@agent-native/core 0.131.5 → 0.131.7

package/dist/secrets/crypto.js

@@ -10,24 +10,25 @@
  * existing single-app deployments can keep reading and writing secrets while
  * they migrate to the shared key.
  *
- * The default encryption key is derived from
- * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,
- * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app
- * workspace read one app's encrypted production data without replacing the
- * shared local auth secret. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`)
- * typically set none of those literal env vars per app; in that case the
- * shared-key variant falls back further to material derived from the
- * workspace-wide `A2A_SECRET` (see `getWorkspaceA2ADerivedSecret`), so sibling
- * apps in the same workspace still land on the same shared key without any
- * extra configuration. In production we refuse to start without configured
- * key material — a CWD-derived fallback would be effectively static (e.g.
- * `/var/task` on Lambda), so anyone with read access to the DB could decrypt
- * every secret.
+ * The generic encryption key is derived from
+ * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then
+ * `SECRETS_ENCRYPTION_KEY`, then `BETTER_AUTH_SECRET`. Workspace-shared vault
+ * rows use a different precedence: `WORKSPACE_SECRETS_ENCRYPTION_KEY`, then
+ * the legacy shared `SECRETS_ENCRYPTION_KEY`, then material derived from the
+ * workspace-wide `A2A_SECRET`, then the app-local auth/key fallbacks retained
+ * for backward-compatible reads. A previous workspace key can be supplied
+ * during rotation with `WORKSPACE_SECRETS_ENCRYPTION_KEY_PREVIOUS`. This keeps
+ * sibling apps on one stable key even when each app correctly has a different
+ * auth secret, and prevents A2A trust rotation from stranding vault data.
+ *
+ * In production we refuse to start without configured key material — a
+ * CWD-derived fallback would be effectively static (e.g. `/var/task` on
+ * Lambda), so anyone with read access to the DB could decrypt every secret.
  *
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
  */
-import { getWorkspaceA2ADerivedSecret } from "../server/derived-secret.js";
+import { deriveServerSecret, getWorkspaceA2ADerivedSecret, } from "../server/derived-secret.js";
 function getNodeCrypto() {
     if (typeof window !== "undefined" ||
         typeof process === "undefined" ||
@@ -66,15 +67,81 @@ function appScopedEncryptionKey() {
         ? process.env[`${appName}_SECRETS_ENCRYPTION_KEY`] // guard:allow-env-credential — deploy-level app encryption material, never a user credential.
         : undefined;
 }
-function sharedEncryptionKeyMaterial() {
+/**
+ * Preserve the generic/app-local key precedence. Generic encrypted values are
+ * not a cross-app boundary, and changing their preferred key would strand
+ * existing OAuth tokens and credentials.
+ */
+function genericEncryptionKeyMaterial() {
     if (typeof process === "undefined")
         return undefined;
     return (process.env.SECRETS_ENCRYPTION_KEY ||
         process.env.BETTER_AUTH_SECRET ||
         getWorkspaceA2ADerivedSecret("secrets-encryption"));
 }
-function deriveSecretEncryptionKey(explicit, errorMessage, warningMessage) {
+function workspaceSharedEncryptionKeyMaterial() {
+    if (typeof process === "undefined")
+        return undefined;
+    return process.env.WORKSPACE_SECRETS_ENCRYPTION_KEY?.trim() || undefined;
+}
+function previousWorkspaceSharedEncryptionKeyMaterial() {
+    if (typeof process === "undefined")
+        return undefined;
+    return (process.env.WORKSPACE_SECRETS_ENCRYPTION_KEY_PREVIOUS?.trim() || undefined);
+}
+/**
+ * Vault sharing follows configured A2A trust even on independently deployed
+ * sibling apps that are not launched by the workspace wrapper. The wrapper's
+ * `AGENT_NATIVE_WORKSPACE` flag remains required for auth/OAuth-derived
+ * secrets, but it must not be a hidden prerequisite for decrypting vault rows
+ * when every app already has the same explicit `A2A_SECRET`.
+ */
+function a2aSharedEncryptionKeyMaterial() {
+    const workspaceDerived = getWorkspaceA2ADerivedSecret("secrets-encryption");
+    if (workspaceDerived)
+        return workspaceDerived;
+    if (typeof process === "undefined")
+        return undefined;
+    const rootSecret = process.env.A2A_SECRET?.trim();
+    return rootSecret
+        ? deriveServerSecret(rootSecret, "secrets-encryption")
+        : undefined;
+}
+/**
+ * Stable materials that may be used for workspace-shared vault rows, ordered
+ * from current preference to legacy compatibility fallbacks.
+ *
+ * `BETTER_AUTH_SECRET` deliberately comes after the workspace and A2A-derived
+ * materials: sibling apps normally have different auth secrets but share
+ * workspace trust.
