@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/backends/env-file/env-file.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * Env File Backend Descriptor
+ *
+ * Reads/writes secrets from .env.{environment} files in the bound workspace
+ * root (`runtime/workspace-path`); a relative `basePath` resolves against it.
+ * Default backend for local and dev tiers.
+ */
+const descriptor = {
+    id: 'env-file',
+    kind: 'secrets/store',
+    name: 'Environment File',
+    description: 'Stores secrets in .env.{environment} files',
+    tags: ['local'],
+    enabled: true,
+    backend: 'env-file',
+    selection: 'scope',
+    tiers: ['local', 'dev'],
+    priority: 0,
+    config: {
+        basePath: '.'
+    }
+};
+export default descriptor;
+//# sourceMappingURL=env-file.descriptor.js.map

package/dist/backends/env-file/env-file.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.descriptor.js","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,4CAA4C;IACzD,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE;QACP,QAAQ,EAAE,GAAG;KACb;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/env-file/env-file.impl.local.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Env File Backend Implementation
+ *
+ * Reads and writes .env.{environment} files with KEY=VALUE format, through the
+ * runtime's filesystem adapter, with the one `.env` grammar of `./manifest`.
+ * Preserves comments, blank lines, and ordering on writes; an entry this store
+ * does not change is written back as it was. The file is published atomically,
+ * owner-private (0600).
+ *
+ * - The environment is a tier name, validated before a path is built, so no
+ *   `../` leaves the declared directory.
+ * - Keys are environment-variable shaped; a value is one line (a newline, `\r`
+ *   or NUL is refused) and is quoted so reading it back gives the same value.
+ * - A write that would leave the file as it is writes nothing (`unset` of a key
+ *   that is not there included).
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretEntry, SecretsStoreImplementation } from '../../domain/kinds/store.interface.ts';
+import type { SecretsStoreDescriptor } from '../../domain/kinds/store.schema.ts';
+declare class EnvFileStore implements SecretsStoreImplementation {
+    private readonly runtime;
+    readonly id = "env-file";
+    readonly descriptor: SecretsStoreDescriptor;
+    constructor(desc: SecretsStoreDescriptor, runtime: RuntimeRef);
+    /**
+     * Where `.env.<environment>` lives: the descriptor's `basePath`, resolved
+     * against the bound workspace root (`runtime/workspace-path`) at use. It never
+     * follows the launch directory; an unbound host fails with `workspace-unbound`.
+     * The host's own files, so the adapter is not the workspace-rooted view.
+     */
+    private location;
+    /** The file's text; `undefined` only when there is no file. */
+    private readText;
+    private readLines;
+    /** Read-modify-write one file as one step; nothing is written when `change` leaves the text as it was. */
+    private modify;
+    private put;
+    list(environment: string): Promise<SecretEntry[]>;
+    get(environment: string, key: string): Promise<string | undefined>;
+    set(environment: string, key: string, value: string): Promise<void>;
+    unset(environment: string, key: string): Promise<void>;
+    getAll(environment: string): Promise<Record<string, string>>;
+    setAll(environment: string, secrets: Record<string, string>): Promise<void>;
+}
+export declare function createEnvFileStore(runtime: RuntimeRef): import("@vibesdotdev/kernel").RuntimeImplementationWrapper<EnvFileStore>;
+export {};
+//# sourceMappingURL=env-file.impl.local.d.ts.map

package/dist/backends/env-file/env-file.impl.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.impl.local.d.ts","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.impl.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIzF,OAAO,KAAK,EAAE,WAAW,EAAC,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACpG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AA0CjF,cAAM,YAAa,YAAW,0BAA0B;IAMtD,OAAO,CAAC,QAAQ,CAAC,OAAO;IALzB,QAAQ,CAAC,EAAE,cAAc;IACzB,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;gBAG3C,IAAI,EAAE,sBAAsB,EACX,OAAO,EAAE,UAAU;IAKrC;;;;;OAKG;YACW,QAAQ;IAUtB,+DAA+D;YACjD,QAAQ;YASR,SAAS;IAMvB,0GAA0G;YAC5F,MAAM;IAepB,OAAO,CAAC,GAAG;IAaL,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAKjD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAMlE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAK5D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CASjF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,4EAQrD"}

