@bevel-software/platform-core-backend 0.1.0

package/dist/modules/secrets-vault/secrets-vault.contract.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Secrets Vault — the per-user credential store that backs UTCP tool variables
+ * (`${FOO_API_KEY}`). Distinct from `modules/watchlist` (connector+URL POINTERS, no
+ * credentials): this holds the actual secret VALUES, encrypted at rest, and
+ * resolves them for the `bevel-secrets` UTCP variable loader at tool-call time.
+ *
+ * This interface is the swap seam: `DbSecretsVaultService` stores secrets in our
+ * own encrypted table today, but a future `ExternalSecretManagerService` (backed
+ * by a client's HashiCorp Vault / AWS Secrets Manager / Doppler) can implement
+ * the same contract without any change to the loader or the tools.
+ */
+export type SecretKind = 'static' | 'oauth';
+/** A secret as shown in listings — NEVER carries the value or token material. */
+export interface SecretSummary {
+    id: string;
+    /** The UTCP variable name this secret resolves (e.g. `FOO_API_KEY`). */
+    key: string;
+    kind: SecretKind;
+    label: string | null;
+    /** For `oauth`: whether a token has been obtained (the user completed the flow). */
+    authorized?: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface PutStaticSecretInput {
+    userId: string;
+    key: string;
+    value: string;
+    label?: string | null;
+}
+/** A shared/admin static secret — one row per key, `user_id NULL`, read by every invoker. */
+export interface PutSharedStaticSecretInput {
+    key: string;
+    value: string;
+    label?: string | null;
+}
+/** Whether a variable's key has a shared (admin) value and/or the caller's own value. */
+export interface SecretConfigStatus {
+    key: string;
+    adminConfigured: boolean;
+    userConfigured: boolean;
+    /**
+     * For an OAuth-backed per-user row: whether the caller has completed sign-in (a
+     * token exists). `undefined` for static rows / when the caller has no row. Lets
+     * the pre-check treat "row present but not authorized" as still-missing.
+     */
+    userAuthorized?: boolean;
+    /**
+     * For an OAuth-backed per-user row: the scopes the caller's token was actually
+     * granted (space-delimited, as the provider echoed them). `undefined` for static
+     * rows, callers with no row, or tokens minted before granted scopes were
+     * captured. Lets the pre-check tell whether a token still covers a tool whose
+     * required scopes have grown.
+     */
+    grantedScopes?: string;
+}
+/**
+ * How a secret is provisioned — mirrors `ToolVariableScope` in the tool-manuals
+ * contract, redeclared here to keep the vault free of a tool-manuals import.
+ */
+export type SecretScope = 'admin' | 'user';
+/** Resolves a UTCP-namespaced key (`<manual>_<VAR>`) to its provisioning scope. */
+export type VariableScopeResolver = (key: string) => Promise<SecretScope>;
+/** Non-secret OAuth provider config the user supplies when registering an oauth secret. */
+export interface OAuthProviderConfig {
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientId: string;
+    /** Kept out of listings; stored encrypted alongside the tokens. */
+    clientSecret?: string;
+    scopes?: string[];
+    /** Extra static params appended to the authorization request (e.g. `audience`). */
+    authParams?: Record<string, string>;
+    /** Use PKCE (S256) on the authorization-code flow. Required by MCP-spec providers. */
+    pkce?: boolean;
+    /**
+     * A PUBLIC client (RFC 6749 §2.1): no client secret exists, by design — token
+     * requests authenticate with PKCE only. Distinguishes "no secret needed" from
+     * "the owner hasn't set the secret yet" (which stays an error).
+     */
+    publicClient?: boolean;
+    /**
+     * RFC 8707 resource indicator, sent on the authorization AND token requests so
+     * the issued token is audience-bound. MCP-spec providers require it (the MCP
+     * server's canonical URL).
+     */
+    resource?: string;
+}
+export interface CreateOAuthSecretInput {
+    userId: string;
+    key: string;
+    label?: string | null;
+    provider: OAuthProviderConfig;
+}
+export interface ISecretsVaultService {
+    /** The caller's secrets (values omitted). */
+    list(userId: string): Promise<SecretSummary[]>;
+    /** One secret's summary, or null if it isn't the caller's. */
+    getById(userId: string, id: string): Promise<SecretSummary | null>;
+    /** Create or replace the caller's (per-user) static secret keyed by its UTCP variable name. */
+    putStatic(input: PutStaticSecretInput): Promise<SecretSummary>;
+    /** Create or replace the SHARED (admin) static secret for a key — read by every invoker. */
+    putSharedStatic(input: PutSharedStaticSecretInput): Promise<SecretSummary>;
+    /** Register an oauth secret (provider config only; tokens arrive via the flow). */
+    createOAuth(input: CreateOAuthSecretInput): Promise<SecretSummary>;
+    /** Delete the caller's secret by id. */
+    remove(userId: string, id: string): Promise<void>;
+    /** Delete the caller's (per-user) secret by key. */
+    removeUserByKey(userId: string, key: string): Promise<void>;
