ADDR,
-  token: process.env.VAULT_TOKEN
-}));
+// Include both plugins in the host composition.
+const store = await runtime.query('secrets/store').resolve();
 \`\`\`
 
-**Use when:** Running in production cloud environments with Vault infrastructure.
+## Resolution
 
-### Wrangler secrets (Cloudflare Workers)
+Eligible scope stores declare the active tier in their tiers array. The unique
+highest priority wins. A highest-priority tie refuses INVALID_INPUT
+store-ambiguous. It never silently chooses the first registered store.
+The supported tiers are local, dev, staging, and production.
 
-Cloudflare Workers secrets via Wrangler:
+An explicit by-id descriptor remains available with withId(id), and does not
+participate in generic selection. This supports identity-scoped and opt-in stores.
+Missing implementations and backend failures propagate through the runtime;
+consumers do not substitute process environment reads.
 
-\`\`\`ts
-import { wranglerBackend } from '@vibesdotdev/secrets-backend-wrangler';
-
-await runtime.registerPlugin(wranglerBackend.plugin());
-\`\`\`
-
-**Use when:** Deploying to Cloudflare Workers edge runtime.
-
-### Encrypted local backend (development)
-
-Local development with encryption at rest:
-
-\`\`\`ts
-import { encryptedLocalBackend } from '@vibesdotdev/secrets-backend-encrypted-local';
+## Provider integration ownership
 
-await runtime.registerPlugin(encryptedLocalBackend.plugin({
-  keyPath: '.vibes/secrets.key',
-  dataPath: '.vibes/secrets.enc.json'
-}));
-\`\`\`
-
-**Use when:** Local development, testing, or single-user consumer apps.
-
-## Backend resolution
-
-The runtime selects backends based on **environment tier** and **priority**:
-
-\`\`\`ts
-const store = await runtime.query('secrets/store')
-  .forHardware('consumer')
-  .resolve();
-
-// Resolution logic:
-// 1. Filter by environment tier (from scope qualifiers)
-// 2. Sort by priority (higher = preferred)
-// 3. Return first match
-\`\`\`
+Provider-specific plugins live with their integration owner. For example,
+@vibesdotdev/integrations-vibes/secrets/platform-api bridges managed,
+identity-scoped secrets to the store kind. It is explicitly selected by id;
+priority does not make it an infrastructure-tier fallback. The serving application
+owns authorization and persistence. Integration documentation owns its settings.
 
-Environment tiers:
-- \`local\` — Development environments
-- \`staging\` — Staging/pre-production
-- \`production\` — Production cloud
+Cloud provider write-only stores can accept deployment credentials without being
+able to reveal them. A source that lists a key but cannot read its value is refused
+by transfer operations; it is never silently copied as an empty store.
 
-## WRONG: Hardcoding backend selection
+## Registering a generic Vault store
 
 \`\`\`ts
-// ❌ NEVER — bypasses tier-based resolution
-const store = await runtime.query('secrets/store')
-  .withId('encrypted-local')
-  .resolve();
-\`\`\`
-
-## RIGHT: Hardware-scoped resolution
-
-\`\`\`ts
-// ✅ Let runtime select based on tier + priority
-const store = await runtime.query('secrets/store')
-  .forHardware('consumer')
-  .resolve();
-\`\`\`
-
-## Backend registration
-
-Backends register as \`secrets/store\` descriptors:
-
-\`\`\`ts
-export const vaultBackend = createRuntimePlugin({
-  id: 'secrets-backend-vault',
-  descriptors: [{
-    kind: 'secrets/store',
-    id: 'vault',
-    title: 'HashiCorp Vault',
-    tiers: ['production'],
-    priority: 100,  // highest priority for production
-    implementation: VaultStoreImplementation
-  }]
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { SecretsStoreDescriptorSchema } from '@vibesdotdev/secrets/kinds/store.schema';
+import { createVaultStore } from '@vibesdotdev/secrets/backends/vault';
+
+const descriptor = SecretsStoreDescriptorSchema.parse({
+ kind: 'secrets/store', id: 'vault', backend: 'vault',
+ tiers: ['staging', 'production'], priority: 30, selection: 'by-id',
+ config: { address: 'https://vault.example.test', paths: 'app', writePath: 'app' }
+});
+const plugin = createRuntimePlugin({
+ id: 'example.secrets-vault', name: 'Example Vault store', dependencies: ['secrets'],
+ descriptors: [descriptor],
+ onRegister(runtime) {
+  runtime.registerLoader('secrets/store', descriptor.id,
+   async () => createVaultStore(runtime, descriptor));
+ }
 });
 \`\`\`
 
-## Missing backend behavior
-
-**Hard rule:** Missing backends cause hard failure. The \`resolve()\` method throws if no backend has registered for the current scope.
-
-\`\`\`ts
-try {
-  const store = await runtime.query('secrets/store').resolve();
-} catch (error) {
-  // No backend registered for current tier/hardware
-  console.error('No secrets backend available');
-}
-\`\`\`
+## Selecting another tier
 
-:::card{title="See also"}
-- [\`secrets.encryption\`](secrets.encryption) — Encryption at rest, key management
-- [\`secrets.env-file\`](secrets.env-file) — .env file handling
-- [\`config/environment\`](config.environment) — Environment tier configuration
-:::
+resolveSecretsStore(runtime, tier) uses the same priority and ambiguity rules.
+It returns null when no kind or eligible store exists. A registered loader failure
+propagates. The caller must handle absence before using the store.
 `
     },
-    parent: 'secrets',
-    order: 1,
-    tags: ['secrets', 'backends', 'vault', 'wrangler', 'encryption'],
-    surfaces: ['cli', 'web', 'in-app'],
-    hardware: ['consumer', 'cloud'],
-    enabled: true
+    parent: 'secrets', order: 1, tags: ['secrets', 'backends', 'encryption'],
+    surfaces: ['cli', 'web', 'in-app'], hardware: ['consumer', 'cloud'], enabled: true
 };
 export default descriptor;
 //# sourceMappingURL=backends.docs.descriptor.js.map

package/dist/docs/backends.docs.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"backends.docs.descriptor.js","sourceRoot":"","sources":["../../src/docs/backends.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACtC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,sEAAsE;IAC/E,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkIX;KACE;IACD,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC;IAChE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IAClC,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"backends.docs.descriptor.js","sourceRoot":"","sources":["../../src/docs/backends.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB;IACpE,OAAO,EAAE,mEAAmE;IAC5E,IAAI,EAAE;QACL,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK;QACnC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ET;KACC;IACD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC;IACxE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI;CAClF,CAAC;AACF,eAAe,UAAU,CAAC"}

package/dist/docs/encryption.docs.descriptor.d.ts

@@ -1,4 +1,4 @@
-import type { DocsTopicDescriptor } from '@vibesdotdev/docs';
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
 declare const descriptor: DocsTopicDescriptor;
 export default descriptor;
 //# sourceMappingURL=encryption.docs.descriptor.d.ts.map

package/dist/docs/encryption.docs.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/encryption.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,QAAA,MAAM,UAAU,EAAE,mBAgKjB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"encryption.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/encryption.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBA0JjB,CAAC;AAEF,eAAe,UAAU,CAAC"}