@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.d.ts

@@ -0,0 +1,11 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type CheckArgs, type CheckOptionsInput } from "../../../../../schemas/cli/commands/check.schema.ts";
+export { checkOptionsSchema, type CheckArgs, type CheckOptionsInput } from "../../../../../schemas/cli/commands/check.schema.ts";
+export { describeEmptyDiscovery, logger, sanitizeDiagnosticMessage, storeAccessAction, tryListStoreEntries, tryResolveStoreBounded, withStoreDeadline, type ManifestCheck, type StoreDiagnostic } from "./check-diagnostics.ts";
+export { collectDriftRows } from "./check-drift.ts";
+export { collectStoreAvailability } from "./store-availability.ts";
+declare const _default: {
+    execute(_args: CheckArgs, opts: CheckOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.check.cli-command.impl.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.check.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOrE,OAAO,EAAqB,KAAK,SAAS,EAAC,KAAK,iBAAiB,EAAE,MAAM,qDAAqD,CAAC;AAc/H,OAAO,EAAE,kBAAkB,EAAC,KAAK,SAAS,EAAC,KAAK,iBAAiB,EAAE,MAAM,qDAAqD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAC,MAAM,EAAC,yBAAyB,EAAC,iBAAiB,EAAC,mBAAmB,EAAC,sBAAsB,EAAC,iBAAiB,EAAC,KAAK,aAAa,EAAC,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxN,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;;mBAI7C,SAAS,QAAQ,iBAAiB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADxG,wBA4HE"}

