@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/secrets-vault/index.d.ts

@@ -1,7 +1,7 @@
 export { DbSecretsVaultService } from './db-secrets-vault.service.js';
 export { McpOAuthDiscoveryService, type McpAuthDiscovery } from './mcp-oauth-discovery.service.js';
 export { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, type SecretsVaultRoutesDeps, } from './secrets-vault.routes.js';
-export type { ISecretsVaultService, SecretSummary, SecretKind, OAuthProviderConfig, PutStaticSecretInput, CreateOAuthSecretInput, } from './secrets-vault.contract.js';
+export type { ISecretsVaultService, SecretSummary, SecretKind, OAuthProviderConfig, PutStaticSecretInput, CreateOAuthSecretInput, ForcedRefreshOutcome, } from './secrets-vault.contract.js';
 export { InvalidSecretError, SecretNotFoundError, SecretOAuthError, } from './secrets-vault.contract.js';
 export { registerBevelSecretsVariableLoader, bevelSecretsLoaderConfig, BEVEL_SECRETS_LOADER_TYPE, } from './secrets-variable-loader.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/modules/secrets-vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}

package/dist/modules/secrets-vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAyB,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AASnC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAyB,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-discovery.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAI7F,MAAM,MAAM,gBAAgB;AAC1B,yEAAyE;AACvE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,gFAAgF;GAC9E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE;AACpD,uFAAuF;GACrF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,wBAAwB;IAQjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsE;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmF;IAC3G,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6D;gBAGrE,IAAI,EAAE;QACrB,YAAY,EAAE,oBAAoB,CAAC;QACnC,mGAAmG;QACnG,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;KACxB;IAGH,OAAO,CAAC,GAAG;IAIX,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAInC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAY9E;;;;;;OAMG;IACG,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBhH,OAAO,CAAC,QAAQ;YAMF,QAAQ;YAgCR,aAAa;IA2D3B,gFAAgF;YAClE,0BAA0B;YAuB1B,+BAA+B;YAwG/B,QAAQ;IAUtB,yFAAyF;YAC3E,SAAS;CAUxB"}
+{"version":3,"file":"mcp-oauth-discovery.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAO7F,MAAM,MAAM,gBAAgB;AAC1B,yEAAyE;AACvE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,gFAAgF;GAC9E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE;AACpD,uFAAuF;GACrF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,wBAAwB;IAQjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsE;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmF;IAC3G,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6D;gBAGrE,IAAI,EAAE;QACrB,YAAY,EAAE,oBAAoB,CAAC;QACnC,mGAAmG;QACnG,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;KACxB;IAGH,OAAO,CAAC,GAAG;IAIX,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAInC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAY9E;;;;;;OAMG;IACG,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBhH,OAAO,CAAC,QAAQ;YAMF,QAAQ;YAgCR,aAAa;IA2D3B,gFAAgF;YAClE,0BAA0B;YAuB1B,+BAA+B;YAwG/B,QAAQ;IAUtB,yFAAyF;YAC3E,SAAS;CAUxB"}

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js

@@ -1,3 +1,5 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('mcp-oauth-discovery');
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import { utcpNamespacedKey, MCP_OAUTH_VAR } from '../../shared/utcp-namespace.js';
 const FETCH_TIMEOUT_MS = 5_000;
@@ -105,7 +107,7 @@ export class McpOAuthDiscoveryService {
         }
         catch (err) {
             const reason = `provider lookup failed (not re-registering): ${err instanceof Error ? err.message : String(err)}`;
-            console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${reason}`);
+            log.warn(`"${manualName}" (${mcpUrl}): ${reason}`);
             return { status: 'unsupported', reason };
         }
         if (existing)
@@ -121,7 +123,7 @@ export class McpOAuthDiscoveryService {
             };
         }
         if (result.status === 'unsupported') {
-            console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${result.reason}`);
+            log.warn(`"${manualName}" (${mcpUrl}): ${result.reason}`);
         }
         return this.remember(key, result);
     }
@@ -195,7 +197,7 @@ export class McpOAuthDiscoveryService {
             }))
                 .then((result) => {
                 if (result.status === 'unsupported') {
-                    console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${result.reason}`);
+                    log.warn(`"${manualName}" (${mcpUrl}): ${result.reason}`);
                 }
                 this.asCache.set(mcpUrl, { result, expiresAt: this.now() + NEGATIVE_TTL_MS });
                 return result;

