@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/backends/host-credentials/index.js

@@ -0,0 +1,7 @@
+// The store judges publisher liveness through the composing runtime's process service,
+// so it is host-neutral and part of this one entry (`createHostCredentialsStore`,
+// `PRINCIPAL_CREDENTIAL_KEYS`).
+export { HOST_CREDENTIALS_STORE_ID, default as hostCredentialsDescriptor } from "./host-credentials.descriptor.js";
+export { PRINCIPAL_CREDENTIAL_KEYS, createHostCredentialsStore } from "./host-credentials.impl.js";
+export { createSecretsBackendHostCredentialsPlugin, default, secretsBackendHostCredentialsPlugin } from "./host-credentials.plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/backends/host-credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/host-credentials/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,kFAAkF;AAClF,gCAAgC;AAChC,OAAO,EAAE,yBAAyB,EAAC,OAAO,IAAI,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAC,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AAC3H,OAAO,EACP,yCAAyC,EAAC,OAAO,EAAC,mCAAmC,EACpF,MAAM,8BAA8B,CAAC"}

package/dist/backends/mounted-files/index.d.ts

@@ -0,0 +1,3 @@
+export { MOUNTED_FILES_STORE_ID, SECRETS_MOUNT_DIR_KEY, default as mountedFilesDescriptor } from './mounted-files.descriptor.ts';
+export { default, secretsBackendMountedFilesPlugin } from './mounted-files.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/mounted-files/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/mounted-files/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,sBAAsB,EACtB,qBAAqB,EAAC,OAAO,IAAI,sBAAsB,EACtD,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,OAAO,EAAC,gCAAgC,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/backends/mounted-files/index.js

@@ -0,0 +1,4 @@
+export { MOUNTED_FILES_STORE_ID, SECRETS_MOUNT_DIR_KEY, default as mountedFilesDescriptor } from "./mounted-files.descriptor.js";
+// Node filesystem store: `@vibesdotdev/secrets/backends/mounted-files/node`.
+export { default, secretsBackendMountedFilesPlugin } from "./mounted-files.plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/backends/mounted-files/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/mounted-files/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,sBAAsB,EACtB,qBAAqB,EAAC,OAAO,IAAI,sBAAsB,EACtD,MAAM,+BAA+B,CAAC;AACvC,6EAA6E;AAC7E,OAAO,EAAE,OAAO,EAAC,gCAAgC,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/backends/mounted-files/mounted-files.descriptor.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `mounted-files`: a read-only store over a directory of files the host
+ * declared in `VIBES_SECRETS_MOUNT_DIR` (a Kubernetes secret volume, a Docker
+ * secret mount). One file per credential: the file name is the key, the trimmed
+ * content is the value. Scope-selected on the deployed tiers only; the plugin
+ * registers it only when the directory is declared.
+ */
+import type { SecretsStoreDescriptor } from '../../domain/kinds/store.schema.ts';
+export declare const MOUNTED_FILES_STORE_ID = "mounted-files";
+/** The declared host value naming the mounted secrets directory. */
+export declare const SECRETS_MOUNT_DIR_KEY = "VIBES_SECRETS_MOUNT_DIR";
+declare const descriptor: SecretsStoreDescriptor;
+export default descriptor;
+//# sourceMappingURL=mounted-files.descriptor.d.ts.map

package/dist/backends/mounted-files/mounted-files.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.descriptor.d.ts","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEjF,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,QAAA,MAAM,UAAU,EAAE,sBAWjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/mounted-files/mounted-files.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * `mounted-files`: a read-only store over a directory of files the host
+ * declared in `VIBES_SECRETS_MOUNT_DIR` (a Kubernetes secret volume, a Docker
+ * secret mount). One file per credential: the file name is the key, the trimmed
+ * content is the value. Scope-selected on the deployed tiers only; the plugin
+ * registers it only when the directory is declared.
+ */
+export const MOUNTED_FILES_STORE_ID = 'mounted-files';
+/** The declared host value naming the mounted secrets directory. */
+export const SECRETS_MOUNT_DIR_KEY = 'VIBES_SECRETS_MOUNT_DIR';
+const descriptor = {
+    id: MOUNTED_FILES_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Mounted files',
+    description: 'Credentials mounted as one file per key in the directory declared by VIBES_SECRETS_MOUNT_DIR',
+    tags: ['host', 'read-only'],
+    enabled: true,
+    backend: 'mounted-files',
+    selection: 'scope',
+    tiers: ['dev', 'staging', 'production'],
+    priority: 100
+};
+export default descriptor;
+//# sourceMappingURL=mounted-files.descriptor.js.map

