@clef-sh/ui 0.1.13-beta.88

package/dist/server/api.js

@@ -0,0 +1,1020 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiRouter = createApiRouter;
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const child_process_1 = require("child_process");
+const express_1 = require("express");
+// On Linux, libuv creates socketpairs for child stdio. Go's os.Open on
+// /dev/stdin re-opens /proc/self/fd/0 which fails with ENXIO on socketpairs.
+// Use a FIFO workaround on Linux, but not inside Jest (where the runner is
+// mocked and real subprocesses are never spawned).
+const _useStdinFifo = process.platform === "linux" && !process.env.JEST_WORKER_ID;
+const core_1 = require("@clef-sh/core");
+function createApiRouter(deps) {
+    const router = (0, express_1.Router)();
+    const parser = new core_1.ManifestParser();
+    const matrix = new core_1.MatrixManager();
+    // Wrap the runner so sops subprocesses always run from the repo root
+    // and work around /dev/stdin failures on Linux.
+    //
+    // Problem: SopsClient.encrypt passes /dev/stdin as the input file.
+    // On Linux /dev/stdin → /proc/self/fd/0 which fails with ENXIO when
+    // the Node SEA binary was spawned with stdin detached.
+    //
+    // Fix: when we see /dev/stdin in the args AND stdin content in opts,
+    // replace it with a FIFO (named pipe). A FIFO is an in-memory kernel
+    // buffer — plaintext never touches disk. The FIFO is cleaned up after
+    // the subprocess exits.
+    const sopsRunner = {
+        run: (cmd, args, opts) => {
+            const stdinIdx = args.indexOf("/dev/stdin");
+            // Only use the FIFO workaround in Linux SEA binaries where
+            // /dev/stdin → /proc/self/fd/0 fails with ENXIO on socketpairs.
+            // Normal Node.js processes (including Jest on Linux CI) work fine.
+            const needsFifo = stdinIdx >= 0 && opts?.stdin !== undefined && _useStdinFifo;
+            if (!needsFifo) {
+                return deps.runner.run(cmd, args, {
+                    ...opts,
+                    cwd: opts?.cwd ?? deps.repoRoot,
+                    env: opts?.env,
+                });
+            }
+            // Create a FIFO and feed stdin content through a background process
+            const fifoDir = (0, child_process_1.execFileSync)("mktemp", ["-d", path.join(os.tmpdir(), "clef-fifo-XXXXXX")])
+                .toString()
+                .trim();
+            const fifoPath = path.join(fifoDir, "input");
+            (0, child_process_1.execFileSync)("mkfifo", [fifoPath]);
+            // Background writer — blocks at OS level until sops opens the read end
+            const writer = (0, child_process_1.spawn)("dd", [`of=${fifoPath}`, "status=none"], {
+                stdio: ["pipe", "ignore", "ignore"],
+            });
+            writer.stdin.write(opts.stdin);
+            writer.stdin.end();
+            const patchedArgs = [...args];
+            patchedArgs[stdinIdx] = fifoPath;
+            const { stdin: _stdin, ...restOpts } = opts;
+            return deps.runner
+                .run(cmd, patchedArgs, {
+                ...restOpts,
+                cwd: restOpts?.cwd ?? deps.repoRoot,
+                env: { SOPS_CONFIG: path.join(deps.repoRoot, ".sops.yaml"), ...restOpts?.env },
+            })
+                .finally(() => {
+                try {
+                    writer.kill();
+                }
+                catch {
+                    /* already exited */
+                }
+                try {
+                    (0, child_process_1.execFileSync)("rm", ["-rf", fifoDir]);
+                }
+                catch {
+                    /* best effort */
+                }
+            });
+        },
+    };
+    const sops = new core_1.SopsClient(sopsRunner, deps.ageKeyFile, deps.ageKey, deps.sopsPath);
+    const diffEngine = new core_1.DiffEngine();
+    const schemaValidator = new core_1.SchemaValidator();
+    const lintRunner = new core_1.LintRunner(matrix, schemaValidator, sops);
+    const git = new core_1.GitIntegration(deps.runner);
+    const scanRunner = new core_1.ScanRunner(deps.runner);
+    const recipientManager = new core_1.RecipientManager(sops, matrix);
+    const serviceIdManager = new core_1.ServiceIdentityManager(sops, matrix);
+    const backendMigrator = new core_1.BackendMigrator(sops, matrix);
+    const bulkOps = new core_1.BulkOps();
+    // In-session scan cache
+    let lastScanResult = null;
+    let lastScanAt = null;
+    function loadManifest() {
+        const manifestPath = `${deps.repoRoot}/clef.yaml`;
+        return parser.parse(manifestPath);
+    }
+    function zeroStringRecord(record) {
+        for (const k of Object.keys(record))
+            record[k] = "";
+    }
+    function setNoCacheHeaders(res) {
+        res.set({