package/dist/backends/env-file/env-file.impl.local.js

@@ -0,0 +1,170 @@
+/**
+ * Env File Backend Implementation
+ *
+ * Reads and writes .env.{environment} files with KEY=VALUE format, through the
+ * runtime's filesystem adapter, with the one `.env` grammar of `./manifest`.
+ * Preserves comments, blank lines, and ordering on writes; an entry this store
+ * does not change is written back as it was. The file is published atomically,
+ * owner-private (0600).
+ *
+ * - The environment is a tier name, validated before a path is built, so no
+ *   `../` leaves the declared directory.
+ * - Keys are environment-variable shaped; a value is one line (a newline, `\r`
+ *   or NUL is refused) and is quoted so reading it back gives the same value.
+ * - A write that would leave the file as it is writes nothing (`unset` of a key
+ *   that is not there included).
+ */
+import { publishPrivateFile, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createRuntimeImplementation } from '@vibesdotdev/kernel/factory/implementation';
+import * as z from 'zod/v4';
+import { assertEnvironmentSecretKey } from "../../domain/kinds/secret-key.js";
+import { dotenvValues, formatDotenvEntry, parseDotenv } from "../../domain/manifest/dotenv.js";
+import { isAbsentEntry, outcomeOf } from "../../support/file-failure.js";
+import { serializeByPath } from "../../support/path-queue.js";
+import { parseStoreEnvironment } from "../../support/store-environment.js";
+import descriptor from "./env-file.descriptor.js";
+/** A directory this store has to create is the owner's alone. */
+const ENV_DIRECTORY_MODE = 0o700;
+function unreadable(path, cause) {
+    return new CapabilityError('The env file could not be read.', 'UNAVAILABLE', {
+        reason: 'env-file-unreadable',
+        cause,
+        details: { store: 'env-file', path }
+    });
+}
+function entryIndex(lines, key) {
+    return lines.findLastIndex((line) => line.type === 'entry' && line.key === key);
+}
+/** Add an entry before the file's final newline, so appending never leaves a blank line behind. */
+function appendEntry(lines, raw, key, value) {
+    const entry = { type: 'entry', raw, key, value };
+    const last = lines.at(-1);
+    if (last?.type === 'blank' && last.raw === '')
+        lines.splice(lines.length - 1, 0, entry);
+    else
+        lines.push(entry);
+}
+/** The file's text for `lines`: each line as it is, ending in a newline unless the file is empty. */
+function renderLines(lines) {
+    const text = lines.map((line) => line.raw).join('\n');
+    return text === '' || text.endsWith('\n') ? text : `${text}\n`;
+}
+class EnvFileStore {
+    runtime;
+    id = 'env-file';
+    descriptor;
+    constructor(desc, runtime) {
+        this.runtime = runtime;
+        this.descriptor = desc;
+    }
+    /**
+     * Where `.env.<environment>` lives: the descriptor's `basePath`, resolved
+     * against the bound workspace root (`runtime/workspace-path`) at use. It never
+     * follows the launch directory; an unbound host fails with `workspace-unbound`.
+     * The host's own files, so the adapter is not the workspace-rooted view.
+     */
+    async location(environment) {
+        const tier = parseStoreEnvironment(environment);
+        const fs = await resolveFileSystemAdapter(this.runtime, { binding: false });
+        const configured = this.descriptor.config?.basePath ?? '.';
+        const directory = fs.isAbsolute(configured)
+            ? configured
+            : fs.join(await this.runtime.context('runtime/workspace-path'), configured);
+        return { fs, directory, path: fs.join(directory, `.env.${tier}`) };
+    }
+    /** The file's text; `undefined` only when there is no file. */
+    async readText({ fs, path }) {
+        const read = await outcomeOf(() => fs.readFile(path, 'utf-8'));
+        // Asked for utf-8, the adapter answers text.
+        if (read.ok)
+            return z.string().parse(read.value);
+        // Only an absent file is an empty store; a denied read is not.
+        if (isAbsentEntry(read.failure))
+            return undefined;
+        throw unreadable(path, read.failure);
+    }
+    async readLines(environment) {
+        const location = await this.location(environment);
+        const text = await serializeByPath(location.path, () => this.readText(location));
+        return text === undefined ? [] : parseDotenv(text);
+    }
+    /** Read-modify-write one file as one step; nothing is written when `change` leaves the text as it was. */
+    async modify(environment, change) {
+        const location = await this.location(environment);
+        await serializeByPath(location.path, async () => {
+            const before = await this.readText(location);
+            const lines = before === undefined ? [] : parseDotenv(before);
+            // The unchanged file as this store would write it: a missing final newline alone is not a change.
+            const unchanged = renderLines(lines);
+            change(lines);
+            const after = renderLines(lines);
+            if (after === unchanged)
+                return;
+            await location.fs.mkdir(location.directory, { recursive: true, mode: ENV_DIRECTORY_MODE });
+            await publishPrivateFile(location.fs, location.path, after);
+        });
+    }
+    put(lines, key, value) {
+        const raw = formatDotenvEntry(key, value);
+        const index = entryIndex(lines, key);
+        if (index < 0) {
+            appendEntry(lines, raw, key, value);
+            return;
+        }
+        const existing = lines[index];
+        // The same value again leaves the line as it is: its `export`, quoting and trailing comment stay.
+        if (existing?.type === 'entry' && existing.value === value)
+            return;
+        lines[index] = { type: 'entry', raw, key, value };
+    }
+    async list(environment) {
+        const lines = await this.readLines(environment);
+        return [...dotenvValues(lines)].map(([key, value]) => ({ key, hasValue: value !== '', source: this.id }));
+    }
+    async get(environment, key) {
+        parseStoreEnvironment(environment);
+        assertEnvironmentSecretKey(key);
+        return dotenvValues(await this.readLines(environment)).get(key);
+    }
+    async set(environment, key, value) {
+        parseStoreEnvironment(environment);
+        assertEnvironmentSecretKey(key);
+        formatDotenvEntry(key, value);
+        await this.modify(environment, (lines) => this.put(lines, key, value));
+    }
+    async unset(environment, key) {
+        parseStoreEnvironment(environment);
+        assertEnvironmentSecretKey(key);
+        await this.modify(environment, (lines) => {
+            // Every occurrence goes, from the end so the indexes still hold.
+            for (let index = entryIndex(lines, key); index >= 0; index = entryIndex(lines, key))
+                lines.splice(index, 1);
+        });
+    }
+    async getAll(environment) {
+        // fromEntries defines own properties, so a `__proto__` key in the file is surfaced, not swallowed.
+        return Object.fromEntries(dotenvValues(await this.readLines(environment)));
+    }
+    async setAll(environment, secrets) {
+        parseStoreEnvironment(environment);
+        const entries = Object.entries(secrets);
+        // Every entry is checked before the file is touched: all land or none do.
+        for (const [key, value] of entries)
+            formatDotenvEntry(key, value);
+        await this.modify(environment, (lines) => {
+            for (const [key, value] of entries)
+                this.put(lines, key, value);
+        });
+    }
+}
+export function createEnvFileStore(runtime) {
+    const store = new EnvFileStore(descriptor, runtime);
+    return createRuntimeImplementation({
+        id: 'env-file',
+        kind: 'secrets/store',
+        priority: 0,
+        implementation: store
+    });
+}
+//# sourceMappingURL=env-file.impl.local.js.map