package/dist/backends/mounted-files/mounted-files.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.descriptor.js","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,MAAM,UAAU,GAA2B;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,8FAA8F;IAC3G,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;IAC3B,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,eAAe;IACxB,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IACvC,QAAQ,EAAE,GAAG;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/backends/mounted-files/mounted-files.impl.local.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `mounted-files` secrets store: reads credentials from files in one
+ * declared directory, through the runtime's filesystem adapter. File name = key;
+ * trimmed content = value.
+ *
+ * - A key with no file is `undefined` (the kernel reports `credential-not-set`).
+ * - A key that is not a plain file name is `INVALID_INPUT` `mounted-key-invalid`
+ *   (no path traversal out of the declared directory); a name the store never
+ *   answers (`__proto__`, a control character, over-long) is
+ *   `INVALID_INPUT` `secret-key-invalid`. Neither error carries the key.
+ * - A read is bounded: a file over 64 KiB is `INVALID_INPUT`
+ *   `mounted-file-too-large`, and is never read whole.
+ * - Any read failure other than an absent file is `UNAVAILABLE`
+ *   `mounted-file-unreadable` (EACCES, EISDIR, ...); it never reads as not set.
+ * - `list` names the files and never opens them: one unreadable file cannot
+ *   fail it. `hasValue` is whether the listing reports the file non-empty (a
+ *   symlinked entry, as a Kubernetes secret volume projects, is not followed
+ *   and reads as set).
+ * - The store is read-only: a write is `PERMISSION_DENIED` `store-read-only`.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../domain/kinds/store.interface.ts';
+/** The most a mounted credential file may hold: a credential is a short string, never a bulk file. */
+export declare const MOUNTED_FILE_MAX_BYTES: number;
+/** `runtime`'s filesystem adapter is the host's own files, never a workspace-rooted view. */
+export declare function createMountedFilesStore(directory: string, runtime: RuntimeRef): SecretsStoreImplementation;
+//# sourceMappingURL=mounted-files.impl.local.d.ts.map

package/dist/backends/mounted-files/mounted-files.impl.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.impl.local.d.ts","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.impl.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEzF,OAAO,KAAK,EAAc,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAKpG,sGAAsG;AACtG,eAAO,MAAM,sBAAsB,QAAY,CAAC;AA6DhD,6FAA6F;AAC7F,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,0BAA0B,CAmE1G"}

