@agent-vm/secret-management 0.0.71 → 0.0.72

package/dist/contracts.d.ts

@@ -9,6 +9,10 @@ type SecretRef = {
 } | {
   readonly source: 'environment';
   readonly ref: string;
+} | {
+  readonly source: 'config';
+  readonly ref?: never;
+  readonly value: string;
 };
 interface SecretResolver {
   resolve(ref: SecretRef): Promise<string>;

package/dist/index.js

@@ -10,11 +10,23 @@ function resolveEnvironmentSecret(ref, env) {
 	if (value.trim().length === 0) throw new Error(`Environment variable '${ref.ref}' is set but empty.`);
 	return value;
 }
+function resolveConfigSecret(ref) {
+	if (ref.value.trim().length === 0) throw new Error("Config secret value is empty.");
+	return ref.value;
+}
 function formatUnknownError$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+function describeSecretRef(ref) {
+	switch (ref.source) {
+		case "1password":
+		case "environment": return ref.ref;
+		case "config": return "<config>";
+		default: return JSON.stringify(ref);
+	}
+}
 function createSecretResolutionError(options) {
-	return new Error(`Failed to resolve secret '${options.secretName}' from '${options.ref.ref}': ${formatUnknownError$1(options.cause)}`, { cause: options.cause });
+	return new Error(`Failed to resolve secret '${options.secretName}' from '${describeSecretRef(options.ref)}': ${formatUnknownError$1(options.cause)}`, { cause: options.cause });
 }
 function throwAggregateSecretResolutionError(failures) {
 	if (failures.length > 0) throw new AggregateError(failures, `Failed to resolve ${String(failures.length)} secret(s).`);
@@ -27,6 +39,7 @@ function createCompositeSecretResolver(onePasswordResolver, env = process.env) {
 		async resolve(ref) {
 			switch (ref.source) {
 				case "environment": return resolveEnvironmentSecret(ref, env);
+				case "config": return resolveConfigSecret(ref);
 				case "1password":
 					if (!onePasswordResolver) throw new Error("Secret with source '1password' requires host.secretsProvider to be configured.");
 					return await onePasswordResolver.resolve(ref);
@@ -49,6 +62,17 @@ function createCompositeSecretResolver(onePasswordResolver, env = process.env) {
 						}));
 					}
 					break;
+				case "config":
+					try {
+						resolved[name] = resolveConfigSecret(ref);
+					} catch (error) {
+						failures.push(createSecretResolutionError({
+							cause: error,
+							ref,
+							secretName: name
+						}));
+					}
+					break;
 				case "1password":
 					onePasswordRefs[name] = ref;
 					break;
@@ -218,6 +242,40 @@ async function resolveServiceAccountToken(source, dependencies) {
 		default: throw new Error(`Unsupported token source: ${JSON.stringify(source)}`);
 	}
 }
+function resolveConfigSecretValue(ref) {
+	if (ref.value.trim().length === 0) throw new Error("Config secret value is empty.");
+	return ref.value;
+}
+function createCompositeOnlySecretSourceError(source) {
+	return /* @__PURE__ */ new Error(`Secret source '${source}' must be resolved by the composite resolver before reaching the 1Password resolver.`);
+}
+function splitSecretRefs(refs) {
+	const onePasswordRefs = {};
+	const resolvedSecrets = {};
+	for (const [secretName, secretRef] of Object.entries(refs)) switch (secretRef.source) {
+		case "1password":
+			onePasswordRefs[secretName] = secretRef;
+			break;
+		case "config":
+			resolvedSecrets[secretName] = resolveConfigSecretValue(secretRef);
+			break;
+		case "environment": throw createCompositeOnlySecretSourceError(secretRef.source);
+		default: throw new Error(`Unsupported secret source: ${JSON.stringify(secretRef)}`);
+	}
+	return {
+		onePasswordRefs,
+		resolvedSecrets
+	};
+}
+function hasOnePasswordRefs(refs) {
+	return Object.keys(refs).length > 0;
+}
+function mergeResolvedSecrets(resolvedSecrets, onePasswordSecrets) {
+	return {
+		...resolvedSecrets,
+		...onePasswordSecrets
+	};
+}
 async function resolveSecretWithOpCli(serviceAccountToken, secretReference, exec) {
 	return stripOpReadStdoutTerminator((await exec("op", ["read", secretReference], {
 		env: createOpCliServiceAccountEnv(serviceAccountToken),
@@ -429,6 +487,12 @@ async function createSecretResolver(options, dependencies = {}) {
 		});
 		return {
 			resolve: async (ref) => {
+				switch (ref.source) {
+					case "config": return resolveConfigSecretValue(ref);
+					case "environment": throw createCompositeOnlySecretSourceError(ref.source);
