@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/src/kinds/store.kind.ts

@@ -1,52 +0,0 @@
-/**
- * Secrets Store Kind Definition
- *
- * Registers the secrets/store kind with the runtime.
- * Resolution selects backends by environment tier and priority.
- */
-
-import { createRuntimeKind } from '@vibesdotdev/runtime/factory/kind';
-import type { KindContext, RuntimeKindDescriptorRecord, RuntimeDescriptor } from '@vibesdotdev/runtime/schemas/kind';
-import type { RuntimeScope } from '@vibesdotdev/runtime/schemas/scope';
-import {
-	SecretsStoreDescriptorSchema,
-	type SecretsStoreDescriptor,
-	type EnvironmentTier
-} from './store.schema';
-import type { SecretsStoreImplementation } from './store.interface';
-/**
- * Resolve the best secrets store for the current scope.
- *
- * Filters candidates by environment tier (from scope qualifiers),
- * then picks the highest-priority match.
- *
- * No defaultImplementation — missing backends cause hard failure at resolve()
- * time per the SPEC hard rule: "Missing-backend means hard failure."
- */
-function resolveSecretsStore(
-	candidates: RuntimeDescriptor[],
-	scope: RuntimeScope,
-	_context: KindContext
-): SecretsStoreDescriptor | undefined {
-	const typed = candidates as SecretsStoreDescriptor[];
-	if (typed.length === 0) return undefined;
-	if (typed.length === 1) return typed[0];
-
-	const envTier = (scope.qualifiers?.environmentTier ?? 'local') as EnvironmentTier;
-	const tierMatches = typed.filter((d) => d.tiers.includes(envTier));
-	const pool = tierMatches.length > 0 ? tierMatches : typed;
-
-	pool.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-	return pool[0];
-}
-
-export const secretsStoreKind = createRuntimeKind<
-	SecretsStoreDescriptor,
-	SecretsStoreImplementation,
-	KindContext
->({
-	id: 'secrets/store',
-	descriptorSchema: SecretsStoreDescriptorSchema,
-	resolve: resolveSecretsStore,
-	contexts: []
-});

package/src/kinds/store.schema.ts

@@ -1,8 +0,0 @@
-export {
-	SecretsStoreDescriptorSchema,
-	EnvironmentTierSchema,
-	SecretsBackendSchema,
-	type SecretsStoreDescriptor,
-	type EnvironmentTier,
-	type SecretsBackend
-} from './schemas/store.schema';