+ */
+function sharedEncryptionKeyMaterials() {
+    if (typeof process === "undefined")
+        return [];
+    const candidates = [
+        workspaceSharedEncryptionKeyMaterial(),
+        process.env.SECRETS_ENCRYPTION_KEY,
+        a2aSharedEncryptionKeyMaterial(),
+        previousWorkspaceSharedEncryptionKeyMaterial(),
+        process.env.BETTER_AUTH_SECRET,
+        appScopedEncryptionKey(),
+    ].filter((value) => Boolean(value));
+    return [...new Set(candidates)];
+}
+function preferredSharedEncryptionKeyMaterial() {
+    if (typeof process === "undefined")
+        return undefined;
+    return (workspaceSharedEncryptionKeyMaterial() ||
+        process.env.SECRETS_ENCRYPTION_KEY ||
+        a2aSharedEncryptionKeyMaterial() ||
+        process.env.BETTER_AUTH_SECRET ||
+        appScopedEncryptionKey());
+}
+function hashSecretEncryptionKey(material) {
     const { createHash } = requireNodeCrypto();
+    return createHash("sha256").update(material).digest();
+}
+function deriveSecretEncryptionKey(explicit, errorMessage, warningMessage) {
     if (!explicit) {
         if (processNodeEnv() === "production") {
             throw new Error(errorMessage);
@@ -86,7 +153,7 @@ function deriveSecretEncryptionKey(explicit, errorMessage, warningMessage) {
         }
     }
     const material = explicit || `agent-native-secrets:${processCwd()}`;
-    return createHash("sha256").update(material).digest();
+    return hashSecretEncryptionKey(material);
 }
 /**
  * Derive the key used by generic encrypted values such as credentials and
@@ -100,7 +167,7 @@ export function getSecretEncryptionKey() {
             .toUpperCase()
             .replace(/[^A-Z0-9]+/g, "_")
             .replace(/^_+|_+$/g, "");
-    return deriveSecretEncryptionKey(appScopedEncryptionKey() || sharedEncryptionKeyMaterial(), "[agent-native/secrets] Refusing to start in production without an encryption key. " +
+    return deriveSecretEncryptionKey(appScopedEncryptionKey() || genericEncryptionKeyMaterial(), "[agent-native/secrets] Refusing to start in production without an encryption key. " +
         `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
         "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
         "which means anyone with read access to the DB could decrypt every secret.", "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
@@ -109,25 +176,30 @@ export function getSecretEncryptionKey() {
 }
 /**
  * Derive the preferred workspace-shared key used by `app_secrets` rows.
- * Unlike generic column-level encryption, workspace vault data should decrypt
- * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take
- * precedence. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`) that set
- * neither literal var still get stable shared material derived from the
- * workspace-wide `A2A_SECRET` before falling further back. The app-scoped key
- * remains a compatibility fallback for deployments that have not configured
- * shared material yet; once the shared key is configured, writes use it and
- * reads still fall back to old rows.
+ * Unlike generic column-level encryption, workspace vault data must decrypt
+ * in sibling apps. An explicit `WORKSPACE_SECRETS_ENCRYPTION_KEY` wins without
+ * changing the key for app-local OAuth and credential ciphertext. The legacy
+ * shared `SECRETS_ENCRYPTION_KEY` remains supported; hosted workspaces
+ * otherwise derive material from their shared `A2A_SECRET` before considering
+ * app-local `BETTER_AUTH_SECRET` or app-scoped key fallbacks. Reads try every
+ * configured legacy/previous candidate and report when the ciphertext should
+ * be refreshed under the preferred key.
  */
 export function getSharedSecretEncryptionKey() {
-    return deriveSecretEncryptionKey(sharedEncryptionKeyMaterial() || appScopedEncryptionKey(), "[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. " +
-        "Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment " +
-        "— or, on a hosted workspace deploy, ensure A2A_SECRET is set so shared material can be derived from it.", "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using app-scoped or machine-local fallback for workspace secrets. " +
-        "Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows, " +
-        "or rely on A2A_SECRET-derived material on hosted workspace deploys.");
+    return deriveSecretEncryptionKey(preferredSharedEncryptionKeyMaterial(), "[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. " +
+        "Set WORKSPACE_SECRETS_ENCRYPTION_KEY (preferred), SECRETS_ENCRYPTION_KEY, ensure a hosted workspace has A2A_SECRET, " +
+        "or set BETTER_AUTH_SECRET / an app-scoped " +
+        "*_SECRETS_ENCRYPTION_KEY compatibility fallback in the deploy environment.", "[agent-native/secrets] Workspace encryption key not set — using app-scoped or machine-local fallback for workspace secrets. " +
+        "Set WORKSPACE_SECRETS_ENCRYPTION_KEY or rely on A2A_SECRET-derived material on hosted workspace deploys so sibling apps share vault rows.");
 }
 /** Whether this deployment has stable workspace-shared key material. */
 export function hasSharedSecretEncryptionKeyMaterial() {
-    return Boolean(sharedEncryptionKeyMaterial());
+    if (typeof process === "undefined")
+        return false;
+    return Boolean(workspaceSharedEncryptionKeyMaterial() ||
+        process.env.SECRETS_ENCRYPTION_KEY ||
+        a2aSharedEncryptionKeyMaterial() ||
+        process.env.BETTER_AUTH_SECRET);
 }
 function encryptWithKey(plaintext, key) {
     const { createCipheriv, randomBytes } = requireNodeCrypto();
@@ -168,7 +240,36 @@ export function encryptSharedSecretValue(plaintext) {
 }
 /** Decrypt a workspace-shared `app_secrets` value. */
 export function decryptSharedSecretValue(encrypted) {
-    return decryptWithKey(encrypted, getSharedSecretEncryptionKey());
+    return decryptSharedSecretValueDetailed(encrypted).value;
+}
+/**
+ * Decrypt workspace ciphertext with the preferred key first, then configured
+ * legacy candidates. The result never exposes which secret material matched.