+					case "1password": break;
+					default: throw new Error(`Unsupported secret source: ${JSON.stringify(ref)}`);
+				}
 				try {
 					return await client.secrets.resolve(ref.ref);
 				} catch (error) {
@@ -445,12 +509,15 @@ async function createSecretResolver(options, dependencies = {}) {
 				}
 			},
 			resolveAll: async (refs) => {
+				const splitRefs = splitSecretRefs(refs);
+				if (!hasOnePasswordRefs(splitRefs.onePasswordRefs)) return splitRefs.resolvedSecrets;
 				try {
-					return mapSdkResolveAllResponse(refs, await client.secrets.resolveAll(Object.values(refs).map((secretRef) => secretRef.ref)));
+					const response = await client.secrets.resolveAll(Object.values(splitRefs.onePasswordRefs).map((secretRef) => secretRef.ref));
+					return mergeResolvedSecrets(splitRefs.resolvedSecrets, mapSdkResolveAllResponse(splitRefs.onePasswordRefs, response));
 				} catch (error) {
 					const sdkResolveAllError = createFallbackStageError("1Password SDK resolveAll", error);
 					try {
-						return await resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec);
+						return mergeResolvedSecrets(splitRefs.resolvedSecrets, await resolveAllSecretsWithOpCli(options.serviceAccountToken, splitRefs.onePasswordRefs, exec));
 					} catch (fallbackError) {
 						throw createFallbackFailureError({
 							fallbackError,
@@ -465,6 +532,12 @@ async function createSecretResolver(options, dependencies = {}) {
 		const sdkClientCreationError = createFallbackStageError("1Password SDK client creation", error);
 		return {
 			resolve: async (ref) => {
+				switch (ref.source) {
+					case "config": return resolveConfigSecretValue(ref);
+					case "environment": throw createCompositeOnlySecretSourceError(ref.source);
+					case "1password": break;
+					default: throw new Error(`Unsupported secret source: ${JSON.stringify(ref)}`, { cause: error });
+				}
 				try {
 					return await resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec);
 				} catch (fallbackError) {
@@ -476,8 +549,10 @@ async function createSecretResolver(options, dependencies = {}) {
 				}
 			},
 			resolveAll: async (refs) => {
+				const splitRefs = splitSecretRefs(refs);
+				if (!hasOnePasswordRefs(splitRefs.onePasswordRefs)) return splitRefs.resolvedSecrets;
 				try {
-					return await resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec);
+					return mergeResolvedSecrets(splitRefs.resolvedSecrets, await resolveAllSecretsWithOpCli(options.serviceAccountToken, splitRefs.onePasswordRefs, exec));
 				} catch (fallbackError) {
 					throw createFallbackFailureError({
 						fallbackError,
@@ -492,8 +567,19 @@ async function createSecretResolver(options, dependencies = {}) {
 async function createOpCliSecretResolver(options, dependencies = {}) {
 	const exec = dependencies.execFileAsync ?? execFileAsync;
 	return {
-		resolve: async (ref) => await resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec),
-		resolveAll: async (refs) => await resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec)
+		resolve: async (ref) => {
+			switch (ref.source) {
+				case "config": return resolveConfigSecretValue(ref);
+				case "environment": throw createCompositeOnlySecretSourceError(ref.source);
+				case "1password": return await resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec);
+				default: throw new Error(`Unsupported secret source: ${JSON.stringify(ref)}`);
+			}
+		},
+		resolveAll: async (refs) => {
+			const splitRefs = splitSecretRefs(refs);
+			if (!hasOnePasswordRefs(splitRefs.onePasswordRefs)) return splitRefs.resolvedSecrets;
+			return mergeResolvedSecrets(splitRefs.resolvedSecrets, await resolveAllSecretsWithOpCli(options.serviceAccountToken, splitRefs.onePasswordRefs, exec));
+		}
 	};
 }
 //#endregion

package/dist/testing.js

@@ -1,6 +1,7 @@
 //#region src/testing.ts
 function createStaticSecretResolver(values) {
 	const resolve = async (ref) => {
+		if (ref.source === "config") return ref.value;
 		const value = values[ref.ref];
 		if (value === void 0) throw new Error(`No test secret value configured for '${ref.ref}'.`);
 		return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/secret-management",
-  "version": "0.0.71",
+  "version": "0.0.72",
   "description": "Shared secret reference contracts and resolvers for agent-vm packages.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {