@aitne/daemon 0.1.0

package/dist/secrets/codex-home-materializer.js

@@ -0,0 +1,76 @@
+/**
+ * Codex CLI's Azure OpenAI mode requires a `[model_providers.azure]`
+ * block in `config.toml` — env vars alone cannot configure it. To honor
+ * the env-mirror chokepoint without trampling the operator's personal
+ * `~/.codex/` configuration, the daemon writes a managed config.toml to
+ * `<PA_DATA_DIR>/codex-home/config.toml` and points `CODEX_HOME` at that
+ * directory for spawned codex subprocesses.
+ *
+ * The user's `~/.codex/` is never touched.
+ *
+ * Lifecycle:
+ *   - On startup / sync with an `azure-openai` config: ensure the dir
+ *     exists, write/refresh config.toml (chmod 0600), set `CODEX_HOME`.
+ *   - On clear / switch to direct openai: remove the file (best-effort)
+ *     and unset `CODEX_HOME` so codex falls back to `~/.codex/`.
+ */
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { buildCodexAzureConfigToml, } from "@aitne/shared";
+import { createLogger } from "../logging.js";
+const logger = createLogger("codex-home-materializer");
+/** Subdirectory under `PA_DATA_DIR` that holds the managed `config.toml`. */
+const CODEX_HOME_SUBDIR = "codex-home";
+/** Resolve the path the daemon manages for codex Azure config. */
+export function resolveCodexHomePath(dataDir) {
+    return join(dataDir, CODEX_HOME_SUBDIR);
+}
+/**
+ * Write `config.toml` to the managed `CODEX_HOME` directory and return
+ * the directory path. Idempotent — safe to call on every sync.
+ *
+ * Sets file permissions to 0600 because the file embeds the
+ * `AZURE_OPENAI_API_KEY` env-key reference (not the key itself, but the
+ * config still expresses production routing — treat as sensitive).
+ */
+export function materializeCodexAzureConfig(dataDir, config) {
+    const home = resolveCodexHomePath(dataDir);
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    // mkdirSync's mode arg is ignored on existing dirs (POSIX semantics);
+    // re-chmod to be safe across re-runs is unnecessary here because the
+    // directory only contains daemon-managed files.
+    const tomlPath = join(home, "config.toml");
+    writeFileSync(tomlPath, buildCodexAzureConfigToml(config), {
+        mode: 0o600,
+    });
+    logger.info({ path: tomlPath, deploymentName: config.deploymentName ?? null }, "Materialized Codex Azure config.toml");
+    return home;
+}
+/**
+ * Remove the managed `config.toml` file (and its parent dir if empty).
+ * Best-effort: missing-file is fine, permission errors are logged but
+ * not thrown.
+ */
+export function clearCodexAzureConfig(dataDir) {
+    const home = resolveCodexHomePath(dataDir);
+    const tomlPath = join(home, "config.toml");
+    try {
+        rmSync(tomlPath, { force: true });
+    }
+    catch (err) {
+        logger.warn({ err, path: tomlPath }, "Failed to remove config.toml");
+        return;
+    }
+    // Try to remove the dir if it became empty. `rmSync` without
+    // `recursive: true` throws on non-empty dirs — we swallow that case
+    // because future iterations may drop other managed files (auth.json,
+    // sessions/, etc.) into the same directory and we don't want to
+    // delete them. Missing-dir also throws and is equally fine.
+    try {
+        rmSync(home, { recursive: false });
+    }
+    catch {
+        // Non-empty or already-gone — both fine.
+    }
+}
+//# sourceMappingURL=codex-home-materializer.js.map

package/dist/secrets/codex-home-materializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-home-materializer.js","sourceRoot":"","sources":["../../src/secrets/codex-home-materializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,MAA+B;IAE/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,sEAAsE;IACtE,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE;QACzD,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,EACjE,sCAAsC,CACvC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,6DAA6D;IAC7D,oEAAoE;IACpE,qEAAqE;IACrE,gEAAgE;IAChE,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC"}

