@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/surfaces/svelte/components/SecretRevealButton.svelte

@@ -0,0 +1,141 @@
+<script lang="ts">
+	import { settle } from '@vibesdotdev/kernel';
+	import { Button } from '@vibesdotdev/kit/components/ui/button';
+	import { Icon } from '@vibesdotdev/kit/components/icon';
+	import { getLogger } from '@vibesdotdev/logging';
+	import { getSecretsState } from '../state-context.js';
+	import { type SecretSummary } from '../client/runtime';
+
+	/**
+	 * SecretRevealButton — click-to-reveal a single secret value with an
+	 * auto-hide timer. The value lives only inside this component's local state
+	 * (not in the secrets state), is wiped after the timer elapses, and is wiped
+	 * again on unmount.
+	 *
+	 * Security:
+	 *  - Logs contain only fixed operation facts.
+	 *  - Failures use fixed messages and value-free log facts.
+	 *  - The countdown is visible so the user knows the value is about to clear.
+	 */
+	type Props = {
+		secret: SecretSummary;
+		/** Seconds to keep the value visible after reveal. Default 15. */
+		autoHideSeconds?: number;
+		variant?: 'default' | 'outline' | 'ghost';
+		size?: 'sm' | 'default';
+		label?: string;
+		/** Notified after a successful reveal — payload is the descriptor only. */
+		onReveal?: (secret: SecretSummary) => void;
+		/** Notified on reveal error. */
+		onError?: (message: string) => void;
+	};
+
+	let props: Props = $props();
+	// Taken while the component initializes (Svelte's context rule), used by the handlers below.
+	const secretsState = getSecretsState();
+
+	const secretValue = $derived(props.secret);
+	const autoHide = $derived(props.autoHideSeconds ?? 15);
+	const variantValue = $derived(props.variant ?? 'outline');
+	const sizeValue = $derived(props.size ?? 'sm');
+	const labelValue = $derived(props.label ?? 'Reveal');
+
+	type Phase = 'idle' | 'loading' | 'revealed' | 'error';
+	let phase = $state<Phase>('idle');
+	let revealedValue = $state<string | null>(null);
+	let errorMessage = $state<string | null>(null);
+	let remainingSeconds = $state(0);
+	let timer: ReturnType<typeof setInterval> | null = null;
+
+	const logger = getLogger('secrets.reveal-button');
+
+	function clearTimer(): void {
+		if (timer) {
+			clearInterval(timer);
+			timer = null;
+		}
+	}
+
+	function wipe(): void {
+		revealedValue = null;
+		remainingSeconds = 0;
+		phase = 'idle';
+		clearTimer();
+	}
+
+	function startCountdown(): void {
+		clearTimer();
+		remainingSeconds = autoHide;
+		timer = setInterval(() => {
+			remainingSeconds -= 1;
+			if (remainingSeconds <= 0) {
+				wipe();
+			}
+		}, 1000);
+	}
+
+	async function handleReveal(): Promise<void> {
+		if (phase === 'loading') return;
+		phase = 'loading';
+		errorMessage = null;
+		const outcome = await settle(async () => {
+			const result = await secretsState.reveal(secretValue.id);
+			revealedValue = result.value;
+			phase = 'revealed';
+			startCountdown();
+			props.onReveal?.(secretValue);
+		});
+		if (!outcome.ok) {
+			const message = 'Failed to reveal secret';
+			errorMessage = message;
+			phase = 'error';
+			// Never log identifiers or the upstream payload body.
+			logger.warn('Reveal failed', { reason: 'secrets-surface-operation-failed' });
+			props.onError?.(message);
+		}
+	}
+
+	function handleHide(): void {
+		logger.debug('Reveal hidden');
+		wipe();
+	}
+
+	$effect(() => {
+		return () => {
+			// Unmount cleanup — wipe local memory.
+			revealedValue = null;
+			clearTimer();
+		};
+	});
+</script>
+
+{#if phase === 'idle' || phase === 'loading'}
+	<Button
+		variant={variantValue}
+		size={sizeValue}
+		onclick={handleReveal}
+		disabled={phase === 'loading'}
+		aria-label={`Reveal ${secretValue.name}`}
+	>
+		<Icon icon="lucide:eye" class="mr-1 h-4 w-4" />
+		{phase === 'loading' ? 'Loading…' : labelValue}
+	</Button>
+{:else if phase === 'revealed' && revealedValue !== null}
+	<div class="flex items-center gap-2">
+		<code
+			class="rounded-sm border bg-muted px-2 py-1 font-mono text-xs break-all"
+			aria-live="polite"
+		>{revealedValue}</code>
+		<span class="text-xs text-muted-foreground" aria-live="polite">
+			Hides in {remainingSeconds}s
+		</span>
+		<Button variant="ghost" size="sm" onclick={handleHide} aria-label="Hide value">
+			<Icon icon="lucide:eye-off" class="h-4 w-4" />
+		</Button>
+	</div>
+{:else if phase === 'error' && errorMessage}
+	<div class="flex items-center gap-2">
+		<span class="text-xs text-destructive" role="alert">{errorMessage}</span>
+		<Button variant="ghost" size="sm" onclick={handleReveal}>Retry</Button>
+	</div>
+{/if}