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.js

@@ -0,0 +1,132 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { canonicalImportManifest } from "../../../../../domain/manifest/canonical.js";
+import { resolveSecretRequirementsWithDiagnostics } from "../../../../../domain/requirements/resolver.js";
+import { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.js";
+import { attemptOf } from "../../../../../support/file-failure.js";
+import { resolveSecretsEnvironment } from "../../../environment.js";
+import { requirementsForApp } from "../../../shared/app-target.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { driftFingerprintHome } from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { describeEmptyDiscovery } from "./check-diagnostics.js";
+import { collectDriftRows } from "./check-drift.js";
+import { renderCheckReport } from "./check-report.js";
+import { collectStoreAvailability } from "./store-availability.js";
+export { checkOptionsSchema } from "../../../../../schemas/cli/commands/check.schema.js";
+export { describeEmptyDiscovery, logger, sanitizeDiagnosticMessage, storeAccessAction, tryListStoreEntries, tryResolveStoreBounded, withStoreDeadline } from "./check-diagnostics.js";
+export { collectDriftRows } from "./check-drift.js";
+export { collectStoreAvailability } from "./store-availability.js";
+export default {
+    async execute(_args, opts, commandContext) {
+        const { runtime } = commandContext;
+        // SAFETY: cli/ui context provides UIContext methods.
+        const ui = (await runtime.context('cli/ui'));
+        const options = parseCommandInput(checkOptionsSchema, opts, 'check');
+        const storeTimeoutMs = Number(options.storeTimeoutMs ?? 15_000);
+        if (!Number.isFinite(storeTimeoutMs) || storeTimeoutMs <= 0) {
+            throw new CapabilityError('--store-timeout-ms must be a finite positive number.', 'INVALID_INPUT', {
+                reason: 'store-timeout-invalid',
+                retryable: false,
+                details: { option: 'storeTimeoutMs' }
+            });
+        }
+        const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, options.environment);
+        // Deployment configs are read from the bound workspace; an unbound host
+        // fails with workspace-unbound instead of reading the cwd.
+        const workspaceRoot = await runtime.context('runtime/workspace-path');
+        const { requirements: allRequirements, discovery } = await resolveSecretRequirementsWithDiagnostics(runtime, {
+            deploymentConfigRoot: workspaceRoot
+        });
+        let requirements = allRequirements;
+        const targetApp = options.app;
+        if (targetApp) {
+            const targeted = attemptOf(() => requirementsForApp(targetApp, allRequirements, discovery.failures.length));
+            if (targeted.ok) {
+                requirements = targeted.value;
+            }
+            else {
+                // `INVALID_INPUT` `unknown-secret-requirement-app`: rendered as the typed envelope, never a zero-item success.
+                const refusal = CapabilityError.from(targeted.failure);
+                if (options.json) {
+                    ui.render(refusal.toEnvelope(), { format: 'json' });
+                }
+                else {
+                    ui.error(refusal.message);
+                }
+                requestCLIExit(refusal.exitCode);
+            }
+        }
+        if (requirements.length === 0 && !options.manifest && !options.drift) {
+            ui.info(options.app
+                ? `No secret requirements found for app: ${options.app}`
+                : describeEmptyDiscovery(discovery));
+            if (discovery.failures.length > 0) {
+                for (const failure of discovery.failures.slice(0, 5)) {
+                    ui.error(`  failed to load ${failure.path}: ${failure.message}`);
+                }
+                if (discovery.failures.length > 5) {
+                    ui.error(`  … and ${discovery.failures.length - 5} more config load failures`);
+                }
+                requestCLIExit(2);
+            }
+            return;
+        }
+        if (requirements.length === 0) {
+            ui.info('Requirement discovery returned zero targets. If this ran outside a workspace, discovery is partial.');
+        }
+        // `runtime.assets(kind)` THROWS for an unregistered kind (it is not a
+        // lookup that returns empty). Before this guard, a runtime composed
+        // without any `secrets/store` backend plugin made this command crash
+        // with an uncaught exception before a single line of the report printed
+        // list() failure already does: report every requirement 'unknown' with
+        // an actionable diagnostic, never crash before the report renders.
+        const { availableKeys, storeDiagnostics, tierStores } = await collectStoreAvailability(runtime, envTier, envName, storeTimeoutMs, options);
+        const results = requirements.map((req) => {
+            const source = availableKeys.get(req.key);
+            let status;
+            if (source) {
+                status = 'ok';
+            }
+            else if (storeDiagnostics.length > 0) {
+                status = 'unknown';
+            }
+            else if (req.required) {
+                status = 'missing';
+            }
+            else {
+                status = 'warn';
+            }
+            return { ...req, status, source };
+        });
+        const manifestChecks = options.manifest
+            ? canonicalImportManifest.secrets.map((entry) => {
+                const storedIn = availableKeys.get(entry.key);
+                let status;
+                if (storedIn)
+                    status = 'ok';
+                else if (storeDiagnostics.length > 0)
+                    status = 'unknown';
+                else if (entry.required)
+                    status = 'missing';
+                else
+                    status = 'warn';
+                return {
+                    key: entry.key,
+                    required: entry.required,
+                    source: entry.source,
+                    status,
+                    storedIn
+                };
+            })
+            : [];
+        const drift = options.drift
+            ? await collectDriftRows(runtime, await driftFingerprintHome(runtime), envName, tierStores, storeTimeoutMs, storeDiagnostics)
+            : { rows: [], unreadable: [] };
+        const driftRows = drift.rows;
+        // A store that cannot be checked, or a key one refused to return, leaves the comparison incomplete.
+        const driftUnknown = Boolean(options.drift && (storeDiagnostics.length > 0 || drift.unreadable.length > 0));
+        const driftDiverged = driftRows.filter((row) => row.status === 'diverge').length;
+        renderCheckReport(ui, options, envName, envTier, results, manifestChecks, drift, driftRows, driftUnknown, driftDiverged, storeDiagnostics, requirements);
+    }
+};
+//# sourceMappingURL=secrets.check.cli-command.impl.js.map