package/dist/secrets/encrypted-blob-store.d.ts

@@ -0,0 +1,20 @@
+import type { BlobName } from "./types.js";
+import type { SecretStore } from "./secret-store.js";
+export interface EncryptedBlobStore {
+    exists(name: BlobName): Promise<boolean>;
+    readUtf8(name: BlobName): Promise<string | null>;
+    writeUtf8(name: BlobName, plaintext: string): Promise<void>;
+    remove(name: BlobName): Promise<void>;
+}
+export declare class FileEncryptedBlobStore implements EncryptedBlobStore {
+    private readonly rootDir;
+    private readonly secretStore;
+    constructor(rootDir: string, secretStore: SecretStore);
+    exists(name: BlobName): Promise<boolean>;
+    readUtf8(name: BlobName): Promise<string | null>;
+    writeUtf8(name: BlobName, plaintext: string): Promise<void>;
+    remove(name: BlobName): Promise<void>;
+    private getOrCreateMasterKey;
+    private getBlobPath;
+}
+//# sourceMappingURL=encrypted-blob-store.d.ts.map

package/dist/secrets/encrypted-blob-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-blob-store.d.ts","sourceRoot":"","sources":["../../src/secrets/encrypted-blob-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAarD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjD,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAE7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,WAAW;IAGrC,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IASxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBhD,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB3D,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YAI7B,oBAAoB;IAWlC,OAAO,CAAC,WAAW;CAMpB"}

package/dist/secrets/encrypted-blob-store.js

@@ -0,0 +1,80 @@
+import { access, mkdir, readFile, rm, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+const BLOB_MASTER_KEY_NAME = "encryptedBlobMasterKey";
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+export class FileEncryptedBlobStore {
+    rootDir;
+    secretStore;
+    constructor(rootDir, secretStore) {
+        this.rootDir = rootDir;
+        this.secretStore = secretStore;
+    }
+    async exists(name) {
+        try {
+            await access(this.getBlobPath(name));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async readUtf8(name) {
+        try {
+            const raw = await readFile(this.getBlobPath(name), "utf8");
+            const envelope = JSON.parse(raw);
+            const key = await this.getOrCreateMasterKey();
+            const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"));
+            decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+            const plaintext = Buffer.concat([
+                decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+                decipher.final(),
+            ]);
+            return plaintext.toString("utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async writeUtf8(name, plaintext) {
+        const key = await this.getOrCreateMasterKey();
+        const iv = randomBytes(IV_BYTES);
+        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext, "utf8"),
+            cipher.final(),
+        ]);
+        const tag = cipher.getAuthTag();
+        const envelope = {
+            version: 1,
+            iv: iv.toString("base64"),
+            tag: tag.toString("base64"),
+            ciphertext: ciphertext.toString("base64"),
+        };
+        await mkdir(this.rootDir, { recursive: true, mode: 0o700 });
+        await writeFile(this.getBlobPath(name), JSON.stringify(envelope), { encoding: "utf8", mode: 0o600 });
+    }
+    async remove(name) {
+        await rm(this.getBlobPath(name), { force: true });
+    }
+    async getOrCreateMasterKey() {
+        const existing = await this.secretStore.get(BLOB_MASTER_KEY_NAME);
+        if (existing) {
+            return Buffer.from(existing, "base64");
+        }
+        const next = randomBytes(KEY_BYTES);
+        await this.secretStore.set(BLOB_MASTER_KEY_NAME, next.toString("base64"));
+        return next;
+    }
+    getBlobPath(name) {
+        if (!name || name.startsWith("/") || name.includes("..")) {
+            throw new Error(`Invalid blob name: ${name}`);
+        }
+        return join(this.rootDir, `${name}.enc`);
+    }
+}
+//# sourceMappingURL=encrypted-blob-store.js.map

package/dist/secrets/encrypted-blob-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-blob-store.js","sourceRoot":"","sources":["../../src/secrets/encrypted-blob-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,EAAE,EACF,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI5E,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAgBpB,MAAM,OAAO,sBAAsB;IAEd;IACA;IAFnB,YACmB,OAAe,EACf,WAAwB;QADxB,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,IAAc;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CACnC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC3D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,SAAiB;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAiB;YAC7B,OAAO,EAAE,CAAC;YACV,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C,CAAC;QAEF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACzB,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/secrets/platform-secret-store.d.ts