package/dist/backends/env-file/env-file.impl.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.impl.local.js","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.impl.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,kBAAkB,EAAC,wBAAwB,EAAkC,MAAM,yBAAyB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,EAAE,YAAY,EAAC,iBAAiB,EAAC,WAAW,EAAkB,MAAM,iCAAiC,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAC,SAAS,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAElD,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAQjC,SAAS,UAAU,CAAC,IAAY,EAAE,KAAoB;IACrD,OAAO,IAAI,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE;QAC5E,MAAM,EAAE,qBAAqB;QAC7B,KAAK;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACpC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,GAAW;IAC5D,OAAO,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,KAAmB,EAAE,GAAW,EAAE,GAAW,EAAE,KAAa;IAChF,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE;QAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;;QACnF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,KAA4B;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,MAAM,YAAY;IAMC;IALT,EAAE,GAAG,UAAU,CAAC;IAChB,UAAU,CAAyB;IAE5C,YACC,IAA4B,EACX,OAAmB;QAAnB,YAAO,GAAP,OAAO,CAAY;QAEpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,WAAmB;QACzC,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,IAAI,GAAG,CAAC;QAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAmB;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,6CAA6C;QAC7C,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,+DAA+D;QAC/D,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,0GAA0G;IAClG,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAqC;QAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC9D,kGAAkG;YAClG,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3F,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,KAAmB,EAAE,GAAW,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,kGAAkG;QAClG,IAAI,QAAQ,EAAE,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO;QACnE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW;QACzC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACnC,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,GAAW,EAAE,KAAa;QACxD,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACnC,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,GAAW;QAC3C,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACnC,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACxC,iEAAiE;YACjE,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAC,KAAK,IAAI,CAAC,EAAC,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC/B,mGAAmG;QACnG,OAAO,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,OAA+B;QAChE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAmB;IACrD,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,2BAA2B,CAAC;QAClC,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,KAAK;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/backends/env-file/env-file.plugin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Secrets Backend Env-File Plugin
+ *
+ * Registers the env-file secrets/store backend with the runtime.
+ * Reads/writes .env.{environment} files. Consumer hardware only (Node/Bun).
+ */
+export declare const secretsBackendEnvFilePlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsBackendEnvFilePlugin;
+//# sourceMappingURL=env-file.plugin.d.ts.map