+ */
+export function decryptSharedSecretValueDetailed(encrypted) {
+    const preferredKey = getSharedSecretEncryptionKey();
+    const candidateKeys = [preferredKey];
+    for (const material of sharedEncryptionKeyMaterials()) {
+        const candidate = hashSecretEncryptionKey(material);
+        if (!candidateKeys.some((existing) => existing.equals(candidate))) {
+            candidateKeys.push(candidate);
+        }
+    }
+    let lastError;
+    for (const candidate of candidateKeys) {
+        try {
+            return {
+                value: decryptWithKey(encrypted, candidate),
+                needsReencrypt: !candidate.equals(preferredKey),
+            };
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error("Unable to decrypt workspace secret");
 }
 /**
  * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by

package/dist/secrets/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/secrets/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAI3E,SAAS,aAAa;IACpB,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAEhC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;AAEnC,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,iBAAiB;IACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,iGAAiG;SAC3I,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,OAAO;QACZ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,yBAAyB,CAAC,CAAC,8FAA8F;QACjJ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,oBAAoB,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA4B,EAC5B,YAAoB,EACpB,cAAsB;IAEtB,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,cAAc,EAAE,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,UAAU,EAAE,EAAE,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,iGAAiG;aAC3H,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,yBAAyB,CAC9B,sBAAsB,EAAE,IAAI,2BAA2B,EAAE,EACzD,oFAAoF;QAClF,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,2BAA2B,CAAC,CAAC,CAAC,EAAE,2EAA2E;QACtI,yFAAyF;QACzF,2EAA2E,EAC7E,0FAA0F;QACxF,4GAA4G;QAC5G,iEAAiE,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,yBAAyB,CAC9B,2BAA2B,EAAE,IAAI,sBAAsB,EAAE,EACzD,gHAAgH;QAC9G,uHAAuH;QACvH,yGAAyG,EAC3G,4HAA4H;QAC1H,4GAA4G;QAC5G,qEAAqE,CACxE,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oCAAoC;IAClD,OAAO,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,cAAc,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,cAAc,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,cAAc,CAAC,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,cAAc,CAAC,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC","sourcesContent":["/**\n * Shared AES-256-GCM encryption for secret values at rest.\n *\n * Used by the framework secrets vault, per-user/per-org credentials\n * (`resolveCredential` / `saveCredential`, stored in `settings`), and other\n * column-level encrypted values. The `app_secrets` storage layer uses the\n * shared-key variant below because workspace-scoped vault rows are readable by\n * sibling apps in the same workspace. When a deployment has not been given\n * shared key material yet, that variant falls back to the app-scoped key so\n * existing single-app deployments can keep reading and writing secrets while\n * they migrate to the shared key.\n *\n * The default encryption key is derived from\n * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,\n * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app\n * workspace read one app's encrypted production data without replacing the\n * shared local auth secret. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`)\n * typically set none of those literal env vars per app; in that case the\n * shared-key variant falls back further to material derived from the\n * workspace-wide `A2A_SECRET` (see `getWorkspaceA2ADerivedSecret`), so sibling\n * apps in the same workspace still land on the same shared key without any\n * extra configuration. In production we refuse to start without configured\n * key material — a CWD-derived fallback would be effectively static (e.g.\n * `/var/task` on Lambda), so anyone with read access to the DB could decrypt\n * every secret.\n *\n * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix\n * lets readers distinguish ciphertext from legacy plaintext during migration.\n */\n\nimport { getWorkspaceA2ADerivedSecret } from \"../server/derived-secret.js\";\n\ntype NodeCryptoModule = typeof import(\"node:crypto\");\n\nfunction getNodeCrypto(): NodeCryptoModule | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:crypto\") as\n    | NodeCryptoModule\n    | undefined;\n}\n\nconst nodeCrypto = getNodeCrypto();\n\nlet _warnedFallback = false;\n\nfunction requireNodeCrypto(): NonNullable<typeof nodeCrypto> {\n  if (!nodeCrypto) {\n    throw new Error(\n      \"[agent-native/secrets] Secret encryption is only available in server/runtime code.\",\n    );\n  }\n  return nodeCrypto;\n}\n\nfunction processNodeEnv(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env.NODE_ENV;\n}\n\nfunction processCwd(): string {\n  if (typeof process === \"undefined\") return \".\";\n  return process.cwd();\n}\n\nfunction appScopedEncryptionKey(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const appName = process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.\n    .toUpperCase()\n    .replace(/[^A-Z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return appName\n    ? process.env[`${appName}_SECRETS_ENCRYPTION_KEY`] // guard:allow-env-credential — deploy-level app encryption material, never a user credential.\n    : undefined;\n}\n\nfunction sharedEncryptionKeyMaterial(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return (\n    process.env.SECRETS_ENCRYPTION_KEY ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"secrets-encryption\")\n  );\n}\n\nfunction deriveSecretEncryptionKey(\n  explicit: string | undefined,\n  errorMessage: string,\n  warningMessage: string,\n): Buffer {\n  const { createHash } = requireNodeCrypto();\n\n  if (!explicit) {\n    if (processNodeEnv() === \"production\") {\n      throw new Error(errorMessage);\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(warningMessage);\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${processCwd()}`;\n  return createHash(\"sha256\").update(material).digest();\n}\n\n/**\n * Derive the key used by generic encrypted values such as credentials and\n * OAuth tokens. App-specific key material is allowed for these app-local\n * values.