@@ -0,0 +1,17 @@
+import type { PersonalAgentKeychainClient } from "@aitne/shared/keychain-helper-client";
+import type { SecretStore } from "./secret-store.js";
+import type { StoredSecretName } from "./secret-names.js";
+export interface PlatformSecretStoreOptions {
+    client?: PersonalAgentKeychainClient;
+}
+export declare class PlatformSecretStore implements SecretStore {
+    private readonly clientPromise;
+    private initError;
+    constructor(options?: PlatformSecretStoreOptions);
+    private getClient;
+    has(name: StoredSecretName): Promise<boolean>;
+    get(name: StoredSecretName): Promise<string | null>;
+    set(name: StoredSecretName, value: string): Promise<void>;
+    delete(name: StoredSecretName): Promise<void>;
+}
+//# sourceMappingURL=platform-secret-store.d.ts.map

package/dist/secrets/platform-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-secret-store.d.ts","sourceRoot":"","sources":["../../src/secrets/platform-secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,2BAA2B,CAAC;CACtC;AAED,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,SAAS,CAAsB;gBAE3B,OAAO,GAAE,0BAA+B;YAYtC,SAAS;IAKjB,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7C,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnD,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;CAIpD"}

package/dist/secrets/platform-secret-store.js

@@ -0,0 +1,37 @@
+import { createSecretClient } from "@aitne/shared/secret-client-factory";
+export class PlatformSecretStore {
+    clientPromise;
+    initError = null;
+    constructor(options = {}) {
+        this.clientPromise = (options.client
+            ? Promise.resolve(options.client)
+            : createSecretClient()).catch((err) => {
+            // Capture the error so it doesn't float as an unhandled rejection.
+            // It will be re-thrown on the first method call.
+            this.initError = err;
+            throw err;
+        });
+    }
+    async getClient() {
+        if (this.initError)
+            throw this.initError;
+        return await this.clientPromise;
+    }
+    async has(name) {
+        const client = await this.getClient();
+        return await client.has(name);
+    }
+    async get(name) {
+        const client = await this.getClient();
+        return await client.get(name);
+    }
+    async set(name, value) {
+        const client = await this.getClient();
+        await client.set(name, value);
+    }
+    async delete(name) {
+        const client = await this.getClient();
+        await client.delete(name);
+    }
+}
+//# sourceMappingURL=platform-secret-store.js.map

package/dist/secrets/platform-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-secret-store.js","sourceRoot":"","sources":["../../src/secrets/platform-secret-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE,MAAM,OAAO,mBAAmB;IACb,aAAa,CAAuC;IAC7D,SAAS,GAAiB,IAAI,CAAC;IAEvC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM;YAClC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,kBAAkB,EAAE,CACvB,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YACrB,mEAAmE;YACnE,iDAAiD;YACjD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAsB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAsB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAsB,EAAE,KAAa;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAsB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/secrets/redaction.d.ts

@@ -0,0 +1,2 @@
+export { redactSensitiveString as redactString, SENSITIVE_KEY_PATTERN, } from "@aitne/shared";
+//# sourceMappingURL=redaction.d.ts.map

package/dist/secrets/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/secrets/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,IAAI,YAAY,EACrC,qBAAqB,GACtB,MAAM,eAAe,CAAC"}

package/dist/secrets/redaction.js

@@ -0,0 +1,2 @@
+export { redactSensitiveString as redactString, SENSITIVE_KEY_PATTERN, } from "@aitne/shared";
+//# sourceMappingURL=redaction.js.map

package/dist/secrets/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/secrets/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,IAAI,YAAY,EACrC,qBAAqB,GACtB,MAAM,eAAe,CAAC"}

