@agentconnect.md/setup 1.37.0-rc.4 → 1.37.0-rc.5

package/dist/index.js

@@ -56521,6 +56521,26 @@ async function disconnectPrisma() {
 	await singleton?.$disconnect();
 	singleton = void 0;
 }
+//#endregion
+//#region ../control-plane/dist/secrets/scope.js
+/** Deployment-owned material (the deployment config document's secrets). */
+const DEPLOYMENT_SCOPE = { kind: "deployment" };
+/**
+* Envelope marker for values sealed under a SCOPED key. It carries a format
+* version and nothing else — deliberately not the tenant id (see above). Its
+* one job is to let `open` tell a scoped value apart from a pre-scoping one, so
+* the rollout needs no backfill.
+*/
+const SECRET_ENVELOPE_PREFIX = "acv1:";
+/**
+* Org key names default to `<deployment key>-org-`, so they inherit whatever
+* namespace the deployment key already occupies. Deployments commonly share one
+* transit mount and rely on key naming alone to stay separated; a fixed prefix
+* would collide their org keys, a derived one cannot.
+*/
+function effectiveOrgKeyPrefix(transitKey, configured) {
+	return configured ?? `${transitKey}-org-`;
+}
 const HttpUrlSchema = string().url().superRefine((value, ctx) => {
 	const url = new URL(value);
 	if (url.protocol !== "http:" && url.protocol !== "https:") ctx.addIssue({
@@ -56775,7 +56795,7 @@ var DeploymentConfigService = class {
 		for (const [rawKey, value] of Object.entries(secretPatch)) {
 			const key = DeploymentSecretKeySchema.parse(rawKey);
 			prepared[key] = value === null ? null : {
-				sealedValue: await this.cipher.seal(value),
+				sealedValue: await this.cipher.seal(value, DEPLOYMENT_SCOPE),
 				fingerprint: fingerprint(value)
 			};
 		}
@@ -56796,7 +56816,7 @@ var DeploymentConfigService = class {
 		const secrets = {};
 		for (const secret of row.secrets) {
 			const parsed = DeploymentSecretKeySchema.safeParse(secret.key);
-			if (parsed.success && openedKeys.has(parsed.data)) secrets[parsed.data] = await this.cipher.open(secret.sealedValue);
+			if (parsed.success && openedKeys.has(parsed.data)) secrets[parsed.data] = await this.cipher.open(secret.sealedValue, DEPLOYMENT_SCOPE);
 		}
 		return {
 			schemaVersion: 1,
@@ -56992,12 +57012,19 @@ var PgDeploymentConfigStore = class extends DeploymentConfigService {
 *
 * Envelope encryption as a service: the data key never leaves Vault; the CP
 * sends base64 plaintext to `transit/encrypt/<key>` and stores the returned
-* self-describing `vault:vN:…` ciphertext in the existing text columns.
+* ciphertext, behind this deployment's envelope tag, in the existing text
+* columns. WHICH key is chosen comes from the {@link SecretScope} the caller
+* passes — the deployment's key, or `<orgKeyPrefix><orgId>` — so an
+* organization's material can be destroyed with its key
+* (docs/designs/per-org-secret-encryption.md).
 *
 * Contract (pinned on the port):
-* - `open` PASSES THROUGH values it did not seal (no `vault:vN:` prefix ⇒
-*   return as-is): existing plaintext rows keep reading after the flip, and the
-*   next write re-seals them — the rollout is online, no backfill required.
+* - `open` PASSES THROUGH values it did not seal (neither the envelope tag nor
+*   a bare `vault:vN:` prefix ⇒ return as-is): existing plaintext rows keep
+*   reading after the flip, and the next write re-seals them — the rollout is
+*   online, no backfill required.
+* - A value sealed under one scope does NOT open under another: Transit rejects
+*   a ciphertext presented to a different key, which is the cross-tenant fence.
 * - No argument or response body is ever logged; errors carry only the HTTP
 *   status and Vault's `errors[]` strings.
 *
@@ -57008,11 +57035,13 @@ var PgDeploymentConfigStore = class extends DeploymentConfigService {
 * that exact login wire shape ({role, jwt}), so nothing here is bound to
 * Kubernetes — a k8s ServiceAccount token is just the common jwtPath.
 *
-* `open` results are cached in-process keyed by ciphertext (bounded, insertion-
-* order eviction): reconcile opens every owned agent's secrets per register, and
-* Transit ciphertexts are stable until re-sealed, so the cache turns that into
-* one network call per distinct value. `seal` is never cached — Transit returns
-* fresh ciphertext per call by design.
+* `open` results are cached in-process keyed by key name AND ciphertext
+* (bounded, insertion-order eviction): reconcile opens every owned agent's
+* secrets per register, and Transit ciphertexts are stable until re-sealed, so
+* the cache turns that into one network call per distinct value. The key name
+* belongs in the cache key because the stored string alone no longer implies
+* one. `seal` is never cached — Transit returns fresh ciphertext per call by
+* design.
