@cat-factory/kernel 0.148.1 → 0.148.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/ports/agent-definition.d.ts +11 -0
- package/dist/ports/agent-definition.d.ts.map +1 -1
- package/dist/ports/index.d.ts +4 -1
- package/dist/ports/index.d.ts.map +1 -1
- package/dist/ports/index.js +1 -0
- package/dist/ports/index.js.map +1 -1
- package/dist/ports/key-fingerprint-store.d.ts +11 -0
- package/dist/ports/key-fingerprint-store.d.ts.map +1 -0
- package/dist/ports/key-fingerprint-store.js +9 -0
- package/dist/ports/key-fingerprint-store.js.map +1 -0
- package/dist/ports/sealed-secret-inventory.d.ts +48 -0
- package/dist/ports/sealed-secret-inventory.d.ts.map +1 -0
- package/dist/ports/sealed-secret-inventory.js +8 -0
- package/dist/ports/sealed-secret-inventory.js.map +1 -0
- package/dist/ports/secret-cipher.d.ts +21 -0
- package/dist/ports/secret-cipher.d.ts.map +1 -1
- package/dist/ports/secret-cipher.js +13 -1
- package/dist/ports/secret-cipher.js.map +1 -1
- package/package.json +2 -2
|
@@ -47,6 +47,17 @@ export interface AgentCloneSpec {
|
|
|
47
47
|
sparsePaths?: string[];
|
|
48
48
|
/** Full history (needed to diff against base / merge); absent ⇒ shallow. */
|
|
49
49
|
full?: boolean;
|
|
50
|
+
/**
|
|
51
|
+
* Fetch the reviewed PR's HEAD into the checkout as `origin/pr-head` before the agent runs
|
|
52
|
+
* (the `pr-reviewer`). A review clones the `base` branch — so files the PR ADDS are absent and
|
|
53
|
+
* modified files are only at their base version — and the container agent has no git credential
|
|
54
|
+
* of its own, so it cannot fetch the head itself (the token lives with the harness). When set,
|
|
55
|
+
* the engine resolves the block's reviewed PR number into the job's `reviewPrNumber` and the
|
|
56
|
+
* harness fetches `pull/<n>/head` (GitHub) / `merge-requests/<n>/head` (GitLab) with its token,
|
|
57
|
+
* so the agent can `git diff origin/<base>...origin/pr-head` and read full head file bodies.
|
|
58
|
+
* Best-effort: a failed fetch just leaves the review on the base checkout + injected diff.
|
|
59
|
+
*/
|
|
60
|
+
prHead?: boolean;
|
|
50
61
|
}
|
|
51
62
|
/** The optional LLM step of an agent definition. */
|
|
52
63
|
export interface AgentStepSpec {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-definition.d.ts","sourceRoot":"","sources":["../../src/ports/agent-definition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAoBhD,sCAAsC;AACtC,MAAM,MAAM,YAAY;AACtB,oFAAoF;AAClF,QAAQ;AACV,6FAA6F;GAC3F,mBAAmB;AACrB,8FAA8F;GAC5F,kBAAkB,CAAA;AAEtB,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,8FAA8F;IAC9F,IAAI,EAAE,OAAO,GAAG,YAAY,CAAA;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,YAAY,CAAA;IAC7C,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,OAAO,CAAA;
|
|
1
|
+
{"version":3,"file":"agent-definition.d.ts","sourceRoot":"","sources":["../../src/ports/agent-definition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAoBhD,sCAAsC;AACtC,MAAM,MAAM,YAAY;AACtB,oFAAoF;AAClF,QAAQ;AACV,6FAA6F;GAC3F,mBAAmB;AACrB,8FAA8F;GAC5F,kBAAkB,CAAA;AAEtB,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,8FAA8F;IAC9F,IAAI,EAAE,OAAO,GAAG,YAAY,CAAA;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,YAAY,CAAA;IAC7C,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,CAAA;IAC5C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,CAAA;IACf,sFAAsF;IACtF,OAAO,EAAE,eAAe,CAAA;IACxB,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;OAQG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,WAAW,CAAC,EAAE,cAAc,CAAA;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,mBAAmB,EAAE,CAAA;CACrC;AAED;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA"}
|
package/dist/ports/index.d.ts
CHANGED
|
@@ -51,7 +51,10 @@ export type { SkillResource, AccountSkillRecord, AccountSkillRepository, SkillSo
|
|
|
51
51
|
export type { AppCaches, AccountModelPolicyCacheValue, BudgetLimitCacheValue, CachedRepoRead, GroupCacheHandle, RiskPolicyCacheValue, WorkspaceAccessCacheValue, WorkspaceSettingsCacheValue, } from './caching.js';
|
|
52
52
|
export { readCachedWorkspaceSettings, repoFilesCacheGroup } from './caching.js';
|
|
53
53
|
export type { SelectableFragment, FragmentSelectionContext, FragmentSelector, ResolvedRunFragment, FragmentResolverInput, FragmentRunSelection, FragmentResolver, } from './fragment-selector.js';
|
|
54
|
-
export type { SecretCipher } from './secret-cipher.js';
|
|
54