\n */\nexport function getSecretEncryptionKey(): Buffer {\n  const appName =\n    typeof process === \"undefined\"\n      ? undefined\n      : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.\n          .toUpperCase()\n          .replace(/[^A-Z0-9]+/g, \"_\")\n          .replace(/^_+|_+$/g, \"\");\n  return deriveSecretEncryptionKey(\n    appScopedEncryptionKey() || sharedEncryptionKeyMaterial(),\n    \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n      `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : \"\"}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +\n      \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n      \"which means anyone with read access to the DB could decrypt every secret.\",\n    \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n      \"Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. \" +\n      \"Production deploys without one of these env vars now hard-fail.\",\n  );\n}\n\n/**\n * Derive the preferred workspace-shared key used by `app_secrets` rows.\n * Unlike generic column-level encryption, workspace vault data should decrypt\n * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take\n * precedence. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`) that set\n * neither literal var still get stable shared material derived from the\n * workspace-wide `A2A_SECRET` before falling further back. The app-scoped key\n * remains a compatibility fallback for deployments that have not configured\n * shared material yet; once the shared key is configured, writes use it and\n * reads still fall back to old rows.\n */\nexport function getSharedSecretEncryptionKey(): Buffer {\n  return deriveSecretEncryptionKey(\n    sharedEncryptionKeyMaterial() || appScopedEncryptionKey(),\n    \"[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. \" +\n      \"Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment \" +\n      \"— or, on a hosted workspace deploy, ensure A2A_SECRET is set so shared material can be derived from it.\",\n    \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using app-scoped or machine-local fallback for workspace secrets. \" +\n      \"Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows, \" +\n      \"or rely on A2A_SECRET-derived material on hosted workspace deploys.\",\n  );\n}\n\n/** Whether this deployment has stable workspace-shared key material. */\nexport function hasSharedSecretEncryptionKeyMaterial(): boolean {\n  return Boolean(sharedEncryptionKeyMaterial());\n}\n\nfunction encryptWithKey(plaintext: string, key: Buffer): string {\n  const { createCipheriv, randomBytes } = requireNodeCrypto();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\nfunction decryptWithKey(encrypted: string, key: Buffer): string {\n  const { createDecipheriv } = requireNodeCrypto();\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/** Encrypt a plain-text value with the generic app-local key. */\nexport function encryptSecretValue(plaintext: string): string {\n  return encryptWithKey(plaintext, getSecretEncryptionKey());\n}\n\n/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */\nexport function decryptSecretValue(encrypted: string): string {\n  return decryptWithKey(encrypted, getSecretEncryptionKey());\n}\n\n/** Encrypt a workspace-shared `app_secrets` value. */\nexport function encryptSharedSecretValue(plaintext: string): string {\n  return encryptWithKey(plaintext, getSharedSecretEncryptionKey());\n}\n\n/** Decrypt a workspace-shared `app_secrets` value. */\nexport function decryptSharedSecretValue(encrypted: string): string {\n  return decryptWithKey(encrypted, getSharedSecretEncryptionKey());\n}\n\n/**\n * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by\n * three hex segments. Intentionally strict so a legacy plaintext credential\n * that merely happens to start with `v1:` is treated as plaintext (and read via\n * the legacy fallback) rather than mis-decrypted.\n */\nconst ENCRYPTED_VALUE_RE = /^v1:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/;\n\nexport function isEncryptedSecretValue(value: unknown): value is string {\n  return typeof value === \"string\" && ENCRYPTED_VALUE_RE.test(value);\n}\n"]}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/secrets/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAIrC,SAAS,aAAa;IACpB,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAEhC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;AAEnC,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,iBAAiB;IACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,iGAAiG;SAC3I,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,OAAO;QACZ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,yBAAyB,CAAC,CAAC,8FAA8F;QACjJ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,oBAAoB,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC;IAC3C,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,4CAA4C;IACnD,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE,IAAI,EAAE,IAAI,SAAS,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,8BAA8B;IACrC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IAC5E,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,OAAO,UAAU;QACf,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,oBAAoB,CAAC;QACtD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B;IACnC,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG;QACjB,oCAAoC,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,8BAA8B,EAAE;QAChC,4CAA4C,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,sBAAsB,EAAE;KACzB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oCAAoC;IAC3C,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,CACL,oCAAoC,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,8BAA8B,EAAE;QAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,sBAAsB,EAAE,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA4B,EAC5B,YAAoB,EACpB,cAAsB;IAEtB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,cAAc,EAAE,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,UAAU,EAAE,EAAE,CAAC;IACpE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,iGAAiG;aAC3H,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,yBAAyB,CAC9B,sBAAsB,EAAE,IAAI,4BAA4B,EAAE,EAC1D,oFAAoF;QAClF,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,2BAA2B,CAAC,CAAC,CAAC,EAAE,2EAA2E;QACtI,yFAAyF;QACzF,2EAA2E,EAC7E,0FAA0F;QACxF,4GAA4G;QAC5G,iEAAiE,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,yBAAyB,CAC9B,oCAAoC,EAAE,EACtC,gHAAgH;QAC9G,sHAAsH;QACtH,4CAA4C;QAC5C,4EAA4E,EAC9E,8HAA8H;QAC5H,2IAA2I,CAC9I,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oCAAoC;IAClD,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,OAAO,CACZ,oCAAoC,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,8BAA8B,EAAE;QAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,cAAc,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,cAAc,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,cAAc,CAAC,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,gCAAgC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC;AAC3D,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAiB;IAEjB,MAAM,YAAY,GAAG,4BAA4B,EAAE,CAAC;IACpD,MAAM,aAAa,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,4BAA4B,EAAE,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC;gBAC3C,cAAc,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;aAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,YAAY,KAAK;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC","sourcesContent":["/**\n * Shared AES-256-GCM encryption for secret values at rest.\n *\n * Used by the framework secrets vault, per-user/per-org credentials\n * (`resolveCredential` / `saveCredential`, stored in `settings`), and other\n * column-level encrypted values. The `app_secrets` storage layer uses the\n * shared-key variant below because workspace-scoped vault rows are readable by\n * sibling apps in the same workspace. When a deployment has not been given\n * shared key material yet, that variant falls back to the app-scoped key so\n * existing single-app deployments can keep reading and writing secrets while\n * they migrate to the shared key.\n *\n * The generic encryption key is derived from\n * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then\n * `SECRETS_ENCRYPTION_KEY`, then `BETTER_AUTH_SECRET`. Workspace-shared vault\n * rows use a different precedence: `WORKSPACE_SECRETS_ENCRYPTION_KEY`, then\n * the legacy shared `SECRETS_ENCRYPTION_KEY`, then material derived from the\n * workspace-wide `A2A_SECRET`, then the app-local auth/key fallbacks retained\n * for backward-compatible reads. A previous workspace key can be supplied\n * during rotation with `WORKSPACE_SECRETS_ENCRYPTION_KEY_PREVIOUS`. This keeps\n * sibling apps on one stable key even when each app correctly has a different\n * auth secret, and prevents A2A trust rotation from stranding vault data.\n *\n * In production we refuse to start without configured key material — a\n * CWD-derived fallback would be effectively static (e.g. `/var/task` on\n * Lambda), so anyone with read access to the DB could decrypt every secret.\n *\n * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix\n * lets readers distinguish ciphertext from legacy plaintext during migration.\n */\n\nimport {\n  deriveServerSecret,\n  getWorkspaceA2ADerivedSecret,\n} from \"../server/derived-secret.js\";\n\ntype NodeCryptoModule = typeof import(\"node:crypto\");\n\nfunction getNodeCrypto(): NodeCryptoModule | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:crypto\") as\n    | NodeCryptoModule\n    | undefined;\n}\n\nconst nodeCrypto = getNodeCrypto();\n\nlet _warnedFallback = false;\n\nfunction requireNodeCrypto(): NonNullable<typeof nodeCrypto> {\n  if (!nodeCrypto) {\n    throw new Error(\n      \"[agent-native/secrets] Secret encryption is only available in server/runtime code.\",\n    );\n  }\n  return nodeCrypto;\n}\n\nfunction processNodeEnv(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env.NODE_ENV;\n}\n\nfunction processCwd(): string {\n  if (typeof process === \"undefined\") return \".\";\n  return process.cwd();\n}\n\nfunction appScopedEncryptionKey(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  const appName = process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.\n    .toUpperCase()\n    .replace(/[^A-Z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return appName\n    ? process.env[`${appName}_SECRETS_ENCRYPTION_KEY`] // guard:allow-env-credential — deploy-level app encryption material, never a user credential.\n    : undefined;\n}\n\n/**\n * Preserve the generic/app-local key precedence. Generic encrypted values are\n * not a cross-app boundary, and changing their preferred key would strand\n * existing OAuth tokens and credentials.\n */\nfunction genericEncryptionKeyMaterial(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return (\n    process.env.SECRETS_ENCRYPTION_KEY ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"secrets-encryption\")\n  );\n}\n\nfunction workspaceSharedEncryptionKeyMaterial(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env.WORKSPACE_SECRETS_ENCRYPTION_KEY?.trim() || undefined;\n}\n\nfunction previousWorkspaceSharedEncryptionKeyMaterial(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return (\n    process.env.WORKSPACE_SECRETS_ENCRYPTION_KEY_PREVIOUS?.trim() || undefined\n  );\n}\n\n/**\n * Vault sharing follows configured A2A trust even on independently deployed\n * sibling apps that are not launched by the workspace wrapper. The wrapper's\n * `AGENT_NATIVE_WORKSPACE` flag remains required for auth/OAuth-derived\n * secrets, but it must not be a hidden prerequisite for decrypting vault rows\n * when every app already has the same explicit `A2A_SECRET`.