@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/surfaces/cli/commands/oauth-client/mint-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-response.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAC,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgC,EAAE,WAAmB,EAAE,IAA2G,EAAE,OAAe,EAAE,IAA8B,EAAE,GAAW,EAAE,IAAgC,EAAE,QAAgB;IACzT,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CACnB,gBAAgB,CACf,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAC7F,GAAG,CACH,CACD,CAAC;QACF,IAAI,CAAC,mCAAmC,QAAQ,YAAY,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IAEvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,qFAAqF;QACrF,sEAAsE;QACtE,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,IAAI,CACH,IAAI,CAAC,mCAAmC,QAAQ,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvC,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC;IAElC,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC3D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC;IACvE,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CACH,gGAAgG,CAChG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;AACzD,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint-storage.d.ts

@@ -0,0 +1,28 @@
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../../../../domain/kinds/store.interface.ts';
+export declare const LOCAL_BACKEND_KINDS: Set<string>;
+export declare function recordFingerprintsSafe(runtime: RuntimeRef, envName: string, targetId: string, clientIdKey: string, mintedClientId: string, clientSecretKey: string, mintedClientSecret: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: unknown;
+}>;
+/**
+ * Write the minted id and secret as one pair: if the secret cannot be stored,
+ * the id written before it is put back to what the key held (or removed), and
+ * the failure is reported with the client id (not a secret), so the operator
+ * knows a client exists on the server that no store holds the secret of.
+ */
+export declare function storePairOrRollBack(input: {
+    impl: SecretsStoreImplementation;
+    environment: string;
+    store: string;
+    clientIdKey: string;
+    clientSecretKey: string;
+    mintedClientId: string;
+    mintedClientSecret: string;
+    previousClientId: string | undefined;
+}): Promise<void>;
+/** Put the client id key back to what it held before (or remove it); the failure, if any, is returned. */
+export declare function restoreClientId(impl: SecretsStoreImplementation, environment: string, clientIdKey: string, previousClientId: string | undefined): Promise<CapabilityError | undefined>;
+//# sourceMappingURL=mint-storage.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-storage.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAG9F,eAAO,MAAM,mBAAmB,aAA2C,CAAC;AAE5E,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,kBAAkB,EAAE,MAAM,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAqBvD;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,0BAA0B,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AAED,0GAA0G;AAC1G,wBAAsB,eAAe,CACpC,IAAI,EAAE,0BAA0B,EAChC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQtC"}

package/dist/surfaces/cli/commands/oauth-client/mint-storage.js

@@ -0,0 +1,76 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { driftFingerprintHome, recordFingerprint } from "../../shared/stores/drift-fingerprints.impl.consumer.js";
+export const LOCAL_BACKEND_KINDS = new Set(['env-file', 'encrypted-local']);
+export async function recordFingerprintsSafe(runtime, envName, targetId, clientIdKey, mintedClientId, clientSecretKey, mintedClientSecret) {
+    try {
+        const home = await driftFingerprintHome(runtime);
+        await recordFingerprint({
+            environment: envName,
+            backend: targetId,
+            key: clientIdKey,
+            value: mintedClientId,
+            home
+        });
+        await recordFingerprint({
+            environment: envName,
+            backend: targetId,
+            key: clientSecretKey,
+            value: mintedClientSecret,
+            home
+        });
+        return { ok: true };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+/**
+ * Write the minted id and secret as one pair: if the secret cannot be stored,
+ * the id written before it is put back to what the key held (or removed), and
+ * the failure is reported with the client id (not a secret), so the operator
+ * knows a client exists on the server that no store holds the secret of.
+ */
+export async function storePairOrRollBack(input) {
+    const { impl, environment, store, clientIdKey, clientSecretKey, mintedClientId, mintedClientSecret, previousClientId } = input;
+    let idWritten = false;
+    try {
+        await impl.set(environment, clientIdKey, mintedClientId);
+        idWritten = true;
+        await impl.set(environment, clientSecretKey, mintedClientSecret);
+        return;
+    }
+    catch (thrown) {
+        const writeFailure = CaughtFailureSchema.parse(thrown);
+        const rollbackFailure = idWritten
+            ? await restoreClientId(impl, environment, clientIdKey, previousClientId)
+            : undefined;
+        const rollback = !idWritten ? 'not-needed' : rollbackFailure ? 'failed' : 'restored';
+        throw new CapabilityError(`secrets oauth-client mint: client ${mintedClientId} was minted but its secret could not be stored in [${store}]; ` +
+            (rollbackFailure
+                ? `${clientIdKey} may still hold the new client id (the rollback also failed). `
+                : `${clientIdKey} was left as it was. `) +
+            'The secret cannot be shown again: revoke that client and mint again.', 'UNAVAILABLE', {
+            reason: 'oauth-client-store-write-failed',
+            retryable: false,
+            recoveryHint: rollbackFailure ? 'Check the stored client id key by hand.' : undefined,
+            details: { clientId: mintedClientId, store, rollback },
+            cause: rollbackFailure
+                ? new AggregateError([writeFailure, rollbackFailure], 'the secret write and its rollback both failed')
+                : writeFailure
+        });
+    }
+}
+/** Put the client id key back to what it held before (or remove it); the failure, if any, is returned. */
+export async function restoreClientId(impl, environment, clientIdKey, previousClientId) {
+    try {
+        if (previousClientId === undefined)
+            await impl.unset(environment, clientIdKey);
+        else
+            await impl.set(environment, clientIdKey, previousClientId);
+        return undefined;
+    }
+    catch (thrown) {
+        return CapabilityError.from(CaughtFailureSchema.parse(thrown));
+    }
+}
+//# sourceMappingURL=mint-storage.js.map