package/dist/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.check.cli-command.impl.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/secrets.check.cli-command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EACP,wCAAwC,EACvC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAwC,MAAM,qDAAqD,CAAC;AAC/H,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACP,oBAAoB,EAEnB,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAqB,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAwC,MAAM,qDAAqD,CAAC;AAC/H,OAAO,EAAE,sBAAsB,EAAC,MAAM,EAAC,yBAAyB,EAAC,iBAAiB,EAAC,mBAAmB,EAAC,sBAAsB,EAAC,iBAAiB,EAA0C,MAAM,wBAAwB,CAAC;AACxN,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAgB,EAAE,IAAuB,EAAE,cAA8B;QACtF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,qDAAqD;QACrD,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAc,CAAC;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAErE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,eAAe,EAAE;gBAClG,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;aACrC,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEvG,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;QAC9E,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,GACjD,MAAM,wCAAwC,CAAC,OAAO,EAAE;YACvD,oBAAoB,EAAE,aAAa;SACnC,CAAC,CAAC;QACJ,IAAI,YAAY,GAAG,eAAe,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;QAC9B,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5G,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACP,+GAA+G;gBAC/G,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBAClB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACP,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;gBACD,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACtE,EAAE,CAAC,IAAI,CACN,OAAO,CAAC,GAAG;gBACV,CAAC,CAAC,yCAAyC,OAAO,CAAC,GAAG,EAAE;gBACxD,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,CACpC,CAAC;YACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACtD,EAAE,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,EAAE,CAAC,KAAK,CAAC,WAAW,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAChF,CAAC;gBACD,cAAc,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,OAAO;QACR,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,EAAE,CAAC,IAAI,CACN,qGAAqG,CACrG,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3I,MAAM,OAAO,GAAkB,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAA6B,CAAC;YAClC,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,SAAS,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,MAAM,CAAC;YACjB,CAAC;YACD,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,cAAc,GAAoB,OAAO,CAAC,QAAQ;YACvD,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9C,IAAI,MAA+B,CAAC;gBACpC,IAAI,QAAQ;oBAAE,MAAM,GAAG,IAAI,CAAC;qBACvB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,GAAG,SAAS,CAAC;qBACpD,IAAI,KAAK,CAAC,QAAQ;oBAAE,MAAM,GAAG,SAAS,CAAC;;oBACvC,MAAM,GAAG,MAAM,CAAC;gBACrB,OAAO;oBACN,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM;oBACN,QAAQ;iBACR,CAAC;YACH,CAAC,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;YAC1B,CAAC,CAAC,MAAM,gBAAgB,CACvB,OAAO,EACP,MAAM,oBAAoB,CAAC,OAAO,CAAC,EACnC,OAAO,EACP,UAAU,EACV,cAAc,EACd,gBAAgB,CAChB;YACD,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAChC,MAAM,SAAS,GAAe,KAAK,CAAC,IAAI,CAAC;QACzC,oGAAoG;QACpG,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5G,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QACjF,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC1J,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/check/store-availability.d.ts

@@ -0,0 +1,30 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { EnvironmentTier } from '../../../../../domain/kinds/store.schema.ts';
+import type { CheckOptionsInput } from '../../../../../schemas/cli/commands/check.schema.ts';
+export declare function collectStoreAvailability(runtime: VibesRuntime, envTier: EnvironmentTier, envName: string, storeTimeoutMs: number, options: CheckOptionsInput): Promise<{
+    availableKeys: Map<string, string>;
+    storeDiagnostics: {
+        storeId: string;
+        storeName: string;
+        backend: string;
+        environment: string;
+        error: string;
+        action: string;
+    }[];
+    tierStores: {
+        id: string;
+        kind: "secrets/store";
+        backend: string;
+        tiers: ("local" | "dev" | "staging" | "production")[];
+        name?: string | undefined;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+        enabled?: boolean | undefined;
+        hardware?: string[] | undefined;
+        selection?: "scope" | "by-id" | undefined;
+        managedCredentialValues?: true | undefined;
+        priority?: number | undefined;
+        config?: Record<string, string> | undefined;
+    }[];
+}>;
+//# sourceMappingURL=store-availability.d.ts.map

package/dist/surfaces/cli/commands/maintenance/check/store-availability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-availability.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/store-availability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAKnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qDAAqD,CAAC;AAG7F,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;GAwDlK"}