package/dist/surfaces/svelte/components/SecretRevealButton.svelte.d.ts

@@ -0,0 +1,28 @@
+import { type SecretSummary } from '../client/runtime';
+/**
+ * SecretRevealButton — click-to-reveal a single secret value with an
+ * auto-hide timer. The value lives only inside this component's local state
+ * (not in the secrets state), is wiped after the timer elapses, and is wiped
+ * again on unmount.
+ *
+ * Security:
+ *  - Logs contain only fixed operation facts.
+ *  - Failures use fixed messages and value-free log facts.
+ *  - The countdown is visible so the user knows the value is about to clear.
+ */
+type Props = {
+    secret: SecretSummary;
+    /** Seconds to keep the value visible after reveal. Default 15. */
+    autoHideSeconds?: number;
+    variant?: 'default' | 'outline' | 'ghost';
+    size?: 'sm' | 'default';
+    label?: string;
+    /** Notified after a successful reveal — payload is the descriptor only. */
+    onReveal?: (secret: SecretSummary) => void;
+    /** Notified on reveal error. */
+    onError?: (message: string) => void;
+};
+declare const SecretRevealButton: import("svelte").Component<Props, {}, "">;
+type SecretRevealButton = ReturnType<typeof SecretRevealButton>;
+export default SecretRevealButton;
+//# sourceMappingURL=SecretRevealButton.svelte.d.ts.map

package/dist/surfaces/svelte/components/SecretRevealButton.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRevealButton.svelte.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/components/SecretRevealButton.svelte.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,KAAK,KAAK,GAAG;IACZ,MAAM,EAAE,aAAa,CAAC;IACtB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1C,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,gCAAgC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,CAAC;AAkHH,QAAA,MAAM,kBAAkB,2CAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}

package/dist/surfaces/svelte/components/SecretRotateDialog.svelte

@@ -0,0 +1,59 @@
+<script lang="ts">
+	import { ConfirmDialog, Input, Label } from '@vibesdotdev/kit/components';
+
+	let {
+		open = $bindable(false),
+		secretName = 'this secret',
+		rotating = false,
+		onconfirm
+	}: {
+		open?: boolean;
+		secretName?: string;
+		rotating?: boolean;
+		onconfirm?: (value: string) => void | Promise<void>;
+	} = $props();
+
+	let value = $state('');
+
+	$effect(() => {
+		if (open) value = '';
+	});
+
+	function handleConfirm() {
+		const trimmed = value.trim();
+		if (!trimmed || rotating) return;
+		void onconfirm?.(trimmed);
+	}
+</script>
+
+<ConfirmDialog
+	bind:open
+	title="Rotate Secret"
+	description="Enter a new value for {secretName}. The old value will be replaced immediately."
+	confirmLabel={rotating ? 'Rotating' : 'Rotate Secret'}
+	loading={rotating}
+	disabled={!value.trim()}
+	variant="default"
+	onconfirm={handleConfirm}
+>
+	{#snippet body()}
+		<form
+			class="space-y-2"
+			onsubmit={(event) => {
+				event.preventDefault();
+				handleConfirm();
+			}}
+		>
+			<Label for="rotated-secret-value">New Secret Value <span class="text-destructive">*</span></Label>
+			<Input
+				id="rotated-secret-value"
+				type="password"
+				bind:value
+				required
+				disabled={rotating}
+				placeholder="Enter the new secret value"
+				autocomplete="new-password"
+			/>
+		</form>
+	{/snippet}
+</ConfirmDialog>

