@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/src/cli/export/secrets.export.cli-command.impl.ts

@@ -1,139 +0,0 @@
-import { resolve, dirname } from 'node:path';
-import { mkdir, writeFile, chmod, rename } from 'node:fs/promises';
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { AuditLogInput } from '@vibesdotdev/logging';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor, EnvironmentTier } from '../../kinds/store.schema';
-import { canonicalImportManifest } from '../../manifest/canonical';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-const LOCAL_BACKENDS = new Set(['env-file', 'encrypted-local']);
-
-function findSourceBackend(
-	descriptors: SecretsStoreDescriptor[],
-	tier: EnvironmentTier,
-	backendId?: string
-): SecretsStoreDescriptor | undefined {
-	if (backendId) return descriptors.find((d) => d.id === backendId);
-	return descriptors
-		.filter((d) => d.tiers.includes(tier) && LOCAL_BACKENDS.has(d.backend))
-		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))[0];
-}
-
-function serializeEnv(secrets: Record<string, string>): string {
-	const lines = Object.keys(secrets)
-		.sort()
-		.map((key) => {
-			const value = secrets[key] ?? '';
-			const needsQuote = value.includes(' ') || value.includes('#') || value.includes('"');
-			const escaped = needsQuote ? `"${value.replace(/"/g, '\\"')}"` : value;
-			return `${key}=${escaped}`;
-		});
-	return `# Generated by 'vibes secrets export' — DO NOT COMMIT\n${lines.join('\n')}\n`;
-}
-
-async function writeEnvFile(path: string, content: string): Promise<void> {
-	const absolute = resolve(process.cwd(), path);
-	await mkdir(dirname(absolute), { recursive: true });
-	const tmp = `${absolute}.tmp.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-	await writeFile(tmp, content, { encoding: 'utf-8', mode: 0o600 });
-	await rename(tmp, absolute);
-	await chmod(absolute, 0o600);
-}
-
-async function promptConfirm(prompt: string): Promise<boolean> {
-	process.stderr.write(prompt);
-	for await (const chunk of process.stdin) {
-		const answer = (chunk as Buffer).toString('utf-8').trim().toLowerCase();
-		return answer === 'y' || answer === 'yes';
-	}
-	return false;
-}
-
-function emitAudit(input: AuditLogInput): void {
-	process.stderr.write(`[AUDIT] ${JSON.stringify({
-		id: crypto.randomUUID(),
-		timestamp: new Date().toISOString(),
-		...input
-	})}\n`);
-}
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			from?: string;
-			out?: string;
-			manifestOnly?: boolean;
-			force?: boolean;
-		};
-
-		if (!options.out) {
-			ui.error('--out <path> is required. Export refuses to write secrets to stdout.');
-			process.exit(1);
-		}
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const source = findSourceBackend(descriptors, envTier, options.from);
-		if (!source) {
-			ui.error('No local secrets store found to export from.');
-			process.exit(1);
-		}
-
-		const impl = (await runtime
-			.query('secrets/store')
-			.withId(source.id)
-			.resolve()) as SecretsStoreImplementation;
-		let secrets = await impl.getAll(envName);
-
-		if (options.manifestOnly) {
-			const manifestKeys = new Set(canonicalImportManifest.secrets.map((s) => s.key));
-			secrets = Object.fromEntries(
-				Object.entries(secrets).filter(([k]) => manifestKeys.has(k))
-			);
-		}
-
-		const count = Object.keys(secrets).length;
-		if (count === 0) {
-			ui.info(`No secrets to export from [${source.id}] for ${envName}.`);
-			return;
-		}
-
-		if (!options.force) {
-			const confirmed = await promptConfirm(
-				`\n[EXPORT] About to write ${count} secret value(s) from [${source.id}] (${envName}) to ${options.out}.\nThis bulk reveal is logged to the audit trail.\nContinue? [y/N] `
-			);
-			if (!confirmed) {
-				ui.info('Export cancelled.');
-				return;
-			}
-		}
-
-		emitAudit({
-			category: 'data_access',
-			severity: 'high',
-			action: 'secrets.export',
-			actor: { id: 'cli', type: 'user', name: 'CLI user' },
-			target: { id: source.id, type: 'secrets-store', name: source.id },
-			outcome: 'success',
-			context: {
-				environment: envName,
-				backend: source.id,
-				count,
-				manifestOnly: options.manifestOnly === true,
-				outPath: options.out
-			}
-		});
-
-		await writeEnvFile(options.out, serializeEnv(secrets));
-		ui.success(`Exported ${count} secret(s) from [${source.id}] to ${options.out} (mode 0600)`);
-	}
-};

