@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/src/cli/push/secrets.push.cli-command.descriptor.ts

@@ -1,24 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.push',
-	name: 'push',
-	description: 'Deploy secrets from local store to a remote backend',
-	group: 'secrets',
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--source-env <name>', description: 'Source environment in the source backend (default: source backend\'s primary tier, e.g. "local" for encrypted-local)' },
-		{ flags: '--from <backend>', description: 'Source backend (default: highest-priority local)' },
-		{ flags: '--to <backend>', description: 'Target backend (default: highest-priority remote)' },
-		{ flags: '--key <key>', description: 'Push only one secret key (repeat or comma-separate for multiple keys)' },
-		{ flags: '--app <id>', description: 'Push only secrets required by this app' },
-		{ flags: '--dry-run', description: 'Show what would be pushed without pushing' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 60
-};
-
-export default descriptor;

package/src/cli/push/secrets.push.cli-command.impl.ts

@@ -1,149 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor, EnvironmentTier } from '../../kinds/store.schema';
-import { resolveSecretRequirements, uniqueSecretKeys } from '../../requirements/resolver';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-const LOCAL_BACKENDS = new Set(['env-file', 'encrypted-local']);
-const REMOTE_BACKENDS = new Set(['cloudflare-api', 'cloudflare-secrets-store', 'vault']);
-
-// Preferred ordering when picking a backend's primary tier as the default
-// source-env. We pick the lowest tier the backend serves (local > dev >
-// staging > production), since that's where a developer's local `secrets set`
-// writes land. Keeps `push --environment production` reading from the user's
-// machine-local store rather than stale data left in vault.environments.production
-// from a long-ago `vibes secrets import`.
-const TIER_PREFERENCE: EnvironmentTier[] = ['local', 'dev', 'staging', 'production'];
-
-function pickPrimaryTier(descriptor: SecretsStoreDescriptor): EnvironmentTier {
-	for (const tier of TIER_PREFERENCE) {
-		if (descriptor.tiers.includes(tier)) return tier;
-	}
-	return descriptor.tiers[0] ?? 'local';
-}
-
-function findBackend(
-	descriptors: SecretsStoreDescriptor[],
-	tier: EnvironmentTier,
-	backendId: string | undefined,
-	filter: Set<string>
-): SecretsStoreDescriptor | undefined {
-	if (backendId) return descriptors.find((d) => d.id === backendId);
-	return descriptors
-		.filter((d) => d.tiers.includes(tier) && filter.has(d.backend))
-		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))[0];
-}
-
-function parseKeyFilter(value: unknown): Set<string> | undefined {
-	const rawValues = Array.isArray(value)
-		? value.filter((entry): entry is string => typeof entry === 'string')
-		: typeof value === 'string'
-			? [value]
-			: [];
-	const keys = rawValues
-		.flatMap((entry) => entry.split(','))
-		.map((entry) => entry.trim())
-		.filter((entry) => entry.length > 0);
-	return keys.length > 0 ? new Set(keys) : undefined;
-}
-
-export default {
-	async execute(_args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const options = opts as {
-			environment?: string;
-			sourceEnv?: string;
-			from?: string;
-			to?: string;
-			key?: string | string[];
-			app?: string;
-			dryRun?: boolean;
-		};
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		// Pick the source backend independently of the target env tier: typical
-		// flow is "push from machine-local store to production CF store" and
-		// the local store doesn't serve the production tier.
-		const source = options.from
-			? descriptors.find((d) => d.id === options.from)
-			: descriptors
-				.filter((d) => LOCAL_BACKENDS.has(d.backend))
-				.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))[0];
-		const target = findBackend(descriptors, envTier, options.to, REMOTE_BACKENDS);
-
-		if (!source) {
-			ui.error('No local secrets store found. Set secrets with `vibes secrets set` first.');
-			process.exit(1);
-		}
-		if (!target) {
-			ui.error('No remote secrets store available for this environment tier.');
-			process.exit(1);
-		}
-
-		// Source env defaults to the source backend's primary tier (e.g. 'local'
-		// for encrypted-local), NOT the target env. Reading from `getAll(envName)`
-		// blindly used to pull whatever stale values a prior `vibes secrets import`
-		// left in `vault.environments[envName]`, even though developers' day-to-day
-		// `vibes secrets set` writes always land in the local-tier namespace.
-		// That mismatch would overwrite live prod keys with stale test keys.
-		const sourceEnv = options.sourceEnv ?? pickPrimaryTier(source);
-
-		if (sourceEnv !== envName) {
-			ui.log(
-				`Reading from [${source.id}] env "${sourceEnv}" (source backend's primary tier); writing to [${target.id}] env "${envName}". Override with --source-env if needed.`
-			);
-		}
-
-		const sourceImpl = (await runtime
-			.query('secrets/store')
-			.withId(source.id)
-			.resolve()) as SecretsStoreImplementation;
-		let secrets = await sourceImpl.getAll(sourceEnv);
-
-		if (options.app) {
-			const requirements = await resolveSecretRequirements(runtime);
-			const appReqs = requirements.filter((r) => r.appId === options.app);
-			const appKeys = new Set(uniqueSecretKeys(appReqs));
-			secrets = Object.fromEntries(
-				Object.entries(secrets).filter(([k]) => appKeys.has(k))
-			);
-		}
-
-		const keyFilter = parseKeyFilter(options.key);
-		if (keyFilter) {
-			secrets = Object.fromEntries(
-				Object.entries(secrets).filter(([key]) => keyFilter.has(key))
-			);
-		}
-
-		const keys = Object.keys(secrets);
-		if (keys.length === 0) {
-			ui.info('No secrets to push.');
-			return;
-		}
-
-		if (options.dryRun) {
-			ui.log(`\nDry run: would push ${keys.length} secret(s) from [${source.id}] to [${target.id}]\n`);
-			for (const key of keys.sort()) {
-				ui.log(`  ${key}`);
-			}
-			ui.log('');
-			return;
-		}
-
-		const targetImpl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-		await targetImpl.setAll(envName, secrets);
-
-		ui.success(`Pushed ${keys.length} secret(s) from [${source.id}] to [${target.id}] for ${envName}`);
-	}
-};

package/src/cli/reveal/secrets.reveal.cli-command.descriptor.ts

@@ -1,21 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.reveal',
-	name: 'reveal',
-	description: 'Reveal a secret value (writes to stderr with audit log)',
-	group: 'secrets',
-	arguments: [{ name: 'key', description: 'Secret key to reveal', required: true }],
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--backend <id>', description: 'Filter to a specific backend' },
-		{ flags: '--force', description: 'Skip confirmation prompt' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 20
-};
-
-export default descriptor;

package/src/cli/reveal/secrets.reveal.cli-command.impl.ts

@@ -1,108 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor, EnvironmentTier } from '../../kinds/store.schema';
-import type { AuditLogInput } from '@vibesdotdev/logging';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-function resolveBackend(
-	descriptors: SecretsStoreDescriptor[],
-	tier: EnvironmentTier,
-	backendId?: string
-): SecretsStoreDescriptor | undefined {
-	if (backendId) return descriptors.find((d) => d.id === backendId);
-	const tierStores = descriptors
-		.filter((d) => d.tiers.includes(tier))
-		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-	return tierStores[0];
-}
-
-function emitAudit(input: AuditLogInput): void {
-	process.stderr.write(`[AUDIT] ${JSON.stringify({
-		id: crypto.randomUUID(),
-		timestamp: new Date().toISOString(),
-		...input
-	})}\n`);
-}
-
-export default {
-	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const key = args.key as string;
-		const options = opts as { environment?: string; backend?: string; force?: boolean };
-
-		if (!key) {
-			ui.error('Usage: vibes secrets reveal <KEY>');
-			process.exit(1);
-		}
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const target = resolveBackend(descriptors, envTier, options.backend);
-
-		if (!target) {
-			ui.error(`No secrets store available for tier: ${envTier}`);
-			process.exit(1);
-		}
-
-		const impl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-
-		const value = await impl.get(envName, key);
-		if (value === undefined || value === '') {
-			ui.error(`Secret not found: ${key}`);
-			process.exit(1);
-		}
-
-		// Skip the interactive confirmation when:
-		//   - explicit --force flag
-		//   - VIBES_SECRETS_REVEAL_NO_PROMPT=1 set (CI / scripts opt-in)
-		//   - stdin or stderr is not a TTY (automation context — there's no
-		//     human to answer the prompt, and blocking on stdin would hang)
-		const noPromptEnv = process.env.VIBES_SECRETS_REVEAL_NO_PROMPT === '1';
-		const stdinIsTty = Boolean((process.stdin as { isTTY?: boolean }).isTTY);
-		const stderrIsTty = Boolean((process.stderr as { isTTY?: boolean }).isTTY);
-		const skipPrompt = options.force || noPromptEnv || !stdinIsTty || !stderrIsTty;
-		if (!skipPrompt) {
-			process.stderr.write(`\n[REVEAL] About to reveal secret "${key}" to terminal.\n`);
-			process.stderr.write(`This value will be printed to stderr and logged to the audit trail.\n`);
-			process.stderr.write(`Continue? [y/N] `);
-
-			let confirmation = '';
-			for await (const chunk of process.stdin) {
-				confirmation = (chunk as Buffer).toString('utf-8').trim().toLowerCase();
-				break;
-			}
-
-			if (confirmation !== 'y' && confirmation !== 'yes') {
-				ui.info('Reveal cancelled.');
-				process.exit(0);
-			}
-		}
-
-		emitAudit({
-			category: 'data_access',
-			severity: 'high',
-			action: 'secrets.reveal',
-			actor: { id: 'cli', type: 'user', name: 'CLI user' },
-			target: { id: key, type: 'secret', name: key },
-			outcome: 'success',
-			context: {
-				environment: envName,
-				backend: target.id
-			}
-		});
-
-		// Value goes to STDOUT so scripts can capture it via `$(vibes secrets reveal X)`.
-		// Audit/notice messaging stays on STDERR so a piped consumer gets a clean value.
-		process.stdout.write(`${value}\n`);
-		process.stderr.write(`\n[REVEAL] ${key} revealed (logged to audit trail).\n`);
-	}
-};