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-discovery.service.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA0BlF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,mFAAmF;AACnF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AACnC,6FAA6F;AAC7F,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,wBAAwB;IAQhB;IAPF,KAAK,GAAG,IAAI,GAAG,EAA2D,CAAC;IAC3E,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IACzE,6FAA6F;IAC5E,OAAO,GAAG,IAAI,GAAG,EAAwE,CAAC;IAC1F,UAAU,GAAG,IAAI,GAAG,EAAkD,CAAC;IAExF,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAkB;QAC9B,OAAO,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAc;QAChD,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAAC,UAAkB,EAAE,MAAc,EAAE,QAAgB;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EACJ,0JAA0J;aAC7J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACvD,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;SACjF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,MAAwB;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,UAAkB,EAAE,MAAc;QACpE,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClH,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,MAAM,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;YAC7E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,GAAW,EAAE,MAAc;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACjD,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EACJ,uGAAuG;oBACvG,oCAAoC,IAAI,CAAC,IAAI,CAAC,WAAW,4CAA4C;oBACrG,2HAA2H;aAC9H,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,oDAAoD;QACpD,kBAAkB,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,sBAAsB;gBACnC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBACtC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;aACnC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,GAAG,EAAE,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjH,MAAM,QAAQ,GAAwB;YACpC,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,CAAC,YAAY;YAC3B,QAAQ;SACT,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC;YAClD,GAAG;YACH,KAAK,EAAE,GAAG,UAAU,UAAU;YAC9B,QAAQ;SACT,CAAC,CAAC;QACH,uEAAuE;QACvE,MAAM,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,YAAY,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,0BAA0B,CAAC,UAAkB,EAAE,MAAc;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC;iBACnD,KAAK,CAAC,CAAC,GAAY,EAAiC,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAC;iBACF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;gBAC9E,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAC1D,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,qCAAqC;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE;wBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;qBAC1D;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,CAAC;YAC7F,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GACV,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC/D,SAAS,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM;YAC1B,CAAC,CAAC,CAAC,MAAM,CAAC;YACV,CAAC,CAAC;gBACE,IAAI,GAAG,CAAC,wCAAwC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;gBAC9G,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;aAClE,CAAC;QACN,IAAI,GAAG,GAAmC,IAAI,CAAC;QAC/C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM;QACjB,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;YAC7C,GAAG,IAAI,IAAI,CAAC;QACd,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC;YAC3D,CAAC,CAAC,GAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,wEAAwE;QACxE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxE,MAAM,YAAY,GAAG;YACnB,IAAI,GAAG,CAAC,0CAA0C,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;YACrF,IAAI,GAAG,CAAC,GAAG,UAAU,mCAAmC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;SAChF,CAAC;QACF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,MAAM;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,uCAAuC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QACjG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,EAAE,EAAE;gBACF,gBAAgB;gBAChB,QAAQ;gBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,QAAQ;gBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAiB;QACnD,kBAAkB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,yFAAyF;AACzF,SAAS,wBAAwB,CAAC,MAAqB;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"mcp-oauth-discovery.service.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AA0BlF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,mFAAmF;AACnF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AACnC,6FAA6F;AAC7F,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,wBAAwB;IAQhB;IAPF,KAAK,GAAG,IAAI,GAAG,EAA2D,CAAC;IAC3E,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IACzE,6FAA6F;IAC5E,OAAO,GAAG,IAAI,GAAG,EAAwE,CAAC;IAC1F,UAAU,GAAG,IAAI,GAAG,EAAkD,CAAC;IAExF,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAkB;QAC9B,OAAO,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAc;QAChD,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAAC,UAAkB,EAAE,MAAc,EAAE,QAAgB;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EACJ,0JAA0J;aAC7J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACvD,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;SACjF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,MAAwB;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,UAAkB,EAAE,MAAc;QACpE,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,MAAM,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,GAAW,EAAE,MAAc;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACjD,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EACJ,uGAAuG;oBACvG,oCAAoC,IAAI,CAAC,IAAI,CAAC,WAAW,4CAA4C;oBACrG,2HAA2H;aAC9H,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,oDAAoD;QACpD,kBAAkB,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,sBAAsB;gBACnC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBACtC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;aACnC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,GAAG,EAAE,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjH,MAAM,QAAQ,GAAwB;YACpC,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,CAAC,YAAY;YAC3B,QAAQ;SACT,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC;YAClD,GAAG;YACH,KAAK,EAAE,GAAG,UAAU,UAAU;YAC9B,QAAQ;SACT,CAAC,CAAC;QACH,uEAAuE;QACvE,MAAM,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,YAAY,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,0BAA0B,CAAC,UAAkB,EAAE,MAAc;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC;iBACnD,KAAK,CAAC,CAAC,GAAY,EAAiC,EAAE,CAAC,CAAC;gBACvD,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAC;iBACF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBACpC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;gBAC9E,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAC1D,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,qCAAqC;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE;wBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;qBAC1D;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,CAAC;YAC7F,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GACV,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC/D,SAAS,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM;YAC1B,CAAC,CAAC,CAAC,MAAM,CAAC;YACV,CAAC,CAAC;gBACE,IAAI,GAAG,CAAC,wCAAwC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;gBAC9G,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;aAClE,CAAC;QACN,IAAI,GAAG,GAAmC,IAAI,CAAC;QAC/C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM;QACjB,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;YAC7C,GAAG,IAAI,IAAI,CAAC;QACd,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC;YAC3D,CAAC,CAAC,GAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,wEAAwE;QACxE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxE,MAAM,YAAY,GAAG;YACnB,IAAI,GAAG,CAAC,0CAA0C,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;YACrF,IAAI,GAAG,CAAC,GAAG,UAAU,mCAAmC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;SAChF,CAAC;QACF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,MAAM;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,uCAAuC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QACjG,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,EAAE,EAAE;gBACF,gBAAgB;gBAChB,QAAQ;gBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,QAAQ;gBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAiB;QACnD,kBAAkB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,yFAAyF;AACzF,SAAS,wBAAwB,CAAC,MAAqB;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/modules/secrets-vault/secrets-variable-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-variable-loader.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAwC,MAAM,WAAW,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AASzD,qBAAa,0BAA2B,YAAW,cAAc;IAC/D,QAAQ,CAAC,oBAAoB,mBAA6B;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;gBAEX,MAAM,EAAE,MAAM;IAI1B;;;;;;;OAOG;IACG,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAcxD;AA4BD;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAE3F;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhF"}
+{"version":3,"file":"secrets-variable-loader.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAwC,MAAM,WAAW,CAAC;AAEtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAIxE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AASzD,qBAAa,0BAA2B,YAAW,cAAc;IAC/D,QAAQ,CAAC,oBAAoB,mBAA6B;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;gBAEX,MAAM,EAAE,MAAM;IAI1B;;;;;;;OAOG;IACG,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAWxD;AA4BD;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAE3F;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhF"}