package/dist/backends/mounted-files/mounted-files.impl.local.js

@@ -0,0 +1,146 @@
+/**
+ * The `mounted-files` secrets store: reads credentials from files in one
+ * declared directory, through the runtime's filesystem adapter. File name = key;
+ * trimmed content = value.
+ *
+ * - A key with no file is `undefined` (the kernel reports `credential-not-set`).
+ * - A key that is not a plain file name is `INVALID_INPUT` `mounted-key-invalid`
+ *   (no path traversal out of the declared directory); a name the store never
+ *   answers (`__proto__`, a control character, over-long) is
+ *   `INVALID_INPUT` `secret-key-invalid`. Neither error carries the key.
+ * - A read is bounded: a file over 64 KiB is `INVALID_INPUT`
+ *   `mounted-file-too-large`, and is never read whole.
+ * - Any read failure other than an absent file is `UNAVAILABLE`
+ *   `mounted-file-unreadable` (EACCES, EISDIR, ...); it never reads as not set.
+ * - `list` names the files and never opens them: one unreadable file cannot
+ *   fail it. `hasValue` is whether the listing reports the file non-empty (a
+ *   symlinked entry, as a Kubernetes secret volume projects, is not followed
+ *   and reads as set).
+ * - The store is read-only: a write is `PERMISSION_DENIED` `store-read-only`.
+ */
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { assertSecretKey } from "../../domain/kinds/secret-key.js";
+import { errnoOf, isAbsentEntry, outcomeOf } from "../../support/file-failure.js";
+import { isSecretKey } from "../../support/secret-value.js";
+import descriptor, { MOUNTED_FILES_STORE_ID } from "./mounted-files.descriptor.js";
+/** The most a mounted credential file may hold: a credential is a short string, never a bulk file. */
+export const MOUNTED_FILE_MAX_BYTES = 64 * 1024;
+/** The store is read-only; the refusal names the store, never the key asked. */
+function readOnly() {
+    return new CapabilityError('The mounted-files store is read-only.', 'PERMISSION_DENIED', {
+        reason: 'store-read-only',
+        details: { store: MOUNTED_FILES_STORE_ID }
+    });
+}
+function isPlainFileName(key) {
+    return key !== '' && key !== '.' && key !== '..' && !/[/\\\0]/.test(key);
+}
+function notPlainName() {
+    return new CapabilityError('The key is not a valid mounted credential name.', 'INVALID_INPUT', {
+        reason: 'mounted-key-invalid',
+        details: { store: MOUNTED_FILES_STORE_ID }
+    });
+}
+function unreadable(path, cause) {
+    const code = errnoOf(cause);
+    return new CapabilityError(`The mounted secret file could not be read (${code ?? 'unknown'}).`, 'UNAVAILABLE', {
+        reason: 'mounted-file-unreadable',
+        cause,
+        details: code ? { store: MOUNTED_FILES_STORE_ID, path, errno: code } : { store: MOUNTED_FILES_STORE_ID, path }
+    });
+}
+function tooLarge(path, sizeBytes) {
+    return new CapabilityError(`The mounted secret file is ${sizeBytes} bytes; a credential file may hold at most ${MOUNTED_FILE_MAX_BYTES}.`, 'INVALID_INPUT', {
+        reason: 'mounted-file-too-large',
+        retryable: false,
+        details: { store: MOUNTED_FILES_STORE_ID, path, sizeBytes, maxBytes: MOUNTED_FILE_MAX_BYTES }
+    });
+}
+/** The adapter's size-bounded read, or a typed refusal: an unbounded fallback would read a hostile file whole. */
+function boundedReader(fs) {
+    const read = fs.readFileVersioned;
+    if (!fs.descriptor.capabilities.includes('versioned-file') || !read) {
+        throw new CapabilityError('This filesystem adapter cannot bound a read, which the mounted-files store needs.', 'UNAVAILABLE', {
+            reason: 'filesystem-versioned-file-unavailable',
+            retryable: false,
+            details: { adapterId: fs.descriptor.id, capability: 'versioned-file' },
+            recoveryHint: 'Select a filesystem adapter that advertises versioned-file.'
+        });
+    }
+    return (path, maxBytes) => read.call(fs, path, { maxBytes });
+}
+/** Whether `name` is a file name this store answers; a name it refuses is not a credential, so it is not listed. */
+function isCredentialName(name) {
+    return !name.startsWith('.') && isPlainFileName(name) && isSecretKey(name);
+}
+/** `runtime`'s filesystem adapter is the host's own files, never a workspace-rooted view. */
+export function createMountedFilesStore(directory, runtime) {
+    const hostFileSystem = () => resolveFileSystemAdapter(runtime, { binding: false });
+    async function readKey(fs, key) {
+        if (!isPlainFileName(key))
+            throw notPlainName();
+        assertSecretKey(key);
+        const path = fs.join(directory, key);
+        const read = await boundedReader(fs)(path, MOUNTED_FILE_MAX_BYTES);
+        switch (read.status) {
+            case 'ok':
+                return new TextDecoder().decode(read.bytes).trim();
+            case 'not-found':
+                return undefined;
+            case 'too-large':
+                throw tooLarge(path, read.sizeBytes);
+            case 'unavailable':
+                throw unreadable(path, read.cause ?? new Error(read.reason));
+            default:
+                throw unreadable(path, new Error(read.reason));
+        }
+    }
+    /** The credential files of the directory with whether the listing reports each non-empty. */
+    async function entries(fs) {
+        const read = await outcomeOf(() => fs.list(directory));
+        if (!read.ok) {
+            // An absent directory holds no credentials; any other failure is not absence.
+            if (isAbsentEntry(read.failure))
+                return [];
+            throw unreadable(directory, read.failure);
+        }
+        // Kubernetes projects `..data` and timestamped dirs beside the key files; only
+        // non-dot names that resolve to files or symlinks are credentials.
+        return read.value
+            .filter((entry) => (entry.kind === 'file' || entry.kind === 'symlink') && isCredentialName(entry.name))
+            .map((entry) => ({ key: entry.name, hasValue: entry.sizeBytes !== 0 }));
+    }
+    return {
+        id: MOUNTED_FILES_STORE_ID,
+        descriptor,
+        async get(_environment, key) {
+            return readKey(await hostFileSystem(), key);
+        },
+        async list() {
+            const listed = await entries(await hostFileSystem());
+            return listed.map(({ key, hasValue }) => ({ key, hasValue, source: MOUNTED_FILES_STORE_ID }));
+        },
+        async getAll() {
+            const fs = await hostFileSystem();
+            const values = [];
+            for (const { key } of await entries(fs)) {
+                const value = await readKey(fs, key);
+                if (value !== undefined)
+                    values.push([key, value]);
+            }
+            // fromEntries defines own properties: no key is ever assigned through the prototype.
+            return Object.fromEntries(values);
+        },
+        async set() {
+            throw readOnly();
+        },
+        async unset() {
+            throw readOnly();
+        },
+        async setAll() {
+            throw readOnly();
+        }
+    };
+}
+//# sourceMappingURL=mounted-files.impl.local.js.map

