@aexol/spectral 0.9.244 → 0.9.246

package/dist/server/handlers/secrets.js

@@ -0,0 +1,78 @@
+/**
+ * REST handlers for the local secret store.
+ *
+ * Contract (shared with the landing frontend):
+ *  - `GET  /api/secrets`        → `{ secrets: SecretMeta[] }` — metadata only,
+ *                                 values are NEVER returned by anything.
+ *  - `POST /api/secrets`        → `{ secret: SecretMeta }` — body
+ *                                 `{ name, value }`.
+ *  - `DELETE /api/secrets/:name` → `{ ok: true }`.
+ *
+ * Name normalization/validation and the 64 KiB value cap live in
+ * `src/secrets/store.ts`. Errors follow the existing handler error shape
+ * (`BadRequestError`/`NotFoundError` → 400/404 in the relay rest loop).
+ *
+ * SECURITY: no handler here (or anywhere in the relay loop) logs a request or
+ * response value. Only names appear in error messages, and only after they
+ * have passed `normalizeSecretName` (letters/digits/underscores).
+ */
+import { SecretNameError, SecretValueError, deleteSecret, listSecrets, normalizeSecretName, setSecret, } from "../../secrets/index.js";
+import { BadRequestError, NotFoundError } from "./errors.js";
+function toBadRequest(err) {
+    if (err instanceof SecretNameError || err instanceof SecretValueError) {
+        return new BadRequestError(err.message);
+    }
+    return null;
+}
+/**
+ * `GET /api/secrets` — list secrets as metadata only.
+ */
+export function handleListSecrets() {
+    return { secrets: listSecrets() };
+}
+/**
+ * `POST /api/secrets` — create or update a secret. Body: `{ name, value }`.
+ * Returns the metadata-only view; the stored value is never echoed back.
+ */
+export function handleSetSecret(body) {
+    if (typeof body.name !== "string" || body.name.trim() === "") {
+        throw new BadRequestError("name (string) is required");
+    }
+    if (typeof body.value !== "string") {
+        throw new BadRequestError("value (string) is required");
+    }
+    try {
+        const secret = setSecret(body.name, body.value);
+        return { secret };
+    }
+    catch (err) {
+        const mapped = toBadRequest(err);
+        if (mapped)
+            throw mapped;
+        throw err;
+    }
+}
+/**
+ * `DELETE /api/secrets/:name` — delete a secret. Throws `NotFoundError` (404)
+ * when the name is not stored.
+ */
+export function handleDeleteSecret(rawName) {
+    if (typeof rawName !== "string" || rawName.trim() === "") {
+        throw new BadRequestError("name (string) is required");
+    }
+    let name;
+    try {
+        name = normalizeSecretName(rawName);
+    }
+    catch (err) {
+        const mapped = toBadRequest(err);
+        if (mapped)
+            throw mapped;
+        throw err;
+    }
+    const deleted = deleteSecret(name);
+    if (!deleted) {
+        throw new NotFoundError(`Secret ${name} not found`);
+    }
+    return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.244",
+  "version": "0.9.246",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,