package/dist/backends/env-file/env-file.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.plugin.d.ts","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,eAAO,MAAM,2BAA2B,6CAoBtC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/backends/env-file/env-file.plugin.js

@@ -0,0 +1,23 @@
+/**
+ * Secrets Backend Env-File Plugin
+ *
+ * Registers the env-file secrets/store backend with the runtime.
+ * Reads/writes .env.{environment} files. Consumer hardware only (Node/Bun).
+ */
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import descriptor from "./env-file.descriptor.js";
+export const secretsBackendEnvFilePlugin = createRuntimePlugin({
+    id: '@vibesdotdev/secrets/backends/env-file',
+    name: 'Secrets Backend: Env-File',
+    description: 'Env-file secrets backend. Reads/writes .env.{environment} files for local and dev tiers.',
+    dependencies: ['secrets'],
+    descriptors: [descriptor],
+    onRegister: async (runtime) => {
+        runtime.registerLoader('secrets/store', 'env-file', async () => {
+            const { createEnvFileStore } = await import("./env-file.impl.local.js");
+            return createEnvFileStore(runtime);
+        }, { priority: 0, origin: 'secrets-backend-env-file' });
+    }
+});
+export default secretsBackendEnvFilePlugin;
+//# sourceMappingURL=env-file.plugin.js.map

package/dist/backends/env-file/env-file.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.plugin.js","sourceRoot":"","sources":["../../../src/backends/env-file/env-file.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAElD,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;IAC9D,EAAE,EAAE,wCAAwC;IAC5C,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACV,0FAA0F;IAC3F,YAAY,EAAE,CAAC,SAAS,CAAC;IAEzB,WAAW,EAAE,CAAC,UAAU,CAAC;IAEzB,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,cAAc,CACrB,eAAe,EACf,UAAU,EACV,KAAK,IAAI,EAAE;YACV,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACxE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACnD,CAAC;IACH,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/backends/env-file/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @vibesdotdev/secrets/backends/env-file
+ *
+ * Env-file secrets backend. Reads/writes .env.{environment} files
+ * for local and dev tiers.
+ */
+export { default, secretsBackendEnvFilePlugin } from './env-file.plugin.ts';
+export { default as envFileDescriptor } from './env-file.descriptor.ts';
+export { createEnvFileStore } from './env-file.impl.local.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/env-file/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/env-file/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAC,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAG3E,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/backends/env-file/index.js

@@ -0,0 +1,13 @@
+/**
+ * @vibesdotdev/secrets/backends/env-file
+ *
+ * Env-file secrets backend. Reads/writes .env.{environment} files
+ * for local and dev tiers.
+ */
+// Plugin
+export { default, secretsBackendEnvFilePlugin } from "./env-file.plugin.js";
+// Descriptor
+export { default as envFileDescriptor } from "./env-file.descriptor.js";
+// Implementation factory
+export { createEnvFileStore } from "./env-file.impl.local.js";
+//# sourceMappingURL=index.js.map

package/dist/backends/env-file/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/env-file/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS;AACT,OAAO,EAAE,OAAO,EAAC,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAE3E,aAAa;AACb,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAExE,yBAAyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/backends/host-credentials/host-credentials.descriptor.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `host-credentials`: the store a host composes when it boots with a
+ * `VIBES_HOST_CREDENTIALS` manifest (rc05 §2.2-§2.3). Scope-selected at
+ * priority 1000 on every tier, so while it is composed it answers every
+ * unnamed lookup: a manifest key from the captured environment, anything else
+ * as not set. Selection is not a chain, so an unlisted key never reaches a
+ * lower store.
+ */
+import type { SecretsStoreDescriptor } from '../../domain/kinds/store.schema.ts';
+export declare const HOST_CREDENTIALS_STORE_ID = "host-credentials";
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=host-credentials.descriptor.d.ts.map

package/dist/backends/host-credentials/host-credentials.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.descriptor.d.ts","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEjF,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D,QAAA,MAAM,UAAU,EAAE,sBAYjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/host-credentials/host-credentials.descriptor.js