package/dist/surfaces/cli/commands/maintenance/check/store-availability.js

@@ -0,0 +1,57 @@
+import { parseSecretsStoreDescriptors } from "../../../../../domain/kinds/store-selection.js";
+import { isGenericSecretsStoreDescriptor } from "../../../../../domain/kinds/store.schema.js";
+import { logger, sanitizeDiagnosticMessage, storeAccessAction, tryListStoreEntries } from "./secrets.check.cli-command.impl.js";
+export async function collectStoreAvailability(runtime, envTier, envName, storeTimeoutMs, options) {
+    const secretsStoreKindRegistered = runtime.hasKind('secrets/store');
+    const descriptors = secretsStoreKindRegistered
+        ? parseSecretsStoreDescriptors(runtime.assets('secrets/store').descriptors())
+        : [];
+    // Availability is evidence from every scope store serving the tier (drift compares them
+    // too), not one pick: the stores a key may be answered from are all asked.
+    const tierStores = descriptors.filter((d) => isGenericSecretsStoreDescriptor(d) && d.tiers.includes(envTier));
+    const availableKeys = new Map();
+    const storeDiagnostics = [];
+    if (!secretsStoreKindRegistered) {
+        storeDiagnostics.push({
+            storeId: 'secrets/store',
+            storeName: 'secrets/store',
+            backend: 'unregistered',
+            environment: envName,
+            error: "No 'secrets/store' kind is registered in this runtime — no secrets backend plugin was loaded.",
+            action: 'Ensure a secrets backend plugin (encrypted-local, cloudflare-secrets-store, etc.) is composed into this runtime before running `vibes secrets check`.'
+        });
+    }
+    for (const desc of tierStores) {
+        const outcome = await tryListStoreEntries(runtime, desc.id, envName, storeTimeoutMs);
+        if (outcome.ok) {
+            for (const entry of outcome.entries) {
+                if (entry.hasValue && !availableKeys.has(entry.key)) {
+                    availableKeys.set(entry.key, entry.source);
+                }
+            }
+        }
+        else {
+            const error = outcome.error;
+            logger.warn('Failed to query secrets store during check', {
+                storeId: desc.id,
+                error
+            });
+            const message = sanitizeDiagnosticMessage(error instanceof Error ? error.message : String(error));
+            storeDiagnostics.push({
+                storeId: desc.id,
+                storeName: desc.name ?? desc.id,
+                backend: desc.backend,
+                environment: envName,
+                error: message,
+                action: storeAccessAction(desc, message, {
+                    environment: envName,
+                    app: options.app,
+                    manifest: options.manifest,
+                    json: options.json
+                })
+            });
+        }
+    }
+    return { availableKeys, storeDiagnostics, tierStores };
+}
+//# sourceMappingURL=store-availability.js.map

package/dist/surfaces/cli/commands/maintenance/check/store-availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-availability.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/check/store-availability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,EACP,+BAA+B,EAE9B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,MAAM,EAAC,yBAAyB,EAAC,iBAAiB,EAAC,mBAAmB,EAAuB,MAAM,qCAAqC,CAAC;AAElJ,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqB,EAAE,OAAwB,EAAE,OAAe,EAAE,cAAsB,EAAE,OAA0B;IAClK,MAAM,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,WAAW,GAA6B,0BAA0B;QACvE,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7E,CAAC,CAAC,EAAE,CAAC;IACN,wFAAwF;IACxF,2EAA2E;IAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtE,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,eAAe;YAC1B,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,OAAO;YACpB,KAAK,EAAE,+FAA+F;YACtG,MAAM,EAAE,uJAAuJ;SAC/J,CAAC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5C,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBACzD,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,KAAK;aACL,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,yBAAyB,CACxC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;YACF,gBAAgB,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,OAAO;gBACpB,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE;oBACxC,WAAW,EAAE,OAAO;oBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;iBAClB,CAAC;aACF,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.export.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAoBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.descriptor.js

@@ -0,0 +1,23 @@
+const descriptor = {
+    kind: 'cli/command',
+    id: 'secrets.export',
+    name: 'export',
+    description: 'Export secrets from a local backend to an env-formatted file (audit-logged)',
+    group: 'secrets',
+    options: [
+        { flags: '--environment <name>', description: 'Source environment (default: current)' },
+        { flags: '--from <backend>', description: 'Source backend (default: highest-priority local)' },
+        { flags: '--out <path>', description: 'Output file path (required; created mode 0600)' },
+        { flags: '--manifest-only', description: 'Limit to keys declared in the canonical manifest' },
+        {
+            flags: '--force',
+            description: 'Skip the interactive bulk-reveal confirmation (an existing --out file is replaced either way)'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 35
+};
+export default descriptor;
+//# sourceMappingURL=secrets.export.cli-command.descriptor.js.map

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.export.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,kDAAkD,EAAE;QAC9F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,gDAAgD,EAAE;QACxF,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,kDAAkD,EAAE;QAC7F;YACC,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,+FAA+F;SAC5G;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type ExportArgs, type ExportOptionsInput } from "../../../../../schemas/cli/commands/export.schema.ts";
+export { exportOptionsSchema, type ExportArgs, type ExportOptionsInput } from "../../../../../schemas/cli/commands/export.schema.ts";
+declare const _default: {
+    execute(_args: ExportArgs, opts: ExportOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.export.cli-command.impl.consumer.d.ts.map

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.export.cli-command.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOrE,OAAO,EAAsB,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAWnI,OAAO,EAAE,mBAAmB,EAAC,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;;mBAgC7G,UAAU,QAAQ,kBAAkB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD1G,wBA4FE"}