package/dist/modules/secrets-vault/secrets-variable-loader.js

@@ -1,4 +1,6 @@
 import { VariableLoaderSerializer, Serializer } from '@utcp/sdk';
+import { logger } from '../../shared/logging.js';
+const log = logger('secrets-vault');
 /**
  * The `bevel-secrets` UTCP variable loader — the swappable seam that lets any
  * UTCP client resolve `${VAR}` placeholders from the Secrets Vault at tool-call
@@ -49,7 +51,7 @@ export class BevelSecretsVariableLoader {
         catch (err) {
             // Log the fault so a backend failure is distinguishable from a merely
             // unset secret (resolve returning null) when troubleshooting.
-            console.error(`[secrets-vault] resolve failed for user=${this.user_id} key=${effectiveKey}:`, err instanceof Error ? err.message : String(err));
+            log.error(`resolve failed for user=${this.user_id} key=${effectiveKey}:`, { err });
             return null;
         }
     }

package/dist/modules/secrets-vault/secrets-variable-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-variable-loader.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,wBAAwB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;GAIG;AACH,IAAI,kBAAkB,GAAgC,IAAI,CAAC;AAE3D,MAAM,OAAO,0BAA0B;IAC5B,oBAAoB,GAAG,yBAAyB,CAAC;IACjD,OAAO,CAAS;IAIzB,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,YAAoB;QAC5B,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,2CAA2C,IAAI,CAAC,OAAO,QAAQ,YAAY,GAAG,EAC9E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,oCAAqC,SAAQ,UAA0B;IAC3E,MAAM,CAAC,GAAmB;QACxB,OAAO;YACL,oBAAoB,EAAE,yBAAyB;YAC/C,OAAO,EAAG,GAAkC,CAAC,OAAO,IAAI,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,GAA4B;QACvC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF;AAED,uEAAuE;AACvE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,wDAAwD;AACxD,wBAAwB,CAAC,sBAAsB,CAC7C,yBAAyB,EACzB,IAAI,oCAAoC,EAAE,EAC1C,IAAI,CACL,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,YAAkC;IACnF,kBAAkB,GAAG,YAAY,CAAC;AACpC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"secrets-variable-loader.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,wBAAwB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;GAIG;AACH,IAAI,kBAAkB,GAAgC,IAAI,CAAC;AAE3D,MAAM,OAAO,0BAA0B;IAC5B,oBAAoB,GAAG,yBAAyB,CAAC;IACjD,OAAO,CAAS;IAIzB,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,YAAoB;QAC5B,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,QAAQ,YAAY,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,oCAAqC,SAAQ,UAA0B;IAC3E,MAAM,CAAC,GAAmB;QACxB,OAAO;YACL,oBAAoB,EAAE,yBAAyB;YAC/C,OAAO,EAAG,GAAkC,CAAC,OAAO,IAAI,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,GAA4B;QACvC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF;AAED,uEAAuE;AACvE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,wDAAwD;AACxD,wBAAwB,CAAC,sBAAsB,CAC7C,yBAAyB,EACzB,IAAI,oCAAoC,EAAE,EAC1C,IAAI,CACL,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,YAAkC;IACnF,kBAAkB,GAAG,YAAY,CAAC;AACpC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC"}