package/dist/surfaces/svelte/components/SecretRotateDialog.svelte.d.ts

@@ -0,0 +1,10 @@
+type $$ComponentProps = {
+    open?: boolean;
+    secretName?: string;
+    rotating?: boolean;
+    onconfirm?: (value: string) => void | Promise<void>;
+};
+declare const SecretRotateDialog: import("svelte").Component<$$ComponentProps, {}, "open">;
+type SecretRotateDialog = ReturnType<typeof SecretRotateDialog>;
+export default SecretRotateDialog;
+//# sourceMappingURL=SecretRotateDialog.svelte.d.ts.map

package/dist/surfaces/svelte/components/SecretRotateDialog.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRotateDialog.svelte.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/components/SecretRotateDialog.svelte.ts"],"names":[],"mappings":"AAKC,KAAK,gBAAgB,GAAI;IACxB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,CAAC;AAsCH,QAAA,MAAM,kBAAkB,0DAAwC,CAAC;AACjE,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChE,eAAe,kBAAkB,CAAC"}

package/dist/surfaces/svelte/components/SecretsList.svelte

@@ -0,0 +1,122 @@
+<script lang="ts">
+	import { settle } from '@vibesdotdev/kernel';
+	import { Button } from '@vibesdotdev/kit/components/ui/button';
+	import { Icon } from '@vibesdotdev/kit/components/icon';
+	import EmptyState from '@vibesdotdev/kit/components/layout/EmptyState';
+	import { getLogger } from '@vibesdotdev/logging';
+	import { getSecretsState } from '../state-context.js';
+	import type { SecretSummary } from '../client/runtime';
+
+	type Props = {
+		/**
+		 * Explicit list of secret descriptors. When omitted, the component reads
+		 * from the secrets state's `secrets` (preferred path — keeps a single source of
+		 * truth across the page).
+		 */
+		secrets?: SecretSummary[];
+		accountOrigin?: string;
+		onReveal?: (secret: SecretSummary) => void;
+		onCopyId?: (secret: SecretSummary) => void;
+		emptyTitle?: string;
+		emptyDescription?: string;
+		/**
+		 * When false (default), the Reveal button is hidden — useful for read-only
+		 * admin surfaces where descriptor display is the goal and value access
+		 * lives behind a separate flow.
+		 */
+		revealEnabled?: boolean;
+	};
+
+	let props: Props = $props();
+	// Taken while the component initializes (Svelte's context rule).
+	const secretsState = getSecretsState();
+
+	const secretsValue = $derived(props.secrets ?? secretsState.secrets);
+	const emptyTitleValue = $derived(props.emptyTitle ?? 'No secrets');
+	const emptyDescriptionValue = $derived(
+		props.emptyDescription ?? 'Create a secret to manage credentials and API keys.'
+	);
+	const revealEnabledValue = $derived(props.revealEnabled ?? false);
+
+	const logger = getLogger('secrets.list');
+
+	function fmtDate(value: SecretSummary['lastRotatedAt'] | SecretSummary['updatedAt']): string {
+		if (!value) return 'never';
+		const d = value instanceof Date ? value : new Date(value);
+		if (Number.isNaN(d.getTime())) return 'unknown';
+		return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
+	}
+
+	async function copyId(secret: SecretSummary) {
+		const outcome = await settle(async () => {
+			if (globalThis.navigator?.clipboard) {
+				await globalThis.navigator.clipboard.writeText(secret.id);
+			}
+			logger.debug('Copied secret id');
+			props.onCopyId?.(secret);
+		});
+		if (!outcome.ok) {
+			logger.warn('Failed to copy secret id', {
+				reason: 'secrets-surface-operation-failed'
+			});
+		}
+	}
+
+	function requestReveal(secret: SecretSummary) {
+		// Record the operation without caller-controlled metadata.
+		logger.info('Reveal requested');
+		props.onReveal?.(secret);
+	}
+</script>
+
+{#if secretsValue.length === 0}
+	<EmptyState icon="lucide:key" title={emptyTitleValue} description={emptyDescriptionValue} />
+{:else}
+	<ul class="secrets-list divide-y rounded-md border bg-card">
+		{#each secretsValue as secret (secret.id)}
+			<li class="secrets-list__row flex items-center justify-between gap-4 px-4 py-3">
+				<div class="min-w-0 flex-1">
+					<div class="flex items-center gap-2">
+						<span class="truncate font-medium">{secret.name}</span>
+						<span
+							class="secrets-list__chip inline-flex items-center rounded-sm border bg-muted px-2 py-0.5 text-xs text-muted-foreground"
+						>
+							{secret.providerType}
+						</span>
+						<span
+							class="secrets-list__chip inline-flex items-center rounded-sm border bg-muted px-2 py-0.5 text-xs text-muted-foreground"
+						>
+							{secret.scope}
+						</span>
+					</div>
+					<div class="mt-1 text-xs text-muted-foreground">
+						<span>Rotated: {fmtDate(secret.lastRotatedAt ?? null)}</span>
+						<span class="mx-2">·</span>
+						<span>Updated: {fmtDate(secret.updatedAt)}</span>
+					</div>
+				</div>
+				<div class="flex shrink-0 items-center gap-2">
+					<Button
+						variant="ghost"
+						size="sm"
+						onclick={() => copyId(secret)}
+						aria-label="Copy secret ID"
+						title="Copy ID"
+					>
+						<Icon icon="lucide:copy" class="h-4 w-4" />
+					</Button>
+					{#if revealEnabledValue}
+						<Button
+							variant="outline"
+							size="sm"
+							onclick={() => requestReveal(secret)}
+							aria-label={`Reveal ${secret.name}`}
+						>
+							<Icon icon="lucide:eye" class="mr-1 h-4 w-4" />Reveal
+						</Button>
+					{/if}
+				</div>
+			</li>
+		{/each}
+	</ul>
+{/if}