package/src/manifest/canonical.ts

@@ -1,324 +0,0 @@
-/**
- * Vibes Secrets Import Manifest (canonical, value-free)
- *
- * Read by `vibes secrets import` to discover which keys to pull from which
- * local root env files when bootstrapping the encrypted Vibes store. The
- * manifest is reconciled against ground truth: every entry corresponds to a
- * real `secret: true` env var declared by an app's deployment config (or, in
- * auth-web's case, by its sub-manifest files).
- *
- * Sources:
- *   - `local-env` (`.env.local`) is the canonical machine-local store of
- *     every actual production-quality secret value: auth secrets, OAuth
- *     client secrets (GitHub / Google / Discord / Microsoft), Resend, the
- *     internal auth token, Stripe billing keys, etc.
- *   - `production-env` (`.env.production`) holds production-flavored
- *     non-secret config plus the operator's CF coordinates. Value-free here.
- *   - `manual` is a pseudo-source for keys that must be set through another
- *     channel (`vibes secrets set`, generated tokens, or pasted from a vault).
- *     The import command skips `manual` entries with a notice.
- *
- * Operator credentials (`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`,
- * `CLOUDFLARE_SECRETS_STORE_ID`) are intentionally NOT in this manifest.
- * They authenticate the operator's machine to push secrets into the store;
- * they are never themselves pushed into the store.
- */
-
-import {
-	SecretsImportManifestSchema,
-	type SecretsImportManifest
-} from './import-manifest.schema';
-
-const manifest: SecretsImportManifest = SecretsImportManifestSchema.parse({
-	version: 1,
-	sources: {
-		'local-env': {
-			path: '.env.local',
-			purpose:
-				'Canonical machine-local secret values: auth, OAuth, billing, internal tokens'
-		},
-		'production-env': {
-			path: '.env.production',
-			purpose: 'Production-flavored non-secret config + CF operator coordinates'
-		},
-		'manual': {
-			purpose:
-				"Set via `vibes secrets set <KEY>` or generated by ops; not sourced from a local file"
-		}
-	},
-	secrets: [
-		// --- Auth gateway (auth-web) — sourced from .env.local ----------------------
-		{
-			key: 'VIBES_AUTH_SECRET',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: true,
-			description: 'Better Auth signing secret (auth-web)'
-		},
-		// `VIBES_AUTH_DATABASE_URL` / `VIBES_AUTH_DATABASE_AUTH_TOKEN` are
-		// dev-only: production auth-web binds its own D1 database (`vibes-auth-db`)
-		// via the `DB` binding in `wrangler.jsonc`. The libsql/file fallback in
-		// `auth-web/src/server/persistence.ts` is for local dev only. We keep
-		// them in the manifest so `vibes secrets import` still picks them up
-		// for a working local store, but they're optional and never pushed to
-		// the production Secrets Store.
-		{
-			key: 'VIBES_AUTH_DATABASE_URL',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'LibSQL/Turso connection URL for auth persistence (DEV ONLY — production uses D1)'
-		},
-		{
-			key: 'VIBES_AUTH_DATABASE_AUTH_TOKEN',
-			category: 'vibes-auth',
-			source: 'local-env',
-			aliases: ['DATABASE_AUTH_TOKEN'],
-			required: false,
-			description: 'LibSQL/Turso auth token for auth persistence (DEV ONLY — production uses D1)'
-		},
-		{
-			key: 'VIBES_AUTH_RESEND_API_KEY',
-			category: 'vibes-auth',
-			source: 'local-env',
-			aliases: ['RESEND_API_KEY'],
-			required: false,
-			description: 'Resend API key for auth email delivery'
-		},
-		{
-			key: 'VIBES_AUTH_TWILIO_ACCOUNT_SID',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Twilio account SID for phone OTP delivery'
-		},
-		{
-			key: 'VIBES_AUTH_TWILIO_AUTH_TOKEN',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Twilio auth token for phone OTP delivery'
-		},
-		{
-			key: 'VIBES_AUTH_GITHUB_CLIENT_ID',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'GitHub OAuth client ID'
-		},
-		{
-			key: 'VIBES_AUTH_GITHUB_CLIENT_SECRET',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'GitHub OAuth client secret'
-		},
-		{
-			key: 'VIBES_AUTH_GOOGLE_CLIENT_ID',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Google OAuth client ID'
-		},
-		{
-			key: 'VIBES_AUTH_GOOGLE_CLIENT_SECRET',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Google OAuth client secret'
-		},
-		{
-			key: 'VIBES_AUTH_DISCORD_CLIENT_ID',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Discord OAuth client ID'
-		},
-		{
-			key: 'VIBES_AUTH_DISCORD_CLIENT_SECRET',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Discord OAuth client secret'
-		},
-		{
-			key: 'VIBES_AUTH_MICROSOFT_CLIENT_ID',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Microsoft (Azure AD) OAuth client ID'
-		},
-		{
-			key: 'VIBES_AUTH_MICROSOFT_CLIENT_SECRET',
-			category: 'vibes-auth',
-			source: 'local-env',
-			required: false,
-			description: 'Microsoft (Azure AD) OAuth client secret'
-		},
-