+            "Cache-Control": "no-store, no-cache, must-revalidate",
+            Pragma: "no-cache",
+            Expires: "0",
+        });
+    }
+    // GET /api/manifest
+    router.get("/manifest", (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            res.json(manifest);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load manifest";
+            res.status(500).json({ error: message, code: "MANIFEST_ERROR" });
+        }
+    });
+    // GET /api/matrix
+    router.get("/matrix", async (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            const statuses = await matrix.getMatrixStatus(manifest, deps.repoRoot, sops);
+            res.json(statuses);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to get matrix status";
+            res.status(500).json({ error: message, code: "MATRIX_ERROR" });
+        }
+    });
+    // GET /api/namespace/:ns/:env
+    // FR-31 note: Decrypted values are held in V8 heap memory during the request lifecycle.
+    // JavaScript/V8 uses immutable strings — we cannot reliably zero them after use.
+    // This is a known limitation of garbage-collected runtimes.
+    router.get("/namespace/:ns/:env", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const manifest = loadManifest();
+            const { ns, env } = req.params;
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envExists = manifest.environments.some((e) => e.name === env);
+            if (!nsExists || !envExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const decrypted = await sops.decrypt(filePath);
+            // Read pending keys from metadata (plaintext sidecar)
+            let pending = [];
+            try {
+                pending = await (0, core_1.getPendingKeys)(filePath);
+            }
+            catch {
+                // Metadata unreadable — no pending info
+            }
+            res.json({ ...decrypted, pending });
+        }
+        catch {
+            res.status(500).json({ error: "Failed to decrypt namespace", code: "DECRYPT_ERROR" });
+        }
+    });
+    // PUT /api/namespace/:ns/:env/:key
+    // body: { value: string } — set a specific value
+    // body: { random: true }  — generate random value server-side and mark pending
+    // Note: Unlike the CLI set command, the API rolls back on metadata failure
+    // to ensure callers always get a consistent state. See set.ts for the CLI
+    // approach which warns and continues. This asymmetry is intentional.
+    router.put("/namespace/:ns/:env/:key", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const manifest = loadManifest();
+            const { ns, env, key } = req.params;
+            const { value, random, confirmed } = req.body;
+            if (!random && (value === undefined || value === null)) {
+                res.status(400).json({
+                    error: "Request body must include 'value' or 'random: true'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envExists = manifest.environments.some((e) => e.name === env);
+            if (!nsExists || !envExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            if (matrix.isProtectedEnvironment(manifest, env) && !confirmed) {
+                res.status(409).json({
+                    error: "Protected environment requires confirmation",
+                    code: "PROTECTED_ENV",
+                    protected: true,
+                });
+                return;
+            }
+            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const decrypted = await sops.decrypt(filePath);
+            if (random) {
+                // Generate random value server-side and mark as pending
+                const randomValue = (0, core_1.generateRandomValue)();
+                const previousValue = decrypted.values[key];
+                decrypted.values[key] = randomValue;
+                await sops.encrypt(filePath, decrypted.values, manifest, env);
+                try {
+                    await (0, core_1.markPendingWithRetry)(filePath, [key], "clef ui");
+                }
+                catch {
+                    // Both retry attempts failed — roll back the encrypt
+                    try {
+                        if (previousValue !== undefined) {
+                            decrypted.values[key] = previousValue;
+                        }
+                        else {
+                            delete decrypted.values[key];
+                        }
+                        await sops.encrypt(filePath, decrypted.values, manifest, env);
+                    }
+                    catch {
+                        // Rollback also failed — return 500 with context
+                        return res.status(500).json({
+                            error: "Partial failure",
+                            message: "Value was encrypted but pending state could not be recorded. " +