@@ -0,0 +1,23 @@
+/**
+ * `host-credentials`: the store a host composes when it boots with a
+ * `VIBES_HOST_CREDENTIALS` manifest (rc05 §2.2-§2.3). Scope-selected at
+ * priority 1000 on every tier, so while it is composed it answers every
+ * unnamed lookup: a manifest key from the captured environment, anything else
+ * as not set. Selection is not a chain, so an unlisted key never reaches a
+ * lower store.
+ */
+export const HOST_CREDENTIALS_STORE_ID = 'host-credentials';
+const descriptor = {
+    id: HOST_CREDENTIALS_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Host credentials',
+    description: 'Credentials a live publisher (vibes secrets exec, a CI step, the orchestrator) put in this process environment and named in VIBES_HOST_CREDENTIALS',
+    tags: ['host', 'read-only'],
+    enabled: true,
+    backend: 'host-credentials',
+    selection: 'scope',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 1000
+};
+export default descriptor;
+//# sourceMappingURL=host-credentials.descriptor.js.map

package/dist/backends/host-credentials/host-credentials.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.descriptor.js","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACV,oJAAoJ;IACrJ,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;IAC3B,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,IAAI;CACd,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/host-credentials/host-credentials.impl.d.ts

@@ -0,0 +1,25 @@
+import { type HostCredentialsHost } from "../../schemas/backends/host.schema.ts";
+export { type HostCredentialsHost } from "../../schemas/backends/host.schema.ts";
+/**
+ * The `host-credentials` secrets store (rc05 §2.2-§2.3; rc01 §2.1).
+ *
+ * It answers only the keys a live publisher named in the captured
+ * `VIBES_HOST_CREDENTIALS` manifest, from the environment's captured snapshot
+ * (never the live process environment).
+ *
+ * - The manifest is read from the captured snapshot and parsed on every call,
+ *   and the publisher's liveness is checked on every read, so a changed or
+ *   replaced manifest is seen at once. A dead publisher, a pid whose start time
+ *   differs, or a past lease expiry is `AUTH_REQUIRED` `host-credentials-stale`.
+ * - An unparseable manifest is `INVALID_INPUT` `manifest-invalid`.
+ * - On a `requestPrincipals` host the caller's bearer is the request
+ *   principal's, so a principal key is refused with `PERMISSION_DENIED`
+ *   `principal-key-reserved` (rc01 amendments A9, A10).
+ * - The store is read-only: a write is `PERMISSION_DENIED` `store-read-only`.
+ */
+import { type HostCredentialsLivenessProbe } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../domain/kinds/store.interface.ts';
+/** Keys that carry the caller's identity: auth's declared principal keys. */
+export declare const PRINCIPAL_CREDENTIAL_KEYS: ReadonlySet<string>;
+export declare function createHostCredentialsStore(host: HostCredentialsHost, probe: HostCredentialsLivenessProbe): SecretsStoreImplementation;
+//# sourceMappingURL=host-credentials.impl.d.ts.map

package/dist/backends/host-credentials/host-credentials.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.impl.d.ts","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAMP,KAAK,4BAA4B,EAEhC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAc,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAIpG,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAiC,CAAC;AAkB5F,wBAAgB,0BAA0B,CACzC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,4BAA4B,GACjC,0BAA0B,CAgF5B"}

