@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/surfaces/tui/index.js

@@ -0,0 +1,12 @@
+/**
+ * @vibesdotdev/secrets/tui - barrel export.
+ *
+ * Re-exports the plugin (default + named) and the descriptors so
+ * consumers can register the plugin directly or reference individual
+ * descriptors for testing / documentation.
+ */
+export { secretsTuiPlugin as default, secretsTuiPlugin } from "./secrets-tui.plugin.js";
+export { default as secretsTuiAppDescriptor } from "./secrets.tui-app.descriptor.js";
+export { default as secretsTuiOpenDescriptor } from "./secrets.tui-open.descriptor.js";
+export { default as secretsTuiStateDescriptor } from "./state/secrets.tui-state.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/surfaces/tui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/surfaces/tui/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAC,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,yBAAyB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/surfaces/tui/secrets-tui.plugin.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Secrets TUI Plugin
+ *
+ * Registers the secrets inspector `tui/app` (`secrets.inspector`), the
+ * `secrets.list` `tui/state` slice, and the `secrets.open`
+ * `tui/command` against the kinds owned by `@vibesdotdev/tui`.
+ *
+ * The core `@vibesdotdev/secrets` package stays surface-neutral (kind +
+ * backend impls + CLI commands); the TUI surface is split out so
+ * non-TUI consumers never pull `@opentui/react` or this package's JSX.
+ *
+ * Plugin id parity (AGENT-CONSTITUTION "Plugin id parity"): there is
+ * no `*.cloud.plugin.ts` variant - TUI surfaces are consumer-only -
+ * so the canonical id is `secrets.tui`.
+ */
+export declare const secretsTuiPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsTuiPlugin;
+//# sourceMappingURL=secrets-tui.plugin.d.ts.map

package/dist/surfaces/tui/secrets-tui.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-tui.plugin.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets-tui.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,eAAO,MAAM,gBAAgB,6CA0B3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/surfaces/tui/secrets-tui.plugin.js

@@ -0,0 +1,42 @@
+/**
+ * Secrets TUI Plugin
+ *
+ * Registers the secrets inspector `tui/app` (`secrets.inspector`), the
+ * `secrets.list` `tui/state` slice, and the `secrets.open`
+ * `tui/command` against the kinds owned by `@vibesdotdev/tui`.
+ *
+ * The core `@vibesdotdev/secrets` package stays surface-neutral (kind +
+ * backend impls + CLI commands); the TUI surface is split out so
+ * non-TUI consumers never pull `@opentui/react` or this package's JSX.
+ *
+ * Plugin id parity (AGENT-CONSTITUTION "Plugin id parity"): there is
+ * no `*.cloud.plugin.ts` variant - TUI surfaces are consumer-only -
+ * so the canonical id is `secrets.tui`.
+ */
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import secretsAppDescriptor from "./secrets.tui-app.descriptor.js";
+import secretsOpenDescriptor from "./secrets.tui-open.descriptor.js";
+import secretsStateDescriptor from "./state/secrets.tui-state.descriptor.js";
+const TUI_APP = { kind: 'tui/app' };
+const TUI_STATE = { kind: 'tui/state' };
+const TUI_COMMAND = { kind: 'tui/command' };
+export const secretsTuiPlugin = createRuntimePlugin({
+    id: 'secrets.tui',
+    name: 'Secrets TUI Surface',
+    description: 'Interactive secret browser: descriptor list, metadata pane, and a confirmation-gated, time-limited reveal pane.',
+    // Dependencies:
+    //   - `tui` owns the tui/app + tui/state + tui/command kinds the
+    //     descriptors register against.
+    //   - `secrets` owns the `secrets/store` kind the state impl and
+    //     reveal flow query. Without this dep the inspector cannot
+    //     enumerate backends.
+    dependencies: ['tui', 'secrets'],
+    descriptors: [secretsAppDescriptor, secretsStateDescriptor, secretsOpenDescriptor],
+    loaders: [
+        loader('secrets.inspector', TUI_APP, () => import("./secrets.tui-app.impl.consumer.js")),
+        loader('secrets.list', TUI_STATE, () => import("./state/secrets.tui-state.impl.consumer.js")),
+        loader('secrets.open', TUI_COMMAND, () => import("./secrets.tui-open.impl.consumer.js"))
+    ]
+});
+export default secretsTuiPlugin;
+//# sourceMappingURL=secrets-tui.plugin.js.map

