@cmetech/otto 1.1.1 → 1.2.5

package/packages/coworker-vault/dist/data-vault.js

@@ -0,0 +1,223 @@
+// packages/coworker-vault/src/data-vault.ts
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { BindingRefMalformed, VaultEntryMalformed, VaultEntryNotFound } from './errors.js';
+const REF_RE = /^([a-z][a-z0-9-]*):([a-z][a-z0-9-]*)$/;
+export class LocalDataVault {
+    globalRoot;
+    workspaceRoot;
+    audit;
+    now;
+    constructor(opts) {
+        this.globalRoot = opts.globalDir;
+        this.workspaceRoot = opts.workspaceDir;
+        this.audit = opts.audit;
+        this.now = opts.now ?? (() => new Date().toISOString());
+        this.sweepOrphans(this.globalVaultDir());
+        const ws = this.workspaceVaultDir();
+        if (ws)
+            this.sweepOrphans(ws);
+    }
+    static parseRef(input) {
+        const m = REF_RE.exec(input);
+        if (!m)
+            throw new BindingRefMalformed(input);
+        return { engine: m[1], name: m[2] };
+    }
+    static formatRef(ref) {
+        return `${ref.engine}:${ref.name}`;
+    }
+    globalVaultDir() {
+        return join(this.globalRoot, 'data_vault');
+    }
+    workspaceVaultDir() {
+        return this.workspaceRoot ? join(this.workspaceRoot, 'data_vault') : undefined;
+    }
+    fileNameFor(ref) {
+        return `${ref.engine}-${ref.name}.json`;
+    }
+    resolveScope(ref) {
+        const ws = this.workspaceVaultDir();
+        if (ws && existsSync(join(ws, this.fileNameFor(ref)))) {
+            return { dir: ws, scope: 'workspace' };
+        }
+        if (existsSync(join(this.globalVaultDir(), this.fileNameFor(ref)))) {
+            return { dir: this.globalVaultDir(), scope: 'global' };
+        }
+        return null;
+    }
+    writeScope(forceWorkspace) {
+        if (forceWorkspace) {
+            const ws = this.workspaceVaultDir();
+            if (!ws)
+                throw new Error('Workspace scope requested but no workspace root configured.');
+            return { dir: ws, scope: 'workspace' };
+        }
+        const ws = this.workspaceVaultDir();
+        if (ws && existsSync(ws))
+            return { dir: ws, scope: 'workspace' };
+        return { dir: this.globalVaultDir(), scope: 'global' };
+    }
+    async set(ref, fields, opts = {}) {
+        const target = this.writeScope(opts.forceWorkspace ?? false);
+        mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+        const path = join(target.dir, this.fileNameFor(ref));
+        const tmp = `${path}.tmp`;
+        const existing = existsSync(path) ? this.readEntry(path) : null;
+        const ts = this.now();
+        const entry = {
+            _schema: 1,
+            engine: ref.engine,
+            name: ref.name,
+            fields,
+            created_at: existing?.created_at ?? ts,
+            last_modified_at: ts,
+        };
+        writeFileSync(tmp, JSON.stringify(entry, null, 2), { mode: 0o600 });
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, path);
+        this.audit.append({
+            _schema: 1,
+            ts,
+            producer: 'vault',
+            action: 'set',
+            detail: {
+                engine: ref.engine,
+                name: ref.name,
+                scope: target.scope,
+                fields_set: Object.keys(fields),
+            },
+        });
+        this.writeSidecar(target.scope, (m) => {
+            m[LocalDataVault.formatRef(ref)] = ts;
+        });
+    }
+    async get(ref) {
+        const r = this.resolveScope(ref);
+        if (!r) {
+            const searched = [];
+            const ws = this.workspaceVaultDir();
+            if (ws)
+                searched.push(join(ws, this.fileNameFor(ref)));
+            searched.push(join(this.globalVaultDir(), this.fileNameFor(ref)));