-		// --- Internal cross-app bearer tokens (account-web, ai-web) ------------------
-		{
-			key: 'VIBES_AUTH_INTERNAL_TOKEN',
-			category: 'vibes-internal',
-			source: 'local-env',
-			required: true,
-			description: 'Bearer token for internal/admin auth API calls'
-		},
-		{
-			key: 'VIBES_INTERNAL_SERVICE_TOKEN',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: true,
-			description: 'Shared internal bearer token for platform/account internal RPCs'
-		},
-		{
-			key: 'VIBES_PLATFORM_INTERNAL_TOKEN',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: false,
-			description: 'Platform-specific internal bearer token; falls back to VIBES_INTERNAL_SERVICE_TOKEN'
-		},
-		{
-			key: 'VIBES_EMAIL_INGRESS_TOKEN',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: false,
-			description: 'Bearer token for inbound email webhooks (auth-web /api/email)'
-		},
-
-		// --- Billing (account-web) ---------------------------------------------------
-		// `.env.production` stores Stripe under a `VIBES_ACCOUNT_STRIPE_*` prefix;
-		// `.env.local` uses the canonical names directly. Either source resolves.
-		{
-			key: 'STRIPE_SECRET_KEY',
-			category: 'provider-billing',
-			source: 'local-env',
-			aliases: ['VIBES_ACCOUNT_STRIPE_SECRET_KEY'],
-			required: false,
-			description: 'Stripe secret key for billing sync and checkout'
-		},
-		{
-			key: 'STRIPE_WEBHOOK_SECRET',
-			category: 'provider-billing',
-			source: 'local-env',
-			required: false,
-			description: 'Stripe webhook signing secret for /api/webhooks/stripe'
-		},
-		{
-			key: 'STRIPE_PUB_KEY',
-			category: 'provider-billing',
-			source: 'local-env',
-			aliases: ['PUBLIC_STRIPE_KEY', 'VIBES_ACCOUNT_STRIPE_PUB_KEY'],
-			required: false,
-			description: 'Stripe publishable key (pk_live_*/pk_test_*); safe to expose to clients but tracked here so live/test mode stays aligned with STRIPE_SECRET_KEY'
-		},
-		{
-			key: 'STRIPE_RESTRICTED_KEY',
-			category: 'provider-billing',
-			source: 'local-env',
-			aliases: ['VIBES_ACCOUNT_STRIPE_RESTRICTED_KEY'],
-			required: false,
-			description: 'Stripe restricted live key (rk_live_*) for narrow-scope ops/CI usage; not consumed at runtime — runtime uses STRIPE_SECRET_KEY'
-		},
-		{
-			key: 'CF_BILLING_SECRET',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: false,
-			description: 'Cloudflare-side billing webhook secret'
-		},
-		{
-			key: 'RESEND_API_KEY',
-			category: 'provider-other',
-			source: 'manual',
-			required: false,
-			description: 'Resend API key used by account-web to send invoice receipt emails'
-		},
-
-		// --- LLM / voice / search providers (ai-web, ai-web) ----------------------
-		{
-			key: 'OPENAI_API_KEY',
-			category: 'provider-llm',
-			source: 'manual',
-			required: false,
-			description: 'OpenAI provider key (ai-web)'
-		},
-		{
-			key: 'ANTHROPIC_API_KEY',
-			category: 'provider-llm',
-			source: 'manual',
-			required: false,
-			description: 'Anthropic provider key (ai-web)'
-		},
-		{
-			key: 'GOOGLE_API_KEY',
-			category: 'provider-llm',
-			source: 'manual',
-			required: false,
-			description: 'Google provider key (ai-web)'
-		},
-		{
-			key: 'GEMINI_API_KEY',
-			category: 'provider-llm',
-			source: 'manual',
-			required: false,
-			description: 'Gemini-named provider key alias (ai-web)'
-		},
-		{
-			key: 'DEEPGRAM_API_KEY',
-			category: 'provider-voice',
-			source: 'manual',
-			required: false,
-			description: 'Deepgram transcription provider key (ai-web)'
-		},
-		{
-			key: 'ELEVENLABS_API_KEY',
-			category: 'provider-voice',
-			source: 'manual',
-			required: false,
-			description: 'ElevenLabs TTS provider key (ai-web)'
-		},
-		{
-			key: 'FIRECRAWL_API_KEY',
-			category: 'provider-search',
-			source: 'manual',
-			required: false,
-			description: 'Firecrawl crawl/scrape provider key (ai-web)'
-		},
-		{
-			key: 'VIBES_API_TOKEN',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: false,
-			description: 'Tools-web internal API token'
-		},
-		{
-			key: 'VIBES_TOOL_REGISTRY_TOKEN',
-			category: 'vibes-internal',
-			source: 'manual',
-			required: false,
-			description: 'Tools-web tool-registry access token'
-		},
-
-		// --- Other provider creds (referenced by deployment configs but not in
-		//     a Pages app's secrets list yet — included so they round-trip if
-		//     they end up in `.env.local`) -----------------------------------------
-		{
-			key: 'DIGITALOCEAN_API_TOKEN',
-			category: 'provider-other',
-			source: 'local-env',
-			required: false,
-			description: 'DigitalOcean API token for DOKS / DO Spaces tooling'
-		},
-		{
-			key: 'NPM_TOKEN',
-			category: 'provider-other',
-			source: 'manual',
-			required: false,
-			description: 'npm publish token used by `vibes infra npm publish`'
-		}
-	]
-});
-
-export const canonicalImportManifest: SecretsImportManifest = manifest;
-export default manifest;