package/dist/surfaces/tui/secrets-tui.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-tui.plugin.js","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets-tui.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,mBAAmB,EAAC,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,oBAAoB,MAAM,iCAAiC,CAAC;AACnE,OAAO,qBAAqB,MAAM,kCAAkC,CAAC;AACrE,OAAO,sBAAsB,MAAM,yCAAyC,CAAC;AAE7E,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAC7C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,WAAW,EAAW,CAAC;AACjD,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAW,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,iHAAiH;IAClH,gBAAgB;IAChB,iEAAiE;IACjE,oCAAoC;IACpC,iEAAiE;IACjE,+DAA+D;IAC/D,0BAA0B;IAC1B,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAEhC,WAAW,EAAE,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,CAAC;IAElF,OAAO,EAAE;QACR,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oCAAqC,CAAC,CAC7C;QACD,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE,CACtC,MAAM,CAAC,4CAA4C,CAAC,CACpD;QACD,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,qCAAqC,CAAC,CAC7C;KACD;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/surfaces/tui/secrets.tui-app.descriptor.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Secrets Inspector - tui/app descriptor
+ *
+ * Registers an interactive secret browser as a discoverable
+ * `tui/app`. Sidebar lists secret descriptors (key, source, hasValue)
+ * for the resolved environment - NEVER values. Detail panes show
+ * metadata and, on explicit user confirmation, briefly reveal a
+ * single value with an auto-clear countdown.
+ *
+ * Stem `secrets.tui-app` is feature-prefixed per R3.1 stem-uniqueness
+ * - no collision with other -tui packages' `*.descriptor.ts`.
+ */
+import type { TuiAppDescriptor } from '@vibesdotdev/tui/schemas/tui-app';
+declare const descriptor: TuiAppDescriptor;
+export default descriptor;
+//# sourceMappingURL=secrets.tui-app.descriptor.d.ts.map

package/dist/surfaces/tui/secrets.tui-app.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-app.descriptor.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-app.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,QAAA,MAAM,UAAU,EAAE,gBAiBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/secrets.tui-app.descriptor.js

@@ -0,0 +1,31 @@
+/**
+ * Secrets Inspector - tui/app descriptor
+ *
+ * Registers an interactive secret browser as a discoverable
+ * `tui/app`. Sidebar lists secret descriptors (key, source, hasValue)
+ * for the resolved environment - NEVER values. Detail panes show
+ * metadata and, on explicit user confirmation, briefly reveal a
+ * single value with an auto-clear countdown.
+ *
+ * Stem `secrets.tui-app` is feature-prefixed per R3.1 stem-uniqueness
+ * - no collision with other -tui packages' `*.descriptor.ts`.
+ */
+const descriptor = {
+    kind: 'tui/app',
+    id: 'secrets.inspector',
+    title: 'Secrets',
+    description: 'Browse keys for the current environment and reveal one value, confirmed and time-limited.',
+    icon: '⊠',
+    category: 'System',
+    audience: 'ops',
+    order: 8,
+    route: '/secrets',
+    states: ['secrets.list'],
+    embeddable: false,
+    minSize: { width: 80, height: 24 },
+    surfaces: ['tui'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=secrets.tui-app.descriptor.js.map

package/dist/surfaces/tui/secrets.tui-app.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-app.descriptor.js","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-app.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,UAAU,GAAqB;IACpC,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,SAAS;IAChB,WAAW,EACV,2FAA2F;IAC5F,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,CAAC,cAAc,CAAC;IACxB,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IAClC,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/secrets.tui-app.impl.consumer.d.ts

@@ -0,0 +1,4 @@
+import type { TuiAppImplementation } from '@vibesdotdev/tui/kinds/tui-app';
+declare const impl: TuiAppImplementation;
+export default impl;
+//# sourceMappingURL=secrets.tui-app.impl.consumer.d.ts.map

package/dist/surfaces/tui/secrets.tui-app.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-app.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-app.impl.consumer.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACZ,oBAAoB,EAEnB,MAAM,gCAAgC,CAAC;AA0LxC,QAAA,MAAM,IAAI,EAAE,oBAAyD,CAAC;AACtE,eAAe,IAAI,CAAC"}

package/dist/surfaces/tui/secrets.tui-app.impl.consumer.js

@@ -0,0 +1,115 @@
+import { jsx as _jsx, jsxs as _jsxs } from "@opentui/react/jsx-runtime";
+import { useViewport } from '@vibesdotdev/tui';
+import { Panel } from '@vibesdotdev/tui/components/content';
+import DSDivider from '@vibesdotdev/tui/components/content/Divider';
+import { HStack, VStack } from '@vibesdotdev/tui/components/layout';
+import { PageHeader, PageLayout } from '@vibesdotdev/tui/components/page';
+import { useContributeScreenStatus } from '@vibesdotdev/tui/shell';
+import { useTuiDispatch, useTuiState } from '@vibesdotdev/tui/state/hooks';
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { SecretsContentNotice, SecretsOpening, SecretsUnavailablePane } from "./components/InspectorNotices.js";
+import { RevealPane } from "./components/RevealPane.js";
+import { SecretMetadataPane } from "./components/SecretMetadataPane.js";
+import { SecretsListPane } from "./components/SecretsListPane.js";
+import { useInspectorKeys } from "./components/useInspectorKeys.js";
+import { secretsListStateKey } from "./state/secrets.tui-state.key.js";
+function findEntry(entries, id) {
+    if (!id)
+        return null;
+    return entries.find((e) => e.id === id) ?? null;
+}
+/**
+ * The one calm reassurance line, or (when a refresh failed but the last
+ * good key list is still on screen) the one warning line in its place.
+ * Never both - one quiet line, never a band.
+ */
+function SecretsInspectorApp({ navigate, runtime: runtimeProp, embedded = false }) {
+    const { width, height } = useViewport();
+    const compact = width <= 90 || height <= 26;
+    const state = useTuiState(secretsListStateKey);
+    const dispatch = useTuiDispatch(secretsListStateKey);
+    // SAFETY: TuiAppProps contract passes the active VibesRuntime instance.
+    const runtime = runtimeProp;
+    const [selectedId, setSelectedId] = useState(null);
+    const [revealPhase, setRevealPhase] = useState('idle');
+    const [filter, setFilter] = useState('');
+    const entries = state?.secrets ?? [];
+    // Find-as-you-type over the (already-loaded) key index - a client-side
+    // narrow, never a re-fetch. Matches on the key name.
+    const visibleEntries = useMemo(() => {
+        const query = filter.trim().toLowerCase();
+        if (!query)
+            return entries;
+        return entries.filter((e) => e.key.toLowerCase().includes(query));
+    }, [entries, filter]);
+    const selected = useMemo(() => findEntry(entries, selectedId), [entries, selectedId]);
+    // Keep a valid selection within the visible set: land on the first entry
+    // once loaded, and re-anchor to the first match whenever the current
+    // selection is filtered out from view.
+    useEffect(() => {
+        if (visibleEntries.length === 0)
+            return;
+        const stillVisible = selectedId != null && visibleEntries.some((e) => e.id === selectedId);
+        if (!stillVisible) {
+            setSelectedId(visibleEntries[0].id);
+        }
+    }, [visibleEntries, selectedId]);
+    // Whenever the selection changes, drop any in-flight reveal phase.
+    useEffect(() => {
+        setRevealPhase('idle');
+    }, [selectedId]);
+    const triggerRefresh = useCallback(() => {
+        dispatch({ type: 'REFRESH' });
+    }, [dispatch]);
+    /**
+     * Out-of-band value resolver.
+     *
+     * SECURITY: this function is the ONLY place in the package that
+     * resolves a secret value. It returns the string directly to
+     * `RevealPane`, which holds it in transient local state. The value
+     * is NEVER written to the shared `secrets.list` state slice and
+     * NEVER logged.
+     */
+    const resolveSecretValue = useCallback(async (entry) => {
+        // SAFETY: Resolution of a known secrets/store descriptor ID produces a SecretsStoreImplementation.
+        const impl = (await runtime
+            .query('secrets/store')
+            .withId(entry.backendId)
+            .resolve());
+        const value = await impl.get(state?.environment ?? 'local', entry.key);
+        if (value === undefined || value === '') {
+            throw new Error(`Secret not found or empty: ${entry.key}`);
+        }
+        return value;
+    }, [runtime, state?.environment]);
+    useInspectorKeys({ filter, setFilter, selected, selectedId, setSelectedId, revealPhase, setRevealPhase, triggerRefresh, navigate });
+    const loaded = Boolean(state?.loaded);
+    const error = state?.error ?? null;
+    const setCount = entries.filter((e) => e.hasValue).length;
+    const showUnavailableState = Boolean(loaded && error && entries.length === 0);
+    // Keyboard actions are swallowed while a confirmation is armed (the
+    // RevealPane's own Y/N/Esc badges are the truthful instructions then);
+    // otherwise refresh always works and reveal only when a value exists.
+    const actionsLive = revealPhase !== 'confirm';
+    useContributeScreenStatus('secrets.inspector', {
+        facts: loaded && !error
+            ? [{ slot: 'context', value: `${entries.length} keys - ${setCount} present`, tone: 'muted' }]
+            : [],
+        hints: actionsLive
+            ? [
+                ...(selected?.hasValue ? [{ keys: 'v', label: 'reveal', priority: 2 }] : []),
+                { keys: 'r', label: 'refresh', priority: 1 }
+            ]
+            : []
+    });
+    const content = !loaded ? (_jsx(SecretsOpening, { onRefresh: triggerRefresh })) : showUnavailableState ? (_jsx(VStack, { grow: true, padding: 2, children: _jsx(SecretsUnavailablePane, { error: error ?? 'Secrets are unavailable.', onRefresh: triggerRefresh }) })) : (_jsxs(VStack, { grow: true, gap: 0, style: { width: '100%', height: '100%' }, children: [!compact ? _jsx(SecretsContentNotice, { error: entries.length > 0 ? error : null }) : null, _jsxs(HStack, { grow: true, gap: "none", align: "stretch", children: [_jsx(VStack, { style: { width: '40%', minWidth: 36 }, gap: 0, children: _jsx(SecretsListPane, { entries: visibleEntries, totalCount: entries.length, filter: filter, onFilterChange: setFilter, selectedId: selectedId, onSelect: setSelectedId }) }), _jsx(Panel, { bordered: true, padding: "none", children: _jsxs(VStack, { grow: true, gap: 0, children: [_jsx(VStack, { style: { flexShrink: 0 }, children: _jsx(SecretMetadataPane, { entry: selected, environment: state?.environment ?? 'local' }) }), _jsx(DSDivider, {}), _jsx(RevealPane, { lifecycle: runtime.lifecycle, entry: selected, phase: revealPhase, onPhaseChange: setRevealPhase, onReveal: resolveSecretValue })] }) })] })] }));
+    if (embedded) {
+        return _jsx(VStack, { style: { width: '100%', height: '100%' }, children: content });
+    }
+    return (_jsx(PageLayout, { header: _jsx(PageHeader, { title: "Secrets", description: loaded
+                ? `Browse keys for the ${state?.environment ?? 'undeclared'} (${state?.tier ?? 'undeclared'}) environment and reveal one value, confirmed and time-limited.`
+                : 'Browse keys and reveal one value, confirmed and time-limited.' }), children: content }));
+}
+const impl = { component: SecretsInspectorApp };
+export default impl;
+//# sourceMappingURL=secrets.tui-app.impl.consumer.js.map

package/dist/surfaces/tui/secrets.tui-app.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-app.impl.consumer.js","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-app.impl.consumer.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,qCAAqC,CAAC;AAC5D,OAAO,SAAS,MAAM,6CAA6C,CAAC;AACpE,OAAO,EAAE,MAAM,EAAC,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAC,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAKzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAC,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAC,SAAS,EAAC,OAAO,EAAC,QAAQ,EAAiB,MAAM,OAAO,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAC,cAAc,EAAC,sBAAsB,EAAE,MAAM,kCAAmC,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA6B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAqC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAkC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,SAAS,SAAS,CACjB,OAAyC,EACzC,EAAiB;IAEjB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACjD,CAAC;AAED;;;;GAIG;AAEH,SAAS,mBAAmB,CAAC,EAC5B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,QAAQ,GAAG,KAAK,EACH;IACb,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACrD,wEAAwE;IACxE,MAAM,OAAO,GAAG,WAA2B,CAAC;IAE5C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAc,MAAM,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;IACrC,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,OAAO,CACvB,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EACpC,CAAC,OAAO,EAAE,UAAU,CAAC,CACrB,CAAC;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,uCAAuC;IACvC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxC,MAAM,YAAY,GAAG,UAAU,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACF,CAAC,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;IAEjC,mEAAmE;IACnE,SAAS,CAAC,GAAG,EAAE;QACd,cAAc,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,cAAc,GAAG,WAAW,CAAC,GAAS,EAAE;QAC7C,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/B,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,WAAW,CACrC,KAAK,EAAE,KAA4B,EAAmB,EAAE;QACvD,mGAAmG;QACnG,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO;aACzB,KAAK,CAAC,eAAe,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;aACvB,OAAO,EAAE,CAA+B,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,EACD,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAC7B,CAAC;IAEF,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEpI,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC9E,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,CAAC;IAE9C,yBAAyB,CAAC,mBAAmB,EAAE;QAC9C,KAAK,EACJ,MAAM,IAAI,CAAC,KAAK;YACf,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,WAAW,QAAQ,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7F,CAAC,CAAC,EAAE;QACN,KAAK,EAAE,WAAW;YACjB,CAAC,CAAC;gBACD,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE;aAC5C;YACD,CAAC,CAAC,EAAE;KACL,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CACzB,KAAC,cAAc,IAAC,SAAS,EAAE,cAAc,GAAI,CAC7C,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAC1B,KAAC,MAAM,IAAC,IAAI,QAAC,OAAO,EAAE,CAAC,YACtB,KAAC,sBAAsB,IAAC,KAAK,EAAE,KAAK,IAAI,0BAA0B,EAAE,SAAS,EAAE,cAAc,GAAI,GACzF,CACT,CAAC,CAAC,CAAC,CACH,MAAC,MAAM,IAAC,IAAI,QAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAC3D,CAAC,OAAO,CAAC,CAAC,CAAC,KAAC,oBAAoB,IAAC,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,CAAC,IAAI,EACrF,MAAC,MAAM,IAAC,IAAI,QAAC,GAAG,EAAC,MAAM,EAAC,KAAK,EAAC,SAAS,aACtC,KAAC,MAAM,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,YACpD,KAAC,eAAe,IACf,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,OAAO,CAAC,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,SAAS,EACzB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,aAAa,GACtB,GACM,EACT,KAAC,KAAK,IAAC,QAAQ,QAAC,OAAO,EAAC,MAAM,YAC7B,MAAC,MAAM,IAAC,IAAI,QAAC,GAAG,EAAE,CAAC,aAClB,KAAC,MAAM,IAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,YAC/B,KAAC,kBAAkB,IAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,OAAO,GAAI,GAC3E,EACT,KAAC,SAAS,KAAG,EACb,KAAC,UAAU,IACV,SAAS,EAAE,OAAO,CAAC,SAAS,EAC5B,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,cAAc,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,IACM,GACF,IACA,IACD,CACT,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,KAAC,MAAM,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAG,OAAO,GAAU,CAAC;IAC7E,CAAC;IAED,OAAO,CACN,KAAC,UAAU,IACV,MAAM,EACL,KAAC,UAAU,IACV,KAAK,EAAC,SAAS,EACf,WAAW,EACV,MAAM;gBACL,CAAC,CAAC,uBAAuB,KAAK,EAAE,WAAW,IAAI,YAAY,KAAK,KAAK,EAAE,IAAI,IAAI,YAAY,iEAAiE;gBAC5J,CAAC,CAAC,+DAA+D,GAElE,YAGF,OAAO,GACI,CACb,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAyB,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;AACtE,eAAe,IAAI,CAAC"}

package/dist/surfaces/tui/secrets.tui-open.descriptor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Open Secrets Inspector - tui/command descriptor
+ *
+ * Slash command that navigates to the secrets inspector page.
+ *
+ * Keybinding `g r` (revealable secrets) chosen to avoid collisions
+ * with the existing TUI keybindings (verified 2026-05-27):
+ *   - `g a` -> ai-tui
+ *   - `g d` -> storage-tui (data)
+ *   - `g e` -> session-tui
+ *   - `g p` -> pm-tui
+ *   - `g s` -> scope-tui
+ *   - `g w` -> tools/tui (work-items)
+ *
+ * Stem `secrets.tui-open` is feature-prefixed per R3.1 stem-uniqueness.
+ */
+import type { TuiCommandDescriptor } from '@vibesdotdev/tui/schemas/tui-command';
+declare const descriptor: TuiCommandDescriptor;
+export default descriptor;
+//# sourceMappingURL=secrets.tui-open.descriptor.d.ts.map

package/dist/surfaces/tui/secrets.tui-open.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-open.descriptor.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-open.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,QAAA,MAAM,UAAU,EAAE,oBAWjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/secrets.tui-open.descriptor.js

@@ -0,0 +1,29 @@
+/**
+ * Open Secrets Inspector - tui/command descriptor
+ *
+ * Slash command that navigates to the secrets inspector page.
+ *
+ * Keybinding `g r` (revealable secrets) chosen to avoid collisions
+ * with the existing TUI keybindings (verified 2026-05-27):
+ *   - `g a` -> ai-tui
+ *   - `g d` -> storage-tui (data)
+ *   - `g e` -> session-tui
+ *   - `g p` -> pm-tui
+ *   - `g s` -> scope-tui
+ *   - `g w` -> tools/tui (work-items)
+ *
+ * Stem `secrets.tui-open` is feature-prefixed per R3.1 stem-uniqueness.
+ */
+const descriptor = {
+    kind: 'tui/command',
+    id: 'secrets.open',
+    title: 'Open Secrets',
+    description: 'Browse secret descriptors and run a confirmed, time-limited reveal of a single value.',
+    trigger: '/secrets',
+    category: 'System',
+    keybinding: 'g then r',
+    acceptsArgs: false,
+    order: 7
+};
+export default descriptor;
+//# sourceMappingURL=secrets.tui-open.descriptor.js.map

package/dist/surfaces/tui/secrets.tui-open.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-open.descriptor.js","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-open.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,UAAU,GAAyB;IACxC,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,cAAc;IACrB,WAAW,EACV,uFAAuF;IACxF,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,UAAU;IACtB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,CAAC;CACR,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/secrets.tui-open.impl.consumer.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Open Secrets Inspector - tui/command implementation (consumer).
+ *
+ * Navigates to the secrets inspector page when triggered.
+ */
+import type { TuiCommandImplementation } from '@vibesdotdev/tui/kinds/tui-command';
+declare const impl: TuiCommandImplementation;
+export default impl;
+//# sourceMappingURL=secrets.tui-open.impl.consumer.d.ts.map

package/dist/surfaces/tui/secrets.tui-open.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-open.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-open.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEZ,wBAAwB,EACvB,MAAM,oCAAoC,CAAC;AAE5C,QAAA,MAAM,IAAI,EAAE,wBAKX,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/surfaces/tui/secrets.tui-open.impl.consumer.js

@@ -0,0 +1,13 @@
+/**
+ * Open Secrets Inspector - tui/command implementation (consumer).
+ *
+ * Navigates to the secrets inspector page when triggered.
+ */
+const impl = {
+    execute(ctx) {
+        ctx.navigate('/secrets');
+        return '/secrets';
+    }
+};
+export default impl;
+//# sourceMappingURL=secrets.tui-open.impl.consumer.js.map

package/dist/surfaces/tui/secrets.tui-open.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-open.impl.consumer.js","sourceRoot":"","sources":["../../../src/surfaces/tui/secrets.tui-open.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,IAAI,GAA6B;IACtC,OAAO,CAAC,GAAsB;QAC7B,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,UAAU,CAAC;IACnB,CAAC;CACD,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/surfaces/tui/state/list-loading.d.ts

@@ -0,0 +1,4 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { SecretsListState } from './secrets.tui-state.descriptor.ts';
+export declare function buildSecretsListState(runtime: VibesRuntime): Promise<SecretsListState>;
+//# sourceMappingURL=list-loading.d.ts.map

package/dist/surfaces/tui/state/list-loading.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-loading.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/list-loading.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AASxD,OAAO,KAAK,EAEZ,gBAAgB,EACf,MAAM,mCAAmC,CAAC;AAsC3C,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA4E3B"}

package/dist/surfaces/tui/state/list-loading.js

@@ -0,0 +1,79 @@
+import { isGenericSecretsStoreDescriptor } from '@vibesdotdev/secrets';
+import { resolveSecretsEnvironment } from "../../../support/environment.js";
+function entryId(backendId, key) {
+    return `${backendId}::${key}`;
+}
+function toErrorState(envName, envTier, error) {
+    return {
+        environment: envName,
+        tier: envTier,
+        secrets: [],
+        loaded: true,
+        loading: false,
+        error,
+        lastUpdated: Date.now()
+    };
+}
+async function tryResolveSecretsEnvironment(runtime) {
+    try {
+        const data = await resolveSecretsEnvironment(runtime);
+        return { ok: true, data };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export async function buildSecretsListState(runtime) {
+    const envOutcome = await tryResolveSecretsEnvironment(runtime);
+    if (!envOutcome.ok) {
+        // The one failure is `tier-undeclared` (a host composition defect); it
+        // is shown, never replaced by a guessed default environment.
+        return toErrorState('undeclared', null, 'Environment unavailable.');
+    }
+    const environment = envOutcome.data;
+    const { name: envName, tier: envTier } = environment;
+    if (!runtime.hasKind('secrets/store')) {
+        return toErrorState(envName, envTier, 'No secrets/store kind registered. Register a secrets backend plugin to inspect secrets.');
+    }
+    const descriptors = runtime
+        .query('secrets/store')
+        .descriptors();
+    const matching = descriptors.filter((d) => isGenericSecretsStoreDescriptor(d) && d.tiers.includes(envTier));
+    if (matching.length === 0) {
+        return toErrorState(envName, envTier, `No secrets/store backends configured for tier: ${envTier}.`);
+    }
+    // Aggregate by key - later (higher-priority) sources win, mirroring
+    // the secrets-cli list behaviour.
+    const aggregated = new Map();
+    const byPriority = [...matching].sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0));
+    for (const desc of byPriority) {
+        // SAFETY: Resolving a secrets/store descriptor produces a SecretsStoreImplementation.
+        const storeImpl = (await runtime
+            .query('secrets/store')
+            .withId(desc.id)
+            .resolve());
+        const entries = await storeImpl.list(envName);
+        for (const entry of entries) {
+            aggregated.set(entry.key, {
+                id: entryId(desc.id, entry.key),
+                key: entry.key,
+                source: entry.source,
+                hasValue: entry.hasValue,
+                backend: desc.backend,
+                backendId: desc.id,
+                tier: envTier
+            });
+        }
+    }
+    const secrets = [...aggregated.values()].sort((a, b) => a.key.localeCompare(b.key));
+    return {
+        environment: envName,
+        tier: envTier,
+        secrets,
+        loaded: true,
+        loading: false,
+        error: null,
+        lastUpdated: Date.now()
+    };
+}
+//# sourceMappingURL=list-loading.js.map