+            throw new VaultEntryNotFound(ref.engine, ref.name, searched);
+        }
+        const entry = this.readEntry(join(r.dir, this.fileNameFor(ref)));
+        this.audit.append({
+            _schema: 1,
+            ts: this.now(),
+            producer: 'vault',
+            action: 'get',
+            detail: { engine: ref.engine, name: ref.name, scope_resolved: r.scope },
+        });
+        return entry;
+    }
+    async remove(ref) {
+        const r = this.resolveScope(ref);
+        if (!r)
+            throw new VaultEntryNotFound(ref.engine, ref.name, []);
+        unlinkSync(join(r.dir, this.fileNameFor(ref)));
+        this.audit.append({
+            _schema: 1,
+            ts: this.now(),
+            producer: 'vault',
+            action: 'remove',
+            detail: { engine: ref.engine, name: ref.name, scope: r.scope },
+        });
+        this.writeSidecar(r.scope, (m) => {
+            delete m[LocalDataVault.formatRef(ref)];
+        });
+    }
+    async lookupLastModified(refStr) {
+        const ref = LocalDataVault.parseRef(refStr);
+        const r = this.resolveScope(ref);
+        if (!r)
+            return null;
+        const sidecar = this.readSidecar(this.sidecarPathFor(r.scope));
+        return sidecar[refStr] ?? null;
+    }
+    sidecarPathFor(scope) {
+        const dir = scope === 'workspace' ? this.workspaceVaultDir() : this.globalVaultDir();
+        return join(dir, '_last_modified.json');
+    }
+    readSidecar(path) {
+        if (!existsSync(path))
+            return {};
+        try {
+            return JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    writeSidecar(scope, mutate) {
+        const path = this.sidecarPathFor(scope);
+        const data = this.readSidecar(path);
+        mutate(data);
+        const tmp = `${path}.tmp`;
+        writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, path);
+    }
+    async list() {
+        const out = [];
+        const collect = (dir, scope) => {
+            if (!dir || !existsSync(dir))
+                return;
+            for (const f of readdirSync(dir)) {
+                if (!f.endsWith('.json') || f.startsWith('_'))
+                    continue;
+                try {
+                    const entry = this.readEntry(join(dir, f));
+                    out.push({
+                        engine: entry.engine,
+                        name: entry.name,
+                        scope,
+                        fields_set: Object.keys(entry.fields),
+                        last_modified_at: entry.last_modified_at,
+                    });
+                }
+                catch {
+                    /* skip malformed */
+                }
+            }
+        };
+        collect(this.workspaceVaultDir(), 'workspace');
+        collect(this.globalVaultDir(), 'global');
+        return out;
+    }
+    readEntry(path) {
+        let raw;
+        try {
+            raw = readFileSync(path, 'utf8');
+        }
+        catch (err) {
+            throw new VaultEntryMalformed(path, err.message);
+        }
+        let json;
+        try {
+            json = JSON.parse(raw);
+        }
+        catch (err) {
+            throw new VaultEntryMalformed(path, `JSON parse: ${err.message}`);
+        }
+        if (!json || typeof json !== 'object' || json._schema !== 1) {
+            throw new VaultEntryMalformed(path, 'unexpected _schema');
+        }
+        return json;
+    }
+    sweepOrphans(dir) {
+        if (!existsSync(dir))
+            return;
+        for (const f of readdirSync(dir)) {
+            if (f.endsWith('.json.tmp')) {
+                try {
+                    unlinkSync(join(dir, f));
+                }
+                catch {
+                    /* best effort */
+                }
+            }
+        }
+    }
+}