package/dist/secrets/secret-broker.d.ts

@@ -0,0 +1,61 @@
+import { type BackendApiKeyConfig, type BackendId } from "@aitne/shared";
+import type { SecretStore } from "./secret-store.js";
+import type { ScopedSecretName, SecretName, StoredSecretName } from "./types.js";
+export interface SecretBrokerOptions {
+    cacheTtlMs?: number;
+}
+export declare class SecretBroker {
+    private readonly secretStore;
+    private readonly cache;
+    private readonly cacheTtlMs;
+    private readonly writeTails;
+    constructor(secretStore: SecretStore, options?: SecretBrokerOptions);
+    has(name: SecretName): Promise<boolean>;
+    get(name: SecretName): Promise<string | null>;
+    set(name: SecretName, value: string): Promise<void>;
+    delete(name: SecretName): Promise<void>;
+    /**
+     * Scoped-secret accessors — typed for `git.account.<alias>` and other
+     * runtime-scoped families declared in `secret-names.ts`. Sharing the
+     * cache + write-tail machinery with the static-name accessors keeps
+     * the broker's correctness contract unchanged: concurrent
+     * `setScoped` / `deleteScoped` for the same alias serialize, and the
+     * cache invalidates on every write. Callers must build the name via
+     * `scopedSecretName(...)` so the prefix lives in one place.
+     */
+    hasScoped(name: ScopedSecretName): Promise<boolean>;
+    getScoped(name: ScopedSecretName): Promise<string | null>;
+    setScoped(name: ScopedSecretName, value: string): Promise<void>;
+    deleteScoped(name: ScopedSecretName): Promise<void>;
+    private getRaw;
+    private enqueueWrite;
+    invalidate(name: StoredSecretName): void;
+    clearCache(): void;
+    getApiToken(): Promise<string | null>;
+    getSlackBotToken(): Promise<string | null>;
+    getSlackAppToken(): Promise<string | null>;
+    getTelegramBotToken(): Promise<string | null>;
+    getDiscordBotToken(): Promise<string | null>;
+    getNotionApiKey(): Promise<string | null>;
+    getGitHubToken(): Promise<string | null>;
+    getGitHubWebhookSecret(): Promise<string | null>;
+    getGoogleCredentialsJson(): Promise<string | null>;
+    getGoogleTokenJson(): Promise<string | null>;
+    saveGoogleTokenJson(json: string): Promise<void>;
+    getGoogleMapsApiKey(): Promise<string | null>;
+    getAppleCalendarCredentialsJson(): Promise<string | null>;
+    saveAppleCalendarCredentialsJson(json: string): Promise<void>;
+    deleteAppleCalendarCredentials(): Promise<void>;
+    getBackendApiKey(backendId: string): Promise<string | null>;
+    setBackendApiKey(backendId: string, value: string): Promise<void>;
+    deleteBackendApiKey(backendId: string): Promise<void>;
+    /**
+     * Read the parsed `BackendApiKeyConfig` for a backend. Decodes the
+     * stored JSON blob, or falls back to legacy raw-string entries
+     * (promoted to the backend's default direct provider). Returns null
+     * when nothing is configured or the stored value is malformed.
+     */
+    getBackendApiKeyConfig(backendId: BackendId): Promise<BackendApiKeyConfig | null>;
+    setBackendApiKeyConfig(backendId: BackendId, config: BackendApiKeyConfig): Promise<void>;
+}
+//# sourceMappingURL=secret-broker.d.ts.map

package/dist/secrets/secret-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-broker.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EACV,gBAAgB,EAEhB,UAAU,EACV,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,YAAY;IASrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiD;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAIpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8C;gBAGtD,WAAW,EAAE,WAAW,EACzC,OAAO,GAAE,mBAAwB;IAK7B,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7C,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAInD,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzD,SAAS,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAI3C,MAAM;IAepB,OAAO,CAAC,YAAY;IAqBpB,UAAU,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAIxC,UAAU,IAAI,IAAI;IAIlB,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7C,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzC,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIhD,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIlD,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7C,+BAA+B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzD,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/C,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI3D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD;;;;;OAKG;IACG,sBAAsB,CAC1B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAKtC,sBAAsB,CACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC;CAMjB"}