package/src/cli/hooks/pre-commit-secrets.ts

@@ -1,73 +0,0 @@
-const SECRET_PATTERNS: Array<{ pattern: RegExp; name: string }> = [
-	{ pattern: /sk_live_[a-zA-Z0-9]{24,}/, name: 'Stripe live secret key (sk_live_)' },
-	{ pattern: /pk_live_[a-zA-Z0-9]{24,}/, name: 'Stripe live public key (pk_live_)' },
-	{ pattern: /do_[a-zA-Z0-9]{32,}/, name: 'DigitalOcean API key (do_)' },
-	{ pattern: /AKIA[a-zA-Z0-9]{16,}/, name: 'AWS access key ID (AKIA)' },
-	{ pattern: /ghp_[a-zA-Z0-9]{36}/, name: 'GitHub personal access token (ghp_)' },
-	{ pattern: /gho_[a-zA-Z0-9]{36}/, name: 'GitHub OAuth token (gho_)' }
-];
-
-export async function runSecretsPreCommitCheck(workspacePath: string): Promise<number> {
-	const { execSync } = await import('node:child_process');
-
-	let stagedFiles: string[];
-	try {
-		const output = execSync('git diff --cached --name-only --diff-filter=ACM', {
-			cwd: workspacePath,
-			encoding: 'utf-8'
-		});
-		stagedFiles = output.trim().split('\n').filter(Boolean);
-	} catch {
-		return 0;
-	}
-
-	if (!stagedFiles.length) return 0;
-
-	const violations: Array<{ file: string; name: string; line?: string }> = [];
-	const { readFileSync } = await import('node:fs');
-
-	for (const file of stagedFiles) {
-		const fullPath = `${workspacePath}/${file}`;
-
-		let content: string;
-		try {
-			content = readFileSync(fullPath, 'utf-8');
-		} catch {
-			continue;
-		}
-
-		const lines = content.split('\n');
-		for (let i = 0; i < lines.length; i++) {
-			const line = lines[i];
-			for (const { pattern, name } of SECRET_PATTERNS) {
-				if (pattern.test(line)) {
-					violations.push({
-						file,
-						name,
-						line: line.trim().substring(0, 80)
-					});
-					break;
-				}
-			}
-		}
-	}
-
-	if (violations.length > 0) {
-		process.stderr.write(`\n[SECRETS-001] ${violations.length} secret pattern(s) detected in staged files.\n\n`);
-		for (const v of violations) {
-			process.stderr.write(`  BLOCKED  ${v.file}\n`);
-			process.stderr.write(`    Pattern: ${v.name}\n`);
-			if (v.line) {
-				process.stderr.write(`    Line: ${v.line}\n`);
-			}
-			process.stderr.write('\n');
-		}
-		process.stderr.write('Commit blocked: production secrets must not be committed.\n');
-		process.stderr.write('  - Rotate any exposed keys immediately.\n');
-		process.stderr.write('  - Use `vibes secrets set` to store in a secret manager.\n');
-		process.stderr.write('  - Add to .gitignore if genuinely not a secret.\n\n');
-		return 1;
-	}
-
-	return 0;
-}

package/src/cli/import/secrets.import.cli-command.descriptor.ts

@@ -1,21 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.import',
-	name: 'import',
-	description: 'Import secrets from local root env files into a backend, driven by the canonical manifest',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--to <backend>', description: 'Target backend (default: encrypted-local)' },
-		{ flags: '--source <id>', description: 'Restrict to one source from the manifest' },
-		{ flags: '--dry-run', description: 'Show what would be imported without writing' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 30
-};
-
-export default descriptor;