+                                "Rollback also failed. The key may have a random placeholder value. " +
+                                "Check the file manually.",
+                            code: "PARTIAL_FAILURE",
+                        });
+                    }
+                    return res.status(500).json({
+                        error: "Pending state could not be recorded",
+                        message: "The operation was rolled back. No changes were made.",
+                        code: "PENDING_FAILURE",
+                    });
+                }
+                res.json({ success: true, key, pending: true });
+            }
+            else {
+                decrypted.values[key] = String(value);
+                await sops.encrypt(filePath, decrypted.values, manifest, env);
+                // Validate against schema if defined (B1)
+                const nsDef = manifest.namespaces.find((n) => n.name === ns);
+                if (nsDef?.schema) {
+                    try {
+                        const schema = schemaValidator.loadSchema(path.join(deps.repoRoot, nsDef.schema));
+                        const result = schemaValidator.validate({ [key]: String(value) }, schema);
+                        const violations = [...result.errors, ...result.warnings];
+                        if (violations.length > 0) {
+                            // Resolve pending state if the key was pending
+                            try {
+                                await (0, core_1.markResolved)(filePath, [key]);
+                            }
+                            catch {
+                                // Metadata update failed — non-fatal
+                            }
+                            return res.json({
+                                success: true,
+                                key,
+                                warnings: violations.map((v) => v.message),
+                            });
+                        }
+                    }
+                    catch {
+                        // Schema load failed — skip validation, not fatal
+                    }
+                }
+                // Resolve pending state if the key was pending
+                try {
+                    await (0, core_1.markResolved)(filePath, [key]);
+                }
+                catch {
+                    // Metadata update failed — non-fatal
+                }
+                res.json({ success: true, key });
+            }
+        }
+        catch {
+            res.status(500).json({ error: "Failed to set value", code: "SET_ERROR" });
+        }
+    });
+    // DELETE /api/namespace/:ns/:env/:key
+    router.delete("/namespace/:ns/:env/:key", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const manifest = loadManifest();
+            const { ns, env, key } = req.params;
+            const { confirmed } = (req.body ?? {});
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envExists = manifest.environments.some((e) => e.name === env);
+            if (!nsExists || !envExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            if (matrix.isProtectedEnvironment(manifest, env) && !confirmed) {
+                res.status(409).json({
+                    error: "Protected environment requires confirmation",
+                    code: "PROTECTED_ENV",
+                    protected: true,
+                });
+                return;
+            }
+            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const decrypted = await sops.decrypt(filePath);
+            if (!(key in decrypted.values)) {
+                res.status(404).json({
+                    error: `Key '${key}' not found in ${ns}/${env}.`,
+                    code: "KEY_NOT_FOUND",
+                });
+                return;
+            }
+            delete decrypted.values[key];
+            await sops.encrypt(filePath, decrypted.values, manifest, env);
+            // Clean up pending metadata if it exists
+            try {
+                await (0, core_1.markResolved)(filePath, [key]);
+            }
+            catch {
+                // Best effort — orphaned metadata is annoying but not dangerous
+            }
+            res.json({ success: true, key });
+        }
+        catch {
+            res.status(500).json({ error: "Failed to delete key", code: "DELETE_ERROR" });
+        }
+    });
+    // POST /api/namespace/:ns/:env/:key/accept — resolve pending state without changing the value
+    router.post("/namespace/:ns/:env/:key/accept", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const manifest = loadManifest();
+            const { ns, env, key } = req.params;
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envExists = manifest.environments.some((e) => e.name === env);