package/dist/modules/secrets-vault/secrets-vault.contract.d.ts

@@ -39,6 +39,20 @@ export interface SecretConfigStatus {
     key: string;
     adminConfigured: boolean;
     userConfigured: boolean;
+    /**
+     * How the SHARED row is stored, or `null` when there is none. A `.tool` can be
+     * edited to turn a plain key into an OAuth variable (or back) while the old row
+     * survives, and the two kinds are not interchangeable: an OAuth flow reads the
+     * client secret off an `oauth` row and `resolve` reads a value off a `static`
+     * one. A caller that asks "is this set up?" has to mean "set up AS THE KIND THE
+     * MANUAL NOW DECLARES", or it offers an Authorize the flow will refuse.
+     *
+     * Required, not optional: "the field was left out" and "there is no row" have
+     * to be the same answer, or a caller that trusts it cannot be strict.
+     */
+    adminKind: SecretKind | null;
+    /** How the CALLER's own row is stored, or `null` when they have none. Same reason. */
+    userKind: SecretKind | null;
     /**
      * For an OAuth-backed per-user row: whether the caller has completed sign-in (a
      * token exists). `undefined` for static rows / when the caller has no row. Lets
@@ -92,7 +106,41 @@ export interface CreateOAuthSecretInput {
     label?: string | null;
     provider: OAuthProviderConfig;
 }
+/** Secrets stored under one manual's name, counted — never a value, never whose. */
+export interface NamespaceSecretCount {
+    /** Typed values and shared client secrets. */
+    keys: number;
+    /** Per-user OAuth rows — somebody signed in (or started to). */
+    signIns: number;
+}
+/**
+ * Whether a vault key belongs to the namespace `prefix` (`utcpNamespacePrefix`).
+ *
+ * A bare `startsWith` is not enough: namespacing doubles every underscore, so
+ * manual `foo`'s prefix `foo_` is also the start of manual `foo_bar`'s
+ * `foo__bar_`. A remainder starting with `_` therefore belongs to a longer
+ * name.
+ *
+ * `_X` IS a legal variable name, so `foo` declaring `_bar_KEY` stores under
+ * `foo__bar_KEY` — the very key `foo_bar` declaring `KEY` stores under. The
+ * UTCP encoding makes those one row with two honest claimants, and no rule
+ * applied to the key can tell them apart. This predicate therefore answers NO
+ * for every `_`-leading remainder, with no exception for a declaring manual:
+ * the only thing it is used for is counting and WIPING a whole namespace, and
+ * an ambiguous row left standing is recoverable where one wrongly deleted is
+ * not. (Establishing that no colliding manual exists is not an option either
+ * — the tool catalog omits what it could not read, so its silence is not
+ * proof.)
+ */
+export declare function isKeyInNamespace(key: string, prefix: string): boolean;
 export interface ISecretsVaultService {
+    /** Count every user's secrets under one namespace prefix — see {@link isKeyInNamespace}. */
+    countNamespace(prefix: string): Promise<NamespaceSecretCount>;
+    /**
+     * Delete every secret under one namespace prefix — the shared rows and every
+     * user's. What deleting a tool wipes; returns what it removed.
+     */
+    removeNamespace(prefix: string): Promise<NamespaceSecretCount>;
     /** The caller's secrets (values omitted). */
     list(userId: string): Promise<SecretSummary[]>;
     /** One secret's summary, or null if it isn't the caller's. */
@@ -171,7 +219,24 @@ export interface ISecretsVaultService {
      * token (refreshed on demand). Returns null when missing or not-yet-authorized.
      */
     resolve(userId: string, key: string): Promise<string | null>;
+    /**
+     * Refresh the caller's OAuth token for `key` NOW, ignoring its stored expiry —
+     * for when a downstream server has just rejected the token (401 /
+     * `invalid_token`), which outranks whatever lifetime it was issued with.
+     * Callers own the pacing (the MCP proxy allows one per user+manual per
+     * minute); this method refreshes every time it is asked.
+     */
+    forceRefresh(userId: string, key: string): Promise<ForcedRefreshOutcome>;
 }
+/**
+ * What a {@link ISecretsVaultService.forceRefresh} did:
+ *   - `refreshed` — fresh tokens are stored; a retry will use them.
+ *   - `rejected` — the grant is dead (provider 400/401, or no refresh token):
+ *     the token set was wiped, client secret kept; the user must re-authorize.
+ *   - `transient` — network/timeout/5xx: tokens kept, a later call tries again.
+ *   - `skipped` — nothing to refresh (no such OAuth row, or not signed in).
+ */
+export type ForcedRefreshOutcome = 'refreshed' | 'rejected' | 'transient' | 'skipped';
 /** Thrown when input fails validation. Routes map to 422. */
 export declare class InvalidSecretError extends Error {
     constructor(message: string);
@@ -207,4 +272,17 @@ export declare class SecretOAuthError extends Error {
  */
 export declare function missingScopes(required: string[] | undefined, granted: string | undefined): string[];
 export declare function scopesCovered(required: string[] | undefined, granted: string | undefined): boolean;
+/**
+ * Is the stored row the KIND the manual now declares — i.e. would the thing the
+ * UI is about to offer actually work?
+ *
+ * A `.tool` can be edited to turn a plain key into an OAuth variable, or back,
+ * and the row set for the previous shape survives the edit. The two are not
+ * interchangeable: `beginToolOAuthByKey` refuses a `static` shared row, and
+ * `resolve` hands an OAuth row's ACCESS TOKEN to a variable whose consumer
+ * wants the value. So "a row exists" is never "this variable is set up", and
+ * every surface that asks the second question pairs the presence flag with the
+ * kind rather than re-deriving the rule.
+ */
+export declare function configuredAs(want: SecretKind, present: boolean | undefined, stored: SecretKind | null | undefined): boolean;
 //# sourceMappingURL=secrets-vault.contract.d.ts.map

