feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/api-client/src/generated/index.ts

@@ -96,8 +96,11 @@ export type { Project } from './models/Project';
 export type { ProjectID } from './models/ProjectID';
 export { ProjectMember } from './models/ProjectMember';
 export type { ProjectOverview } from './models/ProjectOverview';
+export type { ProjectSecret } from './models/ProjectSecret';
+export type { ProjectSecretListResponse } from './models/ProjectSecretListResponse';
 export type { ProjectSummary } from './models/ProjectSummary';
 export type { ReadinessStatus } from './models/ReadinessStatus';
+export type { RevealProjectSecretResponse } from './models/RevealProjectSecretResponse';
 export type { RybbitMetricItem } from './models/RybbitMetricItem';
 export type { RybbitSite } from './models/RybbitSite';
 export { ScheduledJob } from './models/ScheduledJob';
@@ -106,6 +109,8 @@ export type { ScheduledJobListResponse } from './models/ScheduledJobListResponse
 export { ScheduledJobRun } from './models/ScheduledJobRun';
 export type { ScheduledJobRunListResponse } from './models/ScheduledJobRunListResponse';
 export type { SchemaQuery } from './models/SchemaQuery';
+export type { SecretName } from './models/SecretName';
+export type { SetProjectSecretRequest } from './models/SetProjectSecretRequest';
 export type { TableQuery } from './models/TableQuery';
 export type { TelemetryComponent } from './models/TelemetryComponent';
 export type { TelemetryComponentListResponse } from './models/TelemetryComponentListResponse';
@@ -223,8 +228,11 @@ export { $Project } from './schemas/$Project';
 export { $ProjectID } from './schemas/$ProjectID';
 export { $ProjectMember } from './schemas/$ProjectMember';
 export { $ProjectOverview } from './schemas/$ProjectOverview';
+export { $ProjectSecret } from './schemas/$ProjectSecret';
+export { $ProjectSecretListResponse } from './schemas/$ProjectSecretListResponse';
 export { $ProjectSummary } from './schemas/$ProjectSummary';
 export { $ReadinessStatus } from './schemas/$ReadinessStatus';
+export { $RevealProjectSecretResponse } from './schemas/$RevealProjectSecretResponse';
 export { $RybbitMetricItem } from './schemas/$RybbitMetricItem';
 export { $RybbitSite } from './schemas/$RybbitSite';
 export { $ScheduledJob } from './schemas/$ScheduledJob';
@@ -233,6 +241,8 @@ export { $ScheduledJobListResponse } from './schemas/$ScheduledJobListResponse';
 export { $ScheduledJobRun } from './schemas/$ScheduledJobRun';
 export { $ScheduledJobRunListResponse } from './schemas/$ScheduledJobRunListResponse';
 export { $SchemaQuery } from './schemas/$SchemaQuery';
+export { $SecretName } from './schemas/$SecretName';
+export { $SetProjectSecretRequest } from './schemas/$SetProjectSecretRequest';
 export { $TableQuery } from './schemas/$TableQuery';
 export { $TelemetryComponent } from './schemas/$TelemetryComponent';
 export { $TelemetryComponentListResponse } from './schemas/$TelemetryComponentListResponse';
@@ -270,6 +280,7 @@ export { IntegrationsService } from './services/IntegrationsService';
 export { OrganizationsService } from './services/OrganizationsService';
 export { PlatformService } from './services/PlatformService';
 export { ProjectsService } from './services/ProjectsService';
+export { SecretsService } from './services/SecretsService';
 export { StorageService } from './services/StorageService';
 export { TelemetryService } from './services/TelemetryService';
 export { WebhooksService } from './services/WebhooksService';

packages/api-client/src/generated/models/ProjectSecret.ts

@@ -0,0 +1,16 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type ProjectSecret = {
+    id: string;
+    /**
+     * Env-var-safe name; referenced as secret://NAME in job payloads.
+     */
+    name: string;
+    url: string;
+    notes: string;
+    created_at: string;
+    updated_at: string;
+};
+

packages/api-client/src/generated/models/ProjectSecretListResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { ProjectSecret } from './ProjectSecret';
+export type ProjectSecretListResponse = {
+    items: Array<ProjectSecret>;
+};
+

packages/api-client/src/generated/models/RevealProjectSecretResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type RevealProjectSecretResponse = {
+    name: string;
+    value: string;
+};
+

packages/api-client/src/generated/models/SecretName.ts

@@ -0,0 +1,5 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type SecretName = string;

packages/api-client/src/generated/models/SetProjectSecretRequest.ts

@@ -0,0 +1,13 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type SetProjectSecretRequest = {
+    /**
+     * Plaintext — stored AES-256-GCM encrypted, never returned by list.
+     */
+    value: string;
+    url?: string;
+    notes?: string;
+};
+