package/src/manifest/import-manifest.schema.ts

@@ -1,63 +0,0 @@
-/**
- * Secrets Import Manifest Schema
- *
- * Catalogs the secrets the platform expects to receive from local root env
- * files at bootstrap time. Carries no values — only key identity, source
- * preference, and intent. The manifest is the contract a `vibes secrets
- * import` command (phase 5) reads against.
- */
-
-import * as z from 'zod/v4';
-
-/**
- * Where a secret value is expected to originate from when running
- * `vibes secrets import`. Sources with a `path` are repo-relative .env-shaped
- * files; they are read-only inputs and never committed. Sources without a
- * `path` (e.g. the canonical `manual` source) describe entries that are not
- * importable from disk and must be set through other means
- * (`vibes secrets set`, generated tokens, Cloudflare dashboard, etc.).
- */
-export const SecretSourceSchema = z.object({
-	/** Repo-relative path to the .env file. Omit for non-importable sources. */
-	path: z.string().min(1).optional(),
-	/** Why this source owns this category of secrets (Vibes internals, providers, etc.) */
-	purpose: z.string().min(1)
-});
-export type SecretSource = z.infer<typeof SecretSourceSchema>;
-
-export const SecretCategorySchema = z.enum([
-	'vibes-internal',
-	'vibes-auth',
-	'cloudflare',
-	'provider-llm',
-	'provider-voice',
-	'provider-search',
-	'provider-billing',
-	'provider-other'
-]);
-export type SecretCategory = z.infer<typeof SecretCategorySchema>;
-
-export const SecretManifestEntrySchema = z.object({
-	/** Canonical key in Cloudflare Secrets Store. Matches env var name unless renamed. */
-	key: z.string().regex(/^[_A-Z0-9]+$/),
-	/** Category this secret belongs to (drives source-file routing) */
-	category: SecretCategorySchema,
-	/** Preferred source file id (must exist in `sources`) */
-	source: z.string().min(1),
-	/** Alternate names this secret may appear under in the source file */
-	aliases: z.array(z.string().regex(/^[_A-Z0-9]+$/)).default([]),
-	/** Whether the secret is required for a production push */
-	required: z.boolean().default(true),
-	/** Human-readable description of what this secret unlocks */
-	description: z.string().min(1)
-});
-export type SecretManifestEntry = z.infer<typeof SecretManifestEntrySchema>;
-
-export const SecretsImportManifestSchema = z.object({
-	version: z.literal(1),
-	/** Map of source id → file path + purpose */
-	sources: z.record(z.string().min(1), SecretSourceSchema),
-	/** Catalog of expected secrets, keyed by canonical name */
-	secrets: z.array(SecretManifestEntrySchema)
-});
-export type SecretsImportManifest = z.infer<typeof SecretsImportManifestSchema>;

package/src/manifest/index.ts

@@ -1,12 +0,0 @@
-export {
-	SecretsImportManifestSchema,
-	SecretManifestEntrySchema,
-	SecretSourceSchema,
-	SecretCategorySchema,
-	type SecretsImportManifest,
-	type SecretManifestEntry,
-	type SecretSource,
-	type SecretCategory
-} from './import-manifest.schema';
-
-export { canonicalImportManifest } from './canonical';

package/src/requirements/index.ts

@@ -1,6 +0,0 @@
-export {
-	resolveSecretRequirements,
-	groupRequirementsByApp,
-	uniqueSecretKeys,
-	type SecretRequirement
-} from './resolver';