package/dist/backends/host-credentials/host-credentials.impl.js

@@ -0,0 +1,111 @@
+import {} from "../../schemas/backends/host.schema.js";
+export {} from "../../schemas/backends/host.schema.js";
+/**
+ * The `host-credentials` secrets store (rc05 §2.2-§2.3; rc01 §2.1).
+ *
+ * It answers only the keys a live publisher named in the captured
+ * `VIBES_HOST_CREDENTIALS` manifest, from the environment's captured snapshot
+ * (never the live process environment).
+ *
+ * - The manifest is read from the captured snapshot and parsed on every call,
+ *   and the publisher's liveness is checked on every read, so a changed or
+ *   replaced manifest is seen at once. A dead publisher, a pid whose start time
+ *   differs, or a past lease expiry is `AUTH_REQUIRED` `host-credentials-stale`.
+ * - An unparseable manifest is `INVALID_INPUT` `manifest-invalid`.
+ * - On a `requestPrincipals` host the caller's bearer is the request
+ *   principal's, so a principal key is refused with `PERMISSION_DENIED`
+ *   `principal-key-reserved` (rc01 amendments A9, A10).
+ * - The store is read-only: a write is `PERMISSION_DENIED` `store-read-only`.
+ */
+import { CapabilityError, HOST_CREDENTIAL_MANIFEST_KEY as HOST_CREDENTIALS_MANIFEST_KEY, checkHostCredentialsPublisher, hostCredentialsStaleError, parseHostCredentialsManifest } from '@vibesdotdev/kernel';
+import { assertSecretKey } from "../../domain/kinds/secret-key.js";
+import { isSecretKey } from "../../support/secret-value.js";
+import descriptor, { HOST_CREDENTIALS_STORE_ID } from "./host-credentials.descriptor.js";
+/** Keys that carry the caller's identity: auth's declared principal keys. */
+export const PRINCIPAL_CREDENTIAL_KEYS = new Set(['VIBES_AUTH_TOKEN']);
+/** The store is read-only; the refusal names the store, never the key asked. */
+function readOnly() {
+    return new CapabilityError('The host-credentials store is read-only.', 'PERMISSION_DENIED', {
+        reason: 'store-read-only',
+        details: { store: HOST_CREDENTIALS_STORE_ID }
+    });
+}
+function principalKeyReserved(key) {
+    return new CapabilityError(`'${key}' is the caller's identity on this host; it comes from the request principal, never from host credentials.`, 'PERMISSION_DENIED', { reason: 'principal-key-reserved', details: { store: HOST_CREDENTIALS_STORE_ID, key } });
+}
+export function createHostCredentialsStore(host, probe) {
+    /** The manifest of the captured environment as it is now: read and parsed on every call, never kept. */
+    function manifest() {
+        const raw = host.getEnvSnapshot()[HOST_CREDENTIALS_MANIFEST_KEY];
+        if (raw === undefined) {
+            throw new CapabilityError(`This host has no ${HOST_CREDENTIALS_MANIFEST_KEY} manifest.`, 'INVALID_INPUT', { reason: 'manifest-invalid', details: { key: HOST_CREDENTIALS_MANIFEST_KEY, cause: 'absent' } });
+        }
+        return parseHostCredentialsManifest(raw, host.declaredScope.hosting?.venue);
+    }
+    /** The manifest, once its publisher is confirmed live for this read. */
+    async function liveManifest() {
+        const current = manifest();
+        const liveness = await checkHostCredentialsPublisher(current.publisher, probe);
+        if (!liveness.live)
+            throw hostCredentialsStaleError(liveness);
+        return current;
+    }
+    function refusePrincipalKey(key) {
+        if (host.declaredScope.capabilities?.requestPrincipals && PRINCIPAL_CREDENTIAL_KEYS.has(key)) {
+            throw principalKeyReserved(key);
+        }
+    }
+    /** The manifest keys this store answers: not the caller's identity on a principal host, and no name an object holds as internals. */
+    function answerable(current) {
+        const named = current.keys.filter(isSecretKey);
+        return host.declaredScope.capabilities?.requestPrincipals
+            ? named.filter((key) => !PRINCIPAL_CREDENTIAL_KEYS.has(key))
+            : named;
+    }
+    /** The captured value of `key`: an own entry of the snapshot only, never one an object inherits. */
+    function captured(snapshot, key) {
+        return Object.hasOwn(snapshot, key) ? snapshot[key] : undefined;
+    }
+    return {
+        id: HOST_CREDENTIALS_STORE_ID,
+        descriptor,
+        async get(_environment, key) {
+            assertSecretKey(key);
+            refusePrincipalKey(key);
+            const current = await liveManifest();
+            if (!current.keys.includes(key))
+                return undefined;
+            return captured(host.getEnvSnapshot(), key);
+        },
+        async list() {
+            const current = await liveManifest();
+            const snapshot = host.getEnvSnapshot();
+            return answerable(current).map((key) => ({
+                key,
+                hasValue: (captured(snapshot, key) ?? '').length > 0,
+                source: HOST_CREDENTIALS_STORE_ID
+            }));
+        },
+        async getAll() {
+            const current = await liveManifest();
+            const snapshot = host.getEnvSnapshot();
+            const values = [];
+            for (const key of answerable(current)) {
+                const value = captured(snapshot, key);
+                if (value !== undefined)
+                    values.push([key, value]);
+            }
+            return Object.fromEntries(values);
+        },
+        async set() {
+            throw readOnly();
+        },
+        async unset() {
+            throw readOnly();
+        },
+        async setAll() {
+            throw readOnly();
+        }
+    };
+}
+//# sourceMappingURL=host-credentials.impl.js.map