package/dist/backends/mounted-files/mounted-files.impl.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.impl.local.js","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.impl.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACP,wBAAwB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,OAAO,EAAC,aAAa,EAAC,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,UAAU,EAAC,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAElF,sGAAsG;AACtG,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,gFAAgF;AAChF,SAAS,QAAQ;IAChB,OAAO,IAAI,eAAe,CAAC,uCAAuC,EAAE,mBAAmB,EAAE;QACxF,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;KAC1C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY;IACpB,OAAO,IAAI,eAAe,CAAC,iDAAiD,EAAE,eAAe,EAAE;QAC9F,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;KAC1C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAoB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,IAAI,eAAe,CAAC,8CAA8C,IAAI,IAAI,SAAS,IAAI,EAAE,aAAa,EAAE;QAC9G,MAAM,EAAE,yBAAyB;QACjC,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE;KAC9G,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAChD,OAAO,IAAI,eAAe,CACzB,8BAA8B,SAAS,8CAA8C,sBAAsB,GAAG,EAC9G,eAAe,EACf;QACC,MAAM,EAAE,wBAAwB;QAChC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE;KAC7F,CACD,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,SAAS,aAAa,CAAC,EAA8B;IACpD,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CAAC,mFAAmF,EAAE,aAAa,EAAE;YAC7H,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE;YACtE,YAAY,EAAE,6DAA6D;SAC3E,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,oHAAoH;AACpH,SAAS,gBAAgB,CAAC,IAAY;IACrC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,OAAmB;IAC7E,MAAM,cAAc,GAAG,GAAwC,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAExH,KAAK,UAAU,OAAO,CAAC,EAA8B,EAAE,GAAW;QACjE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,EAAE,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACnE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,IAAI;gBACR,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,KAAK,WAAW;gBACf,OAAO,SAAS,CAAC;YAClB,KAAK,WAAW;gBACf,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,KAAK,aAAa;gBACjB,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D;gBACC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IAED,6FAA6F;IAC7F,KAAK,UAAU,OAAO,CAAC,EAA8B;QACpD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACd,8EAA8E;YAC9E,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3C,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,+EAA+E;QAC/E,mEAAmE;QACnE,OAAO,IAAI,CAAC,KAAK;aACf,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACtG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACN,EAAE,EAAE,sBAAsB;QAC1B,UAAU;QACV,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG;YAC1B,OAAO,OAAO,CAAC,MAAM,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,IAAI;YACT,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,MAAM;YACX,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,qFAAqF;YACrF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,GAAG;YACR,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,KAAK;YACV,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,MAAM;YACX,MAAM,QAAQ,EAAE,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backends/mounted-files/mounted-files.plugin.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Secrets Backend: mounted-files
+ *
+ * Composes the read-only `mounted-files` store when the host declares
+ * `VIBES_SECRETS_MOUNT_DIR`, and nothing otherwise (declared-optional: an
+ * undeclared directory makes the backend ineligible, never a guessed path).
+ */
+export declare const secretsBackendMountedFilesPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsBackendMountedFilesPlugin;
+//# sourceMappingURL=mounted-files.plugin.d.ts.map

package/dist/backends/mounted-files/mounted-files.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.plugin.d.ts","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,eAAO,MAAM,gCAAgC,6CAoB3C,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/backends/mounted-files/mounted-files.plugin.js

@@ -0,0 +1,28 @@
+/**
+ * Secrets Backend: mounted-files
+ *
+ * Composes the read-only `mounted-files` store when the host declares
+ * `VIBES_SECRETS_MOUNT_DIR`, and nothing otherwise (declared-optional: an
+ * undeclared directory makes the backend ineligible, never a guessed path).
+ */
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import descriptor, { MOUNTED_FILES_STORE_ID, SECRETS_MOUNT_DIR_KEY } from "./mounted-files.descriptor.js";
+export const secretsBackendMountedFilesPlugin = createRuntimePlugin({
+    id: '@vibesdotdev/secrets/backends/mounted-files',
+    name: 'Secrets Backend: Mounted Files',
+    description: 'Read-only credentials from files in the directory declared by VIBES_SECRETS_MOUNT_DIR.',
+    dependencies: ['secrets'],
+    onRegister: async (runtime) => {
+        const directory = runtime.getEnv(SECRETS_MOUNT_DIR_KEY);
+        if (directory === undefined || directory === '')
+            return;
+        runtime.registerDescriptor('secrets/store', descriptor);
+        runtime.registerLoader('secrets/store', MOUNTED_FILES_STORE_ID, async () => {
+            const { createMountedFilesStore } = await import("./mounted-files.impl.local.js");
+            // The store reads through this runtime's filesystem adapter, resolved when it first reads.
+            return { impl: createMountedFilesStore(directory, runtime) };
+        }, { priority: 0, origin: 'secrets-backend-mounted-files' });
+    }
+});
+export default secretsBackendMountedFilesPlugin;
+//# sourceMappingURL=mounted-files.plugin.js.map

package/dist/backends/mounted-files/mounted-files.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounted-files.plugin.js","sourceRoot":"","sources":["../../../src/backends/mounted-files/mounted-files.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,UAAU,EAAC,EAAE,sBAAsB,EAAC,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAExG,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;IACnE,EAAE,EAAE,6CAA6C;IACjD,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,wFAAwF;IACrG,YAAY,EAAE,CAAC,SAAS,CAAC;IACzB,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO;QACxD,OAAO,CAAC,kBAAkB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,cAAc,CACrB,eAAe,EACf,sBAAsB,EACtB,KAAK,IAAI,EAAE;YACV,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAClF,2FAA2F;YAC3F,OAAO,EAAE,IAAI,EAAE,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9D,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CACxD,CAAC;IACH,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/backends/mounted-files/node.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @vibesdotdev/secrets/backends/mounted-files/node
+ *
+ * Node filesystem store for mounted secret files. The universal
+ * `./backends/mounted-files` entry stays free of host imports; the plugin loads
+ * this implementation lazily.
+ */
+export { createMountedFilesStore } from './mounted-files.impl.local.ts';
+//# sourceMappingURL=node.d.ts.map

package/dist/backends/mounted-files/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/backends/mounted-files/node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/backends/mounted-files/node.js