|
+
export type { SecretCipher, SecretDecryptFailureReason } from './secret-cipher.js';
|
|
55
|
+
export { SecretDecryptError, isSecretDecryptError } from './secret-cipher.js';
|
|
56
|
+
export type { KeyFingerprintStore } from './key-fingerprint-store.js';
|
|
57
|
+
export type { SealedSecretInventory, SealedSecretRef, DropSealedSecretResult, } from './sealed-secret-inventory.js';
|
|
55
58
|
export type { PersonalSecretCipher } from './personal-secret-cipher.js';
|
|
56
59
|
export type { EnvironmentProvider, AsyncProvisionCapability, DeployProvisionJob, DeployCloneTarget, DeployProvisionInputs, EnvironmentConnectionTestRequest, ProvisionContext, ProvisionEnvironmentRequest, EnvironmentStatusRequest, EnvironmentTeardownRequest, ProvisionedEnvironment, RecipeStepLog, RecipeStepRecorder, SharedStackEnsureResult, ProvisionFields, SecretResolver, RepoFileReader, RepoValidationSeverity, RepoValidationIssue, RepoValidationRequest, RepoValidationResult, BootstrapConfigFile, BootstrapConfigRequest, BootstrapConfigResult, RepairAgentRequest, RepairAgentSpec, } from './environment-provider.js';
|
|
57
60
|
export type { PreflightProbeOutcome, PreflightHostProbes } from './preflight.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,MAAM,EACN,aAAa,EACb,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,YAAY,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAChF,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAC7D,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,GACnB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,MAAM,EACN,aAAa,EACb,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,YAAY,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,YAAY,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrF,YAAY,EACV,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAChF,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAC7D,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,KAAK,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,GAChB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,GACnB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,SAAS,EACT,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,eAAe,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,2BAA2B,EAC3B,+BAA+B,EAC/B,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AACjF,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,YAAY,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAClG,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EACV,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,+BAA+B,CAAA;AACtC,YAAY,EACV,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,0CAA0C,CAAA;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACtF,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AAC9E,YAAY,EACV,yBAAyB,EACzB,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,YAAY,EACV,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AACpG,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC5E,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAA;AACvF,YAAY,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC7E,YAAY,EACV,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC3E,YAAY,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAA;AACnG,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC1F,YAAY,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AACnF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACpG,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}
|
package/dist/ports/index.js
CHANGED
|
@@ -6,6 +6,7 @@ export { NoopWorkRunner } from './work-runner.js';
|
|
|
6
6
|
export { NoopEventPublisher } from './execution-events.js';
|
|
7
7
|
export { createBinaryArtifactStore } from './binary-artifacts.js';
|
|
8
8
|
export { readCachedWorkspaceSettings, repoFilesCacheGroup } from './caching.js';
|
|
9
|
+
export { SecretDecryptError, isSecretDecryptError } from './secret-cipher.js';
|
|
9
10
|
export { STRICT_URL_SAFETY_POLICY } from './url-safety-policy.js';
|
|
10
11
|
export { NoopBootstrapRunner } from './bootstrap-runner.js';
|
|
11
12
|
export { NoopEnvConfigRepairRunner } from './env-config-repair.js';
|