package/dist/surfaces/cli/commands/oauth-client/mint-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-storage.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAC,iBAAiB,EAAE,MAAM,yDAAyD,CAAC;AAEjH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAmB,EACnB,OAAe,EACf,QAAgB,EAChB,WAAmB,EACnB,cAAsB,EACtB,eAAuB,EACvB,kBAA0B;IAE1B,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,iBAAiB,CAAC;YACvB,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,cAAc;YACrB,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,iBAAiB,CAAC;YACvB,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,eAAe;YACpB,KAAK,EAAE,kBAAkB;YACzB,IAAI;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KASzC;IACA,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAC/H,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACJ,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QACzD,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACjE,OAAO;IACR,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,SAAS;YAChC,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC;YACzE,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,IAAI,eAAe,CACxB,qCAAqC,cAAc,sDAAsD,KAAK,KAAK;YACnH,CAAC,eAAe;gBACf,CAAC,CAAC,GAAG,WAAW,gEAAgE;gBAChF,CAAC,CAAC,GAAG,WAAW,uBAAuB,CAAC;YACzC,sEAAsE,EACtE,aAAa,EACb;YACC,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,SAAS;YACrF,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;YACtD,KAAK,EAAE,eAAe;gBACrB,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,+CAA+C,CAAC;gBACtG,CAAC,CAAC,YAAY;SACf,CACD,CAAC;IACH,CAAC;AACF,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAgC,EAChC,WAAmB,EACnB,WAAmB,EACnB,gBAAoC;IAEpC,IAAI,CAAC;QACJ,IAAI,gBAAgB,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;;YAC1E,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,OAAO,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;AACF,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint-transport.d.ts

@@ -0,0 +1,20 @@
+import * as z from 'zod/v4';
+import { oauthClientResponseSchema } from "../../../../schemas/cli/commands/mint.schema.ts";
+import { type MintFetchOutcome, type OAuthClientRequestBody } from "../../../../schemas/cli/mint-wire.schema.ts";
+export { type MintFetchOutcome, type OAuthClientRequestBody } from "../../../../schemas/cli/mint-wire.schema.ts";
+/** The largest mint response read, in bytes; a larger one is refused. */
+export declare const MINT_MAX_RESPONSE_BYTES: number;
+/**
+ * POST the mint request. The URL was parsed as https (or loopback http on a
+ * development host) by the caller; no redirect is followed with the bearer, and
+ * the response is read up to {@link MINT_MAX_RESPONSE_BYTES} within the one deadline.
+ */
+export declare function tryFetchOAuthClient(url: URL, bearerToken: string, body: OAuthClientRequestBody, timeout: number): Promise<MintFetchOutcome>;
+export declare function tryParseOAuthResponse(text: string): {
+    ok: true;
+    data: z.infer<typeof oauthClientResponseSchema>;
+} | {
+    ok: false;
+    error: unknown;
+};
+//# sourceMappingURL=mint-transport.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-transport.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,KAAK,gBAAgB,EAAC,KAAK,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAEhH,OAAO,EAAE,KAAK,gBAAgB,EAAC,KAAK,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAEhH,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAAc,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAW/B"}