package/dist/surfaces/svelte/components/SecretsList.svelte.d.ts

@@ -0,0 +1,24 @@
+import type { SecretSummary } from '../client/runtime';
+type Props = {
+    /**
+     * Explicit list of secret descriptors. When omitted, the component reads
+     * from the secrets state's `secrets` (preferred path — keeps a single source of
+     * truth across the page).
+     */
+    secrets?: SecretSummary[];
+    accountOrigin?: string;
+    onReveal?: (secret: SecretSummary) => void;
+    onCopyId?: (secret: SecretSummary) => void;
+    emptyTitle?: string;
+    emptyDescription?: string;
+    /**
+     * When false (default), the Reveal button is hidden — useful for read-only
+     * admin surfaces where descriptor display is the goal and value access
+     * lives behind a separate flow.
+     */
+    revealEnabled?: boolean;
+};
+declare const SecretsList: import("svelte").Component<Props, {}, "">;
+type SecretsList = ReturnType<typeof SecretsList>;
+export default SecretsList;
+//# sourceMappingURL=SecretsList.svelte.d.ts.map

package/dist/surfaces/svelte/components/SecretsList.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsList.svelte.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/components/SecretsList.svelte.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGtD,KAAK,KAAK,GAAG;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AA4FH,QAAA,MAAM,WAAW,2CAAwC,CAAC;AAC1D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAClD,eAAe,WAAW,CAAC"}