\n */\nfunction a2aSharedEncryptionKeyMaterial(): string | undefined {\n  const workspaceDerived = getWorkspaceA2ADerivedSecret(\"secrets-encryption\");\n  if (workspaceDerived) return workspaceDerived;\n  if (typeof process === \"undefined\") return undefined;\n  const rootSecret = process.env.A2A_SECRET?.trim();\n  return rootSecret\n    ? deriveServerSecret(rootSecret, \"secrets-encryption\")\n    : undefined;\n}\n\n/**\n * Stable materials that may be used for workspace-shared vault rows, ordered\n * from current preference to legacy compatibility fallbacks.\n *\n * `BETTER_AUTH_SECRET` deliberately comes after the workspace and A2A-derived\n * materials: sibling apps normally have different auth secrets but share\n * workspace trust.\n */\nfunction sharedEncryptionKeyMaterials(): string[] {\n  if (typeof process === \"undefined\") return [];\n  const candidates = [\n    workspaceSharedEncryptionKeyMaterial(),\n    process.env.SECRETS_ENCRYPTION_KEY,\n    a2aSharedEncryptionKeyMaterial(),\n    previousWorkspaceSharedEncryptionKeyMaterial(),\n    process.env.BETTER_AUTH_SECRET,\n    appScopedEncryptionKey(),\n  ].filter((value): value is string => Boolean(value));\n  return [...new Set(candidates)];\n}\n\nfunction preferredSharedEncryptionKeyMaterial(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return (\n    workspaceSharedEncryptionKeyMaterial() ||\n    process.env.SECRETS_ENCRYPTION_KEY ||\n    a2aSharedEncryptionKeyMaterial() ||\n    process.env.BETTER_AUTH_SECRET ||\n    appScopedEncryptionKey()\n  );\n}\n\nfunction hashSecretEncryptionKey(material: string): Buffer {\n  const { createHash } = requireNodeCrypto();\n  return createHash(\"sha256\").update(material).digest();\n}\n\nfunction deriveSecretEncryptionKey(\n  explicit: string | undefined,\n  errorMessage: string,\n  warningMessage: string,\n): Buffer {\n  if (!explicit) {\n    if (processNodeEnv() === \"production\") {\n      throw new Error(errorMessage);\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(warningMessage);\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${processCwd()}`;\n  return hashSecretEncryptionKey(material);\n}\n\n/**\n * Derive the key used by generic encrypted values such as credentials and\n * OAuth tokens. App-specific key material is allowed for these app-local\n * values.\n */\nexport function getSecretEncryptionKey(): Buffer {\n  const appName =\n    typeof process === \"undefined\"\n      ? undefined\n      : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.\n          .toUpperCase()\n          .replace(/[^A-Z0-9]+/g, \"_\")\n          .replace(/^_+|_+$/g, \"\");\n  return deriveSecretEncryptionKey(\n    appScopedEncryptionKey() || genericEncryptionKeyMaterial(),\n    \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n      `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : \"\"}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +\n      \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n      \"which means anyone with read access to the DB could decrypt every secret.\",\n    \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n      \"Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. \" +\n      \"Production deploys without one of these env vars now hard-fail.\",\n  );\n}\n\n/**\n * Derive the preferred workspace-shared key used by `app_secrets` rows.\n * Unlike generic column-level encryption, workspace vault data must decrypt\n * in sibling apps. An explicit `WORKSPACE_SECRETS_ENCRYPTION_KEY` wins without\n * changing the key for app-local OAuth and credential ciphertext. The legacy\n * shared `SECRETS_ENCRYPTION_KEY` remains supported; hosted workspaces\n * otherwise derive material from their shared `A2A_SECRET` before considering\n * app-local `BETTER_AUTH_SECRET` or app-scoped key fallbacks. Reads try every\n * configured legacy/previous candidate and report when the ciphertext should\n * be refreshed under the preferred key.\n */\nexport function getSharedSecretEncryptionKey(): Buffer {\n  return deriveSecretEncryptionKey(\n    preferredSharedEncryptionKeyMaterial(),\n    \"[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. \" +\n      \"Set WORKSPACE_SECRETS_ENCRYPTION_KEY (preferred), SECRETS_ENCRYPTION_KEY, ensure a hosted workspace has A2A_SECRET, \" +\n      \"or set BETTER_AUTH_SECRET / an app-scoped \" +\n      \"*_SECRETS_ENCRYPTION_KEY compatibility fallback in the deploy environment.\",\n    \"[agent-native/secrets] Workspace encryption key not set — using app-scoped or machine-local fallback for workspace secrets. \" +\n      \"Set WORKSPACE_SECRETS_ENCRYPTION_KEY or rely on A2A_SECRET-derived material on hosted workspace deploys so sibling apps share vault rows.\",\n  );\n}\n\n/** Whether this deployment has stable workspace-shared key material. */\nexport function hasSharedSecretEncryptionKeyMaterial(): boolean {\n  if (typeof process === \"undefined\") return false;\n  return Boolean(\n    workspaceSharedEncryptionKeyMaterial() ||\n    process.env.SECRETS_ENCRYPTION_KEY ||\n    a2aSharedEncryptionKeyMaterial() ||\n    process.env.BETTER_AUTH_SECRET,\n  );\n}\n\nfunction encryptWithKey(plaintext: string, key: Buffer): string {\n  const { createCipheriv, randomBytes } = requireNodeCrypto();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\nfunction decryptWithKey(encrypted: string, key: Buffer): string {\n  const { createDecipheriv } = requireNodeCrypto();\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/** Encrypt a plain-text value with the generic app-local key. */\nexport function encryptSecretValue(plaintext: string): string {\n  return encryptWithKey(plaintext, getSecretEncryptionKey());\n}\n\n/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */\nexport function decryptSecretValue(encrypted: string): string {\n  return decryptWithKey(encrypted, getSecretEncryptionKey());\n}\n\n/** Encrypt a workspace-shared `app_secrets` value. */\nexport function encryptSharedSecretValue(plaintext: string): string {\n  return encryptWithKey(plaintext, getSharedSecretEncryptionKey());\n}\n\n/** Decrypt a workspace-shared `app_secrets` value. */\nexport function decryptSharedSecretValue(encrypted: string): string {\n  return decryptSharedSecretValueDetailed(encrypted).value;\n}\n\nexport interface DecryptedSharedSecretValue {\n  value: string;\n  /**\n   * True when a legacy app-local candidate decrypted the value. Callers that\n   * own the row should opportunistically re-encrypt it with the preferred\n   * workspace key.