@@ -0,0 +1,9 @@
+/**
+ * @vibesdotdev/secrets/backends/mounted-files/node
+ *
+ * Node filesystem store for mounted secret files. The universal
+ * `./backends/mounted-files` entry stays free of host imports; the plugin loads
+ * this implementation lazily.
+ */
+export { createMountedFilesStore } from "./mounted-files.impl.local.js";
+//# sourceMappingURL=node.js.map

package/dist/backends/mounted-files/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../src/backends/mounted-files/node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/backends/vault/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @vibesdotdev/secrets/backends/vault
+ *
+ * Generic HashiCorp Vault KV v2 backend: the client and the store factory,
+ * parameterized by the composed descriptor (address, paths, mounts). The Vibes
+ * Vault composition — descriptor, defaults and plugin — lives in
+ * `@vibesdotdev/integrations-vibes/secrets/vault`.
+ */
+export { collectStoredUnsealKeys, deleteKVKey, ensureVaultUnsealed, listKVPaths, readKVSecret, writeKVSecret, type VaultClientConfig, type VaultSealStatus, type VaultUnsealOptions, type VaultUnsealSourceSpec } from './secrets-vault.client.ts';
+export { VaultStore, createVaultStore, type VaultStoreRuntime } from './secrets-vault.impl.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/vault/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACP,uBAAuB,EAAC,WAAW,EAAC,mBAAmB,EAAC,WAAW,EAAC,YAAY,EAChF,aAAa,EAAC,KAAK,iBAAiB,EACpC,KAAK,eAAe,EAAC,KAAK,kBAAkB,EAAC,KAAK,qBAAqB,EACtE,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAC,gBAAgB,EAAC,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/backends/vault/index.js

@@ -0,0 +1,11 @@
+/**
+ * @vibesdotdev/secrets/backends/vault
+ *
+ * Generic HashiCorp Vault KV v2 backend: the client and the store factory,
+ * parameterized by the composed descriptor (address, paths, mounts). The Vibes
+ * Vault composition — descriptor, defaults and plugin — lives in
+ * `@vibesdotdev/integrations-vibes/secrets/vault`.
+ */
+export { collectStoredUnsealKeys, deleteKVKey, ensureVaultUnsealed, listKVPaths, readKVSecret, writeKVSecret } from "./secrets-vault.client.js";
+export { VaultStore, createVaultStore } from "./secrets-vault.impl.js";
+//# sourceMappingURL=index.js.map

package/dist/backends/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/vault/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACP,uBAAuB,EAAC,WAAW,EAAC,mBAAmB,EAAC,WAAW,EAAC,YAAY,EAChF,aAAa,EAEZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAC,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC"}

package/dist/backends/vault/secrets-vault.client.d.ts

@@ -0,0 +1,15 @@
+import { type VaultClientConfig, type VaultUnsealOptions } from "../../schemas/backends/vault.schema.ts";
+export { KvListSchema, KvReadSchema, LoginSchema, SealStatusSchema, UnsealResponseSchema, type VaultClientConfig, type VaultSealStatus, type VaultUnsealOptions, type VaultUnsealSourceSpec } from "../../schemas/backends/vault.schema.ts";
+export { VAULT_PATH_KIND, addressInvalid, failure, statusFailure, vaultPathAbsent } from "./vault-failures.ts";
+export { K8S_AUTH_MOUNT, deleteKVKey, getVaultToken, listKVPaths, readKVSecret, timeoutOf, vaultFetchResponse, writeKVSecret } from "./vault-kv.ts";
+export { assertSendableToken, fetchVault, isRedirectStatus, readVaultJson, sameVaultUrl, vaultBase, vaultRequestUrl } from "./vault-transport.ts";
+export { collectStoredUnsealKeys, collectUnsealKeysFromSources, uniqueNonEmpty, type UnsealSourceOutcome } from "./vault-unseal.sources.ts";
+export declare const logger: import("@vibesdotdev/logging").LoggerImplementation;
+/** Where Kubernetes mounts a pod's service-account token; read through the filesystem adapter. */
+export declare const K8S_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
+/** The deadline of one Vault request, in milliseconds. */
+export declare const VAULT_REQUEST_TIMEOUT_MS = 15000;
+/** The largest Vault response body read, in bytes; a larger one is refused. */
+export declare const VAULT_MAX_BODY_BYTES: number;
+export declare function ensureVaultUnsealed(config: VaultClientConfig, options: VaultUnsealOptions): Promise<void>;
+//# sourceMappingURL=secrets-vault.client.d.ts.map