 */
 /** Transit ciphertext is self-describing: `vault:v<key-version>:<base64>`. */
 const CIPHERTEXT_RE = /^vault:v\d+:/;
@@ -57021,6 +57050,7 @@ const RENEW_FRACTION = .8;
 var VaultTransitSecretCipher = class {
 	base;
 	key;
+	orgKeyPrefix;
 	mount;
 	namespace;
 	auth;
@@ -57033,6 +57063,7 @@ var VaultTransitSecretCipher = class {
 	constructor(opts) {
 		this.base = `${opts.addr.replace(/\/+$/, "")}/v1`;
 		this.key = opts.key;
+		this.orgKeyPrefix = opts.orgKeyPrefix;
 		this.mount = opts.mount ?? "transit";
 		this.namespace = opts.namespace;
 		this.auth = opts.auth;
@@ -57040,19 +57071,31 @@ var VaultTransitSecretCipher = class {
 		this.now = opts.now ?? Date.now;
 		this.openCacheMax = opts.openCacheMax ?? 5e3;
 	}
-	async seal(plaintext) {
-		const data = await this.transit("encrypt", { plaintext: Buffer.from(plaintext, "utf8").toString("base64") });
-		if (typeof data.ciphertext !== "string") throw new Error("vault transit encrypt: no ciphertext in response");
-		return data.ciphertext;
+	/**
+	* The key a scope resolves to. Org keys are created lazily by Transit on the
+	* first encrypt (the policy must permit creation on that path); nothing here
+	* is coupled to organization creation.
+	*/
+	keyFor(scope) {
+		return scope.kind === "deployment" ? this.key : `${this.orgKeyPrefix}${scope.orgId}`;
 	}
-	async open(stored) {
-		if (!CIPHERTEXT_RE.test(stored)) return stored;
-		const hit = this.openCache.get(stored);
+	async seal(plaintext, scope) {
+		const data = await this.transit("encrypt", this.keyFor(scope), { plaintext: Buffer.from(plaintext, "utf8").toString("base64") });
+		if (typeof data.ciphertext !== "string") throw new Error("vault transit encrypt: no ciphertext in response");
+		return `${SECRET_ENVELOPE_PREFIX}${data.ciphertext}`;
+	}
+	async open(stored, scope) {
+		const scoped = stored.startsWith(SECRET_ENVELOPE_PREFIX);
+		if (!scoped && !CIPHERTEXT_RE.test(stored)) return stored;
+		const key = scoped ? this.keyFor(scope) : this.key;
+		const ciphertext = scoped ? stored.slice(5) : stored;
+		const cacheKey = `${key}\u0000${ciphertext}`;
+		const hit = this.openCache.get(cacheKey);
 		if (hit !== void 0) return hit;
-		const data = await this.transit("decrypt", { ciphertext: stored });
+		const data = await this.transit("decrypt", key, { ciphertext });
 		if (typeof data.plaintext !== "string") throw new Error("vault transit decrypt: no plaintext in response");
 		const value = Buffer.from(data.plaintext, "base64").toString("utf8");
-		this.cacheOpen(stored, value);
+		this.cacheOpen(cacheKey, value);
 		return value;
 	}
 	cacheOpen(ciphertext, plaintext) {
@@ -57062,8 +57105,8 @@ var VaultTransitSecretCipher = class {
 		}
 		this.openCache.set(ciphertext, plaintext);
 	}
-	async transit(op, body) {
-		const path = `${this.mount}/${op}/${this.key}`;
+	async transit(op, key, body) {
+		const path = `${this.mount}/${op}/${key}`;
 		let res = await this.post(path, body, await this.token());
 		if (res.status === 403 && this.auth.method === "jwt") {
 			this.clientToken = void 0;
@@ -57139,11 +57182,21 @@ async function describeError(res) {
 * as Vault Transit stores ciphertext. The composition root selects one provider,
 * so every store switches together.
 *
+* Every call carries a {@link SecretScope} naming WHOSE key to use — the
+* deployment's, or one organization's (docs/designs/per-org-secret-encryption.md).
+* The scope comes from the caller, never from the stored value.
+*
 * Contract for an encrypting implementation (e.g. Vault Transit):
-* - `seal` returns a self-describing value (Transit's `vault:v1:…` is already one).
+* - `seal` returns a self-describing value carrying the envelope version
+*   (`acv1:` + Transit's own `vault:v1:…`).
 * - `open` MUST pass through values it did not seal (no recognizable prefix ⇒
 *   return as-is): existing plaintext rows keep working, and re-sealing on the
 *   next write migrates them lazily — the flip is online, no backfill required.
+*   Values sealed before scoping existed (a bare `vault:vN:`) open under the
+*   deployment key whatever `scope` says; only the envelope-tagged arm is
+*   scoped.
+* - A value sealed under one scope MUST NOT open under another. Failing closed
+*   there is the point of passing the scope in.
 * - Neither side ever logs its argument.
 *
 * This is NOT the C5 `SecretsProvider` lease broker (`providers/provider.ts`),
@@ -57184,6 +57237,7 @@ function makeSecretCipher(config) {
 	return new VaultTransitSecretCipher({
 		addr: config.VAULT_ADDR,
 		key: config.VAULT_TRANSIT_KEY,
+		orgKeyPrefix: effectiveOrgKeyPrefix(config.VAULT_TRANSIT_KEY, config.VAULT_TRANSIT_ORG_KEY_PREFIX),
 		mount: config.VAULT_TRANSIT_MOUNT,
 		...config.VAULT_NAMESPACE ? { namespace: config.VAULT_NAMESPACE } : {},
 		auth