packages/api-client/src/generated/schemas/$ProjectSecret.ts

@@ -0,0 +1,36 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $ProjectSecret = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        name: {
+            type: 'string',
+            description: `Env-var-safe name; referenced as secret://NAME in job payloads.`,
+            isRequired: true,
+        },
+        url: {
+            type: 'string',
+            isRequired: true,
+        },
+        notes: {
+            type: 'string',
+            isRequired: true,
+        },
+        created_at: {
+            type: 'string',
+            isRequired: true,
+            format: 'date-time',
+        },
+        updated_at: {
+            type: 'string',
+            isRequired: true,
+            format: 'date-time',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$ProjectSecretListResponse.ts

@@ -0,0 +1,15 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $ProjectSecretListResponse = {
+    properties: {
+        items: {
+            type: 'array',
+            contains: {
+                type: 'ProjectSecret',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$RevealProjectSecretResponse.ts

@@ -0,0 +1,16 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $RevealProjectSecretResponse = {
+    properties: {
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+        value: {
+            type: 'string',
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$SecretName.ts

@@ -0,0 +1,8 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $SecretName = {
+    type: 'string',
+    pattern: '^[A-Za-z_][A-Za-z0-9_]*$',
+} as const;

packages/api-client/src/generated/schemas/$SetProjectSecretRequest.ts

@@ -0,0 +1,19 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $SetProjectSecretRequest = {
+    properties: {
+        value: {
+            type: 'string',
+            description: `Plaintext — stored AES-256-GCM encrypted, never returned by list.`,
+            isRequired: true,
+        },
+        url: {
+            type: 'string',
+        },
+        notes: {
+            type: 'string',
+        },
+    },
+} as const;

packages/api-client/src/generated/services/SecretsService.ts

@@ -0,0 +1,112 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { ProjectSecret } from '../models/ProjectSecret';
+import type { ProjectSecretListResponse } from '../models/ProjectSecretListResponse';
+import type { RevealProjectSecretResponse } from '../models/RevealProjectSecretResponse';
+import type { SetProjectSecretRequest } from '../models/SetProjectSecretRequest';
+import type { CancelablePromise } from '../core/CancelablePromise';
+import { OpenAPI } from '../core/OpenAPI';
+import { request as __request } from '../core/request';
+export class SecretsService {
+    /**
+     * Lists project secrets — metadata only, values are never included.
+     * @returns ProjectSecretListResponse Project secrets (metadata only)
+     * @throws ApiError
+     */
+    public static listProjectSecrets({
+        projectId,
+    }: {
+        projectId: string,
+    }): CancelablePromise<ProjectSecretListResponse> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/projects/{projectID}/secrets',
+            path: {
+                'projectID': projectId,
+            },
+            errors: {
+                401: `Error response`,
+            },
+        });
+    }
+    /**
+     * Creates or replaces a project secret (AES-256-GCM at rest). Omitted url/notes keep existing values. Job payloads can reference it as secret://NAME, resolved at delivery.
+     * @returns ProjectSecret Secret stored
+     * @throws ApiError
+     */
+    public static setProjectSecret({
+        projectId,
+        name,
+        requestBody,
+    }: {
+        projectId: string,
+        name: string,
+        requestBody: SetProjectSecretRequest,
+    }): CancelablePromise<ProjectSecret> {
+        return __request(OpenAPI, {
+            method: 'PUT',
+            url: '/projects/{projectID}/secrets/{name}',
+            path: {
+                'projectID': projectId,
+                'name': name,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                400: `Error response`,
+                401: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns void
+     * @throws ApiError
+     */
+    public static deleteProjectSecret({
+        projectId,
+        name,
+    }: {
+        projectId: string,
+        name: string,
+    }): CancelablePromise<void> {
+        return __request(OpenAPI, {
+            method: 'DELETE',
+            url: '/projects/{projectID}/secrets/{name}',
+            path: {
+                'projectID': projectId,
+                'name': name,
+            },
+            errors: {
+                401: `Error response`,
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Returns the decrypted value. Every call is audit-logged.
+     * @returns RevealProjectSecretResponse Decrypted value
+     * @throws ApiError
+     */
+    public static revealProjectSecret({
+        projectId,
+        name,
+    }: {
+        projectId: string,
+        name: string,
+    }): CancelablePromise<RevealProjectSecretResponse> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/secrets/{name}/reveal',
+            path: {
+                'projectID': projectId,
+                'name': name,
+            },
+            errors: {
+                401: `Error response`,
+                404: `Error response`,
+            },
+        });
+    }
+}