package/dist/modules/secrets-vault/secrets-vault.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-vault.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sFAAsF;IACtF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnE,+FAA+F;IAC/F,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,4FAA4F;IAC5F,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,wCAAwC;IACxC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,oDAAoD;IACpD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kDAAkD;IAClD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAGzE,uGAAuG;IACvG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,kFAAkF;IAClF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5F;;;;;OAKG;IACH,0BAA0B,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,sBAAsB,CAAC,KAAK,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzE;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,6DAA6D;AAC7D,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,uGAAuG;AACvG,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;gBAPhC,OAAO,EAAE,MAAM;IACf;;;;;OAKG;IACM,cAAc,CAAC,EAAE,MAAM,YAAA;CAKnC;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAInG;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElG"}
+{"version":3,"file":"secrets-vault.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;OAUG;IACH,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3C,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sFAAsF;IACtF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D;;;OAGG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC/D,6CAA6C;IAC7C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnE,+FAA+F;IAC/F,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,4FAA4F;IAC5F,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,wCAAwC;IACxC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,oDAAoD;IACpD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kDAAkD;IAClD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAGzE,uGAAuG;IACvG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,kFAAkF;IAClF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5F;;;;;OAKG;IACH,0BAA0B,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;OAKG;IACH,sBAAsB,CAAC,KAAK,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzE;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE7D;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAEtF,6DAA6D;AAC7D,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,uGAAuG;AACvG,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM;gBAPhC,OAAO,EAAE,MAAM;IACf;;;;;OAKG;IACM,cAAc,CAAC,EAAE,MAAM,YAAA;CAKnC;AAoCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAInG;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAET"}

package/dist/modules/secrets-vault/secrets-vault.contract.js

@@ -9,6 +9,31 @@
  * by a client's HashiCorp Vault / AWS Secrets Manager / Doppler) can implement
  * the same contract without any change to the loader or the tools.
  */
+/**
+ * Whether a vault key belongs to the namespace `prefix` (`utcpNamespacePrefix`).
+ *
+ * A bare `startsWith` is not enough: namespacing doubles every underscore, so
+ * manual `foo`'s prefix `foo_` is also the start of manual `foo_bar`'s
+ * `foo__bar_`. A remainder starting with `_` therefore belongs to a longer
+ * name.
+ *
+ * `_X` IS a legal variable name, so `foo` declaring `_bar_KEY` stores under
+ * `foo__bar_KEY` — the very key `foo_bar` declaring `KEY` stores under. The
+ * UTCP encoding makes those one row with two honest claimants, and no rule
+ * applied to the key can tell them apart. This predicate therefore answers NO
+ * for every `_`-leading remainder, with no exception for a declaring manual:
+ * the only thing it is used for is counting and WIPING a whole namespace, and
+ * an ambiguous row left standing is recoverable where one wrongly deleted is
+ * not. (Establishing that no colliding manual exists is not an option either
+ * — the tool catalog omits what it could not read, so its silence is not
+ * proof.)
+ */
+export function isKeyInNamespace(key, prefix) {
+    if (!key.startsWith(prefix))
+        return false;
+    const rest = key.slice(prefix.length);
+    return rest.length > 0 && !rest.startsWith('_');
+}
 /** Thrown when input fails validation. Routes map to 422. */
 export class InvalidSecretError extends Error {
     constructor(message) {
@@ -87,4 +112,19 @@ export function missingScopes(required, granted) {
 export function scopesCovered(required, granted) {
     return missingScopes(required, granted).length === 0;
 }
+/**
+ * Is the stored row the KIND the manual now declares — i.e. would the thing the
+ * UI is about to offer actually work?
+ *
+ * A `.tool` can be edited to turn a plain key into an OAuth variable, or back,
+ * and the row set for the previous shape survives the edit. The two are not
+ * interchangeable: `beginToolOAuthByKey` refuses a `static` shared row, and
+ * `resolve` hands an OAuth row's ACCESS TOKEN to a variable whose consumer
+ * wants the value. So "a row exists" is never "this variable is set up", and
+ * every surface that asks the second question pairs the presence flag with the
+ * kind rather than re-deriving the rule.
+ */
+export function configuredAs(want, present, stored) {
+    return present === true && stored === want;
+}
 //# sourceMappingURL=secrets-vault.contract.js.map