package/dist/ports/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAwEA,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAchF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AA8B7D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAW5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAmB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAgC,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAgExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAmFjE,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAwEA,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAchF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AA8B7D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAW5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAmB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAgC,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAgExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAmFjE,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAW/E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAqC7E,OAAO,EAAwB,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAgCvF,OAAO,EAAwB,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAWjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAOlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAcjE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAyEvF,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAA;AAoE9E,OAAO,EAGL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export interface KeyFingerprintStore {
|
|
2
|
+
/** The persisted fingerprint, or null when none has been recorded yet (first boot). */
|
|
3
|
+
get(): Promise<string | null>;
|
|
4
|
+
/**
|
|
5
|
+
* Persist the fingerprint. Called once on first boot to seed it; the boot check never
|
|
6
|
+
* overwrites a mismatching value (that would erase the drift signal), so this is a
|
|
7
|
+
* seed-once operation in practice.
|
|
8
|
+
*/
|
|
9
|
+
set(fingerprint: string): Promise<void>;
|
|
10
|
+
}
|
|
11
|
+
//# sourceMappingURL=key-fingerprint-store.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"key-fingerprint-store.d.ts","sourceRoot":"","sources":["../../src/ports/key-fingerprint-store.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7B;;;;OAIG;IACH,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
// Port for the persisted, non-secret fingerprint of the deployment's master
|
|
2
|
+
// ENCRYPTION_KEY (ADR 0026 D6.1). The fingerprint is a one-way HKDF of the key
|
|
3
|
+
// (it leaks nothing usable — you cannot recover a 32-byte key from 8 bytes of HKDF
|
|
4
|
+
// output), persisted once on first boot. Every subsequent boot recomputes it from
|
|
5
|
+
// the current key and compares: a mismatch is an O(1), definitive "the key changed
|
|
6
|
+
// since secrets were last sealed" signal, available BEFORE any request touches a
|
|
7
|
+
// stale secret. A deployment-level singleton (one row), mirrored across runtimes.
|
|
8
|
+
export {};
|
|
9
|
+
//# sourceMappingURL=key-fingerprint-store.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"key-fingerprint-store.js","sourceRoot":"","sources":["../../src/ports/key-fingerprint-store.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* A reference to one sealed secret found in the deployment's stores. It carries the sealed
|
|
3
|
+
* `envelope` (so the sweep can attempt a decrypt) and the `info` HKDF tag needed to build the
|
|
4
|
+
* right cipher for it, plus NON-secret identification (source table, row id, a human label,
|
|
5
|
+
* seal time) — NEVER the plaintext value.
|
|
6
|
+
*/
|
|
7
|
+
export interface SealedSecretRef {
|
|
8
|
+
/** The logical source, e.g. `'environment_connection'` / `'observability_connection'`. */
|
|
9
|
+
source: string;
|
|
10
|
+
/** The owning row's id (stringified; composite keys are joined). Stable per (source, id). */
|
|
11
|
+
id: string;
|
|
12
|
+
/** The workspace the secret belongs to, or null for a deployment-scoped one. */
|
|
13
|
+
workspaceId: string | null;
|
|
14
|
+
/** A human label — the connection type / provider — for the surfaced issue. Never the value. */
|
|
15
|
+
label: string;
|
|
16
|
+
/** The HKDF `info` domain-separation tag the secret was sealed under (to build its cipher). */
|
|
17
|
+
info: string;
|
|
18
|
+
/** The sealed `v1.` envelope string. */
|
|
19
|
+
envelope: string;
|
|
20
|
+
/** Epoch ms the secret was sealed (row create/update), when known. */
|
|
21
|
+
sealedAt: number | null;
|
|
22
|
+
}
|
|
23
|
+
/**
|
|
24
|
+
* The result of a {@link SealedSecretInventory.drop}: whether a stored secret was actually
|
|
25
|
+
* removed, so the caller can report "dropped" vs "already gone" (idempotent).