package/dist/surfaces/cli/commands/oauth-client/mint-transport.js

@@ -0,0 +1,57 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { oauthClientResponseSchema } from "../../../../schemas/cli/commands/mint.schema.js";
+import {} from "../../../../schemas/cli/mint-wire.schema.js";
+import { readBoundedText } from "../../../../transport/bounded-body.js";
+export {} from "../../../../schemas/cli/mint-wire.schema.js";
+/** The largest mint response read, in bytes; a larger one is refused. */
+export const MINT_MAX_RESPONSE_BYTES = 1024 * 1024;
+/**
+ * POST the mint request. The URL was parsed as https (or loopback http on a
+ * development host) by the caller; no redirect is followed with the bearer, and
+ * the response is read up to {@link MINT_MAX_RESPONSE_BYTES} within the one deadline.
+ */
+export async function tryFetchOAuthClient(url, bearerToken, body, timeout) {
+    try {
+        // vibes-runtime-fetch-allow — caller-supplied mint URL (required)
+        const response = await globalThis.fetch(url.href, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${bearerToken}`,
+                'content-type': 'application/json',
+                accept: 'application/json'
+            },
+            body: JSON.stringify(body),
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeout)
+        });
+        const read = await readBoundedText(response, MINT_MAX_RESPONSE_BYTES);
+        if (read.truncated) {
+            return {
+                ok: false,
+                error: new CapabilityError('The mint response is larger than the read limit.', 'INTERNAL', {
+                    reason: 'oauth-client-response-too-large',
+                    retryable: false
+                })
+            };
+        }
+        return { ok: true, response, text: read.text };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export function tryParseOAuthResponse(text) {
+    try {
+        const raw = JSON.parse(text);
+        const parsed = oauthClientResponseSchema.safeParse(raw);
+        if (!parsed.success) {
+            return { ok: false, error: parsed.error };
+        }
+        return { ok: true, data: parsed.data };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+//# sourceMappingURL=mint-transport.js.map

package/dist/surfaces/cli/commands/oauth-client/mint-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-transport.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAqD,MAAM,6CAA6C,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAqD,MAAM,6CAA6C,CAAC;AAEhH,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,GAAQ,EACR,WAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,IAAI,CAAC;QACJ,kEAAkE;QAClE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,IAAI,eAAe,CAAC,kDAAkD,EAAE,UAAU,EAAE;oBAC1F,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;iBAChB,CAAC;aACF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAGjD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint.command.descriptor.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `vibes secrets oauth-client mint` — POST the caller's mint endpoint with a
+ * store-backed bearer, then write client_id / client_secret into the local
+ * secrets store. Secret values never reach stdout/stderr.
+ */
+export declare const oauthClientMintCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "secrets.oauth-client.mint";
+    readonly name: "mint";
+    readonly description: "Mint an OAuth client and store client_id/client_secret locally (values never printed)";
+    readonly group: "secrets.oauth-client";
+    readonly arguments: [{
+        readonly name: "clientName";
+        readonly description: "OAuth client_name (1–120 chars)";
+        readonly required: true;
+    }];
+    readonly options: [{
+        readonly flags: "--redirect-uri <uri...>";
+        readonly description: "Redirect URI (repeatable; at least one required)";
+    }, {
+        readonly flags: "--post-logout-redirect-uri <uri...>";
+        readonly description: "Post-logout redirect URI (repeatable)";
+    }, {
+        readonly flags: "--scope <scope>";
+        readonly description: "OAuth scope string (default: 'openid profile email')";
+    }, {
+        readonly flags: "--url <url>";
+        readonly description: "Mint endpoint (required)";
+    }, {
+        readonly flags: "--bearer <key>";
+        readonly description: "Store key for the internal bearer (required)";
+    }, {
+        readonly flags: "--client-id-key <key>";
+        readonly description: "Store key for client_id (required)";
+    }, {
+        readonly flags: "--client-secret-key <key>";
+        readonly description: "Store key for client_secret (required)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Target environment (default: current)";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Write to a specific local backend";
+    }, {
+        readonly flags: "--timeout <ms>";
+        readonly description: "Request timeout in milliseconds (default: 30000)";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 10;
+    readonly examples: [{
+        readonly command: "vibes secrets oauth-client mint my-client --redirect-uri 'https://app.example.test/oauth/callback' --url 'https://auth.example.test/api/oauth-clients' --bearer AUTH_INTERNAL_TOKEN --client-id-key MY_OAUTH_CLIENT_ID --client-secret-key MY_OAUTH_CLIENT_SECRET --environment local";
+        readonly description: "Mint an OAuth client and store its id/secret locally";
+        readonly expectExit: 0;
+    }];
+};
+export default oauthClientMintCommandDescriptor;
+//# sourceMappingURL=mint.command.descriptor.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4D3C,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint.command.descriptor.js