+    /** Delete the SHARED (admin) secret for a key. */
+    removeShared(key: string): Promise<void>;
+    /** Per-key config status (shared value present? caller's own value present?) for the UI. */
+    statusFor(userId: string, keys: string[]): Promise<SecretConfigStatus[]>;
+    /** Build the provider consent URL for an oauth secret; the caller supplies redirect + signed state. */
+    beginOAuth(userId: string, id: string, redirectUri: string, state: string): Promise<string>;
+    /** Exchange the returned code for tokens and persist them on the oauth secret. */
+    completeOAuth(userId: string, id: string, code: string, redirectUri: string): Promise<void>;
+    /**
+     * Set the confidential client secret + provider config for a tool's OAuth-backed
+     * variable, on the SHARED row (`user_id NULL`) for `key`. The provider meta is
+     * stored ALONGSIDE the secret so a later `.tool` edit can't redirect it. Owner-
+     * gated by the route (write access on the `.tool`).
+     */
+    putSharedOAuthClientSecret(input: {
+        key: string;
+        clientSecret: string;
+        provider: OAuthProviderConfig;
+    }): Promise<void>;
+    /**
+     * Set the provider config for a key's SHARED row where the client may be
+     * PUBLIC (no secret) — the path auto-discovery uses after dynamically
+     * registering a client with an MCP-spec provider. `putSharedOAuthClientSecret`
+     * stays the owner-typed path (secret required).
+     */
+    putSharedOAuthProvider(input: {
+        key: string;
+        label?: string | null;
+        provider: OAuthProviderConfig;
+    }): Promise<void>;
+    /**
+     * The PUBLIC provider config stored on a key's shared oauth row (never the
+     * secret), or null when no shared oauth row exists. Lets auto-discovery skip
+     * re-registering a client whose registration is already persisted.
+     */
+    getSharedOAuthProvider(key: string): Promise<OAuthProviderConfig | null>;
+    /**
+     * Provision (if needed) the caller's per-user oauth row for `key` from the SHARED
+     * row's stored provider meta + client secret, then build the consent URL. 409 if
+     * the owner hasn't set the client secret. Returns the provisioned row's id (to
+     * sign into the callback state) and the consent url.
+     *
+     * `scopes`, when given, are the permissions to REQUEST on the consent screen —
+     * supplied by the caller from the live tool file so a scope added there takes
+     * effect without the owner re-entering the secret. Only the requested scopes
+     * follow the tool file; the client id, addresses, and secret are still read from
+     * the owner-set shared row. Omitted → the shared row's stored scopes are used.
+     */
+    beginToolOAuthByKey(input: {
+        userId: string;
+        key: string;
+        redirectUri: string;
+        state: string;
+        scopes?: string[];
+    }): Promise<{
+        id: string;
+        url: string;
+    }>;
+    /**
+     * Resolve the injectable value for a UTCP variable `key` — the only reader of
+     * secret material. `static` → the decrypted value; `oauth` → a fresh access
+     * token (refreshed on demand). Returns null when missing or not-yet-authorized.
+     */
+    resolve(userId: string, key: string): Promise<string | null>;
+}
+/** Thrown when input fails validation. Routes map to 422. */
+export declare class InvalidSecretError extends Error {
+    constructor(message: string);
+}
+/** Thrown when the secret doesn't exist for this caller. Routes map to 404. */
+export declare class SecretNotFoundError extends Error {
+    constructor(id: string);
+}
+/** Thrown when an OAuth operation can't proceed (e.g. resolve before authorize). Routes map to 409. */
+export declare class SecretOAuthError extends Error {
+    /**
+     * The provider token-endpoint's HTTP status, when the failure IS a provider
+     * response. Lets the refresh path tell a definitive rejection (400/401 —
+     * the grant is dead, mark it so) from a transient outage (keep the tokens,
+     * try again next call).
+     */
+    readonly providerStatus?: number | undefined;
+    constructor(message: string, 
+    /**
+     * The provider token-endpoint's HTTP status, when the failure IS a provider
+     * response. Lets the refresh path tell a definitive rejection (400/401 —
+     * the grant is dead, mark it so) from a transient outage (keep the tokens,
+     * try again next call).
+     */
+    providerStatus?: number | undefined);
+}
+/**
+ * The tool's currently-required scopes NOT covered by the token's granted scopes,
+ * returned in their ORIGINAL declared form (so a UI shows what the tool author
+ * wrote, not the canonical spelling). Matching is by canonical form, so `email`
+ * declared against a granted `.../userinfo.email` is covered. Unknown/empty granted
+ * → everything required is missing (fail-closed). No required scopes → none missing.
+ */
+export declare function missingScopes(required: string[] | undefined, granted: string | undefined): string[];
+export declare function scopesCovered(required: string[] | undefined, granted: string | undefined): boolean;
+//# sourceMappingURL=secrets-vault.contract.d.ts.map