package/dist/surfaces/tui/state/list-loading.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-loading.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/list-loading.ts"],"names":[],"mappings":"AACA,OAAO,EACP,+BAA+B,EAK9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAW5E,SAAS,OAAO,CAAC,SAAiB,EAAE,GAAW;IAC9C,OAAO,GAAG,SAAS,KAAK,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CACpB,OAAe,EACf,OAA+B,EAC/B,KAAa;IAEb,OAAO;QACN,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK;QACL,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAC1C,OAAqB;IAErB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAqB;IAErB,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,uEAAuE;QACvE,6DAA6D;QAC7D,OAAO,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAEpC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAErD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,OAAO,YAAY,CAClB,OAAO,EACP,OAAO,EACP,yFAAyF,CACzF,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACzB,KAAK,CAAqD,eAAe,CAAC;SAC1E,WAAW,EAAE,CAAC;IAEhB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtE,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,YAAY,CAClB,OAAO,EACP,OAAO,EACP,kDAAkD,OAAO,GAAG,CAC5D,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,kCAAkC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAC/C,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/B,sFAAsF;QACtF,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO;aAC9B,KAAK,CAAC,eAAe,CAAC;aACtB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;aACf,OAAO,EAAE,CAA+B,CAAC;QAC3C,MAAM,OAAO,GAAkB,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;gBAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,IAAI,EAAE,OAAO;aACb,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAC1B,CAAC;IAEF,OAAO;QACN,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;AACH,CAAC"}

package/dist/surfaces/tui/state/secrets.tui-state.descriptor.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Secrets List - tui/state descriptor
+ *
+ * Holds the descriptor-level secret index for the active environment:
+ * `{ id, key, source, hasValue, backend, tier, lastUpdated }`. This
+ * slice is DESCRIPTORS ONLY - it MUST NEVER carry secret values. The
+ * reveal flow operates outside the state slice: the app impl calls
+ * the secrets/store kind directly and renders the value as a transient
+ * pane region that is wiped on countdown.
+ *
+ * Security contract enforced by type:
+ *   - `SecretDescriptorEntry` has no `value` field.
+ *   - There is no state action that stores a revealed value into state.
+ *
+ * Stem `secrets.tui-state` is feature-prefixed per R3.1 stem-uniqueness.
+ */
+import type { TuiStateDescriptor } from '@vibesdotdev/tui/schemas/tui-state';
+export type { SecretDescriptorEntry, SecretsListState } from './secrets.tui-state.key.ts';
+declare const descriptor: TuiStateDescriptor;
+export default descriptor;
+//# sourceMappingURL=secrets.tui-state.descriptor.d.ts.map

package/dist/surfaces/tui/state/secrets.tui-state.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAG7E,YAAY,EAAE,qBAAqB,EAAC,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAYzF,QAAA,MAAM,UAAU,EAAE,kBAcjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/state/secrets.tui-state.descriptor.js

@@ -0,0 +1,42 @@
+/**
+ * Secrets List - tui/state descriptor
+ *
+ * Holds the descriptor-level secret index for the active environment:
+ * `{ id, key, source, hasValue, backend, tier, lastUpdated }`. This
+ * slice is DESCRIPTORS ONLY - it MUST NEVER carry secret values. The
+ * reveal flow operates outside the state slice: the app impl calls
+ * the secrets/store kind directly and renders the value as a transient
+ * pane region that is wiped on countdown.
+ *
+ * Security contract enforced by type:
+ *   - `SecretDescriptorEntry` has no `value` field.
+ *   - There is no state action that stores a revealed value into state.
+ *
+ * Stem `secrets.tui-state` is feature-prefixed per R3.1 stem-uniqueness.
+ */
+const defaultValue = {
+    environment: 'local',
+    tier: 'local',
+    secrets: [],
+    loaded: false,
+    loading: false,
+    error: null,
+    lastUpdated: null
+};
+const descriptor = {
+    kind: 'tui/state',
+    id: 'secrets.list',
+    /**
+     * Cross-surface operation identity — the same list-descriptors-only
+     * operation `vibes secrets list` (cli/command `secrets.list`,
+     * secrets-cli) performs. Tracked by
+     * `scripts/check-capability-parity.ts`.
+     */
+    capabilityId: 'secrets.list',
+    defaultValue,
+    refreshInterval: 0,
+    persist: false,
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=secrets.tui-state.descriptor.js.map