+            if (!nsExists || !envExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
+            const decrypted = await sops.decrypt(filePath);
+            const value = key in decrypted.values ? String(decrypted.values[key]) : undefined;
+            await (0, core_1.markResolved)(filePath, [key]);
+            res.json({ success: true, key, value });
+        }
+        catch {
+            res.status(500).json({ error: "Failed to accept pending value", code: "ACCEPT_ERROR" });
+        }
+    });
+    // POST /api/copy
+    // body: { key, fromNs, fromEnv, toNs, toEnv, confirmed? }
+    router.post("/copy", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { key, fromNs, fromEnv, toNs, toEnv, confirmed } = req.body;
+            if (!key || !fromNs || !fromEnv || !toNs || !toEnv) {
+                res.status(400).json({
+                    error: "Request body must include 'key', 'fromNs', 'fromEnv', 'toNs', 'toEnv'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            if (matrix.isProtectedEnvironment(manifest, toEnv) && !confirmed) {
+                res.status(409).json({
+                    error: "Protected environment requires confirmation",
+                    code: "PROTECTED_ENV",
+                    protected: true,
+                });
+                return;
+            }
+            const cells = matrix.resolveMatrix(manifest, deps.repoRoot);
+            const fromCell = cells.find((c) => c.namespace === fromNs && c.environment === fromEnv);
+            const toCell = cells.find((c) => c.namespace === toNs && c.environment === toEnv);
+            if (!fromCell || !toCell) {
+                res.status(404).json({
+                    error: "Source or destination cell not found in matrix.",
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            await bulkOps.copyValue(key, fromCell, toCell, sops, manifest);
+            res.json({ success: true, key, from: `${fromNs}/${fromEnv}`, to: `${toNs}/${toEnv}` });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to copy value";
+            res.status(500).json({ error: message, code: "COPY_ERROR" });
+        }
+    });
+    // GET /api/diff/:ns/:envA/:envB
+    router.get("/diff/:ns/:envA/:envB", async (req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const manifest = loadManifest();
+            const { ns, envA, envB } = req.params;
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envAExists = manifest.environments.some((e) => e.name === envA);
+            const envBExists = manifest.environments.some((e) => e.name === envB);
+            if (!nsExists || !envAExists || !envBExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}', environment '${envA}', or environment '${envB}' not found.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            const result = await diffEngine.diffFiles(ns, envA, envB, manifest, sops, deps.repoRoot);
+            // Mask values by default — only reveal when client explicitly requests it
+            if (req.query.showValues !== "true") {
+                for (const row of result.rows) {
+                    if (row.valueA !== null)
+                        row.valueA = "\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF";
+                    if (row.valueB !== null)
+                        row.valueB = "\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF";
+                }
+            }
+            res.json(result);
+        }
+        catch {
+            res.status(500).json({ error: "Failed to compute diff", code: "DIFF_ERROR" });
+        }
+    });
+    // GET /api/lint/:namespace
+    router.get("/lint/:namespace", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { namespace } = req.params;
+            const nsExists = manifest.namespaces.some((n) => n.name === namespace);
+            if (!nsExists) {
+                res.status(404).json({
+                    error: `Namespace '${namespace}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            const result = await lintRunner.run(manifest, deps.repoRoot);
+            const filtered = result.issues.filter((issue) => {
+                const issueNs = issue.file.split("/")[0];
+                return issueNs === namespace;
+            });
+            res.json({ issues: filtered, fileCount: result.fileCount });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to run lint";
+            res.status(500).json({ error: message, code: "LINT_ERROR" });
+        }
+    });
+    // GET /api/lint
+    router.get("/lint", async (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            const result = await lintRunner.run(manifest, deps.repoRoot);
+            res.json(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to run lint";
+            res.status(500).json({ error: message, code: "LINT_ERROR" });