package/dist/modules/secrets-vault/secrets-vault.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sFAAsF;IACtF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnE,+FAA+F;IAC/F,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,4FAA4F;IAC5F,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,wCAAwC;IACxC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,oDAAoD;IACpD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kDAAkD;IAClD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAGzE,uGAAuG;IACvG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,kFAAkF;IAClF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5F;;;;;OAKG;IACH,0BAA0B,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,sBAAsB,CAAC,KAAK,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzE;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,6DAA6D;AAC7D,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,uGAAuG;AACvG,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;gBAPhC,OAAO,EAAE,MAAM;IACf;;;;;OAKG;IACM,cAAc,CAAC,EAAE,MAAM,YAAA;CAKnC;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAInG;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElG"}

package/dist/modules/secrets-vault/secrets-vault.contract.js

@@ -0,0 +1,90 @@
+/**
+ * Secrets Vault — the per-user credential store that backs UTCP tool variables
+ * (`${FOO_API_KEY}`). Distinct from `modules/watchlist` (connector+URL POINTERS, no
+ * credentials): this holds the actual secret VALUES, encrypted at rest, and
+ * resolves them for the `bevel-secrets` UTCP variable loader at tool-call time.
+ *
+ * This interface is the swap seam: `DbSecretsVaultService` stores secrets in our
+ * own encrypted table today, but a future `ExternalSecretManagerService` (backed
+ * by a client's HashiCorp Vault / AWS Secrets Manager / Doppler) can implement
+ * the same contract without any change to the loader or the tools.
+ */
+/** Thrown when input fails validation. Routes map to 422. */
+export class InvalidSecretError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidSecretError';
+    }
+}
+/** Thrown when the secret doesn't exist for this caller. Routes map to 404. */
+export class SecretNotFoundError extends Error {
+    constructor(id) {
+        super(`Secret not found: ${id}`);
+        this.name = 'SecretNotFoundError';
+    }
+}
+/** Thrown when an OAuth operation can't proceed (e.g. resolve before authorize). Routes map to 409. */
+export class SecretOAuthError extends Error {
+    providerStatus;
+    constructor(message, 
+    /**
+     * The provider token-endpoint's HTTP status, when the failure IS a provider
+     * response. Lets the refresh path tell a definitive rejection (400/401 —
+     * the grant is dead, mark it so) from a transient outage (keep the tokens,
+     * try again next call).
+     */
+    providerStatus) {
+        super(message);
+        this.providerStatus = providerStatus;
+        this.name = 'SecretOAuthError';
+    }
+}
+/**
+ * Whether an OAuth token's granted scopes cover a tool's currently-required scopes:
+ * every required scope must be among the granted ones. No required scopes → trivially
+ * covered. Granted scopes unknown (a token minted before we recorded them, `undefined`)
+ * → NOT covered when anything is required, so the caller is safely routed to re-auth
+ * rather than hitting an opaque provider error. `granted` is the space-delimited string
+ * the provider echoed (`SecretConfigStatus.grantedScopes`); `required` is the manual's
+ * declared list. Lives here (a leaf, dependency-free) so both the MCP pre-check and the
+ * connect route can share one definition without crossing module boundaries.
+ */
+// Google canonicalizes the OIDC convenience aliases `email`/`profile` to its
+// userinfo.* URLs in the `scope` string it echoes at token grant, so a token asked
+// for `email` comes back carrying `https://www.googleapis.com/auth/userinfo.email`.
+// Map both spellings to one canonical form so exact set-membership still matches.
+//
+// INVARIANT — IDENTITY ALIASES ONLY. Every pair here MUST denote the exact same
+// grant in both directions. NEVER add a subsumption (a broad scope that merely
+// *contains* a narrower one, e.g. `.../m8/feeds/` → `.../auth/contacts`) or an
+// unverified alias (`address`, `phone`, `plus.me`): either would let an under-scoped
+// token satisfy a scope it was never granted, breaking the fail-closed guarantee.
+// `openid` has NO url form — it is echoed verbatim, so it is intentionally absent
+// and already matches on both sides.
+const SCOPE_ALIASES = {
+    email: 'https://www.googleapis.com/auth/userinfo.email',
+    'https://www.googleapis.com/auth/userinfo.email': 'https://www.googleapis.com/auth/userinfo.email',
+    profile: 'https://www.googleapis.com/auth/userinfo.profile',
+    'https://www.googleapis.com/auth/userinfo.profile': 'https://www.googleapis.com/auth/userinfo.profile',
+};
+/** Collapse a scope string to its canonical form; unknown scopes pass through unchanged. */
+function canonicalizeScope(s) {
+    return SCOPE_ALIASES[s] ?? s;
+}
+/**
+ * The tool's currently-required scopes NOT covered by the token's granted scopes,
+ * returned in their ORIGINAL declared form (so a UI shows what the tool author
+ * wrote, not the canonical spelling). Matching is by canonical form, so `email`
+ * declared against a granted `.../userinfo.email` is covered. Unknown/empty granted
+ * → everything required is missing (fail-closed). No required scopes → none missing.
+ */
+export function missingScopes(required, granted) {
+    if (!required || required.length === 0)
+        return [];
+    const grantedSet = new Set((granted ?? '').split(/\s+/).filter(Boolean).map(canonicalizeScope));
+    return required.filter((s) => !grantedSet.has(canonicalizeScope(s)));
+}
+export function scopesCovered(required, granted) {
+    return missingScopes(required, granted).length === 0;
+}
+//# sourceMappingURL=secrets-vault.contract.js.map