package/src/cli/secrets.cli-group.descriptor.ts

@@ -1,13 +0,0 @@
-import type { CLIGroupAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLIGroupAssetDescriptor = {
-	kind: 'cli/group',
-	id: 'secrets',
-	name: 'secrets',
-	description: 'Manage environment secrets across backends',
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true
-};
-
-export default descriptor;

package/src/cli/set/secrets.set.cli-command.descriptor.ts

@@ -1,23 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.set',
-	name: 'set',
-	description: 'Set a secret value for the current environment',
-	group: 'secrets',
-	arguments: [
-		{ name: 'key', description: 'Secret key name (e.g., VIBES_AUTH_SECRET)', required: true },
-		{ name: 'value', description: 'Secret value (omit to prompt securely)', required: false }
-	],
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--backend <id>', description: 'Target backend (default: primary for tier)' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 20
-};
-
-export default descriptor;

package/src/cli/set/secrets.set.cli-command.impl.ts

@@ -1,77 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor, EnvironmentTier } from '../../kinds/store.schema';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-// `set` is the write side of the local-development workflow: the user types
-// a value and expects it to land in their machine-local store. Remote
-// backends (vault, cloudflare-secrets-store, ...) are the *deploy* side —
-// reached via `secrets push` after the user explicitly opts in. Default
-// routing therefore restricts to local backend kinds; an explicit
-// `--backend <id>` still wins.
-const LOCAL_BACKEND_KINDS = new Set(['env-file', 'encrypted-local']);
-
-function resolveBackend(
-	descriptors: SecretsStoreDescriptor[],
-	tier: EnvironmentTier,
-	backendId?: string
-): SecretsStoreDescriptor | undefined {
-	if (backendId) return descriptors.find((d) => d.id === backendId);
-	const tierStores = descriptors
-		.filter((d) => d.tiers.includes(tier))
-		.filter((d) => LOCAL_BACKEND_KINDS.has(d.backend))
-		.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-	return tierStores[0];
-}
-
-export default {
-	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const key = args.key as string;
-		let value = args.value as string | undefined;
-		const options = opts as { environment?: string; backend?: string };
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		if (!key || !/^[_A-Z0-9]+$/.test(key)) {
-			ui.error('Secret key must match pattern: ^[_A-Z0-9]+$');
-			process.exit(1);
-		}
-
-		if (!value) {
-			process.stdout.write(`Enter value for ${key}: `);
-			const chunks: Buffer[] = [];
-			for await (const chunk of process.stdin) {
-				chunks.push(chunk as Buffer);
-				if ((chunk as Buffer).includes(10)) break;
-			}
-			value = Buffer.concat(chunks).toString('utf-8').trim();
-		}
-
-		if (!value) {
-			ui.error('No value provided');
-			process.exit(1);
-		}
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const target = resolveBackend(descriptors, envTier, options.backend);
-
-		if (!target) {
-			ui.error(`No secrets store available for tier: ${envTier}`);
-			process.exit(1);
-		}
-
-		const impl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-		await impl.set(envName, key, value);
-
-		ui.success(`Set ${key} in [${target.id}] for environment: ${envName}`);
-	}
-};