package/dist/surfaces/svelte/components/SecretsLoader.svelte

@@ -0,0 +1,72 @@
+<script lang="ts">
+	import { settle } from '@vibesdotdev/kernel';
+	import { onMount } from 'svelte';
+	import { getLogger } from '@vibesdotdev/logging';
+	import { getRuntimeSvelteContext, peekRuntimeSvelteContext } from '@vibesdotdev/surface-sveltekit/svelte/state';
+	import { getSecretsState } from '../state-context.js';
+	import { type ListSecretsFilter, type SecretScope, type SecretSummary } from '../client/runtime';
+
+	const logger = getLogger('secrets.loader');
+
+	/**
+	 * SecretsLoader — non-visual. Drives the enclosing scope's secrets state `init()` from a layout or
+	 * page mount point. Optionally seeds the store from a `+page.server.ts` or
+	 * `+layout.server.ts` payload so reactive reads work before the cross-origin
+	 * fetch resolves.
+	 *
+	 * Mount once at the layout level (or per page when scope is page-specific).
+	 * Renders nothing.
+	 *
+	 * Usage:
+	 *
+	 *   <SecretsLoader
+	 *     initialSecrets={data.secrets}
+	 *     activeBackend="platform"
+	 *   />
+	 *
+	 * For same-origin mounts (inside platform-web itself) pass
+	 * `accountOrigin=""` so requests stay relative.
+	 */
+	type Props = {
+		/** Explicit account/platform origin; `''` is same-origin. Omitted: the runtime's account origin. */
+		accountOrigin?: string;
+		/** Initial secret descriptors from the server `load`. */
+		initialSecrets?: SecretSummary[];
+		/** Active scope hint for display + filtering. */
+		activeBackend?: SecretScope | null;
+		/** Initial filter applied to the first list() call. */
+		filter?: ListSecretsFilter;
+		/** Session token for cross-origin Authorization: Bearer. */
+		authorization?: string;
+	};
+
+	let props: Props = $props();
+	const enclosingRuntime = peekRuntimeSvelteContext();
+	const runtimeStore = enclosingRuntime ?? getRuntimeSvelteContext();
+	// Taken while the component initializes (Svelte's context rule).
+	const secretsState = getSecretsState();
+
+	onMount(() => {
+		void (async () => {
+			const outcome = await settle(async () => {
+				// The runtime tells a development host (loopback http) and, with no explicit origin,
+				// names the account origin. An enclosing surface always resolves its runtime.
+				const runtime =
+					!enclosingRuntime && props.accountOrigin !== undefined
+						? runtimeStore.runtime
+						: (runtimeStore.runtime ?? (await runtimeStore.load()));
+				await secretsState.init({
+					accountOrigin: props.accountOrigin,
+					runtime,
+					authorization: props.authorization,
+					initialSecrets: props.initialSecrets,
+					activeBackend: props.activeBackend ?? null,
+					filter: props.filter
+				});
+			});
+			if (!outcome.ok) {
+				logger.warn('secrets initialization failed', { reason: 'secrets-surface-operation-failed' });
+			}
+		})();
+	});
+</script>

package/dist/surfaces/svelte/components/SecretsLoader.svelte.d.ts

@@ -0,0 +1,36 @@
+import { type ListSecretsFilter, type SecretScope, type SecretSummary } from '../client/runtime';
+/**
+ * SecretsLoader — non-visual. Drives the enclosing scope's secrets state `init()` from a layout or
+ * page mount point. Optionally seeds the store from a `+page.server.ts` or
+ * `+layout.server.ts` payload so reactive reads work before the cross-origin
+ * fetch resolves.
+ *
+ * Mount once at the layout level (or per page when scope is page-specific).
+ * Renders nothing.
+ *
+ * Usage:
+ *
+ *   <SecretsLoader
+ *     initialSecrets={data.secrets}
+ *     activeBackend="platform"
+ *   />
+ *
+ * For same-origin mounts (inside platform-web itself) pass
+ * `accountOrigin=""` so requests stay relative.
+ */
+type Props = {
+    /** Explicit account/platform origin; `''` is same-origin. Omitted: the runtime's account origin. */
+    accountOrigin?: string;
+    /** Initial secret descriptors from the server `load`. */
+    initialSecrets?: SecretSummary[];
+    /** Active scope hint for display + filtering. */
+    activeBackend?: SecretScope | null;
+    /** Initial filter applied to the first list() call. */
+    filter?: ListSecretsFilter;
+    /** Session token for cross-origin Authorization: Bearer. */
+    authorization?: string;
+};
+declare const SecretsLoader: import("svelte").Component<Props, {}, "">;
+type SecretsLoader = ReturnType<typeof SecretsLoader>;
+export default SecretsLoader;
+//# sourceMappingURL=SecretsLoader.svelte.d.ts.map