@@ -0,0 +1,66 @@
+/**
+ * `vibes secrets oauth-client mint` — POST the caller's mint endpoint with a
+ * store-backed bearer, then write client_id / client_secret into the local
+ * secrets store. Secret values never reach stdout/stderr.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const oauthClientMintCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'secrets.oauth-client.mint',
+    name: 'mint',
+    description: 'Mint an OAuth client and store client_id/client_secret locally (values never printed)',
+    group: 'secrets.oauth-client',
+    arguments: [
+        {
+            name: 'clientName',
+            description: 'OAuth client_name (1–120 chars)',
+            required: true
+        }
+    ],
+    options: [
+        {
+            flags: '--redirect-uri <uri...>',
+            description: 'Redirect URI (repeatable; at least one required)'
+        },
+        {
+            flags: '--post-logout-redirect-uri <uri...>',
+            description: 'Post-logout redirect URI (repeatable)'
+        },
+        {
+            flags: '--scope <scope>',
+            description: "OAuth scope string (default: 'openid profile email')"
+        },
+        {
+            flags: '--url <url>',
+            description: 'Mint endpoint (required)'
+        },
+        {
+            flags: '--bearer <key>',
+            description: 'Store key for the internal bearer (required)'
+        },
+        {
+            flags: '--client-id-key <key>',
+            description: 'Store key for client_id (required)'
+        },
+        {
+            flags: '--client-secret-key <key>',
+            description: 'Store key for client_secret (required)'
+        },
+        { flags: '--environment <name>', description: 'Target environment (default: current)' },
+        { flags: '--backend <id>', description: 'Write to a specific local backend' },
+        { flags: '--timeout <ms>', description: 'Request timeout in milliseconds (default: 30000)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 10,
+    examples: [
+        {
+            command: "vibes secrets oauth-client mint my-client --redirect-uri 'https://app.example.test/oauth/callback' --url 'https://auth.example.test/api/oauth-clients' --bearer AUTH_INTERNAL_TOKEN --client-id-key MY_OAUTH_CLIENT_ID --client-secret-key MY_OAUTH_CLIENT_SECRET --environment local",
+            description: 'Mint an OAuth client and store its id/secret locally',
+            expectExit: 0
+        }
+    ]
+});
+export default oauthClientMintCommandDescriptor;
+//# sourceMappingURL=mint.command.descriptor.js.map

package/dist/surfaces/cli/commands/oauth-client/mint.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.command.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAC;IAClE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,MAAM;IACZ,WAAW,EACV,uFAAuF;IACxF,KAAK,EAAE,sBAAsB;IAC7B,SAAS,EAAE;QACV;YACC,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,IAAI;SACd;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,kDAAkD;SAC/D;QACD;YACC,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,uCAAuC;SACpD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,sDAAsD;SACnE;QACD;YACC,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,0BAA0B;SACvC;QACD;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,8CAA8C;SAC3D;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,oCAAoC;SACjD;QACD;YACC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,wCAAwC;SACrD;QACD,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,mCAAmC,EAAE;QAC7E,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC5F;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EACN,uRAAuR;YACxR,WAAW,EACV,sDAAsD;YACvD,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/mint.command.impl.d.ts