package/dist/modules/secrets-vault/secrets-vault.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-vault.contract.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiLH,6DAA6D;AAC7D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,EAAU;QACpB,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,uGAAuG;AACvG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAS9B;IARX,YACE,OAAe;IACf;;;;;OAKG;IACM,cAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,mBAAc,GAAd,cAAc,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qFAAqF;AACrF,kFAAkF;AAClF,kFAAkF;AAClF,qCAAqC;AACrC,MAAM,aAAa,GAA2B;IAC5C,KAAK,EAAE,gDAAgD;IACvD,gDAAgD,EAAE,gDAAgD;IAClG,OAAO,EAAE,kDAAkD;IAC3D,kDAAkD,EAAE,kDAAkD;CACvG,CAAC;AAEF,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"secrets-vault.contract.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoHH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AA+GD,6DAA6D;AAC7D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,EAAU;QACpB,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,uGAAuG;AACvG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAS9B;IARX,YACE,OAAe;IACf;;;;;OAKG;IACM,cAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,mBAAc,GAAd,cAAc,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qFAAqF;AACrF,kFAAkF;AAClF,kFAAkF;AAClF,qCAAqC;AACrC,MAAM,aAAa,GAA2B;IAC5C,KAAK,EAAE,gDAAgD;IACvD,gDAAgD,EAAE,gDAAgD;IAClG,OAAO,EAAE,kDAAkD;IAC3D,kDAAkD,EAAE,kDAAkD;CACvG,CAAC;AAEF,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA8B,EAAE,OAA2B;IACvF,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,OAA4B,EAC5B,MAAqC;IAErC,OAAO,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;AAC7C,CAAC"}

package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-vault.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AACpH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,2FAA2F;IAC3F,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,uFAAuF;IACvF,aAAa,EAAE,cAAc,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,uBAAuB,CAAC;IACzC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,MAAM,CAUtE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAidrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAkC3F"}
+{"version":3,"file":"secrets-vault.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,EAOL,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AACpH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAEhG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,2FAA2F;IAC3F,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,uFAAuF;IACvF,aAAa,EAAE,cAAc,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,uBAAuB,CAAC;IACzC,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,MAAM,CAUtE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CA0gBrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAkC3F"}

