@agentconnect.md/setup 1.37.0-rc.8 → 1.37.0

package/dist/index.js

@@ -57107,8 +57107,10 @@ async function describeVaultError(res) {
 }
 //#endregion
 //#region ../control-plane/dist/secrets/vault-transit.js
-/** Transit ciphertext is self-describing: `vault:v<key-version>:<base64>`. */
-const CIPHERTEXT_RE = /^vault:v\d+:/;
+/** A bare Transit ciphertext — what this cipher produced BEFORE scoping existed. */
+const LEGACY_CIPHERTEXT_RE = /^vault:v\d+:/;
+/** Any version of our own envelope, including ones this build predates. */
+const ENVELOPE_RE = /^acv\d+:/;
 var VaultTransitSecretCipher = class {
 	http;
 	key;
@@ -57143,10 +57145,12 @@ var VaultTransitSecretCipher = class {
 		return `${SECRET_ENVELOPE_PREFIX}${data.ciphertext}`;
 	}
 	async open(stored, scope) {
-		const scoped = stored.startsWith(SECRET_ENVELOPE_PREFIX);
-		if (!scoped && !CIPHERTEXT_RE.test(stored)) return stored;
-		const key = scoped ? this.keyFor(scope) : this.key;
-		const ciphertext = scoped ? stored.slice(5) : stored;
+		if (!stored.startsWith("acv1:")) {
+			assertNotUnreadableCiphertext(stored);
+			return stored;
+		}
+		const key = this.keyFor(scope);
+		const ciphertext = stored.slice(5);
 		const cacheKey = `${key}\u0000${ciphertext}`;
 		const hit = this.openCache.get(cacheKey);
 		if (hit !== void 0) return hit;
@@ -57169,6 +57173,17 @@ var VaultTransitSecretCipher = class {
 		return (await res.json()).data ?? {};
 	}
 };
+/**
+* The pass-through arm exists for values that were never sealed (plaintext rows
+* under `SECRET_CIPHER=none`). It must never swallow a value that IS sealed but
+* unreadable by this build — returning ciphertext as if it were plaintext is
+* silent corruption: the caller ships it to a daemon or a platform API as a
+* credential. Both cases below are loud instead.
+*/
+function assertNotUnreadableCiphertext(stored) {
+	if (LEGACY_CIPHERTEXT_RE.test(stored)) throw new Error("secret cipher: unscoped legacy ciphertext — run the rewrap sweep on a pre-scoping build first");
+	if (ENVELOPE_RE.test(stored)) throw new Error("secret cipher: stored value uses a newer envelope version than this build supports");
+}
 //#endregion
 //#region ../control-plane/dist/secrets/cipher.js
 /**
@@ -57190,12 +57205,12 @@ var VaultTransitSecretCipher = class {
 * Contract for an encrypting implementation (e.g. Vault Transit):
 * - `seal` returns a self-describing value carrying the envelope version
 *   (`acv1:` + Transit's own `vault:v1:…`).
-* - `open` MUST pass through values it did not seal (no recognizable prefix ⇒
-*   return as-is): existing plaintext rows keep working, and re-sealing on the
-*   next write migrates them lazily — the flip is online, no backfill required.
-*   Values sealed before scoping existed (a bare `vault:vN:`) open under the
-*   deployment key whatever `scope` says; only the envelope-tagged arm is
-*   scoped.
+* - `open` MUST pass through values it did not seal (no envelope tag ⇒ return
+*   as-is): existing plaintext rows keep working, and re-sealing on the next
+*   write migrates them lazily — the flip is online, no backfill required. It
+*   must NOT pass through a value that is sealed but unreadable (a pre-scoping
+*   `vault:vN:`, or a newer envelope version) — that has to throw, since
+*   returning ciphertext as plaintext would be shipped onward as a credential.
 * - A value sealed under one scope MUST NOT open under another. Failing closed
 *   there is the point of passing the scope in.
 * - Neither side ever logs its argument.