@@ -0,0 +1,27 @@
+import { type MintCommandArgs, type MintCommandOptions } from "../../../../schemas/cli/commands/mint.schema.ts";
+export { MINT_DEFAULT_TIMEOUT_MS, MINT_MAX_TIMEOUT_MS, mintArgsSchema, mintOptsSchema, oauthClientResponseSchema, stringArrayField, type MintCommandArgs, type MintCommandOptions } from "../../../../schemas/cli/commands/mint.schema.ts";
+export { parseMintRequest } from "./mint-input.ts";
+export { fetchMintedPair } from "./mint-response.ts";
+export { LOCAL_BACKEND_KINDS, recordFingerprintsSafe, restoreClientId, storePairOrRollBack } from "./mint-storage.ts";
+export { MINT_MAX_RESPONSE_BYTES, tryFetchOAuthClient, tryParseOAuthResponse, type MintFetchOutcome, type OAuthClientRequestBody } from "./mint-transport.ts";
+/**
+ * `vibes secrets oauth-client mint` implementation.
+ *
+ * Security contract:
+ *   - Bearer is resolved from the secrets store and injected only into the
+ *     Authorization header — never printed.
+ *   - Minted client_secret / clientSecret are written to the local store via
+ *     the same backend path as `vibes secrets set` and NEVER printed.
+ *   - stdout carries only non-secret summary (client_name, client_id, uris,
+ *     which store keys were written). Audit carries key NAMES + URL — never
+ *     values.
+ */
+import type { CommandContext } from '@vibesdotdev/cli/schemas/types';
+export declare const DEFAULT_SCOPE = "openid profile email";
+export declare const KEY_PATTERN: RegExp;
+export declare function execute(rawArgs: MintCommandArgs, rawOpts: MintCommandOptions, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=mint.command.impl.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/mint.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.command.impl.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,eAAe,EAAC,KAAK,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAI7I,OAAO,EAAE,uBAAuB,EAAC,mBAAmB,EAAC,cAAc,EAAC,cAAc,EAAC,yBAAyB,EAAC,gBAAgB,EAAC,KAAK,eAAe,EAAC,KAAK,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACpO,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAC,sBAAsB,EAAC,eAAe,EAAC,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAC,mBAAmB,EAAC,qBAAqB,EAAC,KAAK,gBAAgB,EAAC,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC1J;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAkBrE,eAAO,MAAM,aAAa,yBAAyB,CAAC;AACpD,eAAO,MAAM,WAAW,QAAiB,CAAC;AAE1C,wBAAsB,OAAO,CAC5B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAkJf;;;;AAED,wBAA2B"}