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.js

@@ -0,0 +1,113 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { publishPrivateFile, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { canonicalImportManifest } from "../../../../../domain/manifest/canonical.js";
+import { serializeDotenv } from "../../../../../domain/manifest/dotenv.js";
+import { exportOptionsSchema } from "../../../../../schemas/cli/commands/export.schema.js";
+import { resolveSecretsEnvironment } from "../../../../../support/environment.js";
+import { outcomeOf } from "../../../../../support/file-failure.js";
+import { openCommandOutput } from "../../../shared/output/command-output.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore, typedStoreFailure } from "../../../shared/stores/store-selection.js";
+export { exportOptionsSchema } from "../../../../../schemas/cli/commands/export.schema.js";
+/** A directory the export has to create is the owner's alone. */
+const EXPORT_DIRECTORY_MODE = 0o700;
+const LOCAL_BACKENDS = new Set(['env-file', 'encrypted-local']);
+/** The export file's text: a header, then the one `.env` grammar of `./manifest` (refuses a key or value it cannot hold). */
+function serializeEnv(secrets) {
+    return `# Generated by 'vibes secrets export' — DO NOT COMMIT\n${serializeDotenv(secrets)}`;
+}
+/**
+ * Publish the export owner-private (0600) through the host's filesystem adapter:
+ * a same-directory temporary file renamed over the target, removed if the write
+ * fails. An existing target is replaced.
+ */
+async function writeEnvFile(fs, absolute, content) {
+    await fs.mkdir(fs.dirname(absolute), { recursive: true, mode: EXPORT_DIRECTORY_MODE });
+    await publishPrivateFile(fs, absolute, content);
+}
+function emitAudit(out, input) {
+    out.warn(`[AUDIT] ${JSON.stringify({
+        id: crypto.randomUUID(),
+        timestamp: new Date().toISOString(),
+        ...input
+    })}`);
+}
+export default {
+    async execute(_args, opts, commandContext) {
+        const { runtime } = commandContext;
+        // SAFETY: 'cli/ui' context provides UIContext.
+        const ui = (await runtime.context('cli/ui'));
+        const options = parseCommandInput(exportOptionsSchema, opts, 'export');
+        const out = await openCommandOutput(runtime);
+        if (!options.out) {
+            ui.error('--out <path> is required. Export refuses to write secrets to stdout.');
+            requestCLIExit(1);
+        }
+        // `--out` is resolved against the host cwd the user typed it in, before any secret is read.
+        const cwd = runtime.localEnvironment.getCwd?.();
+        if (!cwd) {
+            throw new CapabilityError('This host has no working directory.', 'UNAVAILABLE', {
+                reason: 'cwd-unavailable'
+            });
+        }
+        const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+        const outPath = fs.resolve(cwd, options.out);
+        const { name: envName, tier: envTier } = await resolveSecretsEnvironment(runtime, ui, options.environment);
+        // The named `--from`, else the tier's one local store: parsed descriptors, a typed refusal for none or a tie.
+        const source = selectStore(listStoreDescriptors(runtime), envTier, options.from, (d) => LOCAL_BACKENDS.has(d.backend));
+        const impl = await resolveStoreImplementation(runtime, source.id);
+        const revealed = await outcomeOf(() => impl.getAll(envName));
+        if (!revealed.ok)
+            throw typedStoreFailure(revealed.failure, 'read', source.id);
+        let secrets = revealed.value;
+        if (options.manifestOnly) {
+            const manifestKeys = new Set(canonicalImportManifest.secrets.map((s) => s.key));
+            secrets = Object.fromEntries(Object.entries(secrets).filter(([k]) => manifestKeys.has(k)));
+        }
+        const count = Object.keys(secrets).length;
+        if (count === 0) {
+            ui.info(`No secrets to export from [${source.id}] for ${envName}.`);
+            return;
+        }
+        // `--force` skips this confirmation and nothing else: an existing --out file is replaced either way.
+        if (!options.force) {
+            const replaces = (await fs.exists(outPath)) ? ' It replaces the file that is there.' : '';
+            const confirmed = await ui.confirm(`[EXPORT] About to write ${count} secret value(s) from [${source.id}] (${envName}) to ${options.out}.${replaces}\nThis bulk reveal is logged to the audit trail.\nContinue?`, false);
+            if (!confirmed) {
+                ui.info('Export cancelled.');
+                return;
+            }
+        }
+        // The audit records the outcome the write had, so it is emitted after it: `success` only once the file is published.
+        const auditExport = (outcome, failureReason) => {
+            const entry = {
+                category: 'data_access',
+                severity: 'high',
+                action: 'secrets.export',
+                actor: { id: 'cli', type: 'user', name: 'CLI user' },
+                target: { id: source.id, type: 'secrets-store', name: source.id },
+                outcome,
+                context: {
+                    environment: envName,
+                    backend: source.id,
+                    count,
+                    manifestOnly: options.manifestOnly === true,
+                    outPath: options.out
+                }
+            };
+            if (failureReason !== undefined)
+                entry.error = failureReason;
+            emitAudit(out, entry);
+        };
+        const written = await outcomeOf(() => writeEnvFile(fs, outPath, serializeEnv(secrets)));
+        if (!written.ok) {
+            const failure = CapabilityError.from(written.failure);
+            auditExport('failure', failure.reason);
+            throw failure;
+        }
+        auditExport('success');
+        ui.success(`Exported ${count} secret(s) from [${source.id}] to ${options.out} (mode 0600)`);
+    }
+};
+//# sourceMappingURL=secrets.export.cli-command.impl.consumer.js.map