|
|
26
|
+
*/
|
|
27
|
+
export interface DropSealedSecretResult {
|
|
28
|
+
dropped: boolean;
|
|
29
|
+
}
|
|
30
|
+
export interface SealedSecretInventory {
|
|
31
|
+
/**
|
|
32
|
+
* Every sealed secret currently stored, across the sources this runtime knows. Used by the
|
|
33
|
+
* drift sweep to attempt a decrypt of each. Bounded to slow-moving credential tables (not
|
|
34
|
+
* high-volume telemetry), so a full scan is cheap.
|
|
35
|
+
*/
|
|
36
|
+
listSealed(): Promise<SealedSecretRef[]>;
|
|
37
|
+
/**
|
|
38
|
+
* Drop the unrecoverable ciphertext identified by `(source, id)` and flip its owning
|
|
39
|
+
* connection to a "needs re-entry" state (D6.3). Opt-in, per-secret, NEVER automatic — the
|
|
40
|
+
* value is unrecoverable, so a mistaken key change must be fixed by restoring the key, not
|
|
41
|
+
* by this. Idempotent: dropping an already-gone secret reports `dropped: false`.
|
|
42
|
+
*/
|
|
43
|
+
drop(ref: {
|
|
44
|
+
source: string;
|
|
45
|
+
id: string;
|
|
46
|
+
}): Promise<DropSealedSecretResult>;
|
|
47
|
+
}
|
|
48
|
+
//# sourceMappingURL=sealed-secret-inventory.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sealed-secret-inventory.d.ts","sourceRoot":"","sources":["../../src/ports/sealed-secret-inventory.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAA;IACd,6FAA6F;IAC7F,EAAE,EAAE,MAAM,CAAA;IACV,gFAAgF;IAChF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAA;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAA;IACZ,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IACxC;;;;;OAKG;IACH,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;CAC3E"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
// Port for enumerating (and remediating) the deployment's sealed-at-rest secrets, so a
|
|
2
|
+
// boot-time sweep can detect ENCRYPTION_KEY drift per credential and an operator can drop a
|
|
3
|
+
// specific unrecoverable one (ADR 0026 D6.2 / D6.3). Each runtime implements it over its own
|
|
4
|
+
// stores (D1 / Drizzle); the inventory is the ONLY place that knows which tables/columns hold
|
|
5
|
+
// sealed secrets, so adding a source is a change here + its two repo methods, never in the
|
|
6
|
+
// runtime-neutral sweep.
|
|
7
|
+
export {};
|
|
8
|
+
//# sourceMappingURL=sealed-secret-inventory.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sealed-secret-inventory.js","sourceRoot":"","sources":["../../src/ports/sealed-secret-inventory.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,2FAA2F;AAC3F,yBAAyB"}
|
|
@@ -4,4 +4,25 @@ export interface SecretCipher {
|
|
|
4
4
|
/** Decrypt an envelope produced by {@link encrypt}. Throws if tampered/invalid. */
|
|
5
5
|
decrypt(envelope: string): Promise<string>;
|
|
6
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* Why a {@link SecretCipher.decrypt} failed, as a machine-readable discriminant (ADR 0026 D6.2):
|
|
9
|
+
* - `key-mismatch` — the envelope parsed but AES-GCM authentication failed, i.e. the
|
|
10
|
+
* ENCRYPTION_KEY does not match the one the secret was sealed under (rotated/regenerated).
|
|
11
|
+
* The value is UNRECOVERABLE without restoring the original key. This is the drift case.