package/src/cli/import/secrets.import.cli-command.impl.ts

@@ -1,178 +0,0 @@
-import { resolve } from 'node:path';
-import { readFile } from 'node:fs/promises';
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor } from '../../kinds/store.schema';
-import { canonicalImportManifest } from '../../manifest/canonical';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-/**
- * Tiny line-oriented .env parser. Returns a flat KEY → value map.
- * Quoted values are unwrapped. Comments and blank lines are ignored.
- * Missing files yield an empty map (not an error) — sources are bootstrap inputs.
- */
-async function readEnvFile(path: string): Promise<Record<string, string>> {
-	let content: string;
-	try {
-		content = await readFile(path, 'utf-8');
-	} catch {
-		return {};
-	}
-
-	const result: Record<string, string> = {};
-	for (const raw of content.split('\n')) {
-		const line = raw.trim();
-		if (line === '' || line.startsWith('#')) continue;
-		const eqIdx = raw.indexOf('=');
-		if (eqIdx === -1) continue;
-		const key = raw.slice(0, eqIdx).trim();
-		let value = raw.slice(eqIdx + 1).trim();
-		if (
-			(value.startsWith('"') && value.endsWith('"')) ||
-			(value.startsWith("'") && value.endsWith("'"))
-		) {
-			value = value.slice(1, -1);
-		}
-		result[key] = value;
-	}
-	return result;
-}
-
-function pickValue(
-	envMap: Record<string, string>,
-	key: string,
-	aliases: string[]
-): string | undefined {
-	if (envMap[key] !== undefined && envMap[key] !== '') return envMap[key];
-	for (const alias of aliases) {
-		if (envMap[alias] !== undefined && envMap[alias] !== '') return envMap[alias];
-	}
-	return undefined;
-}
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			to?: string;
-			source?: string;
-			dryRun?: boolean;
-		};
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const sourceFilter = options.source;
-		if (sourceFilter && !canonicalImportManifest.sources[sourceFilter]) {
-			ui.error(`Unknown source: ${sourceFilter}. Known: ${Object.keys(canonicalImportManifest.sources).join(', ')}`);
-			process.exit(1);
-		}
-
-		const repoRoot = process.cwd();
-		const sourceContents = new Map<string, Record<string, string>>();
-		const manualSources = new Set<string>();
-		for (const [id, src] of Object.entries(canonicalImportManifest.sources)) {
-			if (sourceFilter && id !== sourceFilter) continue;
-			if (!src.path) {
-				manualSources.add(id);
-				continue;
-			}
-			sourceContents.set(id, await readEnvFile(resolve(repoRoot, src.path)));
-		}
-
-		const found: Record<string, string> = {};
-		const missingRequired: string[] = [];
-		const missingOptional: string[] = [];
-		const manualEntries: { key: string; required: boolean }[] = [];
-
-		for (const entry of canonicalImportManifest.secrets) {
-			if (sourceFilter && entry.source !== sourceFilter) continue;
-			if (manualSources.has(entry.source)) {
-				manualEntries.push({ key: entry.key, required: entry.required });
-				continue;
-			}
-			const sourceMap = sourceContents.get(entry.source);
-			if (!sourceMap) {
-				if (entry.required) missingRequired.push(entry.key);
-				else missingOptional.push(entry.key);
-				continue;
-			}
-			const value = pickValue(sourceMap, entry.key, entry.aliases);
-			if (value === undefined) {
-				if (entry.required) missingRequired.push(entry.key);
-				else missingOptional.push(entry.key);
-				continue;
-			}
-			found[entry.key] = value;
-		}
-
-		const foundCount = Object.keys(found).length;
-
-		if (options.dryRun) {
-			ui.log(`\nDry run: would import ${foundCount} secret(s) for ${envName}\n`);
-			for (const key of Object.keys(found).sort()) ui.log(`  + ${key}`);
-			if (missingRequired.length) {
-				ui.log(`\n  ${missingRequired.length} required secret(s) not found:`);
-				for (const key of missingRequired) ui.log(`  ! ${key}`);
-			}
-			if (missingOptional.length) {
-				ui.log(`\n  ${missingOptional.length} optional secret(s) not found:`);
-				for (const key of missingOptional) ui.log(`  ? ${key}`);
-			}
-			if (manualEntries.length) {
-				ui.log(`\n  ${manualEntries.length} manual entry/entries (set via 'vibes secrets set'):`);
-				for (const { key, required } of manualEntries) {
-					ui.log(`  m ${key} (${required ? 'required' : 'optional'})`);
-				}
-			}
-			ui.log('');
-			return;
-		}
-
-		if (foundCount === 0) {
-			ui.warn('No secrets found in any source file. Nothing to import.');
-			if (missingRequired.length > 0) process.exit(1);
-			return;
-		}
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const targetId = options.to ?? 'encrypted-local';
-		const target = descriptors.find((d) => d.id === targetId)
-			?? descriptors.filter((d) => d.tiers.includes(envTier) && d.backend === 'encrypted-local')[0];
-
-		if (!target) {
-			ui.error(`No backend available with id [${targetId}] for tier ${envTier}`);
-			process.exit(1);
-		}
-
-		const impl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-		await impl.setAll(envName, found);
-
-		ui.success(`Imported ${foundCount} secret(s) into [${target.id}] for ${envName}`);
-
-		const missingManualRequired = manualEntries.filter((e) => e.required).map((e) => e.key);
-		if (manualEntries.length > 0) {
-			ui.info(
-				`${manualEntries.length} manual entry/entries — set via 'vibes secrets set <KEY>' (${
-					missingManualRequired.length
-				} required)`
-			);
-		}
-
-		if (missingRequired.length > 0) {
-			ui.warn(`${missingRequired.length} required secret(s) missing from sources: ${missingRequired.join(', ')}`);
-			process.exit(1);
-		}
-		if (missingOptional.length > 0) {
-			ui.info(`${missingOptional.length} optional secret(s) skipped: ${missingOptional.join(', ')}`);
-		}
-	}
-};