package/dist/backends/host-credentials/host-credentials.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.impl.js","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAA4B,MAAM,uCAAuC,CAAC;AACjF;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACP,eAAe,EACf,4BAA4B,IAAI,6BAA6B,EAC7D,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAG3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,UAAU,EAAC,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAExF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE5F,gFAAgF;AAChF,SAAS,QAAQ;IAChB,OAAO,IAAI,eAAe,CAAC,0CAA0C,EAAE,mBAAmB,EAAE;QAC3F,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;KAC7C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACxC,OAAO,IAAI,eAAe,CACzB,IAAI,GAAG,4GAA4G,EACnH,mBAAmB,EACnB,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,IAAyB,EACzB,KAAmC;IAEnC,wGAAwG;IACxG,SAAS,QAAQ;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACjE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CACxB,oBAAoB,6BAA6B,YAAY,EAC7D,eAAe,EACf,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChG,CAAC;QACH,CAAC;QACD,OAAO,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,wEAAwE;IACxE,KAAK,UAAU,YAAY;QAC1B,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,SAAS,kBAAkB,CAAC,GAAW;QACtC,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,iBAAiB,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IAED,qIAAqI;IACrI,SAAS,UAAU,CAAC,OAAgC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,iBAAiB;YACxD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC,CAAC,KAAK,CAAC;IACV,CAAC;IAED,oGAAoG;IACpG,SAAS,QAAQ,CAAC,QAAgC,EAAE,GAAW;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAED,OAAO;QACN,EAAE,EAAE,yBAAyB;QAC7B,UAAU;QACV,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG;YAC1B,eAAe,CAAC,GAAG,CAAC,CAAC;YACrB,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,IAAI;YACT,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxC,GAAG;gBACH,QAAQ,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBACpD,MAAM,EAAE,yBAAyB;aACjC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACX,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACtC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,GAAG;YACR,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,KAAK;YACV,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,MAAM;YACX,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backends/host-credentials/host-credentials.plugin.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Secrets Backend: host-credentials
+ *
+ * Composes the `host-credentials` store when this host's captured environment
+ * holds a `VIBES_HOST_CREDENTIALS` manifest, and nothing otherwise. The
+ * manifest's validity and liveness are judged on every read, so a stale or
+ * malformed manifest fails closed instead of letting a lower store answer.
+ */
+import { type HostCredentialsLivenessProbe, type RuntimePlugin } from '@vibesdotdev/kernel';
+/**
+ * `probe` overrides liveness probing (tests); absent, the store reads a
+ * publisher's start time through the composing runtime's process service.
+ */
+export declare function createSecretsBackendHostCredentialsPlugin(probe?: Partial<HostCredentialsLivenessProbe>): RuntimePlugin;
+export declare const secretsBackendHostCredentialsPlugin: RuntimePlugin;
+export default secretsBackendHostCredentialsPlugin;
+//# sourceMappingURL=host-credentials.plugin.d.ts.map

package/dist/backends/host-credentials/host-credentials.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.plugin.d.ts","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAMP,KAAK,4BAA4B,EACjC,KAAK,aAAa,EACjB,MAAM,qBAAqB,CAAC;AAI7B;;;GAGG;AACH,wBAAgB,yCAAyC,CACxD,KAAK,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,GAC3C,aAAa,CAsCf;AAED,eAAO,MAAM,mCAAmC,eAA8C,CAAC;AAE/F,eAAe,mCAAmC,CAAC"}