\n   */\n  needsReencrypt: boolean;\n}\n\n/**\n * Decrypt workspace ciphertext with the preferred key first, then configured\n * legacy candidates. The result never exposes which secret material matched.\n */\nexport function decryptSharedSecretValueDetailed(\n  encrypted: string,\n): DecryptedSharedSecretValue {\n  const preferredKey = getSharedSecretEncryptionKey();\n  const candidateKeys = [preferredKey];\n  for (const material of sharedEncryptionKeyMaterials()) {\n    const candidate = hashSecretEncryptionKey(material);\n    if (!candidateKeys.some((existing) => existing.equals(candidate))) {\n      candidateKeys.push(candidate);\n    }\n  }\n\n  let lastError: unknown;\n  for (const candidate of candidateKeys) {\n    try {\n      return {\n        value: decryptWithKey(encrypted, candidate),\n        needsReencrypt: !candidate.equals(preferredKey),\n      };\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  throw lastError instanceof Error\n    ? lastError\n    : new Error(\"Unable to decrypt workspace secret\");\n}\n\n/**\n * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by\n * three hex segments. Intentionally strict so a legacy plaintext credential\n * that merely happens to start with `v1:` is treated as plaintext (and read via\n * the legacy fallback) rather than mis-decrypted.\n */\nconst ENCRYPTED_VALUE_RE = /^v1:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/;\n\nexport function isEncryptedSecretValue(value: unknown): value is string {\n  return typeof value === \"string\" && ENCRYPTED_VALUE_RE.test(value);\n}\n"]}

package/dist/secrets/storage.d.ts

@@ -2,12 +2,12 @@
  * Storage layer for the framework secrets registry.
  *
  * Values are encrypted at rest with AES-256-GCM. The workspace-shared
- * encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the
- * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a
- * second secret during development). Deployments that only have the legacy
- * app-scoped key continue to work until shared key material is configured;
- * once configured, new rows use the shared key and reads retain a legacy-key
- * fallback for existing rows.
+ * encryption key prefers `WORKSPACE_SECRETS_ENCRYPTION_KEY`, then the legacy
+ * combined `SECRETS_ENCRYPTION_KEY`, then the workspace-wide `A2A_SECRET`.
+ * A configured previous workspace key, `BETTER_AUTH_SECRET`, and app-scoped
+ * keys remain read fallbacks for rows written before sibling apps converged on
+ * the shared key. Successful fallback reads race-safely refresh the shared
+ * ciphertext.
  *
  * Secret values are NEVER logged and NEVER returned from any route handler.
  */

package/dist/secrets/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+FjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAoF3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AA8GD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0BlC;AAED,wEAAwE;AACxE,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAgCzC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAkC5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CAmCvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+FjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAmID;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8BlC;AAED,wEAAwE;AACxE,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAoCzC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsC5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CAuCvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}

package/dist/secrets/storage.js

@@ -2,19 +2,19 @@
  * Storage layer for the framework secrets registry.
  *
  * Values are encrypted at rest with AES-256-GCM. The workspace-shared
- * encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the
- * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a
- * second secret during development). Deployments that only have the legacy
- * app-scoped key continue to work until shared key material is configured;
- * once configured, new rows use the shared key and reads retain a legacy-key
- * fallback for existing rows.
+ * encryption key prefers `WORKSPACE_SECRETS_ENCRYPTION_KEY`, then the legacy
+ * combined `SECRETS_ENCRYPTION_KEY`, then the workspace-wide `A2A_SECRET`.
+ * A configured previous workspace key, `BETTER_AUTH_SECRET`, and app-scoped
+ * keys remain read fallbacks for rows written before sibling apps converged on
+ * the shared key. Successful fallback reads race-safely refresh the shared
+ * ciphertext.
  *
  * Secret values are NEVER logged and NEVER returned from any route handler.
  */
 import { randomUUID } from "node:crypto";
 import { getDbExec, isPostgres } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
-import { encryptSecretValue as encryptLegacyValue, encryptSharedSecretValue as encryptValue, decryptSharedSecretValue as decryptValue, decryptSecretValue as decryptLegacyValue, hasSharedSecretEncryptionKeyMaterial, } from "./crypto.js";
+import { encryptSecretValue as encryptLegacyValue, encryptSharedSecretValue as encryptValue, decryptSharedSecretValueDetailed as decryptValue, decryptSecretValue as decryptLegacyValue, hasSharedSecretEncryptionKeyMaterial, } from "./crypto.js";
 import { APP_SECRETS_CREATE_SQL } from "./schema.js";
 // ---------------------------------------------------------------------------
 // Table bootstrap
@@ -139,8 +139,9 @@ export async function writeAppSecret(args) {
     // pointing at data that's no longer current. Siblings then get an honest
     // cache miss (falling back to the legacy column or reporting missing) until
     // the owning app's next read repopulates shared_encrypted_value via
-    // `populateSharedAppSecret`, which only ever fills a NULL column. A
-    // temporary miss is safer than serving rotated-away plaintext.