package/dist/backends/vault/secrets-vault.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.client.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/secrets-vault.client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAwC,KAAK,iBAAiB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAKnK,OAAO,EAAE,YAAY,EAAC,YAAY,EAAC,WAAW,EAAC,gBAAgB,EAAC,oBAAoB,EAAC,KAAK,iBAAiB,EAAC,KAAK,eAAe,EAAC,KAAK,kBAAkB,EAAC,KAAK,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpO,OAAO,EAAE,eAAe,EAAC,cAAc,EAAC,OAAO,EAAC,aAAa,EAAC,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAC,WAAW,EAAC,aAAa,EAAC,WAAW,EAAC,YAAY,EAAC,SAAS,EAAC,kBAAkB,EAAC,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7I,OAAO,EAAE,mBAAmB,EAAC,UAAU,EAAC,gBAAgB,EAAC,aAAa,EAAC,YAAY,EAAC,SAAS,EAAC,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5I,OAAO,EAAE,uBAAuB,EAAC,4BAA4B,EAAC,cAAc,EAAC,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEzI,eAAO,MAAM,MAAM,qDAA6B,CAAC;AAEjD,kGAAkG;AAClG,eAAO,MAAM,cAAc,wDAAwD,CAAC;AAEpF,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AA0DpD,wBAAsB,mBAAmB,CACxC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,kBAAkB,GACzB,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/backends/vault/secrets-vault.client.js

@@ -0,0 +1,120 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import * as z from 'zod/v4';
+import { SealStatusSchema, UnsealResponseSchema } from "../../schemas/backends/vault.schema.js";
+import { redactUrlForDisplay } from "../../transport/secure-url.js";
+import { failure, statusFailure } from "./vault-failures.js";
+import { fetchVault, readVaultJson, vaultRequestUrl } from "./vault-transport.js";
+import { collectUnsealKeysFromSources, uniqueNonEmpty } from "./vault-unseal.sources.js";
+export { KvListSchema, KvReadSchema, LoginSchema, SealStatusSchema, UnsealResponseSchema } from "../../schemas/backends/vault.schema.js";
+export { VAULT_PATH_KIND, addressInvalid, failure, statusFailure, vaultPathAbsent } from "./vault-failures.js";
+export { K8S_AUTH_MOUNT, deleteKVKey, getVaultToken, listKVPaths, readKVSecret, timeoutOf, vaultFetchResponse, writeKVSecret } from "./vault-kv.js";
+export { assertSendableToken, fetchVault, isRedirectStatus, readVaultJson, sameVaultUrl, vaultBase, vaultRequestUrl } from "./vault-transport.js";
+export { collectStoredUnsealKeys, collectUnsealKeysFromSources, uniqueNonEmpty } from "./vault-unseal.sources.js";
+export const logger = getLogger('secrets.vault');
+/** Where Kubernetes mounts a pod's service-account token; read through the filesystem adapter. */
+export const K8S_TOKEN_PATH = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+/** The deadline of one Vault request, in milliseconds. */
+export const VAULT_REQUEST_TIMEOUT_MS = 15_000;
+/** The largest Vault response body read, in bytes; a larger one is refused. */
+export const VAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
+async function vaultOperatorFetch(config, path, schema, operation, init) {
+    const headers = {
+        'Content-Type': 'application/json',
+        ...init?.headers
+    };
+    const res = await fetchVault(vaultRequestUrl(config.address, config.allowLoopbackHttp, path), { ...init, headers }, VAULT_REQUEST_TIMEOUT_MS, operation);
+    if (!res.ok) {
+        await res.body?.cancel();
+        throw statusFailure(operation, res.status);
+    }
+    if (schema === null) {
+        await res.body?.cancel();
+        return undefined;
+    }
+    return readVaultJson(res, schema, operation);
+}
+async function getSealStatus(config) {
+    const status = await vaultOperatorFetch(config, '/v1/sys/seal-status', SealStatusSchema, 'Vault seal status');
+    if (!status)
+        throw failure('Vault seal status returned no body.', 'INTERNAL', 'vault-response-invalid');
+    return status;
+}
+async function submitUnsealKey(config, key) {
+    const status = await vaultOperatorFetch(config, '/v1/sys/unseal', UnsealResponseSchema, 'Vault unseal', { method: 'POST', body: JSON.stringify({ key }) });
+    if (!status)
+        throw failure('Vault unseal returned no body.', 'INTERNAL', 'vault-response-invalid');
+    return status;
+}
+async function resetUnsealProgress(config) {
+    await vaultOperatorFetch(config, '/v1/sys/unseal', null, 'Vault unseal reset', {
+        method: 'POST',
+        body: JSON.stringify({ reset: true })
+    });
+}
+export async function ensureVaultUnsealed(config, options) {
+    const status = await getSealStatus(config);
+    if (!status.initialized) {
+        throw failure('Vault is not initialized. Run `vault operator init` first.', 'UNAVAILABLE', 'vault-not-initialized', {
+            retryable: false
+        });
+    }
+    if (!status.sealed)
+        return;
+    if (!options.autoUnseal && !options.allowPrompt) {
+        throw failure('Vault is sealed and auto-unseal is disabled.', 'UNAVAILABLE', 'vault-sealed', { retryable: false });
+    }
+    const resolvedKeys = options.resolveAdditionalKeys ? await options.resolveAdditionalKeys() : [];
+    const sourced = options.sourceSpecs
+        ? await collectUnsealKeysFromSources(options.sourceSpecs, config.allowLoopbackHttp)
+        : { keys: [], failures: [] };
+    const keys = uniqueNonEmpty([
+        ...(options.additionalKeys ?? []),
+        ...resolvedKeys,
+        ...sourced.keys
+    ]);
+    const collected = [...keys];
+    if (collected.length < status.t && options.allowPrompt && options.prompt) {
+        while (collected.length < status.t) {
+            const entered = await options.prompt(collected.length + 1, status.t);
+            if (!entered)
+                break;
+            if (!collected.includes(entered))
+                collected.push(entered);
+        }
+    }
+    if (collected.length < status.t) {
+        throw failure(`Vault is sealed and only ${collected.length}/${status.t} unseal keys were found` +
+            (sourced.failures.length > 0 ? ` (${sourced.failures.length} unseal source(s) could not be read)` : '') +
+            `. Provide VAULT_UNSEAL_KEY_* through a credential store or configure unseal source backends.`, 'UNAVAILABLE', 'vault-sealed', { retryable: false, cause: sourced.failures[0] });
+    }
+    if (status.progress > 0) {
+        await resetUnsealProgress(config);
+    }
+    let sealed = status.sealed;
+    let lastRejected;
+    for (const key of collected) {
+        if (!sealed)
+            break;
+        // Settled, not caught: a rejected key is kept as data and the next is tried; the final
+        // `sealed` check refuses if no key unseals, and the last failure rides as its cause.
+        const [attempt] = await Promise.allSettled([submitUnsealKey(config, key)]);
+        if (attempt.status === 'fulfilled') {
+            sealed = attempt.value.sealed;
+            continue;
+        }
+        lastRejected = CapabilityError.from(CaughtFailureSchema.parse(attempt.reason));
+        logger.warn('Vault unseal key submission failed; trying remaining keys', {
+            address: redactUrlForDisplay(config.address),
+            error: lastRejected.reason
+        });
+    }
+    if (sealed) {
+        await resetUnsealProgress(config);
+        throw failure('Failed to unseal Vault with available keys.', 'UNAVAILABLE', 'vault-sealed', {
+            retryable: false,
+            cause: lastRejected
+        });
+    }
+}
+//# sourceMappingURL=secrets-vault.client.js.map