package/src/cli/list/secrets.list.cli-command.descriptor.ts

@@ -1,21 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.list',
-	name: 'list',
-	description: 'List secrets for the current environment',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--backend <id>', description: 'Filter to a specific backend' },
-
-		{ flags: '--json', description: 'Output as JSON' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 10
-};
-
-export default descriptor;

package/src/cli/list/secrets.list.cli-command.impl.ts

@@ -1,79 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretEntry, SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor } from '../../kinds/store.schema';
-import { resolveSecretRequirements } from '../../requirements/resolver';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			backend?: string;
-			json?: boolean;
-		};
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const matching = descriptors.filter((d) => {
-			if (options.backend && d.id !== options.backend) return false;
-			return d.tiers.includes(envTier);
-		});
-
-		const aggregated = new Map<string, SecretEntry>();
-		const storesByPriority = [...matching].sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
-
-		for (const desc of storesByPriority) {
-			const impl = (await runtime
-				.query('secrets/store')
-				.withId(desc.id)
-				.resolve()) as SecretsStoreImplementation;
-			const entries = await impl.list(envName);
-			for (const entry of entries) {
-				aggregated.set(entry.key, entry);
-			}
-		}
-
-		const entries = [...aggregated.values()].sort((a, b) => a.key.localeCompare(b.key));
-
-		if (options.json) {
-			const secrets = entries.map((e) => ({ key: e.key, hasValue: e.hasValue, source: e.source }));
-			ui.render({ environment: envName, secrets }, { format: 'json' });
-			return;
-		}
-
-		if (entries.length === 0) {
-			ui.info(`No secrets found for environment: ${envName}`);
-			return;
-		}
-
-		ui.log(`\nSecrets for environment: ${envName}\n`);
-		ui.log('  KEY'.padEnd(45) + 'SOURCE'.padEnd(20) + 'STATUS');
-		ui.log('  ' + '─'.repeat(70));
-
-		for (const entry of entries) {
-			const status = entry.hasValue ? 'set' : 'empty';
-			ui.log(`  ${entry.key.padEnd(43)} ${entry.source.padEnd(18)} ${status}`);
-		}
-		ui.log('');
-
-		try {
-			const requirements = await resolveSecretRequirements(runtime);
-			const required = requirements.filter((r) => r.required);
-			const setKeys = new Set(entries.filter((e) => e.hasValue).map((e) => e.key));
-			const missing = required.filter((r) => !setKeys.has(r.key));
-			if (missing.length > 0) {
-				ui.log(`  ${missing.length} required secret(s) missing. Run 'vibes secrets check' for details.`);
-				ui.log('');
-			}
-		} catch {
-			// infra kinds may not be loaded in all contexts
-		}
-	}
-};