package/dist/surfaces/cli/commands/oauth-client/mint.command.impl.js

@@ -0,0 +1,136 @@
+import { mintArgsSchema, mintOptsSchema } from "../../../../schemas/cli/commands/mint.schema.js";
+import { parseMintRequest } from "./mint-input.js";
+import { fetchMintedPair } from "./mint-response.js";
+import { LOCAL_BACKEND_KINDS, recordFingerprintsSafe, storePairOrRollBack } from "./mint-storage.js";
+export { MINT_DEFAULT_TIMEOUT_MS, MINT_MAX_TIMEOUT_MS, mintArgsSchema, mintOptsSchema, oauthClientResponseSchema, stringArrayField } from "../../../../schemas/cli/commands/mint.schema.js";
+export { parseMintRequest } from "./mint-input.js";
+export { fetchMintedPair } from "./mint-response.js";
+export { LOCAL_BACKEND_KINDS, recordFingerprintsSafe, restoreClientId, storePairOrRollBack } from "./mint-storage.js";
+export { MINT_MAX_RESPONSE_BYTES, tryFetchOAuthClient, tryParseOAuthResponse } from "./mint-transport.js";
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { isSendableHeaderValue } from "../../../../transport/header-value.js";
+import { resolveSecretsEnvironment } from "../../environment.js";
+import { openCommandOutput } from "../../shared/output/command-output.js";
+import { parseCommandInput } from "../../shared/parse-options.js";
+import { redactForPrint, resolveSecretsForLeverage, writeLeverageAudit, writeOnlyRefusal } from "../../shared/stores/leverage-shared.js";
+import { listStoreDescriptors, resolveStoreImplementation, selectStore } from "../../shared/stores/store-selection.js";
+const logger = getLogger('secrets.cli.oauth-client.mint');
+export const DEFAULT_SCOPE = 'openid profile email';
+export const KEY_PATTERN = /^[_A-Z0-9]+$/;
+export async function execute(rawArgs, rawOpts, context) {
+    const { runtime } = context;
+    const out = await openCommandOutput(runtime);
+    const args = parseCommandInput(mintArgsSchema, rawArgs, 'oauth-client mint');
+    const opts = parseCommandInput(mintOptsSchema, rawOpts, 'oauth-client mint');
+    const { bearerKey, environment, backend, clientIdKey, clientSecretKey, shownUrl, clientName, redirectUris, postLogoutRedirectUris, scope, mintUrl, timeout, url } = parseMintRequest(args, opts, out, runtime);
+    // A resolution failure is a typed CapabilityError; the CLI surface renders it.
+    const resolved = await resolveSecretsForLeverage(runtime, [bearerKey], { environment, backend });
+    const audit = (outcome, target, withHops, reason) => writeLeverageAudit(out, {
+        action: 'secrets.oauth-client.mint',
+        keys: [bearerKey, clientIdKey, clientSecretKey],
+        environment: resolved.environment,
+        backend: resolved.backendId,
+        target,
+        outcome,
+        reason,
+        hops: withHops ? resolved.hops : undefined
+    });
+    function fail(message) {
+        out.warn(message);
+        audit('failure', shownUrl, false);
+        requestCLIExit(1);
+    }
+    /** A step after the bearer resolved: its typed failure is audited (the one line every attempt owes) and rethrown as it was thrown. */
+    const audited = async (step) => {
+        try {
+            return await step();
+        }
+        catch (error) {
+            audit('failure', shownUrl, false, CapabilityError.from(CaughtFailureSchema.parse(error)).reason);
+            throw error;
+        }
+    };
+    if (resolved.unreadable.length > 0) {
+        audit('failure', shownUrl, true);
+        throw writeOnlyRefusal('secrets oauth-client mint', resolved);
+    }
+    const bearerValue = resolved.values[bearerKey];
+    if (resolved.missing.length > 0 || bearerValue === undefined) {
+        audit('failure', shownUrl, false);
+        throw new CapabilityError(`secrets oauth-client mint: the bearer ${bearerKey} is not set in environment "${resolved.environment}".`, 'AUTH_REQUIRED', {
+            reason: 'oauth-client-bearer-missing',
+            retryable: false,
+            recoveryHint: `Store it first: vibes secrets set ${bearerKey} --environment ${resolved.environment}`,
+            details: { key: bearerKey, environment: resolved.environment }
+        });
+    }
+    // The bearer is a header value: one that no header can carry is refused here, by shape,
+    // because the runtime's own TypeError quotes it.
+    if (!isSendableHeaderValue(`Bearer ${bearerValue}`)) {
+        audit('failure', shownUrl, false, 'oauth-client-bearer-invalid');
+        throw new CapabilityError(`secrets oauth-client mint: the bearer ${bearerKey} is not a value an Authorization header can carry; nothing was sent.`, 'INVALID_INPUT', { reason: 'oauth-client-bearer-invalid', retryable: false, details: { key: bearerKey } });
+    }
+    // The store the minted pair will be written to is chosen BEFORE the client is
+    // minted: a store that cannot take the pair must not cost a client the server
+    // can no longer show the secret of. The pick is the kind's own over the local
+    // stores of the tier (or the named `--backend`): a priority tie is
+    // `store-ambiguous`, a malformed descriptor `store-descriptor-invalid`, none
+    // `secrets-store-unavailable`; it never sorts and takes the first.
+    const { envName, target, impl, previousClientId } = await audited(async () => {
+        const { name, tier } = await resolveSecretsEnvironment(runtime, null, environment);
+        const chosen = selectStore(listStoreDescriptors(runtime), tier, backend, (descriptor) => LOCAL_BACKEND_KINDS.has(descriptor.backend));
+        const implementation = await resolveStoreImplementation(runtime, chosen.id);
+        // What the id key held before: the first write is undone to exactly this if the second fails.
+        return { envName: name, target: chosen, impl: implementation, previousClientId: await implementation.get(name, clientIdKey) };
+    });
+    const body = {
+        client_name: clientName,
+        redirect_uris: redirectUris,
+        post_logout_redirect_uris: postLogoutRedirectUris,
+        scope
+    };
+    // Everything printed from here on is redacted by VALUE (the bearer, and anything the store
+    // resolved) as well as by field name: a server may echo the bearer in any text it sends.
+    const safe = (text) => redactForPrint(text, resolved.values);
+    const { mintedClientId, mintedClientSecret, response } = await fetchMintedPair(mintUrl, bearerValue, body, timeout, safe, url, fail, shownUrl);
+    await audited(() => storePairOrRollBack({
+        impl,
+        environment: envName,
+        store: target.id,
+        clientIdKey,
+        clientSecretKey,
+        mintedClientId,
+        mintedClientSecret,
+        previousClientId
+    }));
+    const fpOutcome = await recordFingerprintsSafe(runtime, envName, target.id, clientIdKey, mintedClientId, clientSecretKey, mintedClientSecret);
+    if (!fpOutcome.ok) {
+        logger.warn('Stored keys but could not record drift fingerprints', {
+            error: fpOutcome.error
+        });
+    }
+    writeLeverageAudit(out, {
+        action: 'secrets.oauth-client.mint',
+        keys: [bearerKey, clientIdKey, clientSecretKey],
+        environment: envName,
+        backend: target.id,
+        target: `POST ${shownUrl} -> ${response.status}`,
+        outcome: 'success'
+    });
+    // Non-secret summary only — never print client_secret / bearer.
+    for (const line of [
+        `Minted OAuth client "${clientName}"`,
+        `  client_id: ${mintedClientId}`,
+        `  redirect_uris: ${redirectUris.join(', ')}`,
+        `  scope: ${scope}`,
+        `  stored: ${clientIdKey}, ${clientSecretKey} in [${target.id}] env=${envName}`,
+        `  (client_secret written to store; value not printed)`
+    ]) {
+        out.line(line);
+    }
+    requestCLIExit(0);
+}
+export default { execute };
+//# sourceMappingURL=mint.command.impl.js.map