+        }
+    });
+    // POST /api/lint/fix
+    router.post("/lint/fix", async (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            const result = await lintRunner.fix(manifest, deps.repoRoot);
+            res.json(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to run lint fix";
+            res.status(500).json({ error: message, code: "LINT_FIX_ERROR" });
+        }
+    });
+    // POST /api/git/commit
+    router.post("/git/commit", async (req, res) => {
+        try {
+            const { message } = req.body;
+            if (!message || typeof message !== "string") {
+                res.status(400).json({
+                    error: "Request body must include a 'message' string.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            // Stage all modified encrypted files and metadata files
+            const status = await git.getStatus(deps.repoRoot);
+            const clefFiles = [...status.staged, ...status.unstaged, ...status.untracked].filter((f) => f.endsWith(".enc.yaml") || f.endsWith(".enc.json") || f.endsWith(".clef-meta.yaml"));
+            if (clefFiles.length === 0) {
+                res.status(400).json({
+                    error: "No changes to commit",
+                    code: "NOTHING_TO_COMMIT",
+                });
+                return;
+            }
+            await git.stageFiles(clefFiles, deps.repoRoot);
+            const hash = await git.commit(message, deps.repoRoot);
+            res.json({ hash });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to commit";
+            res.status(500).json({ error: message, code: "GIT_ERROR" });
+        }
+    });
+    // GET /api/git/status
+    router.get("/git/status", async (_req, res) => {
+        try {
+            const status = await git.getStatus(deps.repoRoot);
+            res.json(status);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to get git status";
+            res.status(500).json({ error: message, code: "GIT_ERROR" });
+        }
+    });
+    // GET /api/git/diff
+    router.get("/git/diff", async (_req, res) => {
+        setNoCacheHeaders(res);
+        try {
+            const diff = await git.getDiff(deps.repoRoot);
+            res.json({ diff });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Could not get diff";
+            res.status(500).json({ error: message, code: "GIT_DIFF_ERROR" });
+        }
+    });
+    // GET /api/git/log/:ns/:env
+    router.get("/git/log/:ns/:env", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { ns, env } = req.params;
+            const nsExists = manifest.namespaces.some((n) => n.name === ns);
+            const envExists = manifest.environments.some((e) => e.name === env);
+            if (!nsExists || !envExists) {
+                res.status(404).json({
+                    error: `Namespace '${ns}' or environment '${env}' not found in manifest.`,
+                    code: "NOT_FOUND",
+                });
+                return;
+            }
+            const filePath = manifest.file_pattern
+                .replace("{namespace}", ns)
+                .replace("{environment}", env);
+            const log = await git.getLog(filePath, deps.repoRoot);
+            res.json({ log });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Could not get log";
+            res.status(500).json({ error: message, code: "GIT_LOG_ERROR" });
+        }
+    });
+    // POST /api/scan
+    router.post("/scan", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { severity, paths } = req.body;
+            const result = await scanRunner.scan(deps.repoRoot, manifest, {
+                severity: severity === "high" ? "high" : "all",
+                paths: paths && paths.length > 0 ? paths : undefined,
+            });
+            lastScanResult = result;
+            lastScanAt = new Date().toISOString();
+            res.json(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Scan failed";
+            res.status(500).json({ error: message, code: "SCAN_ERROR" });
+        }
+    });
+    // GET /api/scan/status — last scan result for this session
+    router.get("/scan/status", (_req, res) => {
+        res.json({ lastRun: lastScanResult, lastRunAt: lastScanAt });
+    });
+    // POST /api/editor/open — open a file in the OS default editor
+    router.post("/editor/open", async (req, res) => {
+        try {
+            const { file } = req.body;
+            if (!file || typeof file !== "string") {
+                res
+                    .status(400)
+                    .json({ error: "Request body must include a 'file' string.", code: "BAD_REQUEST" });
+                return;
+            }
+            const resolved = path.resolve(deps.repoRoot, file);
+            if (!resolved.startsWith(deps.repoRoot + path.sep) && resolved !== deps.repoRoot) {