package/src/cli/pre-commit/secrets.pre-commit-check.cli-command.descriptor.ts

@@ -1,18 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'dev.secrets.pre-commit-check',
-	name: 'pre-commit-check',
-	description: 'Run secrets pattern detection on staged files',
-	group: 'secrets',
-	options: [
-		{ flags: '--workspace <path>', description: 'Workspace root (default: cwd)' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 1
-};
-
-export default descriptor;

package/src/cli/pre-commit/secrets.pre-commit-check.cli-command.impl.ts

@@ -1,11 +0,0 @@
-import { runSecretsPreCommitCheck } from '../hooks/pre-commit-secrets';
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const options = opts as { workspace?: string };
-		const workspacePath = options.workspace ?? process.cwd();
-
-		const exitCode = await runSecretsPreCommitCheck(workspacePath);
-		process.exit(exitCode);
-	}
-};

package/src/cli/pull/secrets.pull.cli-command.descriptor.ts

@@ -1,22 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.pull',
-	name: 'pull',
-	description: 'Pull secrets from a remote backend to local store',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--from <backend>', description: 'Source remote backend (default: vault)' },
-		{ flags: '--to <backend>', description: 'Target local backend (default: encrypted-local)' },
-		{ flags: '--key <key>', description: 'Pull only one secret key (repeat or comma-separate for multiple keys)' },
-		{ flags: '--dry-run', description: 'Show what would be pulled without pulling' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 70
-};
-
-export default descriptor;

package/src/cli/pull/secrets.pull.cli-command.impl.ts

@@ -1,103 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor } from '../../kinds/store.schema';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-const LOCAL_BACKENDS = new Set(['env-file', 'encrypted-local']);
-const REMOTE_BACKENDS = new Set(['cloudflare-api', 'vault']);
-
-function parseKeyFilter(value: unknown): Set<string> | undefined {
-	const rawValues = Array.isArray(value)
-		? value.filter((entry): entry is string => typeof entry === 'string')
-		: typeof value === 'string'
-			? [value]
-			: [];
-	const keys = rawValues
-		.flatMap((entry) => entry.split(','))
-		.map((entry) => entry.trim())
-		.filter((entry) => entry.length > 0);
-	return keys.length > 0 ? new Set(keys) : undefined;
-}
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			from?: string;
-			to?: string;
-			key?: string | string[];
-			dryRun?: boolean;
-		};
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-
-		const source = options.from
-			? descriptors.find((d) => d.id === options.from)
-			: descriptors
-					.filter((d) => d.tiers.includes(envTier) && REMOTE_BACKENDS.has(d.backend))
-					.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))[0];
-
-		const target = options.to
-			? descriptors.find((d) => d.id === options.to)
-			: descriptors
-					.filter((d) => d.tiers.includes(envTier) && LOCAL_BACKENDS.has(d.backend))
-					.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))[0];
-
-		if (!source) {
-			ui.error('No remote secrets store available. Cloudflare does not support pulling secret values.');
-			process.exit(1);
-		}
-		if (!target) {
-			ui.error('No local secrets store available.');
-			process.exit(1);
-		}
-
-		if (source.backend === 'cloudflare-api' || source.backend === 'cloudflare-secrets-store') {
-			ui.warn('Cloudflare secrets backends do not expose secret values. Pull is only supported from Vault.');
-			process.exit(1);
-		}
-
-		const sourceImpl = (await runtime
-			.query('secrets/store')
-			.withId(source.id)
-			.resolve()) as SecretsStoreImplementation;
-		let secrets = await sourceImpl.getAll(envName);
-		const keyFilter = parseKeyFilter(options.key);
-		if (keyFilter) {
-			secrets = Object.fromEntries(
-				Object.entries(secrets).filter(([key]) => keyFilter.has(key))
-			);
-		}
-		const keys = Object.keys(secrets);
-
-		if (keys.length === 0) {
-			ui.info(`No secrets found in [${source.id}] for environment: ${envName}`);
-			return;
-		}
-
-		if (options.dryRun) {
-			ui.log(`\nDry run: would pull ${keys.length} secret(s) from [${source.id}] to [${target.id}]\n`);
-			for (const key of keys.sort()) {
-				ui.log(`  ${key}`);
-			}
-			ui.log('');
-			return;
-		}
-
-		const targetImpl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-		await targetImpl.setAll(envName, secrets);
-
-		ui.success(`Pulled ${keys.length} secret(s) from [${source.id}] to [${target.id}] for ${envName}`);
-	}
-};