package/dist/surfaces/tui/state/secrets.tui-state.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.descriptor.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,MAAM,YAAY,GAAqB;IACtC,WAAW,EAAE,OAAO;IACpB,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,IAAI;IACX,WAAW,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,UAAU,GAAuB;IACtC,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,cAAc;IAClB;;;;;OAKG;IACH,YAAY,EAAE,cAAc;IAC5B,YAAY;IACZ,eAAe,EAAE,CAAC;IAClB,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/surfaces/tui/state/secrets.tui-state.impl.consumer.d.ts

@@ -0,0 +1,5 @@
+import type { TuiStateImplementation } from '@vibesdotdev/tui/kinds/tui-state';
+import type { SecretsListState } from './secrets.tui-state.descriptor.ts';
+declare const impl: TuiStateImplementation<SecretsListState>;
+export default impl;
+//# sourceMappingURL=secrets.tui-state.impl.consumer.d.ts.map

package/dist/surfaces/tui/state/secrets.tui-state.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiC,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAkB1E,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAgDlD,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/surfaces/tui/state/secrets.tui-state.impl.consumer.js

@@ -0,0 +1,62 @@
+import { buildSecretsListState } from "./list-loading.js";
+import { secretsListStateKey } from "./secrets.tui-state.key.js";
+// Per-instance scratch keyed by the mount's ctx (handed back to reduce/dispose
+// by the store). Two coexisting instances no longer share - or clobber - one
+// module-level refresh closure.
+const scratch = new WeakMap();
+async function tryBuildSecretsListState(runtime) {
+    try {
+        const data = await buildSecretsListState(runtime);
+        return { ok: true, data };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+const impl = {
+    key: secretsListStateKey,
+    async init(ctx) {
+        // SAFETY: TuiStateContext provides the active runtime for state queries.
+        const runtime = ctx.runtime;
+        // Refresh closure captures `ctx.setState`. Errors surface to
+        // `state.error` - never swallowed, never logged with secret data
+        // (no secret data exists at this layer). Keyed by ctx so a second
+        // instance's dispose never nulls this one's refresh, and a refresh
+        // still in flight after dispose() self-cancels instead of publishing
+        // over a superseded mount's state.
+        const refresh = async () => {
+            if (!scratch.has(ctx))
+                return;
+            const outcome = await tryBuildSecretsListState(runtime);
+            if (!scratch.has(ctx))
+                return;
+            if (outcome.ok) {
+                ctx.setState(() => outcome.data);
+            }
+            else {
+                const message = 'Secret metadata could not be loaded.';
+                ctx.setState((prev) => ({
+                    ...prev,
+                    loaded: true,
+                    loading: false,
+                    error: message,
+                    lastUpdated: Date.now()
+                }));
+            }
+        };
+        scratch.set(ctx, { refresh });
+        return buildSecretsListState(runtime);
+    },
+    reduce(state, action, ctx) {
+        if (action.type === 'REFRESH') {
+            void (ctx ? scratch.get(ctx) : undefined)?.refresh();
+        }
+        return state;
+    },
+    dispose(ctx) {
+        if (ctx)
+            scratch.delete(ctx);
+    }
+};
+export default impl;
+//# sourceMappingURL=secrets.tui-state.impl.consumer.js.map

package/dist/surfaces/tui/state/secrets.tui-state.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.impl.consumer.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.impl.consumer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,+EAA+E;AAC/E,6EAA6E;AAC7E,gCAAgC;AAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuE,CAAC;AAEnG,KAAK,UAAU,wBAAwB,CACtC,OAAqB;IAErB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,IAAI,GAA6C;IACtD,GAAG,EAAE,mBAAmB;IACxB,KAAK,CAAC,IAAI,CAAC,GAAsC;QAChD,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAE5B,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACP,MAAM,OAAO,GAAG,sCAAsC,CAAC;gBACvD,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACvB,GAAG,IAAI;oBACP,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,OAAO;oBACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;iBACvB,CAAC,CAAC,CAAC;YACL,CAAC;QACF,CAAC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9B,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CACL,KAAuB,EACvB,MAAsB,EACtB,GAAuC;QAEvC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAuC;QAC9C,IAAI,GAAG;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;CACD,CAAC;AAEF,eAAe,IAAI,CAAC"}