|
|
12
|
+
* - `corrupt` — the envelope itself is malformed/truncated or from a different scheme/version,
|
|
13
|
+
* so decryption never even reaches the key. A separate, non-drift fault.
|
|
14
|
+
*
|
|
15
|
+
* The drift sweep buckets each stored secret by this discriminant, so it must be typed rather
|
|
16
|
+
* than parsed from message text.
|
|
17
|
+
*/
|
|
18
|
+
export type SecretDecryptFailureReason = 'key-mismatch' | 'corrupt';
|
|
19
|
+
/** A typed {@link SecretCipher.decrypt} failure carrying its {@link SecretDecryptFailureReason}. */
|
|
20
|
+
export declare class SecretDecryptError extends Error {
|
|
21
|
+
readonly reason: SecretDecryptFailureReason;
|
|
22
|
+
constructor(reason: SecretDecryptFailureReason, message: string, options?: {
|
|
23
|
+
cause?: unknown;
|
|
24
|
+
});
|
|
25
|
+
}
|
|
26
|
+
/** Narrow an unknown thrown value to a {@link SecretDecryptError} (and optionally a reason). */
|
|
27
|
+
export declare function isSecretDecryptError(error: unknown, reason?: SecretDecryptFailureReason): error is SecretDecryptError;
|
|
7
28
|
//# sourceMappingURL=secret-cipher.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secret-cipher.d.ts","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C"}
|
|
1
|
+
{"version":3,"file":"secret-cipher.d.ts","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,0BAA0B,GAAG,cAAc,GAAG,SAAS,CAAA;AAEnE,oGAAoG;AACpG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;IAC3C,YAAY,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAI7F;CACF;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,0BAA0B,GAClC,KAAK,IAAI,kBAAkB,CAE7B"}
|
|
@@ -3,5 +3,17 @@
|
|
|
3
3
|
// implementation keyed by a service-level master secret. Used to protect the
|
|
4
4
|
// per-tenant management-API secret bundle and the per-environment access creds
|
|
5
5
|
// before they are written to D1, and to decrypt them in-memory at call time.
|
|
6
|
-
|
|
6
|
+
/** A typed {@link SecretCipher.decrypt} failure carrying its {@link SecretDecryptFailureReason}. */
|
|
7
|
+
export class SecretDecryptError extends Error {
|
|
8
|
+
reason;
|
|
9
|
+
constructor(reason, message, options) {
|
|
10
|
+
super(message, options);
|
|
11
|
+
this.name = 'SecretDecryptError';
|
|
12
|
+
this.reason = reason;
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
/** Narrow an unknown thrown value to a {@link SecretDecryptError} (and optionally a reason). */
|
|
16
|
+
export function isSecretDecryptError(error, reason) {
|
|
17
|
+
return error instanceof SecretDecryptError && (reason === undefined || error.reason === reason);
|
|
18
|
+
}
|
|
7
19
|
//# sourceMappingURL=secret-cipher.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secret-cipher.js","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E"}
|
|
1
|
+
{"version":3,"file":"secret-cipher.js","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAsB7E,oGAAoG;AACpG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAA4B;IAC3C,YAAY,MAAkC,EAAE,OAAe,EAAE,OAA6B;QAC5F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,MAAmC;IAEnC,OAAO,KAAK,YAAY,kBAAkB,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AACjG,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cat-factory/kernel",
|
|
3
|
-
"version": "0.148.
|
|
3
|
+
"version": "0.148.3",
|
|
4
4
|
"description": "Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
},
|
|
26
26
|
"dependencies": {
|
|
27
27
|
"ai": "^6.0.230",
|
|
28
|
-
"@cat-factory/contracts": "0.154.
|
|
28
|
+
"@cat-factory/contracts": "0.154.1"
|
|
29
29
|
},
|
|
30
30
|
"devDependencies": {
|
|
31
31
|
"@vitest/coverage-v8": "^4.1.10",
|