package/dist/backends/vault/secrets-vault.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.client.js","sourceRoot":"","sources":["../../../src/backends/vault/secrets-vault.client.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,eAAe,EACf,mBAAmB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAC,oBAAoB,EAAsE,MAAM,wCAAwC,CAAC;AACnK,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAC,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAC,aAAa,EAAC,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAC,cAAc,EAA2B,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,YAAY,EAAC,YAAY,EAAC,WAAW,EAAC,gBAAgB,EAAC,oBAAoB,EAAiG,MAAM,wCAAwC,CAAC;AACpO,OAAO,EAAE,eAAe,EAAC,cAAc,EAAC,OAAO,EAAC,aAAa,EAAC,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAC,WAAW,EAAC,aAAa,EAAC,WAAW,EAAC,YAAY,EAAC,SAAS,EAAC,kBAAkB,EAAC,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7I,OAAO,EAAE,mBAAmB,EAAC,UAAU,EAAC,gBAAgB,EAAC,aAAa,EAAC,YAAY,EAAC,SAAS,EAAC,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5I,OAAO,EAAE,uBAAuB,EAAC,4BAA4B,EAAC,cAAc,EAA2B,MAAM,2BAA2B,CAAC;AAEzI,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;AAEjD,kGAAkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAEpF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAC/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD,KAAK,UAAU,kBAAkB,CAChC,MAAgE,EAChE,IAAY,EACZ,MAAgB,EAChB,SAAiB,EACjB,IAAkB;IAElB,MAAM,OAAO,GAAG;QACf,cAAc,EAAE,kBAAkB;QAClC,GAAG,IAAI,EAAE,OAAO;KAChB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAC/D,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EACpB,wBAAwB,EACxB,SAAS,CACT,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAgE;IAC5F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC9G,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,qCAAqC,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAAgE,EAChE,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACtC,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CACjD,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,gCAAgC,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAgE;IAClG,MAAM,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,MAAyB,EACzB,OAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,4DAA4D,EAAE,aAAa,EAAE,uBAAuB,EAAE;YACnH,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAE3B,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,8CAA8C,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,OAAO,GAAwB,OAAO,CAAC,WAAW;QACvD,CAAC,CAAC,MAAM,4BAA4B,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACnF,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,GAAG,YAAY;QACf,GAAG,OAAO,CAAC,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO;gBAAE,MAAM;YACpB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,CACZ,4BAA4B,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,yBAAyB;YACjF,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,8FAA8F,EAC9F,aAAa,EACb,cAAc,EACd,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAChD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;IACpC,IAAI,YAAyC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,uFAAuF;QACvF,qFAAqF;QACrF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;YACxE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,YAAY,CAAC,MAAM;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,CAAC,6CAA6C,EAAE,aAAa,EAAE,cAAc,EAAE;YAC3F,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,YAAY;SACnB,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/backends/vault/secrets-vault.impl.d.ts