package/dist/surfaces/cli/commands/oauth-client/mint.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.command.impl.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/mint.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAC,cAAc,EAA+C,MAAM,iDAAiD,CAAC;AAC7I,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAC,sBAAsB,EAAC,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAC,mBAAmB,EAAC,cAAc,EAAC,cAAc,EAAC,yBAAyB,EAAC,gBAAgB,EAA+C,MAAM,iDAAiD,CAAC;AACpO,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAC,sBAAsB,EAAC,eAAe,EAAC,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAC,mBAAmB,EAAC,qBAAqB,EAAoD,MAAM,qBAAqB,CAAC;AAe1J,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACP,cAAc,EACd,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EACf,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAC,0BAA0B,EAAC,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAErH,MAAM,MAAM,GAAG,SAAS,CAAC,+BAA+B,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAC;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,OAAwB,EACxB,OAA2B,EAC3B,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAE7E,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAE/M,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAG,CAAC,OAA8B,EAAE,MAAc,EAAE,QAAiB,EAAE,MAAe,EAAQ,EAAE,CAC1G,kBAAkB,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,2BAA2B;QACnC,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;QAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,QAAQ,CAAC,SAAS;QAC3B,MAAM;QACN,OAAO;QACP,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1C,CAAC,CAAC;IAEJ,SAAS,IAAI,CAAC,OAAe;QAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,sIAAsI;IACtI,MAAM,OAAO,GAAG,KAAK,EAAK,IAA0B,EAAc,EAAE;QACnE,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjG,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,gBAAgB,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9D,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,eAAe,CACxB,yCAAyC,SAAS,+BAA+B,QAAQ,CAAC,WAAW,IAAI,EACzG,eAAe,EACf;YACC,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,qCAAqC,SAAS,kBAAkB,QAAQ,CAAC,WAAW,EAAE;YACpG,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;SAC9D,CACD,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,iDAAiD;IACjD,IAAI,CAAC,qBAAqB,CAAC,UAAU,WAAW,EAAE,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC;QACjE,MAAM,IAAI,eAAe,CACxB,yCAAyC,SAAS,sEAAsE,EACxH,eAAe,EACf,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CACxF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,mEAAmE;IACnE,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CACvF,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAC3C,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5E,8FAA8F;QAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;IAC/H,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACZ,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,sBAAsB;QACjD,KAAK;KACL,CAAC;IAEF,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7E,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE/I,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC;QACvC,IAAI;QACJ,WAAW,EAAE,OAAO;QACpB,KAAK,EAAE,MAAM,CAAC,EAAE;QAChB,WAAW;QACX,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,gBAAgB;KAChB,CAAC,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC7C,OAAO,EACP,OAAO,EACP,MAAM,CAAC,EAAE,EACT,WAAW,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,CAClB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YAClE,KAAK,EAAE,SAAS,CAAC,KAAK;SACtB,CAAC,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,2BAA2B;QACnC,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;QAC/C,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,MAAM,EAAE,QAAQ,QAAQ,OAAO,QAAQ,CAAC,MAAM,EAAE;QAChD,OAAO,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI;QAClB,wBAAwB,UAAU,GAAG;QACrC,gBAAgB,cAAc,EAAE;QAChC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,YAAY,KAAK,EAAE;QACnB,aAAa,WAAW,KAAK,eAAe,QAAQ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE;QAC/E,uDAAuD;KACvD,EAAE,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `vibes secrets oauth-client` — mint and manage OAuth clients via the
+ * secrets leverage surface (bearer from store; never print secrets).
+ */
+import type { CLIGroupAssetDescriptor } from '@vibesdotdev/cli/schemas/descriptors';
+declare const descriptor: CLIGroupAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=oauth-client.cli-group.descriptor.d.ts.map