package/dist/modules/secrets-vault/secrets-vault.routes.js

@@ -1,7 +1,9 @@
 import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('secrets');
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
-import { InvalidSecretError, SecretNotFoundError, SecretOAuthError, scopesCovered, missingScopes, } from './secrets-vault.contract.js';
+import { InvalidSecretError, SecretNotFoundError, SecretOAuthError, scopesCovered, missingScopes, configuredAs, } from './secrets-vault.contract.js';
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
@@ -70,7 +72,7 @@ export function createSecretsVaultRoutes(deps) {
             res.json({ secrets: await secretsVault.list(userId) });
         }
         catch (err) {
-            console.error('[secrets] list failed:', err);
+            log.error('list failed:', { err });
             res.status(500).json({ error: 'Internal error' });
         }
     });
@@ -157,9 +159,16 @@ export function createSecretsVaultRoutes(deps) {
             return void res.status(401).json({ error: 'Not authenticated' });
         try {
             const pathFilter = typeof req.query.path === 'string' ? req.query.path : null;
-            let manuals = await toolManualService.listAccessible(email);
-            if (pathFilter)
-                manuals = manuals.filter((m) => m.path === pathFilter);
+            // The Library page's spine, so it carries the refused files too: one
+            // unparseable `.tool` costs the page that tool and nothing else, and the
+            // page can say which file and why instead of rendering a gap. Narrowed
+            // by `?path=` exactly as the manuals are — the editor sidebar asking
+            // about one file gets that file's verdict, valid or not.
+            // One scan, one access pass, one snapshot: `tools` and `invalid` cannot
+            // disagree about which files the workspace held.
+            const { tools: allManuals, invalid: allInvalid } = await toolManualService.listAccessibleCatalog(email);
+            const manuals = pathFilter ? allManuals.filter((m) => m.path === pathFilter) : allManuals;
+            const invalid = pathFilter ? allInvalid.filter((i) => i.path === pathFilter) : allInvalid;
             const allKeys = manuals.flatMap((m) => (m.variables ?? []).map((v) => varKey(m.name, v.name)));
             const status = await secretsVault.statusFor(userId, allKeys);
             const statusByKey = new Map(status.map((s) => [s.key, s]));
@@ -193,18 +202,26 @@ export function createSecretsVaultRoutes(deps) {
                     };
                 }),
             })));
-            res.json({ tools });
+            res.json({ tools, invalid });
         }
         catch (err) {
-            console.error('[secrets] list tools failed:', err);
+            log.error('list tools failed:', { err });
             res.status(500).json({ error: 'Internal error' });
         }
     });
     // The aggregated "connect your tools" view for a single user: every accessible
-    // tool with ONLY its per-user (`user`-scoped) variables and whether the caller
-    // has set each, plus the caller's OAuth secrets and their authorized state. This
-    // is the surface an external-agent user lands on from the needs-authorization
-    // link — it shows exactly what THEY must provide, never the admin/shared items.
+    // tool with the variables still standing between the caller and using it, plus
+    // the caller's OAuth secrets and their authorized state. This is the surface an
+    // external-agent user lands on from the needs-authorization link.
+    //
+    // It reports the WORKSPACE-scoped (`admin`) values too, and not because the
+    // reader can always set them: the Library's plugin banner COUNTS an integration
+    // that needs one, so a page that left them out told the reader four things
+    // needed setup and then showed two. An `admin` value the caller may not write
+    // is flagged `ownerOnly` — the page greys it and names who has to act — and one
+    // that is already set is nobody's outstanding work, so it is dropped. What is
+    // not relaxed is readability: the listing is still built from `listAccessible`,
+    // so a tool the caller may not read is named here in no state at all.
     router.get('/connect/pending', async (req, res) => {
         const userId = req.userId;
         const email = req.userEmail;
@@ -212,51 +229,88 @@ export function createSecretsVaultRoutes(deps) {
             return void res.status(401).json({ error: 'Not authenticated' });
         try {
             const manuals = await toolManualService.listAccessible(email);
-            const allKeys = manuals.flatMap((m) => (m.variables ?? []).filter((v) => v.scope === 'user').map((v) => varKey(m.name, v.name)));
+            // BOTH tiers now — the workspace values are reported as well, so their
+            // stored state has to be asked for.
+            const allKeys = manuals.flatMap((m) => (m.variables ?? []).map((v) => varKey(m.name, v.name)));
             const status = await secretsVault.statusFor(userId, allKeys);
             const statusByKey = new Map(status.map((s) => [s.key, s]));
+            // Who may set a tool's workspace values — writers of its `.tool` file, the
+            // same verdict the admin write route enforces. Resolved once per manual
+            // because both the key rows and the sign-in rows ask it.
+            const canWriteBySlug = new Map(await Promise.all(manuals.map(async (m) => [m.slug, await accessControl.canWrite(defaultWs(), email, m.path)])));
             const tools = manuals
-                .map((m) => ({
-                slug: m.slug,
-                name: m.name,
-                path: m.path,
-                type: m.type,
-                // Plain (non-OAuth) per-user vars render as key inputs under "Keys".
-                variables: (m.variables ?? [])
-                    .filter((v) => v.scope === 'user' && !v.oauth)
-                    .map((v) => {
-                    const key = varKey(m.name, v.name);
-                    return {
-                        name: v.name,
-                        label: v.label ?? null,
-                        key,
-                        configured: statusByKey.get(key)?.userConfigured ?? false,
-                    };
-                }),
-            }))
-                // Only surface tools that actually have per-user items to configure.
+                .map((m) => {
+                const canWrite = canWriteBySlug.get(m.slug) ?? false;
+                return {
+                    slug: m.slug,
