@absolutejs/secrets 0.5.3 → 0.6.1

package/dist/manifest.json

@@ -1,5 +1,5 @@
 {
-	"contract": 1,
+	"contract": 2,
 	"identity": {
 		"accent": "#0d9488",
 		"category": "infrastructure",
@@ -186,6 +186,14 @@
 			"annotations": {
 				"readOnlyHint": true
 			},
+			"authorization": {
+				"effects": [
+					"read"
+				],
+				"requiredScopes": [
+					"secrets:inspect"
+				]
+			},
 			"description": "Check whether a named secret is configured. Reports presence and a log-safe sha256 fingerprint — never the value.",
 			"input": {
 				"type": "object",
@@ -205,6 +213,14 @@
 			"annotations": {
 				"readOnlyHint": true
 			},
+			"authorization": {
+				"effects": [
+					"read"
+				],
+				"requiredScopes": [
+					"secrets:redact"
+				]
+			},
 			"description": "Preview redaction: returns the given text with every known (cached) secret replaced by [REDACTED:name]. Useful to check a log line or error message is safe to share. Only secrets the broker has already resolved are scrubbed.",
 			"input": {
 				"type": "object",
@@ -223,6 +239,14 @@
 			"annotations": {
 				"readOnlyHint": true
 			},
+			"authorization": {
+				"effects": [
+					"read"
+				],
+				"requiredScopes": [
+					"secrets:inspect"
+				]
+			},
 			"description": "Cumulative broker counters since the server started: resolves (hits/misses/errors), rotations, and how often redaction actually fired.",
 			"input": {
 				"type": "object",

package/dist/operations.d.ts

@@ -0,0 +1,87 @@
+import { type ActionDecision, type Agency, type AgentActor } from "@absolutejs/agency";
+import type { SecretBroker } from "./index";
+export type CredentialGrant = {
+    agentId: string;
+    allowedOrigins: ReadonlyArray<string>;
+    createdAt: number;
+    expiresAt: number;
+    grantId: string;
+    maximumUses: number;
+    provider: string;
+    scopes: ReadonlyArray<string>;
+    secretName: string;
+    used: number;
+    userId: string;
+};
+export type CredentialOperationInput = {
+    actor: AgentActor;
+    destination: string;
+    grantId: string;
+    idempotencyKey?: string;
+    input?: unknown;
+    operation: string;
+};
+export type CredentialOperationContext = {
+    credential: string;
+    destination: URL;
+    input: unknown;
+    signal?: AbortSignal;
+};
+export type CredentialProvider = {
+    operations: Record<string, (context: CredentialOperationContext) => Promise<unknown> | unknown>;
+    provider: string;
+};
+export type PendingCredentialOperation = {
+    actionId: string;
+    input: CredentialOperationInput;
+};
+export type CredentialGrantStore = {
+    consume: (grantId: string, now: number) => Promise<CredentialGrant | undefined>;
+    get: (grantId: string) => Promise<CredentialGrant | undefined>;
+    getPending: (actionId: string) => Promise<PendingCredentialOperation | undefined>;
+    put: (grant: CredentialGrant) => Promise<void>;
+    putPending: (pending: PendingCredentialOperation) => Promise<void>;
+    revoke: (grantId: string) => Promise<boolean>;
+};
+export type CredentialOperationEvent = {
+    actionId?: string;
+    destinationOrigin: string;
+    grantId: string;
+    operation: string;
+    provider: string;
+    type: "credential.operation.requested";
+} | {
+    actionId?: string;
+    destinationOrigin: string;
+    grantId: string;
+    operation: string;
+    provider: string;
+    resultDigest?: string;
+    status: "failed" | "succeeded";
+    type: "credential.operation.completed";
+};
+export type CredentialOperationResult = {
+    actionId: string;
+    decision: ActionDecision;
+    kind: "pending";
+} | {
+    actionId?: string;
+    kind: "completed";
+    result: unknown;
+    resultDigest: string;
+};
+export type CredentialOperationBrokerOptions = {
+    agency?: Agency;
+    emit?: (event: CredentialOperationEvent) => Promise<void> | void;
+    now?: () => number;
+    providers: ReadonlyArray<CredentialProvider>;
+    secrets: SecretBroker;
+    store: CredentialGrantStore;
+};
+export declare const createMemoryCredentialGrantStore: () => CredentialGrantStore;
+export declare const createCredentialOperationBroker: ({ agency, emit, now, providers, secrets, store, }: CredentialOperationBrokerOptions) => {
+    request: (input: CredentialOperationInput, signal?: AbortSignal) => Promise<CredentialOperationResult>;
+    resume: (actionId: string, signal?: AbortSignal) => Promise<CredentialOperationResult>;
+    revoke: (grantId: string) => Promise<boolean>;
+};
+export type CredentialOperationBroker = ReturnType<typeof createCredentialOperationBroker>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/secrets",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "Host-side secret broker for multi-tenant Bun runtimes. Pluggable adapters (env-var, in-memory, composite, encrypted-file); audit hook per resolve; safe fingerprints for logs; redact() walks known secrets out of arbitrary text before it lands in a log sink.",
   "repository": {
     "type": "git",
@@ -17,7 +17,7 @@
   "license": "BSL-1.1",
   "author": "Alex Kahn",
   "absolutejs": {
-    "manifestContract": 1
+    "manifestContract": 2
   },
   "publishConfig": {
     "access": "public"
@@ -41,7 +41,8 @@
     "release": "bun run format && bun run check:package && bun publish"
   },
   "dependencies": {
-    "@absolutejs/manifest": "^0.1.0",
+    "@absolutejs/agency": "^0.2.0",
+    "@absolutejs/manifest": "^0.2.0",
     "@absolutejs/telemetry": "^0.1.1",
     "@sinclair/typebox": "^0.34.0"
   },