package/src/requirements/resolver.ts

@@ -1,216 +0,0 @@
-/**
- * Secret Requirements Resolver
- *
- * Resolves secret requirements from two intentional sources:
- *
- * 1. Runtime infra descriptors (`.infra.ts` files) — workers and infrastructure.
- *    Queries runtime for `infra/worker` descriptors. Workers (e.g. job-workers)
- *    declare secrets here because they are infrastructure resources, not web apps.
- *    The `infra/web-app` path is kept for completeness but no longer discovers
- *    vestigial descriptors (deleted 2026-05-20).
- *
- * 2. `deployment.config.ts` files — the canonical per-app deployment system.
- *    Loads each config via `@vibesdotdev/infra-deploy` and extracts `secret: true`
- *    env entries from the `AppDeployment.env` array. This is the authoritative
- *    source for web-app secrets.
- *
- * The two-system split is intentional, not transitional:
- * - `.infra.ts` = infrastructure resources + workers (runtime-discovered assets)
- * - `deployment.config.ts` = web app deployments (build + deploy orchestration)
- *
- * Used by `vibes secrets check` to cross-reference stored secrets against
- * declared requirements.
- */
-
-import type { WebAppDescriptor, WorkerDescriptor } from '@vibesdotdev/infra-core/kinds';
-import { loadDeploymentConfig } from '@vibesdotdev/infra-deploy';
-import type {
-	RequirementInfraDescriptor,
-	SecretRequirement,
-	SecretRequirementsRuntime
-} from './schemas/requirements';
-
-export type { SecretRequirement } from './schemas/requirements';
-
-/**
- * Baked secret requirements captured at compile time by
- * `apps/cli-bin/scripts/build.ts`. Compiled binaries can't re-import
- * workspace `deployment.config.ts` files at runtime (their workspace
- * specifiers don't resolve from the standalone executable), so we read
- * pre-extracted requirements from this define-injected JSON string.
- * In dev mode (source-run, tests) the symbol is undefined and we fall
- * back to live discovery via `resolveFromDeploymentConfigs`.
- */
-declare const __VIBES_BAKED_SECRET_REQUIREMENTS__: string;
-const BAKED_SECRET_REQUIREMENTS_JSON: string =
-	typeof __VIBES_BAKED_SECRET_REQUIREMENTS__ !== 'undefined'
-		? __VIBES_BAKED_SECRET_REQUIREMENTS__
-		: '[]';
-
-function readBakedRequirements(): SecretRequirement[] {
-	if (!BAKED_SECRET_REQUIREMENTS_JSON || BAKED_SECRET_REQUIREMENTS_JSON === '[]') {
-		return [];
-	}
-	try {
-		const parsed = JSON.parse(BAKED_SECRET_REQUIREMENTS_JSON);
-		return Array.isArray(parsed) ? (parsed as SecretRequirement[]) : [];
-	} catch {
-		return [];
-	}
-}
-
-function extractRequirements(descriptors: RequirementInfraDescriptor[]): SecretRequirement[] {
-	const results: SecretRequirement[] = [];
-	for (const desc of descriptors) {
-		if (!desc.env) continue;
-		for (const entry of desc.env) {
-			if (!entry.secret) continue;
-			results.push({
-				key: entry.name,
-				appId: desc.id,
-				required: entry.required ?? true,
-				description: entry.description
-			});
-		}
-	}
-	return results;
-}
-
-/**
- * Resolve secret requirements from deployment.config.ts files.
- *
- * Walks the workspace for `deployment.config.ts` files (same discovery logic
- * as `infra-deploy regenerate`), loads each via subprocess, and extracts
- * `secret: true` env entries from the `AppDeployment.env` array.
- */
-async function resolveFromDeploymentConfigs(
-	rootDir: string
-): Promise<SecretRequirement[]> {
-	const { readdirSync, statSync } = await import('node:fs');
-	const { join } = await import('node:path');
-
-	const IGNORED = new Set([
-		'node_modules', '.git', '.svelte-kit', 'dist', '.next', '.turbo', '.vite', '.wrangler'
-	]);
-	const CONFIG_NAMES = new Set([
-		'deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'
-	]);
-
-	// Discover deployment.config.ts files (mirrors infra-deploy's findDeploymentConfigs)
-	const configs: string[] = [];
-	function walk(dir: string, depth: number): void {
-		if (depth > 4) return;
-		let entries: string[];