package/dist/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.cli-group.descriptor.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF,QAAA,MAAM,UAAU,EAAE,uBAUjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.js

@@ -0,0 +1,17 @@
+/**
+ * `vibes secrets oauth-client` — mint and manage OAuth clients via the
+ * secrets leverage surface (bearer from store; never print secrets).
+ */
+const descriptor = {
+    kind: 'cli/group',
+    id: 'secrets.oauth-client',
+    name: 'oauth-client',
+    description: 'Mint OAuth clients via secrets leverage (store-backed bearer; secrets never printed)',
+    parent: 'secrets',
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 40
+};
+export default descriptor;
+//# sourceMappingURL=oauth-client.cli-group.descriptor.js.map

package/dist/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.cli-group.descriptor.js","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/oauth-client/oauth-client.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,UAAU,GAA4B;IAC3C,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,sFAAsF;IACnG,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/cli/commands/request/request-http.d.ts

@@ -0,0 +1,31 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+/** Same-origin redirects followed before the request is refused. */
+export declare const REQUEST_MAX_REDIRECTS = 5;
+type FetchOutcome = {
+    kind: 'response';
+    response: Response;
+} | {
+    kind: 'transport-failure';
+    error: unknown;
+} | {
+    kind: 'refused';
+    refusal: CapabilityError;
+};
+/**
+ * One request, following only same-origin redirects and only up to
+ * {@link REQUEST_MAX_REDIRECTS}. A redirect to another origin (or scheme) is
+ * refused before it is requested, so no header travels with it.
+ */
+export declare function fetchSameOrigin(first: URL, init: RequestInit, policy: {
+    allowLoopbackHttp: boolean;
+}): Promise<FetchOutcome>;
+/**
+ * When a truncated body ends part-way through a secret value, drop that partial
+ * tail: the redactor matches whole values, so a cut prefix would print. Each form
+ * the redactor recognizes (the value, and its base64, base64url, URL, form and hex
+ * encodings) is trimmed by its exact prefixes, from `MIN_TRIMMED_PREFIX_LENGTH`
+ * characters (or all but one character of a shorter form).
+ */
+export declare function trimPartialSecretTail(text: string, values: Record<string, string>): string;
+export {};
+//# sourceMappingURL=request-http.d.ts.map

package/dist/surfaces/cli/commands/request/request-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-http.d.ts","sourceRoot":"","sources":["../../../../../src/surfaces/cli/commands/request/request-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,KAAK,YAAY,GACd;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjD;;;;GAIG;AACH,wBAAsB,eAAe,CACpC,KAAK,EAAE,GAAG,EACV,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACpC,OAAO,CAAC,YAAY,CAAC,CAgDvB;AAKD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAc1F"}