package/dist/surfaces/svelte/components/SecretsLoader.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsLoader.svelte.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/svelte/components/SecretsLoader.svelte.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGhG;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,KAAK,GAAG;IACZ,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,iDAAiD;IACjD,aAAa,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACnC,uDAAuD;IACvD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA6CH,QAAA,MAAM,aAAa,2CAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/surfaces/svelte/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @vibesdotdev/secrets/svelte
+ *
+ * Svelte components and runtime helpers for secrets management UI. NEVER logs
+ * or echoes secret values — descriptor display + opt-in reveal only.
+ *
+ * Surface:
+ *  - `getSecretsState()` — the Svelte 5 store of the enclosing runtime scope (one per
+ *    request on a server; never a process-global). Holds descriptors only.
+ *  - `<SecretsLoader />` — non-visual; drives `getSecretsState().init()`.
+ *  - `<SecretsList />` — descriptor list, reveal disabled by default.
+ *  - `<SecretRevealButton />` — click-to-reveal with auto-hide timer.
+ *  - `<SecretForm />` — create/update form.
+ *  - `<SecretEditor />`, `<RevealSecretDialog />`, `<RotateSecretButton />` —
+ *    composite dialog/button helpers retained from earlier iterations.
+ *  - `loadSecretsLayoutData` — `+page.server.ts` / `+layout.server.ts` helper.
+ *
+ * Backed by platform-web's `/api/secrets` endpoints.
+ */
+export { default as RevealSecretDialog } from './components/RevealSecretDialog.svelte';
+export { default as RotateSecretButton } from './components/RotateSecretButton.svelte';
+export { default as SecretEditor } from './components/SecretEditor.svelte';
+export { default as SecretForm } from './components/SecretForm.svelte';
+export { default as SecretRevealButton } from './components/SecretRevealButton.svelte';
+export { default as SecretRotateDialog } from './components/SecretRotateDialog.svelte';
+export { default as SecretsList } from './components/SecretsList.svelte';
+export { default as SecretsLoader } from './components/SecretsLoader.svelte';
+export { getSecretsState } from './state-context.ts';
+export { SecretsState, createSecretsState, secretsStateFor, type SecretsStateInitOptions } from './state.svelte.ts';
+export { AccountSecretsClientError, createAccountSecretsClient, getAccountOrigin } from './client/runtime.ts';
+export type { AccountSecretsClient, ListSecretsFilter, SecretInput, SecretScope, SecretSummary } from './client/runtime.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/surfaces/svelte/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACP,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,uBAAuB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACP,yBAAyB,EAAC,0BAA0B,EAAC,gBAAgB,EACpE,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EAAC,WAAW,EAC7B,WAAW,EAAC,aAAa,EACxB,MAAM,qBAAqB,CAAC"}