@@ -0,0 +1,29 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import type { SecretEntry, SecretsStoreImplementation } from '@vibesdotdev/secrets/kinds/store.interface';
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+import type { StoreOperationContext } from '../../domain/kinds/schemas/store.types.ts';
+import { type OtherStoreResolver } from "../../schemas/backends/bootstrap.schema.ts";
+import { type VaultStoreRuntime } from "../../schemas/backends/unseal.schema.ts";
+import { VaultBootstrap } from './vault-bootstrap.ts';
+export { type OtherStoreResolver, type UnsealStoreGetter } from "../../schemas/backends/bootstrap.schema.ts";
+export { UnsealKeyBundleSchema, UnsealSourceSchema, UnsealSourcesSchema, type VaultStoreRuntime } from "../../schemas/backends/unseal.schema.ts";
+export { bool, invalidUnsealSources, mountForEnvironment, parseCsv, parseUnsealSources, pathsForDescriptor, writePathForDescriptor } from "./vault-config.ts";
+export declare const UNSEAL_KEYS: string[];
+/** The service-account token is one short JWT; a larger file is not one. */
+export declare const SERVICE_ACCOUNT_TOKEN_MAX_BYTES: number;
+export declare class VaultStore extends VaultBootstrap implements SecretsStoreImplementation {
+    readonly id = "vault";
+    list(environment: string, operationContext?: StoreOperationContext): Promise<SecretEntry[]>;
+    get(environment: string, key: string, operationContext?: StoreOperationContext): Promise<string | undefined>;
+    set(environment: string, key: string, value: string, operationContext?: StoreOperationContext): Promise<void>;
+    unset(environment: string, key: string, operationContext?: StoreOperationContext): Promise<void>;
+    getAll(environment: string, operationContext?: StoreOperationContext): Promise<Record<string, string>>;
+    setAll(environment: string, secrets: Record<string, string>, operationContext?: StoreOperationContext): Promise<void>;
+    /** The first path that holds `key` (as its own property), with its data. */
+    private locate;
+    /** One path's data, or `undefined` for the typed absence of that path; any other failure propagates. */
+    private readPathIfPresent;
+}
+export declare function invalidUnsealBundle(problem: string): CapabilityError;
+export declare function createVaultStore(runtime: VaultStoreRuntime, desc: SecretsStoreDescriptor, resolveOtherStores?: OtherStoreResolver): import("@vibesdotdev/kernel").RuntimeImplementationWrapper<VaultStore>;
+//# sourceMappingURL=secrets-vault.impl.d.ts.map

package/dist/backends/vault/secrets-vault.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.impl.d.ts","sourceRoot":"","sources":["../../../src/backends/vault/secrets-vault.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EACZ,WAAW,EACX,0BAA0B,EACzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAEvF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AASjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,KAAK,kBAAkB,EAAC,KAAK,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAC,kBAAkB,EAAC,mBAAmB,EAAC,KAAK,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC9I,OAAO,EAAE,IAAI,EAAC,oBAAoB,EAAC,mBAAmB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,kBAAkB,EAAC,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxJ,eAAO,MAAM,WAAW,UAAoE,CAAC;AAC7F,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B,QAAY,CAAC;AAEzD,qBAAa,UAAW,SAAQ,cAAe,YAAW,0BAA0B;IACnF,QAAQ,CAAC,EAAE,WAAW;IAEhB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAe3F,GAAG,CACR,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,qBAAqB,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAUxB,GAAG,CACR,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,gBAAgB,CAAC,EAAE,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;IAWV,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAShG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IActG,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,gBAAgB,CAAC,EAAE,qBAAqB,GACtC,OAAO,CAAC,IAAI,CAAC;IA8BhB,4EAA4E;YAC9D,MAAM;IAWpB,wGAAwG;YAC1F,iBAAiB;CAa/B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMpE;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,sBAAsB,EAC5B,kBAAkB,CAAC,EAAE,kBAAkB,0EASvC"}