+                res.status(400).json({
+                    error: "File path must be within the repository.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const editor = process.env.EDITOR || (process.env.TERM_PROGRAM === "vscode" ? "code" : "");
+            if (!editor) {
+                res.status(500).json({
+                    error: "No editor configured. Set the EDITOR environment variable.",
+                    code: "NO_EDITOR",
+                });
+                return;
+            }
+            await deps.runner.run(editor, [file], { cwd: deps.repoRoot });
+            res.json({ success: true });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to open editor";
+            res.status(500).json({ error: message, code: "EDITOR_ERROR" });
+        }
+    });
+    // POST /api/import/preview — dry run import
+    router.post("/import/preview", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { target, content, format, overwriteKeys } = req.body;
+            if (!target || typeof content !== "string") {
+                res.status(400).json({
+                    error: "Request body must include 'target' and 'content'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const parts = target.split("/");
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                res.status(400).json({
+                    error: "Invalid target format. Use 'namespace/environment'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            const importRunner = new core_1.ImportRunner(sops);
+            const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
+                format,
+                dryRun: true,
+            });
+            // Classify keys using overwriteKeys from the request
+            const overwriteSet = new Set(overwriteKeys ?? []);
+            const wouldImport = result.imported.filter((k) => !overwriteSet.has(k));
+            const wouldOverwrite = result.imported.filter((k) => overwriteSet.has(k));
+            const wouldSkip = result.skipped.map((k) => ({ key: k, reason: "already exists" }));
+            res.json({
+                wouldImport,
+                wouldSkip,
+                wouldOverwrite,
+                warnings: result.warnings,
+                totalKeys: result.imported.length + result.skipped.length,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Preview failed";
+            res.status(500).json({ error: message, code: "IMPORT_PREVIEW_ERROR" });
+        }
+    });
+    // POST /api/import/apply — run actual import
+    router.post("/import/apply", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { target, content, format, keys, overwriteKeys } = req.body;
+            if (!target || typeof content !== "string") {
+                res.status(400).json({
+                    error: "Request body must include 'target' and 'content'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            if (!Array.isArray(keys)) {
+                res
+                    .status(400)
+                    .json({ error: "Request body must include 'keys' array.", code: "BAD_REQUEST" });
+                return;
+            }
+            const parts = target.split("/");
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                res.status(400).json({
+                    error: "Invalid target format. Use 'namespace/environment'.",
+                    code: "BAD_REQUEST",
+                });
+                return;
+            }
+            if (keys.length === 0) {
+                res.json({ imported: [], skipped: [], failed: [] });
+                return;
+            }
+            const importRunner = new core_1.ImportRunner(sops);
+            const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
+                format,
+                keys,
+                overwrite: (overwriteKeys ?? []).length > 0,
+            });
+            res.json({
+                imported: result.imported,
+                skipped: result.skipped,
+                failed: result.failed,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Import failed";
+            res.status(500).json({ error: message, code: "IMPORT_APPLY_ERROR" });
+        }
+    });
+    // GET /api/recipients
+    router.get("/recipients", async (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            const recipients = await recipientManager.list(manifest, deps.repoRoot);
+            const cells = matrix.resolveMatrix(manifest, deps.repoRoot);
+            const totalFiles = cells.filter((c) => c.exists).length;
+            res.json({ recipients, totalFiles });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to list recipients";
+            res.status(500).json({ error: message, code: "RECIPIENTS_ERROR" });
+        }
+    });
+    // GET /api/recipients/validate?key=age1...