-		try { entries = readdirSync(dir); } catch { return; }
-		for (const entry of entries) {
-			if (CONFIG_NAMES.has(entry)) configs.push(join(dir, entry));
-		}
-		for (const entry of entries) {
-			if (IGNORED.has(entry) || entry.startsWith('.')) continue;
-			const full = join(dir, entry);
-			let info;
-			try { info = statSync(full); } catch { continue; }
-			if (info.isDirectory()) walk(full, depth + 1);
-		}
-	}
-	walk(rootDir, 0);
-
-	const requirements: SecretRequirement[] = [];
-	for (const configPath of configs) {
-		const appDir = configPath.replace(/\/deployment\.config\.(ts|js|mjs)$/, '');
-		try {
-			const loaded = await loadDeploymentConfig(appDir);
-			for (const entry of loaded.deployment.env) {
-				if (!entry.secret) continue;
-				requirements.push({
-					key: entry.name,
-					appId: loaded.deployment.appId,
-					required: entry.required ?? true,
-					description: entry.description
-				});
-			}
-		} catch {
-			// Config load failures are non-fatal for secret resolution.
-			// The regen pipeline catches these separately.
-		}
-	}
-	return requirements;
-}
-
-/**
- * Resolve all secret requirements from infra descriptors and deployment configs.
- *
- * Queries two sources:
- * 1. Runtime for `infra/worker` descriptors (`.infra.ts` — workers + infrastructure)
- * 2. `deployment.config.ts` files via `@vibesdotdev/infra-deploy` (web apps)
- *
- * These two sources are mutually exclusive by app type, so there should be no
- * overlap. Both are queried to cover the full surface:
- * - Workers declare secrets in `.infra.ts` (job-workers, ai-workers, etc.)
- * - Web apps declare secrets in `deployment.config.ts` (auth-web, ai-web, etc.)
- *
- * Deployment config entries are appended after descriptor entries.
- * Duplicates are harmless for check reporting.
- */
-export async function resolveSecretRequirements(
-	runtime: SecretRequirementsRuntime,
-	options?: { deploymentConfigRoot?: string }
-): Promise<SecretRequirement[]> {
-	const requirements: SecretRequirement[] = [];
-
-	if (runtime.hasKind('infra/web-app')) {
-		const webApps = runtime.assets('infra/web-app').descriptors() as WebAppDescriptor[];
-		requirements.push(...extractRequirements(webApps));
-	}
-
-	if (runtime.hasKind('infra/worker')) {
-		const workers = runtime.assets('infra/worker').descriptors() as WorkerDescriptor[];
-		requirements.push(...extractRequirements(workers));
-	}
-
-	// Load web-app secrets from deployment.config.ts — the canonical source.
-	// Falls back to process.cwd() when no root is explicitly provided.
-	let liveDeployReqs: SecretRequirement[] = [];
-	if (options?.deploymentConfigRoot || typeof process !== 'undefined') {
-		const root = options?.deploymentConfigRoot ?? process.cwd();
-		try {
-			liveDeployReqs = await resolveFromDeploymentConfigs(root);
-		} catch {
-			// infra-deploy subprocess failures shouldn't block the check.
-		}
-	}
-
-	// In compiled binaries, `resolveFromDeploymentConfigs` returns [] because
-	// the standalone executable can't import workspace deployment.config.ts
-	// files at runtime. Fall back to the build-time snapshot captured by
-	// `apps/cli-bin/scripts/build.ts` so `--app <id>` filtering still works.
-	if (liveDeployReqs.length === 0) {
-		requirements.push(...readBakedRequirements());
-	} else {
-		requirements.push(...liveDeployReqs);
-	}
-
-	return requirements;
-}
-
-/**
- * Group requirements by app/worker ID for per-app reporting.
- */
-export function groupRequirementsByApp(
-	requirements: SecretRequirement[]
-): Map<string, SecretRequirement[]> {
-	const grouped = new Map<string, SecretRequirement[]>();
-	for (const req of requirements) {
-		const existing = grouped.get(req.appId) ?? [];
-		existing.push(req);
-		grouped.set(req.appId, existing);
-	}
-	return grouped;
-}
-
-/**
- * Get unique secret keys across all apps (deduped).
- */
-export function uniqueSecretKeys(requirements: SecretRequirement[]): string[] {
-	return [...new Set(requirements.map((r) => r.key))];
-}