package/dist/surfaces/svelte/index.js

@@ -0,0 +1,30 @@
+/**
+ * @vibesdotdev/secrets/svelte
+ *
+ * Svelte components and runtime helpers for secrets management UI. NEVER logs
+ * or echoes secret values — descriptor display + opt-in reveal only.
+ *
+ * Surface:
+ *  - `getSecretsState()` — the Svelte 5 store of the enclosing runtime scope (one per
+ *    request on a server; never a process-global). Holds descriptors only.
+ *  - `<SecretsLoader />` — non-visual; drives `getSecretsState().init()`.
+ *  - `<SecretsList />` — descriptor list, reveal disabled by default.
+ *  - `<SecretRevealButton />` — click-to-reveal with auto-hide timer.
+ *  - `<SecretForm />` — create/update form.
+ *  - `<SecretEditor />`, `<RevealSecretDialog />`, `<RotateSecretButton />` —
+ *    composite dialog/button helpers retained from earlier iterations.
+ *  - `loadSecretsLayoutData` — `+page.server.ts` / `+layout.server.ts` helper.
+ *
+ * Backed by platform-web's `/api/secrets` endpoints.
+ */
+export { default as RevealSecretDialog } from './components/RevealSecretDialog.svelte';
+export { default as RotateSecretButton } from './components/RotateSecretButton.svelte';
+export { default as SecretEditor } from './components/SecretEditor.svelte';
+export { default as SecretForm } from './components/SecretForm.svelte';
+export { default as SecretRevealButton } from './components/SecretRevealButton.svelte';
+export { default as SecretRotateDialog } from './components/SecretRotateDialog.svelte';
+export { default as SecretsList } from './components/SecretsList.svelte';
+export { default as SecretsLoader } from './components/SecretsLoader.svelte';
+export { getSecretsState } from "./state-context.js";
+export { SecretsState, createSecretsState, secretsStateFor } from "./state.svelte.js";
+export { AccountSecretsClientError, createAccountSecretsClient, getAccountOrigin } from "./client/runtime.js";

package/dist/surfaces/svelte/loaders.d.ts

@@ -0,0 +1,47 @@
+import { type LoadSecretsLayoutDataInput, type SecretsLayoutData } from "../../schemas/ui/svelte/layout.schema.ts";
+export { type LoadSecretsLayoutDataInput, type SecretsLayoutData, type SecretsLayoutFetchers } from "../../schemas/ui/svelte/layout.schema.ts";
+/**
+ * SvelteKit `load` helpers for `@vibesdotdev/secrets/svelte`.
+ *
+ * Exported under the `./loaders` subpath so SvelteKit keeps server-only code
+ * out of the browser bundle (see SURFACE-PACKAGE-CONVENTIONS §2.5 / §2.7).
+ *
+ * Secret values live in platform-web's `src/server/` tree (the SecretService +
+ * encryption pipeline). Per §2.5.1, we accept the data sources via
+ * dependency-injected fetchers so consumers (platform-web today, other admin
+ * surfaces tomorrow) wire their own `src/server/` modules without forking the
+ * loader.
+ *
+ * Critical contract: this loader returns DESCRIPTORS ONLY. Values never appear
+ * in `+page.server.ts` / `+layout.server.ts` payloads — they're fetched
+ * on-demand via the reveal endpoint, audited per-call.
+ */
+/**
+ * Compose the secrets layout payload for a SvelteKit `+page.server.ts` or
+ * `+layout.server.ts`. Returns a serializable object the consuming app spreads
+ * into its own `LayoutServerLoad`/`PageServerLoad` return. The client-side
+ * `getSecretsState().seedInitial()` consumes the same fields.
+ *
+ * A failing fetcher is NOT turned into an empty list: its failure propagates to
+ * SvelteKit, because an empty inventory that looks like success hides the
+ * failure. (No signed-in user, or no scope, is the one empty answer: nothing is
+ * asked.)
+ *
+ * Usage:
+ *
+ *   import { loadSecretsLayoutData } from '@vibesdotdev/secrets/svelte/loaders';
+ *
+ *   export const load: PageServerLoad = async ({ locals }) => {
+ *     const data = await loadSecretsLayoutData({
+ *       user: locals.user,
+ *       scope: 'platform',
+ *       fetchers: {
+ *         listSecrets: ({ userId, scope, scopeId, limit }) =>
+ *           secretService.list({ scope, scopeId, limit }, secretContextFor(userId)),
+ *       },
+ *     });
+ *     return data;
+ *   };
+ */
+export declare function loadSecretsLayoutData(input: LoadSecretsLayoutDataInput): Promise<SecretsLayoutData>;
+//# sourceMappingURL=loaders.d.ts.map

package/dist/surfaces/svelte/loaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loaders.d.ts","sourceRoot":"","sources":["../../../src/surfaces/svelte/loaders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,0BAA0B,EAAC,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAClH,OAAO,EAAE,KAAK,0BAA0B,EAAC,KAAK,iBAAiB,EAAC,KAAK,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAC7I;;;;;;;;;;;;;;;GAeG;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAC1C,KAAK,EAAE,0BAA0B,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAsB5B"}