+    router.get("/recipients/validate", (req, res) => {
+        const key = req.query.key;
+        if (!key) {
+            res.status(400).json({ valid: false, error: "Missing 'key' query parameter." });
+            return;
+        }
+        const result = (0, core_1.validateAgePublicKey)(key);
+        res.json(result);
+    });
+    // POST /api/recipients/add
+    router.post("/recipients/add", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { key, label } = req.body;
+            const result = await recipientManager.add(key, label, manifest, deps.repoRoot);
+            res.json(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to add recipient";
+            res.status(500).json({ error: message, code: "RECIPIENTS_ADD_ERROR" });
+        }
+    });
+    // POST /api/recipients/remove
+    router.post("/recipients/remove", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { key } = req.body;
+            const result = await recipientManager.remove(key, manifest, deps.repoRoot);
+            const cells = matrix.resolveMatrix(manifest, deps.repoRoot);
+            const targets = cells.filter((c) => c.exists).map((c) => `${c.namespace}/${c.environment}`);
+            res.json({ ...result, rotationReminder: targets });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to remove recipient";
+            res.status(500).json({ error: message, code: "RECIPIENTS_REMOVE_ERROR" });
+        }
+    });
+    // GET /api/service-identities
+    router.get("/service-identities", (_req, res) => {
+        try {
+            setNoCacheHeaders(res);
+            const manifest = loadManifest();
+            const identities = manifest.service_identities ?? [];
+            const result = identities.map((si) => {
+                const environments = {};
+                for (const [envName, envConfig] of Object.entries(si.environments)) {
+                    const env = manifest.environments.find((e) => e.name === envName);
+                    if (envConfig.kms) {
+                        environments[envName] = {
+                            type: "kms",
+                            kms: envConfig.kms,
+                            protected: env?.protected ?? false,
+                        };
+                    }
+                    else {
+                        environments[envName] = {
+                            type: "age",
+                            publicKey: envConfig.recipient,
+                            protected: env?.protected ?? false,
+                        };
+                    }
+                }
+                return {
+                    name: si.name,
+                    description: si.description,
+                    namespaces: si.namespaces,
+                    environments,
+                };
+            });
+            res.json({ identities: result });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load service identities";
+            res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
+        }
+    });
+    // POST /api/service-identities — create a new service identity
+    router.post("/service-identities", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { name, description, namespaces, kmsEnvConfigs } = req.body;
+            if (!name || typeof name !== "string") {
+                res.status(400).json({ error: "name is required.", code: "BAD_REQUEST" });
+                return;
+            }
+            if (!Array.isArray(namespaces) || namespaces.length === 0) {
+                res
+                    .status(400)
+                    .json({ error: "namespaces must be a non-empty array.", code: "BAD_REQUEST" });
+                return;
+            }
+            // Validate and cast KMS configs — provider must be one of the allowed values
+            let typedKmsConfigs;
+            if (kmsEnvConfigs && Object.keys(kmsEnvConfigs).length > 0) {
+                typedKmsConfigs = {};
+                for (const [envName, cfg] of Object.entries(kmsEnvConfigs)) {
+                    if (!core_1.VALID_KMS_PROVIDERS.includes(cfg.provider)) {
+                        res.status(400).json({
+                            error: `Invalid KMS provider '${cfg.provider}' for environment '${envName}'. Must be aws, gcp, or azure.`,
+                            code: "BAD_REQUEST",
+                        });
+                        return;
+                    }
+                    typedKmsConfigs[envName] = {
+                        provider: cfg.provider,
+                        keyId: cfg.keyId,
+                    };
+                }
+            }
+            const result = await serviceIdManager.create(name, namespaces, description ?? "", manifest, deps.repoRoot, typedKmsConfigs);
+            setNoCacheHeaders(res);
+            res.json({ identity: result.identity, privateKeys: result.privateKeys });
+            // Best-effort: clear references to private key strings (V8 may retain copies)
+            zeroStringRecord(result.privateKeys);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to create service identity";
+            res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
+        }
+    });
+    // DELETE /api/service-identities/:name
+    router.delete("/service-identities/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const manifest = loadManifest();
+            if (!manifest.service_identities?.find((si) => si.name === name)) {
+                res.status(404).json({ error: `Service identity '${name}' not found.`, code: "NOT_FOUND" });
+                return;
+            }
+            await serviceIdManager.delete(name, manifest, deps.repoRoot);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to delete service identity";
+            res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
+        }
+    });
+    // PATCH /api/service-identities/:name — update environment backends to KMS