package/dist/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.export.cli-command.impl.consumer.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/export/secrets.export.cli-command.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAC,wBAAwB,EAAkC,MAAM,yBAAyB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sDAAsD,CAAC;AACnI,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,0CAA0C,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACP,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sDAAsD,CAAC;AAEnI,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhE,6HAA6H;AAC7H,SAAS,YAAY,CAAC,OAA+B;IACpD,OAAO,0DAA0D,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,EAA8B,EAAE,QAAgB,EAAE,OAAe;IAC5F,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvF,MAAM,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAGD,SAAS,SAAS,CAAC,GAAkB,EAAE,KAAoB;IAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC;QAClC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,KAAK;KACR,CAAC,EAAE,CAAC,CAAC;AACP,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,IAAwB,EAAE,cAA8B;QACxF,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,+CAA+C;QAC/C,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAc,CAAC;QAC1D,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAClB,EAAE,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YACjF,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,4FAA4F;QAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE;gBAC/E,MAAM,EAAE,iBAAiB;aACzB,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CACvE,OAAO,EACP,EAAE,EACF,OAAO,CAAC,WAAW,CACnB,CAAC;QAEF,8GAA8G;QAC9G,MAAM,MAAM,GAAG,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvH,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE7B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,OAAO,GAAG,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACjB,EAAE,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,EAAE,SAAS,OAAO,GAAG,CAAC,CAAC;YACpE,OAAO;QACR,CAAC;QAED,qGAAqG;QACrG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC,2BAA2B,KAAK,0BAA0B,MAAM,CAAC,EAAE,MAAM,OAAO,QAAQ,OAAO,CAAC,GAAG,IAAI,QAAQ,6DAA6D,EAC5K,KAAK,CACL,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAC7B,OAAO;YACR,CAAC;QACF,CAAC;QAED,qHAAqH;QACrH,MAAM,WAAW,GAAG,CAAC,OAA8B,EAAE,aAAsB,EAAQ,EAAE;YACpF,MAAM,KAAK,GAAkB;gBAC5B,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;gBACpD,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;gBACjE,OAAO;gBACP,OAAO,EAAE;oBACR,WAAW,EAAE,OAAO;oBACpB,OAAO,EAAE,MAAM,CAAC,EAAE;oBAClB,KAAK;oBACL,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;oBAC3C,OAAO,EAAE,OAAO,CAAC,GAAG;iBACpB;aACD,CAAC;YACF,IAAI,aAAa,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,aAAa,CAAC;YAC7D,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtD,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,CAAC;QACf,CAAC;QACD,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,EAAE,CAAC,OAAO,CAAC,YAAY,KAAK,oBAAoB,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAC,GAAG,cAAc,CAAC,CAAC;IAC7F,CAAC;CACD,CAAC"}

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.import.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,QAAA,MAAM,UAAU,EAAE,yBAgBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.import.cli-command.descriptor.js","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,2FAA2F;IACxG,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,2CAA2C,EAAE;QACrF,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACnF,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,6CAA6C,EAAE;KAClF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+import { type ImportArgs, type ImportOptionsInput } from "../../../../../schemas/cli/commands/import.schema.ts";
+export { importOptionsSchema, type ImportArgs, type ImportOptionsInput } from "../../../../../schemas/cli/commands/import.schema.ts";
+declare const _default: {
+    execute(_args: ImportArgs, opts: ImportOptionsInput, commandContext: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=secrets.import.cli-command.impl.consumer.d.ts.map