+    // `populateSharedAppSecret`, which fills a NULL column or compare-and-swap
+    // replaces the exact legacy ciphertext it just decrypted. A temporary miss
+    // is safer than serving rotated-away plaintext.
     const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, shared_encrypted_value, description, url_allowlist, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (scope, scope_id, key) DO UPDATE SET
@@ -183,10 +184,14 @@ export async function writeAppSecret(args) {
 function decryptAppSecretValue(encrypted, sharedEncrypted) {
     if (sharedEncrypted) {
         try {
+            const decrypted = decryptValue(sharedEncrypted);
             return {
-                value: decryptValue(sharedEncrypted),
+                value: decrypted.value,
                 usedLegacyKey: false,
-                needsSharedCiphertext: false,
+                needsSharedCiphertext: decrypted.needsReencrypt,
+                sharedCiphertextToReplace: decrypted.needsReencrypt
+                    ? sharedEncrypted
+                    : undefined,
             };
         }
         catch {
@@ -195,10 +200,12 @@ function decryptAppSecretValue(encrypted, sharedEncrypted) {
         }
     }
     try {
+        const decrypted = decryptValue(encrypted);
         return {
-            value: decryptValue(encrypted),
+            value: decrypted.value,
             usedLegacyKey: false,
             needsSharedCiphertext: true,
+            sharedCiphertextToReplace: sharedEncrypted ?? null,
         };
     }
     catch {
@@ -206,27 +213,37 @@ function decryptAppSecretValue(encrypted, sharedEncrypted) {
             value: decryptLegacyValue(encrypted),
             usedLegacyKey: true,
             needsSharedCiphertext: true,
+            sharedCiphertextToReplace: sharedEncrypted ?? null,
         };
     }
 }
 /**
- * Populate the shared column without touching encrypted_value. This is
- * intentionally best-effort: a read must still succeed if a deployment's DB
- * role cannot update the row. The NULL predicate prevents a concurrent writer
- * from overwriting newly-populated shared ciphertext, and leaving updated_at
- * untouched preserves the row's user-visible ordering/metadata.
+ * Create or refresh the shared column without touching encrypted_value. This
+ * is intentionally best-effort: a read must still succeed if a deployment's
+ * DB role cannot update the row. The compare-and-swap predicate prevents a
+ * concurrent writer from being overwritten, and leaving updated_at untouched
+ * preserves the row's user-visible ordering/metadata.
  */
-async function populateSharedAppSecret(id, value) {
+async function populateSharedAppSecret(id, value, sharedCiphertextToReplace) {
     if (id === undefined ||
         id === null ||
         !hasSharedSecretEncryptionKeyMaterial()) {
         return;
     }
     try {
-        await getDbExec().execute({
-            sql: `UPDATE app_secrets SET shared_encrypted_value = ? WHERE id = ? AND shared_encrypted_value IS NULL`,
-            args: [encryptValue(value), id],
-        });
+        const encrypted = encryptValue(value);
+        if (sharedCiphertextToReplace === null) {
+            await getDbExec().execute({
+                sql: `UPDATE app_secrets SET shared_encrypted_value = ? WHERE id = ? AND shared_encrypted_value IS NULL`,
+                args: [encrypted, id],
+            });
+        }
+        else {
+            await getDbExec().execute({
+                sql: `UPDATE app_secrets SET shared_encrypted_value = ? WHERE id = ? AND shared_encrypted_value = ?`,
+                args: [encrypted, id, sharedCiphertextToReplace],
+            });
+        }
     }
     catch {
         // Migration is opportunistic. Preserve the successful read if the update
@@ -280,7 +297,7 @@ export async function readAppSecret(ref) {
         const encrypted = rows[0].encrypted_value;
         const decrypted = decryptAppSecretValue(encrypted, rows[0].shared_encrypted_value);
         if (decrypted.needsSharedCiphertext) {
-            await populateSharedAppSecret(rows[0].id, decrypted.value);
+            await populateSharedAppSecret(rows[0].id, decrypted.value, decrypted.sharedCiphertextToReplace ?? null);
         }
         return {
             value: decrypted.value,
@@ -313,7 +330,7 @@ export async function readAppSecrets(args) {
             const encrypted = row.encrypted_value;
             const decrypted = decryptAppSecretValue(encrypted, row.shared_encrypted_value);
             if (decrypted.needsSharedCiphertext) {
-                await populateSharedAppSecret(row.id, decrypted.value);
+                await populateSharedAppSecret(row.id, decrypted.value, decrypted.sharedCiphertextToReplace ?? null);
             }
             results.set(key, {
                 value: decrypted.value,
@@ -359,7 +376,7 @@ export async function readAppSecretMeta(ref) {
         const encrypted = row.encrypted_value;
         const decrypted = decryptAppSecretValue(encrypted, row.shared_encrypted_value);
         if (decrypted.needsSharedCiphertext) {
-            await populateSharedAppSecret(row.id, decrypted.value);
+            await populateSharedAppSecret(row.id, decrypted.value, decrypted.sharedCiphertextToReplace ?? null);
         }
         last4Value = last4(decrypted.value);
     }
@@ -396,7 +413,7 @@ export async function listAppSecretsForScope(scope, scopeId) {
             const encrypted = row.encrypted_value;
             const decrypted = decryptAppSecretValue(encrypted, row.shared_encrypted_value);
             if (decrypted.needsSharedCiphertext) {
-                await populateSharedAppSecret(row.id, decrypted.value);
+                await populateSharedAppSecret(row.id, decrypted.value, decrypted.sharedCiphertextToReplace ?? null);
             }
             last4Value = last4(decrypted.value);
         }