+    router.patch("/service-identities/:name", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const { kmsEnvConfigs } = req.body;
+            if (!kmsEnvConfigs || Object.keys(kmsEnvConfigs).length === 0) {
+                res
+                    .status(400)
+                    .json({ error: "kmsEnvConfigs must be a non-empty object.", code: "BAD_REQUEST" });
+                return;
+            }
+            const manifest = loadManifest();
+            const typedKmsConfigs = {};
+            for (const [envName, cfg] of Object.entries(kmsEnvConfigs)) {
+                if (cfg.provider !== "aws" && cfg.provider !== "gcp" && cfg.provider !== "azure") {
+                    res.status(400).json({
+                        error: `Invalid KMS provider '${cfg.provider}' for environment '${envName}'. Must be aws, gcp, or azure.`,
+                        code: "BAD_REQUEST",
+                    });
+                    return;
+                }
+                typedKmsConfigs[envName] = { provider: cfg.provider, keyId: cfg.keyId };
+            }
+            await serviceIdManager.updateEnvironments(name, typedKmsConfigs, manifest, deps.repoRoot);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to update service identity";
+            res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
+        }
+    });
+    // POST /api/service-identities/:name/rotate — rotate age key(s)
+    router.post("/service-identities/:name/rotate", async (req, res) => {
+        try {
+            const name = req.params.name;
+            const { environment } = req.body;
+            const manifest = loadManifest();
+            const privateKeys = await serviceIdManager.rotateKey(name, manifest, deps.repoRoot, environment);
+            setNoCacheHeaders(res);
+            res.json({ privateKeys });
+            // Best-effort: clear references to private key strings (V8 may retain copies)
+            zeroStringRecord(privateKeys);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to rotate service identity key";
+            res.status(500).json({ error: message, code: "SERVICE_IDENTITY_ERROR" });
+        }
+    });
+    // ── Backend Migration ──────────────────────────────────────────────
+    router.get("/backend-config", (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            const global = manifest.sops;
+            const environments = manifest.environments.map((env) => ({
+                name: env.name,
+                protected: env.protected === true,
+                effective: (0, core_1.resolveBackendConfig)(manifest, env.name),
+                hasOverride: env.sops !== undefined,
+            }));
+            res.json({ global, environments });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to load backend config";
+            res.status(500).json({ error: message, code: "BACKEND_CONFIG_ERROR" });
+        }
+    });
+    router.post("/migrate-backend/preview", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { target, environment, confirmed } = req.body;
+            if (!target || !target.backend) {
+                res.status(400).json({ error: "Missing target backend", code: "BAD_REQUEST" });
+                return;
+            }
+            // Protected environment check
+            const impactedEnvs = environment
+                ? manifest.environments.filter((e) => e.name === environment)
+                : manifest.environments;
+            const protectedEnvs = impactedEnvs.filter((e) => e.protected);
+            if (protectedEnvs.length > 0 && !confirmed) {
+                res.status(409).json({
+                    error: "Protected environment requires confirmation",
+                    code: "PROTECTED_ENV",
+                    protected: true,
+                });
+                return;
+            }
+            const events = [];
+            const result = await backendMigrator.migrate(manifest, deps.repoRoot, { target, environment, dryRun: true }, (event) => events.push(event));
+            res.json({ success: !result.rolledBack, result, events });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Migration preview failed";
+            res.status(500).json({ error: message, code: "MIGRATION_ERROR" });
+        }
+    });
+    router.post("/migrate-backend/apply", async (req, res) => {
+        try {
+            const manifest = loadManifest();
+            const { target, environment, confirmed } = req.body;
+            if (!target || !target.backend) {
+                res.status(400).json({ error: "Missing target backend", code: "BAD_REQUEST" });
+                return;
+            }
+            // Protected environment check
+            const impactedEnvs = environment
+                ? manifest.environments.filter((e) => e.name === environment)
+                : manifest.environments;
+            const protectedEnvs = impactedEnvs.filter((e) => e.protected);
+            if (protectedEnvs.length > 0 && !confirmed) {
+                res.status(409).json({
+                    error: "Protected environment requires confirmation",
+                    code: "PROTECTED_ENV",
+                    protected: true,
+                });
+                return;
+            }
+            const events = [];
+            const result = await backendMigrator.migrate(manifest, deps.repoRoot, { target, environment, dryRun: false }, (event) => events.push(event));
+            res.json({ success: !result.rolledBack, result, events });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Migration failed";
+            res.status(500).json({ error: message, code: "MIGRATION_ERROR" });
+        }
+    });
+    function dispose() {
+        lastScanResult = null;
+        lastScanAt = null;
+    }
+    // Attach dispose to the router for cleanup
+    router.dispose = dispose;
+    return router;
+}
+//# sourceMappingURL=api.js.map