+                    name: m.name,
+                    path: m.path,
+                    type: m.type,
+                    canWrite,
+                    // Plain (non-OAuth) vars render as key rows under "Keys".
+                    variables: (m.variables ?? [])
+                        .filter((v) => !v.oauth)
+                        .map((v) => {
+                        const key = varKey(m.name, v.name);
+                        const st = statusByKey.get(key);
+                        return {
+                            name: v.name,
+                            label: v.label ?? null,
+                            key,
+                            scope: v.scope,
+                            // "Is there a value this caller's agent would resolve?" — the
+                            // workspace's for an `admin` var, the caller's own for a `user`
+                            // one. A row of the WRONG KIND does not count: this var is not
+                            // oauth, so an `oauth` row left behind by an earlier `.tool`
+                            // edit holds a token set where `resolve` wants a value, and
+                            // calling that configured hides the key nobody has set.
+                            configured: v.scope === 'admin'
+                                ? configuredAs('static', st?.adminConfigured, st?.adminKind)
+                                : configuredAs('static', st?.userConfigured, st?.userKind),
+                            ownerOnly: v.scope === 'admin' && !canWrite,
+                        };
+                    })
+                        // A workspace value already set is outstanding for nobody. The
+                        // caller's own vars stay listed once set, because this page is also
+                        // where they replace one.
+                        .filter((v) => v.scope !== 'admin' || !v.configured),
+                };
+            })
+                // Only surface tools that actually have something to show.
                 .filter((t) => t.variables.length > 0);
             // OAuth-backed per-user vars render as Authorize buttons under "Sign-ins".
             // Keyed by slug+var (the caller's row may not exist yet), with authorized
             // state from the oauth-aware status.
-            const toolOAuth = manuals.flatMap((m) => (m.variables ?? [])
-                .filter((v) => v.scope === 'user' && v.oauth)
-                .map((v) => {
-                const st = statusByKey.get(varKey(m.name, v.name));
-                const authorized = st?.userAuthorized ?? false;
-                // Signed in, but the token's granted scopes no longer cover what the
-                // tool declares → surface as needing re-authorization, not as connected.
-                const needsReauth = authorized && !scopesCovered(v.oauth?.scopes, st?.grantedScopes);
-                return {
-                    slug: m.slug,
-                    varName: v.name,
-                    toolName: m.name,
-                    key: varKey(m.name, v.name),
-                    label: v.label ?? null,
-                    authorized,
-                    needsReauth,
-                };
-            }));
+            const toolOAuth = manuals.flatMap((m) => {
+                const canWrite = canWriteBySlug.get(m.slug) ?? false;
+                return (m.variables ?? [])
+                    .filter((v) => v.scope === 'user' && v.oauth)
+                    .map((v) => {
+                    const st = statusByKey.get(varKey(m.name, v.name));
+                    const authorized = st?.userAuthorized ?? false;
+                    // Signed in, but the token's granted scopes no longer cover what the
+                    // tool declares → surface as needing re-authorization, not as connected.
+                    const needsReauth = authorized && !scopesCovered(v.oauth?.scopes, st?.grantedScopes);
+                    // On an oauth var the ADMIN row is the provider registration — the
+                    // client secret — without which nobody's Authorize can work. It is a
+                    // workspace value like any other, so it carries the same flag. It
+                    // must be an OAUTH row: `beginToolOAuthByKey` refuses a static one,
+                    // so a shared key left over from before this var was made OAuth
+                    // would otherwise light up Authorize with nothing behind it.
+                    const ownerConfigured = configuredAs('oauth', st?.adminConfigured, st?.adminKind);
+                    return {
+                        slug: m.slug,
+                        varName: v.name,
+                        toolName: m.name,
+                        key: varKey(m.name, v.name),
+                        label: v.label ?? null,
+                        authorized,
+                        needsReauth,
+                        ownerConfigured,
+                        ownerOnly: !ownerConfigured && !canWrite,
+                    };
+                });
+            });
             // Standalone sign-ins = oauth secrets the user registered directly on the
             // Secrets page. A TOOL sign-in provisions a per-user row in the same
             // table (keyed `<manual>_<VAR>`), so exclude every tool-var key here or
@@ -270,7 +324,7 @@ export function createSecretsVaultRoutes(deps) {
             res.json({ tools, oauth, toolOAuth });
         }
         catch (err) {
-            console.error('[secrets] connect/pending failed:', err);
+            log.error('connect/pending failed:', { err });
             res.status(500).json({ error: 'Internal error' });
         }
     });
@@ -537,7 +591,7 @@ export function createSecretsVaultPublicRoutes(deps) {
             back(`authorized=${encodeURIComponent(state.i)}`, dest);
         }
         catch (err) {
-            console.error('[secrets] oauth callback failed:', err instanceof Error ? err.message : String(err));
+            log.error('oauth callback failed:', { err });
             back(`error=${encodeURIComponent('Authorization failed. Check the provider configuration and try again.')}`, dest);
         }
     });
@@ -550,7 +604,7 @@ function mapError(err, res, op) {
         return void res.status(404).json({ error: err.message });
     if (err instanceof SecretOAuthError)
         return void res.status(409).json({ error: err.message });
-    console.error(`[secrets] ${op} failed:`, err);
+    log.error(`${op} failed:`, { err });
     res.status(500).json({ error: 'Internal error' });
 }
 const OAUTH_STATE_MAX_AGE_MS = 10 * 60_000;