package/dist/backends/host-credentials/host-credentials.plugin.js

@@ -0,0 +1,52 @@
+/**
+ * Secrets Backend: host-credentials
+ *
+ * Composes the `host-credentials` store when this host's captured environment
+ * holds a `VIBES_HOST_CREDENTIALS` manifest, and nothing otherwise. The
+ * manifest's validity and liveness are judged on every read, so a stale or
+ * malformed manifest fails closed instead of letting a lower store answer.
+ */
+import { CapabilityError, HOST_CREDENTIAL_MANIFEST_KEY, VibesRuntime, createRuntimePlugin, processServiceLivenessProbe } from '@vibesdotdev/kernel';
+import descriptor, { HOST_CREDENTIALS_STORE_ID } from "./host-credentials.descriptor.js";
+/**
+ * `probe` overrides liveness probing (tests); absent, the store reads a
+ * publisher's start time through the composing runtime's process service.
+ */
+export function createSecretsBackendHostCredentialsPlugin(probe) {
+    return createRuntimePlugin({
+        id: '@vibesdotdev/secrets/backends/host-credentials',
+        name: 'Secrets Backend: Host Credentials',
+        description: 'Answers the keys a live publisher named in VIBES_HOST_CREDENTIALS, from the captured environment.',
+        dependencies: ['secrets'],
+        onRegister: async (runtime) => {
+            if (!(runtime instanceof VibesRuntime)) {
+                throw new CapabilityError('host-credentials needs the runtime that composes it.', 'INTERNAL', {
+                    reason: 'runtime-unavailable',
+                    details: { store: HOST_CREDENTIALS_STORE_ID }
+                });
+            }
+            if (!runtime.hasEnvironment)
+                return;
+            if (runtime.getEnvSnapshot()[HOST_CREDENTIAL_MANIFEST_KEY] === undefined)
+                return;
+            runtime.registerDescriptor('secrets/store', descriptor);
+            runtime.registerLoader('secrets/store', HOST_CREDENTIALS_STORE_ID, async () => {
+                const { createHostCredentialsStore } = await import("./host-credentials.impl.js");
+                // The process table is read through the runtime's process service,
+                // resolved at each probe (a lease never needs it). A lease's `expiresAt`
+                // is Unix milliseconds (the publisher writes it from the wall clock), so
+                // its verdict reads the wall clock: `runtime.lifecycle.now()` is a
+                // monotonic count since an arbitrary start and would never expire a lease.
+                const liveness = {
+                    ...processServiceLivenessProbe(runtime),
+                    nowMs: () => Date.now(),
+                    ...probe
+                };
+                return { impl: createHostCredentialsStore(runtime, liveness) };
+            }, { priority: 0, origin: 'secrets-backend-host-credentials' });
+        }
+    });
+}
+export const secretsBackendHostCredentialsPlugin = createSecretsBackendHostCredentialsPlugin();
+export default secretsBackendHostCredentialsPlugin;
+//# sourceMappingURL=host-credentials.plugin.js.map

package/dist/backends/host-credentials/host-credentials.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-credentials.plugin.js","sourceRoot":"","sources":["../../../src/backends/host-credentials/host-credentials.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACP,eAAe,EACf,4BAA4B,EAC5B,YAAY,EACZ,mBAAmB,EACnB,2BAA2B,EAG1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,UAAU,EAAC,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAGxF;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CACxD,KAA6C;IAE7C,OAAO,mBAAmB,CAAC;QAC1B,EAAE,EAAE,gDAAgD;QACpD,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACV,mGAAmG;QACpG,YAAY,EAAE,CAAC,SAAS,CAAC;QACzB,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,CAAC,OAAO,YAAY,YAAY,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,UAAU,EAAE;oBAC7F,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE;iBAC7C,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,OAAO;YACpC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,4BAA4B,CAAC,KAAK,SAAS;gBAAE,OAAO;YACjF,OAAO,CAAC,kBAAkB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACxD,OAAO,CAAC,cAAc,CACrB,eAAe,EACf,yBAAyB,EACzB,KAAK,IAAI,EAAE;gBACV,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;gBAClF,mEAAmE;gBACnE,yEAAyE;gBACzE,yEAAyE;gBACzE,mEAAmE;gBACnE,2EAA2E;gBAC3E,MAAM,QAAQ,GAAiC;oBAC9C,GAAG,2BAA2B,CAAC,OAAO,CAAC;oBACvC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;oBACvB,GAAG,KAAK;iBACR,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChE,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAC3D,CAAC;QACH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,yCAAyC,EAAE,CAAC;AAE/F,eAAe,mCAAmC,CAAC"}

package/dist/backends/host-credentials/index.d.ts

@@ -0,0 +1,4 @@
+export { HOST_CREDENTIALS_STORE_ID, default as hostCredentialsDescriptor } from './host-credentials.descriptor.ts';
+export { PRINCIPAL_CREDENTIAL_KEYS, createHostCredentialsStore, type HostCredentialsHost } from './host-credentials.impl.ts';
+export { createSecretsBackendHostCredentialsPlugin, default, secretsBackendHostCredentialsPlugin } from './host-credentials.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/host-credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/host-credentials/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAC,OAAO,IAAI,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAC,0BAA0B,EAAC,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC3H,OAAO,EACP,yCAAyC,EAAC,OAAO,EAAC,mCAAmC,EACpF,MAAM,8BAA8B,CAAC"}