package/dist/secrets/secret-broker.js

@@ -0,0 +1,160 @@
+import { parseBackendApiKeyConfig, serializeBackendApiKeyConfig, } from "@aitne/shared";
+import { backendApiKeySecretName } from "./secret-names.js";
+export class SecretBroker {
+    secretStore;
+    cache = new Map();
+    cacheTtlMs;
+    // Per-secret write tail. Serializes set/delete for the same name so
+    // concurrent writers (e.g. Calendar + Gmail OAuth refreshes hitting
+    // googleTokenJson) don't collide at the underlying store.
+    writeTails = new Map();
+    constructor(secretStore, options = {}) {
+        this.secretStore = secretStore;
+        this.cacheTtlMs = options.cacheTtlMs ?? 60_000;
+    }
+    async has(name) {
+        return (await this.get(name)) !== null;
+    }
+    async get(name) {
+        return this.getRaw(name);
+    }
+    async set(name, value) {
+        return this.enqueueWrite(name, () => this.secretStore.set(name, value));
+    }
+    async delete(name) {
+        return this.enqueueWrite(name, () => this.secretStore.delete(name));
+    }
+    /**
+     * Scoped-secret accessors — typed for `git.account.<alias>` and other
+     * runtime-scoped families declared in `secret-names.ts`. Sharing the
+     * cache + write-tail machinery with the static-name accessors keeps
+     * the broker's correctness contract unchanged: concurrent
+     * `setScoped` / `deleteScoped` for the same alias serialize, and the
+     * cache invalidates on every write. Callers must build the name via
+     * `scopedSecretName(...)` so the prefix lives in one place.
+     */
+    async hasScoped(name) {
+        return (await this.getRaw(name)) !== null;
+    }
+    async getScoped(name) {
+        return this.getRaw(name);
+    }
+    async setScoped(name, value) {
+        return this.enqueueWrite(name, () => this.secretStore.set(name, value));
+    }
+    async deleteScoped(name) {
+        return this.enqueueWrite(name, () => this.secretStore.delete(name));
+    }
+    async getRaw(name) {
+        const now = Date.now();
+        const cached = this.cache.get(name);
+        if (cached && cached.expiresAt > now) {
+            return cached.value;
+        }
+        const value = await this.secretStore.get(name);
+        this.cache.set(name, {
+            value,
+            expiresAt: now + this.cacheTtlMs,
+        });
+        return value;
+    }
+    enqueueWrite(name, op) {
+        const prev = this.writeTails.get(name) ?? Promise.resolve();
+        const next = prev.catch(() => undefined).then(async () => {
+            try {
+                await op();
+            }
+            finally {
+                this.cache.delete(name);
+            }
+        });
+        this.writeTails.set(name, next);
+        next.finally(() => {
+            if (this.writeTails.get(name) === next) {
+                this.writeTails.delete(name);
+            }
+        }).catch(() => undefined);
+        return next;
+    }
+    invalidate(name) {
+        this.cache.delete(name);
+    }
+    clearCache() {
+        this.cache.clear();
+    }
+    getApiToken() {
+        return this.get("apiToken");
+    }
+    getSlackBotToken() {
+        return this.get("slackBotToken");
+    }
+    getSlackAppToken() {
+        return this.get("slackAppToken");
+    }
+    getTelegramBotToken() {
+        return this.get("telegramBotToken");
+    }
+    getDiscordBotToken() {
+        return this.get("discordBotToken");
+    }
+    getNotionApiKey() {
+        return this.get("notionApiKey");
+    }
+    getGitHubToken() {
+        return this.get("githubToken");
+    }
+    getGitHubWebhookSecret() {
+        return this.get("githubWebhookSecret");
+    }
+    getGoogleCredentialsJson() {
+        return this.get("googleCredentialsJson");
+    }
+    getGoogleTokenJson() {
+        return this.get("googleTokenJson");
+    }
+    saveGoogleTokenJson(json) {
+        return this.set("googleTokenJson", json);
+    }
+    getGoogleMapsApiKey() {
+        return this.get("googleMapsApiKey");
+    }
+    getAppleCalendarCredentialsJson() {
+        return this.get("appleCalendarCredentials");
+    }
+    saveAppleCalendarCredentialsJson(json) {
+        return this.set("appleCalendarCredentials", json);
+    }
+    deleteAppleCalendarCredentials() {
+        return this.delete("appleCalendarCredentials");
+    }
+    // ── Per-backend provider API keys ─────────────────────────────────
+    // Stored in the OS keychain when the operator opts to use the
+    // dashboard's API-key surface instead of CLI login / OAuth. When a
+    // value is present, `backend-api-key-env.ts` mirrors it into
+    // `process.env` (ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY+
+    // GOOGLE_API_KEY) so the existing SDK / CLI subprocesses pick it up
+    // without per-spawn-site refactoring.
+    getBackendApiKey(backendId) {
+        return this.getScoped(backendApiKeySecretName(backendId));
+    }
+    setBackendApiKey(backendId, value) {
+        return this.setScoped(backendApiKeySecretName(backendId), value);
+    }
+    deleteBackendApiKey(backendId) {
+        return this.deleteScoped(backendApiKeySecretName(backendId));
+    }
+    /**
+     * Read the parsed `BackendApiKeyConfig` for a backend. Decodes the
+     * stored JSON blob, or falls back to legacy raw-string entries
+     * (promoted to the backend's default direct provider). Returns null
+     * when nothing is configured or the stored value is malformed.
+     */
+    async getBackendApiKeyConfig(backendId) {
+        const raw = await this.getBackendApiKey(backendId);
+        return parseBackendApiKeyConfig(backendId, raw);
+    }
+    setBackendApiKeyConfig(backendId, config) {
+        return this.setBackendApiKey(backendId, serializeBackendApiKeyConfig(config));
+    }
+}
+//# sourceMappingURL=secret-broker.js.map