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.import.cli-command.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../../../src/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAMrE,OAAO,EAAsB,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;AAYnI,OAAO,EAAE,mBAAmB,EAAC,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAE,MAAM,sDAAsD,CAAC;;mBAsD7G,UAAU,QAAQ,kBAAkB,kBAAkB,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD1G,wBA8HE"}

package/dist/surfaces/cli/commands/maintenance/import/secrets.import.cli-command.impl.consumer.js

@@ -0,0 +1,171 @@
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { canonicalImportManifest } from "../../../../../domain/manifest/canonical.js";
+import { dotenvValues, parseDotenv } from "../../../../../domain/manifest/dotenv.js";
+import { importOptionsSchema } from "../../../../../schemas/cli/commands/import.schema.js";
+import { resolveSecretsEnvironment } from "../../../../../support/environment.js";
+import { isAbsentEntry, outcomeOf } from "../../../../../support/file-failure.js";
+import { openCommandOutput } from "../../../shared/output/command-output.js";
+import { parseCommandInput } from "../../../shared/parse-options.js";
+import { driftFingerprintHome, recordFingerprint } from "../../../shared/stores/drift-fingerprints.impl.consumer.js";
+import { listStoreDescriptors, requireNamedStore, resolveStoreImplementation, typedStoreFailure } from "../../../shared/stores/store-selection.js";
+export { importOptionsSchema } from "../../../../../schemas/cli/commands/import.schema.js";
+/**
+ * A source `.env` file's KEY → value map, read with the one `./manifest`
+ * grammar (the one `export` writes). A missing file yields an empty map (not an
+ * error): sources are bootstrap inputs. Any other read failure is typed
+ * `UNAVAILABLE` `import-source-unreadable` with its cause.
+ */
+async function readEnvFile(fs, path) {
+    const read = await outcomeOf(() => fs.readFile(path, 'utf-8'));
+    // Asked for utf-8, the adapter answers text.
+    if (read.ok)
+        return dotenvValues(parseDotenv(z.string().parse(read.value)));
+    // An absent source file contributes nothing; a denied read is not absence.
+    if (isAbsentEntry(read.failure))
+        return new Map();
+    throw new CapabilityError('An import source file could not be read.', 'UNAVAILABLE', {
+        reason: 'import-source-unreadable',
+        cause: read.failure,
+        details: { path }
+    });
+}
+/** Record each imported value's drift fingerprint like `set` does; a failure is reported, the import already landed. */
+async function recordImportedFingerprints(runtime, environment, backend, found) {
+    try {
+        const home = await driftFingerprintHome(runtime);
+        for (const [key, value] of Object.entries(found)) {
+            await recordFingerprint({ environment, backend, key, value, home });
+        }
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+import * as z from 'zod/v4';
+function pickValue(envMap, key, aliases) {
+    for (const name of [key, ...aliases]) {
+        const value = envMap.get(name);
+        if (value !== undefined && value !== '')
+            return value;
+    }
+    return undefined;
+}
+export default {
+    async execute(_args, opts, commandContext) {
+        const { runtime } = commandContext;
+        // SAFETY: 'cli/ui' context provides UIContext.
+        const ui = (await runtime.context('cli/ui'));
+        const options = parseCommandInput(importOptionsSchema, opts, 'import');
+        const out = await openCommandOutput(runtime);
+        const { name: envName } = await resolveSecretsEnvironment(runtime, ui, options.environment);
+        const sourceFilter = options.source;
+        // A source is a declared own entry of the manifest: `constructor` or `toString` is not one.
+        if (sourceFilter && !Object.hasOwn(canonicalImportManifest.sources, sourceFilter)) {
+            ui.error(`Unknown source: ${sourceFilter}. Known: ${Object.keys(canonicalImportManifest.sources).join(', ')}`);
+            requestCLIExit(1);
+        }
+        // Import sources are workspace-relative paths in the canonical manifest.
+        const repoRoot = await runtime.context('runtime/workspace-path');
+        // The sources are the host's own files at absolute paths, not a workspace-rooted view.
+        const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+        const sourceContents = new Map();
+        const manualSources = new Set();
+        for (const [id, src] of Object.entries(canonicalImportManifest.sources)) {
+            if (sourceFilter && id !== sourceFilter)