package/dist/modules/secrets-vault/secrets-vault.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.contract.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiLH,6DAA6D;AAC7D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,EAAU;QACpB,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,uGAAuG;AACvG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAS9B;IARX,YACE,OAAe;IACf;;;;;OAKG;IACM,cAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,mBAAc,GAAd,cAAc,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qFAAqF;AACrF,kFAAkF;AAClF,kFAAkF;AAClF,qCAAqC;AACrC,MAAM,aAAa,GAA2B;IAC5C,KAAK,EAAE,gDAAgD;IACvD,gDAAgD,EAAE,gDAAgD;IAClG,OAAO,EAAE,kDAAkD;IAC3D,kDAAkD,EAAE,kDAAkD;CACvG,CAAC;AAEF,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/modules/secrets-vault/secrets-vault.routes.d.ts

@@ -0,0 +1,30 @@
+import express from 'express';
+import { type ISecretsVaultService } from './secrets-vault.contract.js';
+import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import '../auth/auth.middleware.js';
+export interface SecretsVaultRoutesDeps {
+    secretsVault: ISecretsVaultService;
+    /** Source of `.tool` manuals + their declared variable scopes (default-branch catalog). */
+    toolManualService: IToolManualService;
+    /** Gates who may set a tool's ADMIN (shared) secrets — writers of the `.tool` file. */
+    accessControl: IAccessControl;
+    /** HMAC secret for signing the OAuth `state` (reuse the connector state secret). */
+    stateSecret: string;
+    /** Public base URL of THIS backend — builds the OAuth redirect URI. */
+    publicBackendUrl: string;
+    /** Public base URL of the SPA — where the OAuth callback lands the browser. */
+    publicFrontendUrl: string;
+}
+/**
+ * Authenticated Secrets Vault CRUD + OAuth start. Every route is scoped to
+ * `req.userId` — secrets are private per user. Mounted behind the JWT middleware.
+ */
+export declare function createSecretsVaultRoutes(deps: SecretsVaultRoutesDeps): express.Router;
+/**
+ * The un-authenticated OAuth callback. Mounted BEFORE the JWT middleware: the
+ * provider redirects the browser here with no Authorization header, so the
+ * caller's identity rides in the signed `state`.
+ */
+export declare function createSecretsVaultPublicRoutes(deps: SecretsVaultRoutesDeps): express.Router;
+//# sourceMappingURL=secrets-vault.routes.d.ts.map

package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-vault.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AAEpH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,2FAA2F;IAC3F,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,uFAAuF;IACvF,aAAa,EAAE,cAAc,CAAC;IAC9B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAoZrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CA6B3F"}