package/dist/secrets/secret-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-broker.js","sourceRoot":"","sources":["../../src/secrets/secret-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAG7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAY5D,MAAM,OAAO,YAAY;IASJ;IARF,KAAK,GAAG,IAAI,GAAG,EAAsC,CAAC;IACtD,UAAU,CAAS;IACpC,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IACzC,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEzE,YACmB,WAAwB,EACzC,UAA+B,EAAE;QADhB,gBAAW,GAAX,WAAW,CAAa;QAGzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAgB;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAgB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAgB,EAAE,KAAa;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAgB;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,IAAsB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAsB;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAsB,EAAE,KAAa;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAsB;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAsB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,KAAK;YACL,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,YAAY,CAClB,IAAsB,EACtB,EAAuB;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,EAAE,EAAE,CAAC;YACb,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,IAAsB;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,+BAA+B;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,gCAAgC,CAAC,IAAY;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,8BAA8B;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAED,qEAAqE;IACrE,8DAA8D;IAC9D,mEAAmE;IACnE,6DAA6D;IAC7D,sEAAsE;IACtE,oEAAoE;IACpE,sCAAsC;IAEtC,gBAAgB,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,KAAa;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAAoB;QAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,sBAAsB,CACpB,SAAoB,EACpB,MAA2B;QAE3B,OAAO,IAAI,CAAC,gBAAgB,CAC1B,SAAS,EACT,4BAA4B,CAAC,MAAM,CAAC,CACrC,CAAC;IACJ,CAAC;CACF"}

package/dist/secrets/secret-names.d.ts

@@ -0,0 +1,34 @@
+export declare const SECRET_NAMES: readonly ["apiToken", "slackBotToken", "slackAppToken", "telegramBotToken", "discordBotToken", "notionApiKey", "githubToken", "githubWebhookSecret", "googleCredentialsJson", "googleTokenJson", "googleMapsApiKey", "appleCalendarCredentials"];
+export type SecretName = (typeof SECRET_NAMES)[number];
+export declare const INTERNAL_SECRET_NAMES: readonly ["encryptedBlobMasterKey", "skillCurationRunTokenKey"];
+export type InternalSecretName = (typeof INTERNAL_SECRET_NAMES)[number];
+/**
+ * Scoped secret families — open-ended secret names whose scope key is
+ * supplied at runtime (an alias, an account id, etc.). Each family lives at
+ * a typed prefix so the secret store retains type discipline without
+ * widening to `string`.
+ *
+ * - `git.account.<alias>`: PAT for a Git account registered in
+ *   `gitAccounts[<alias>]` when its `authMode === "pat-keychain"`. The alias
+ *   matches the same regex the dashboard validates (`^[a-z0-9._-]+$`,
+ *   ≤ 40 chars), so the keychain entry name stays bounded.
+ * - `backend.<id>.api_key`: Provider API key for a backend (claude / codex
+ *   / gemini) when the operator opts to use the dashboard's API-key surface
+ *   instead of the CLI login / OAuth flow. The `<id>` is a `BackendId` from
+ *   `@aitne/shared` and is validated by `isBackendId()` at every
+ *   write/read site.
+ */
+export type ScopedSecretName = `git.account.${string}` | `backend.${string}.api_key`;
+export type StoredSecretName = SecretName | InternalSecretName | ScopedSecretName;
+export declare function isScopedSecretName(value: string): value is ScopedSecretName;
+/**
+ * Build a scoped secret name from a family + opaque scope key. The scope
+ * key is validated against the same character set every API surface uses
+ * (`^[a-z0-9._-]+$`); callers that build names from user input must
+ * pre-validate via the dashboard route schemas. This helper exists to keep
+ * the prefix in one place — do not concatenate by hand at call sites.
+ */
+export declare function scopedSecretName(family: "git.account", scope: string): ScopedSecretName;
+/** Build the keychain name for a backend's stored provider API key. */
+export declare function backendApiKeySecretName(backendId: string): ScopedSecretName;
+//# sourceMappingURL=secret-names.d.ts.map

package/dist/secrets/secret-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-names.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,kPAaf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,qBAAqB,iEAKxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,gBAAgB,GACxB,eAAe,MAAM,EAAE,GACvB,WAAW,MAAM,UAAU,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,kBAAkB,GAClB,gBAAgB,CAAC;AAIrB,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,gBAAgB,CAElB;AAED,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAE3E"}

package/dist/secrets/secret-names.js

@@ -0,0 +1,39 @@
+export const SECRET_NAMES = [
+    "apiToken",
+    "slackBotToken",
+    "slackAppToken",
+    "telegramBotToken",
+    "discordBotToken",
+    "notionApiKey",
+    "githubToken",
+    "githubWebhookSecret",
+    "googleCredentialsJson",
+    "googleTokenJson",
+    "googleMapsApiKey",
+    "appleCalendarCredentials",
+];
+export const INTERNAL_SECRET_NAMES = [
+    "encryptedBlobMasterKey",
+    // P22 §4 risk #4 — HMAC key for one-time skill-curation run tokens.
+    // Rotated on demand; theft requires keychain compromise + active run window.
+    "skillCurationRunTokenKey",
+];
+const SCOPED_SECRET_PREFIXES = ["git.account.", "backend."];
+export function isScopedSecretName(value) {
+    return SCOPED_SECRET_PREFIXES.some((prefix) => value.startsWith(prefix));
+}
+/**
+ * Build a scoped secret name from a family + opaque scope key. The scope
+ * key is validated against the same character set every API surface uses
+ * (`^[a-z0-9._-]+$`); callers that build names from user input must
+ * pre-validate via the dashboard route schemas. This helper exists to keep
+ * the prefix in one place — do not concatenate by hand at call sites.
+ */
+export function scopedSecretName(family, scope) {
+    return `${family}.${scope}`;
+}
+/** Build the keychain name for a backend's stored provider API key. */
+export function backendApiKeySecretName(backendId) {
+    return `backend.${backendId}.api_key`;
+}
+//# sourceMappingURL=secret-names.js.map

package/dist/secrets/secret-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.js","sourceRoot":"","sources":["../../src/secrets/secret-names.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU;IACV,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;IACjB,kBAAkB;IAClB,0BAA0B;CAClB,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,oEAAoE;IACpE,6EAA6E;IAC7E,0BAA0B;CAClB,CAAC;AA6BX,MAAM,sBAAsB,GAAG,CAAC,cAAc,EAAE,UAAU,CAAU,CAAC;AAErE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqB,EACrB,KAAa;IAEb,OAAO,GAAG,MAAM,IAAI,KAAK,EAAsB,CAAC;AAClD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,WAAW,SAAS,UAA8B,CAAC;AAC5D,CAAC"}

package/dist/secrets/secret-store.d.ts

@@ -0,0 +1,8 @@
+import type { StoredSecretName } from "./secret-names.js";
+export interface SecretStore {
+    has(name: StoredSecretName): Promise<boolean>;
+    get(name: StoredSecretName): Promise<string | null>;
+    set(name: StoredSecretName, value: string): Promise<void>;
+    delete(name: StoredSecretName): Promise<void>;
+}
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/secrets/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}

package/dist/secrets/secret-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-store.js.map

package/dist/secrets/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":""}

package/dist/secrets/types.d.ts

@@ -0,0 +1,7 @@
+export type { InternalSecretName, ScopedSecretName, SecretName, StoredSecretName, } from "./secret-names.js";
+export type BlobName = string;
+export interface SecretCacheEntry {
+    value: string | null;
+    expiresAt: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secrets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/secrets/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/secrets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":""}