+                continue;
+            if (!src.path) {
+                manualSources.add(id);
+                continue;
+            }
+            sourceContents.set(id, await readEnvFile(fs, fs.resolve(repoRoot, src.path)));
+        }
+        const found = {};
+        const missingRequired = [];
+        const missingOptional = [];
+        const manualEntries = [];
+        for (const entry of canonicalImportManifest.secrets) {
+            if (sourceFilter && entry.source !== sourceFilter)
+                continue;
+            if (manualSources.has(entry.source)) {
+                manualEntries.push({ key: entry.key, required: entry.required });
+                continue;
+            }
+            const sourceMap = sourceContents.get(entry.source);
+            if (!sourceMap) {
+                if (entry.required)
+                    missingRequired.push(entry.key);
+                else
+                    missingOptional.push(entry.key);
+                continue;
+            }
+            const value = pickValue(sourceMap, entry.key, entry.aliases);
+            if (value === undefined) {
+                if (entry.required)
+                    missingRequired.push(entry.key);
+                else
+                    missingOptional.push(entry.key);
+                continue;
+            }
+            found[entry.key] = value;
+        }
+        const foundCount = Object.keys(found).length;
+        if (options.dryRun) {
+            ui.log(`\nDry run: would import ${foundCount} secret(s) for ${envName}\n`);
+            for (const key of Object.keys(found).sort())
+                ui.log(`  + ${key}`);
+            if (missingRequired.length) {
+                ui.log(`\n  ${missingRequired.length} required secret(s) not found:`);
+                for (const key of missingRequired)
+                    ui.log(`  ! ${key}`);
+            }
+            if (missingOptional.length) {
+                ui.log(`\n  ${missingOptional.length} optional secret(s) not found:`);
+                for (const key of missingOptional)
+                    ui.log(`  ? ${key}`);
+            }
+            if (manualEntries.length) {
+                ui.log(`\n  ${manualEntries.length} manual entry/entries (set via 'vibes secrets set'):`);
+                for (const { key, required } of manualEntries) {
+                    ui.log(`  m ${key} (${required ? 'required' : 'optional'})`);
+                }
+            }
+            ui.log('');
+            return;
+        }
+        if (foundCount === 0) {
+            ui.warn('No secrets found in any source file. Nothing to import.');
+            if (missingRequired.length > 0)
+                requestCLIExit(1);
+            return;
+        }
+        // The named `--to`, else `encrypted-local`: it must be a registered store, never a silent other one.
+        const target = requireNamedStore(listStoreDescriptors(runtime), options.to ?? 'encrypted-local');
+        const impl = await resolveStoreImplementation(runtime, target.id);
+        const written = await outcomeOf(() => impl.setAll(envName, found));
+        if (!written.ok)
+            throw typedStoreFailure(written.failure, 'write', target.id);
+        ui.success(`Imported ${foundCount} secret(s) into [${target.id}] for ${envName}`);
+        // Like `set`: the imported values' fingerprints, so `check --drift` compares them.
+        const fingerprints = await recordImportedFingerprints(runtime, envName, target.id, found);
+        if (!fingerprints.ok) {
+            const failure = CapabilityError.from(CaughtFailureSchema.parse(fingerprints.error));
+            out.warn(`Imported ${foundCount} secret(s), but could not record their drift fingerprints (${failure.reason}): ${failure.message} ` +
+                '`vibes secrets check --drift` will not see these values until they are re-recorded.');
+        }
+        const missingManualRequired = manualEntries.filter((e) => e.required).map((e) => e.key);
+        if (manualEntries.length > 0) {
+            ui.info(`${manualEntries.length} manual entry/entries — set via 'vibes secrets set <KEY>' (${missingManualRequired.length} required)`);
+        }
+        if (missingRequired.length > 0) {
+            ui.warn(`${missingRequired.length} required secret(s) missing from sources: ${missingRequired.join(', ')}`);
+            requestCLIExit(1);
+        }
+        if (missingOptional.length > 0) {
+            ui.info(`${missingOptional.length} optional secret(s) skipped: ${missingOptional.join(', ')}`);
+        }
+    }
+};
+//# sourceMappingURL=secrets.import.cli-command.impl.consumer.js.map