package/src/cli/shared/resolve-environment.ts

@@ -1,57 +0,0 @@
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import { resolveCurrentEnvironmentConfig } from '@vibesdotdev/config/environment/current';
-import type { EnvironmentTier } from '../../kinds/store.schema';
-
-export interface ResolvedSecretsEnvironment {
-	name: string;
-	tier: EnvironmentTier;
-}
-
-const ENVIRONMENT_TIERS = new Set<EnvironmentTier>([
-	'local',
-	'dev',
-	'staging',
-	'production'
-]);
-
-/**
- * Resolve the active environment for secrets commands.
- *
- * Falls back to local when the environment config manifest/plugin graph is
- * unavailable so end-users can still run local secrets workflows.
- */
-export async function resolveSecretsEnvironment(
-	ui: UIContext,
-	environmentOverride?: string
-): Promise<ResolvedSecretsEnvironment> {
-	if (environmentOverride && environmentOverride.length > 0) {
-		if (ENVIRONMENT_TIERS.has(environmentOverride as EnvironmentTier)) {
-			return {
-				name: environmentOverride,
-				tier: environmentOverride as EnvironmentTier
-			};
-		}
-		try {
-			const envConfig = await resolveCurrentEnvironmentConfig();
-			return {
-				name: environmentOverride,
-				tier: (envConfig.tier ?? 'local') as EnvironmentTier
-			};
-		} catch {
-			return { name: environmentOverride, tier: 'local' };
-		}
-	}
-
-	try {
-		const envConfig = await resolveCurrentEnvironmentConfig();
-		return {
-			name: envConfig.name,
-			tier: (envConfig.tier ?? 'local') as EnvironmentTier
-		};
-	} catch {
-		ui.warn(
-			"Environment config manifest is unavailable; defaulting to 'local'. Register @vibesdotdev/config/environment/plugin to enable named environment selection."
-		);
-		return { name: 'local', tier: 'local' };
-	}
-}

package/src/cli/unset/secrets.unset.cli-command.descriptor.ts

@@ -1,22 +0,0 @@
-import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
-
-const descriptor: CLICommandAssetDescriptor = {
-	kind: 'cli/command',
-	id: 'secrets.unset',
-	name: 'unset',
-	description: 'Remove a secret from the current environment',
-	group: 'secrets',
-	arguments: [
-		{ name: 'key', description: 'Secret key name to remove', required: true }
-	],
-	options: [
-		{ flags: '--environment <name>', description: 'Target environment (default: current)' },
-		{ flags: '--backend <id>', description: 'Target backend (default: primary for tier)' }
-	],
-	surfaces: ['cli'],
-	hardware: ['consumer'],
-	enabled: true,
-	order: 30
-};
-
-export default descriptor;

package/src/cli/unset/secrets.unset.cli-command.impl.ts

@@ -1,41 +0,0 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import type { UIContext } from '@vibesdotdev/cli/providers';
-import type { SecretsStoreImplementation } from '../../kinds/store.interface';
-import type { SecretsStoreDescriptor } from '../../kinds/store.schema';
-import { resolveSecretsEnvironment } from '../shared/resolve-environment';
-
-export default {
-	async execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void> {
-		const runtime = getVibesRuntime();
-		const ui = (await runtime.context('cli/ui')) as UIContext;
-		const key = args.key as string;
-		const options = opts as { environment?: string; backend?: string };
-
-		const { name: envName, tier: envTier } = await resolveSecretsEnvironment(
-			ui,
-			options.environment
-		);
-
-		const descriptors = runtime.assets('secrets/store').descriptors() as SecretsStoreDescriptor[];
-		const tierStores = descriptors
-			.filter((d) => {
-				if (options.backend) return d.id === options.backend;
-				return d.tiers.includes(envTier);
-			})
-			.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-
-		const target = tierStores[0];
-		if (!target) {
-			ui.error(`No secrets store available for tier: ${envTier}`);
-			process.exit(1);
-		}
-
-		const impl = (await runtime
-			.query('secrets/store')
-			.withId(target.id)
-			.resolve()) as SecretsStoreImplementation;
-		await impl.unset(envName, key);
-
-		ui.success(`Removed ${key} from [${target.id}] for environment: ${envName}`);
-	}
-};