package/packages/coworker-vault/dist/engine-registry.d.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import type { EngineDefinition, EngineSource } from './types.js';
+declare const ENGINE_SCHEMA: z.ZodObject<{
+    schema_version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        label: z.ZodString;
+        secret: z.ZodBoolean;
+        required: z.ZodBoolean;
+        default: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+export interface RegistryResolution {
+    engine: EngineDefinition;
+    source: EngineSource;
+}
+export interface LoadOptions {
+    userDir?: string | undefined;
+    workspaceDir?: string | undefined;
+}
+export declare class EngineRegistry {
+    private readonly resolutions;
+    private constructor();
+    static load(opts?: LoadOptions): Promise<EngineRegistry>;
+    private static loadDir;
+    get(id: string): EngineDefinition | undefined;
+    require(id: string): EngineDefinition;
+    source(id: string): EngineSource | undefined;
+    all(): RegistryResolution[];
+}
+export { ENGINE_SCHEMA };

package/packages/coworker-vault/dist/engine-registry.js

@@ -0,0 +1,90 @@
+// packages/coworker-vault/src/engine-registry.ts
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { z } from 'zod';
+import { parse as parseYaml } from 'yaml';
+import { EngineNotFound } from './errors.js';
+const ENGINE_FIELD_SCHEMA = z.object({
+    name: z.string().regex(/^[a-z][a-z0-9_]*$/, 'name must match /^[a-z][a-z0-9_]*$/'),
+    label: z.string().min(1),
+    secret: z.boolean(),
+    required: z.boolean(),
+    default: z.string().optional(),
+});
+const ENGINE_SCHEMA = z
+    .object({
+    schema_version: z.literal(1),
+    id: z.string().regex(/^[a-z][a-z0-9-]*$/, 'id must match /^[a-z][a-z0-9-]*$/'),
+    label: z.string().min(1),
+    description: z.string().optional(),
+    fields: z.array(ENGINE_FIELD_SCHEMA).min(1),
+})
+    .passthrough(); // accept unknown top-level keys (forward compat for test: blocks etc.)
+function builtinDir() {
+    return join(dirname(fileURLToPath(import.meta.url)), 'engines');
+}
+export class EngineRegistry {
+    resolutions;
+    constructor(resolutions) {
+        this.resolutions = resolutions;
+    }
+    static async load(opts = {}) {
+        const map = new Map();
+        EngineRegistry.loadDir(builtinDir(), 'builtin', map);
+        if (opts.userDir && existsSync(opts.userDir)) {
+            EngineRegistry.loadDir(opts.userDir, 'user', map);
+        }
+        if (opts.workspaceDir && existsSync(opts.workspaceDir)) {
+            EngineRegistry.loadDir(opts.workspaceDir, 'workspace', map);
+        }
+        return new EngineRegistry(map);
+    }
+    static loadDir(dir, source, out) {
+        if (!existsSync(dir))
+            return;
+        let entries = [];
+        try {
+            entries = readdirSync(dir).filter((f) => f.endsWith('.yaml') || f.endsWith('.yml'));
+        }
+        catch {
+            return;
+        }
+        for (const f of entries) {
+            const path = join(dir, f);
+            let parsed;
+            try {
+                parsed = parseYaml(readFileSync(path, 'utf8'));
+            }
+            catch (err) {
+                process.stderr.write(`engine-registry: parse failed ${path}: ${err.message}\n`);
+                continue;
+            }
+            const result = ENGINE_SCHEMA.safeParse(parsed);
+            if (!result.success) {
+                const detail = result.error.issues
+                    .map((i) => `${i.path.join('.')}: ${i.message}`)
+                    .join('; ');
+                process.stderr.write(`engine-registry: schema invalid ${path}: ${detail}\n`);
+                continue;
+            }
+            out.set(result.data.id, { engine: result.data, source });
+        }
+    }
+    get(id) {
+        return this.resolutions.get(id)?.engine;
+    }
+    require(id) {
+        const r = this.resolutions.get(id);
+        if (!r)
+            throw new EngineNotFound(id);
+        return r.engine;
+    }
+    source(id) {
+        return this.resolutions.get(id)?.source;
+    }
+    all() {
+        return [...this.resolutions.values()];
+    }
+}
+export { ENGINE_SCHEMA };

package/packages/coworker-vault/dist/engines/jira.yaml

@@ -0,0 +1,17 @@
+schema_version: 1
+id: jira
+label: Jira
+description: Atlassian Jira Cloud / Server via Basic auth (email + API token)
+fields:
+  - name: url
+    label: "Instance URL (e.g. https://yourorg.atlassian.net)"
+    secret: false
+    required: true
+  - name: email
+    label: "Atlassian account email"
+    secret: false
+    required: true
+  - name: token
+    label: "API token (from id.atlassian.com → Account → Security)"
+    secret: true
+    required: true

package/packages/coworker-vault/dist/errors.d.ts

@@ -0,0 +1,28 @@
+export declare class EngineNotFound extends Error {
+    readonly id: string;
+    constructor(id: string);
+}
+export declare class EngineValidationError extends Error {
+    readonly yamlPath: string;
+    readonly issue: string;
+    constructor(yamlPath: string, issue: string);
+}
+export declare class VaultEntryNotFound extends Error {
+    readonly engine: string;
+    readonly entryName: string;
+    readonly searched: string[];
+    constructor(engine: string, entryName: string, searched: string[]);
+}
+export declare class VaultEntryMalformed extends Error {
+    readonly path: string;
+    readonly reason: string;
+    constructor(path: string, reason: string);
+}
+export declare class BindingRefMalformed extends Error {
+    readonly input: string;
+    constructor(input: string);
+}
+export declare class BindingNotFound extends Error {
+    readonly ref: string;
+    constructor(ref: string);
+}

package/packages/coworker-vault/dist/errors.js

@@ -0,0 +1,57 @@
+// packages/coworker-vault/src/errors.ts
+export class EngineNotFound extends Error {
+    id;
+    constructor(id) {
+        super(`Unknown engine: ${id}. Available engines can be listed with /datasource list.`);
+        this.id = id;
+        this.name = 'EngineNotFound';
+    }
+}
+export class EngineValidationError extends Error {
+    yamlPath;
+    issue;
+    constructor(yamlPath, issue) {
+        super(`Engine ${yamlPath}: ${issue}`);
+        this.yamlPath = yamlPath;
+        this.issue = issue;
+        this.name = 'EngineValidationError';
+    }
+}
+export class VaultEntryNotFound extends Error {
+    engine;
+    entryName;
+    searched;
+    constructor(engine, entryName, searched) {
+        super(`Vault entry not found: ${engine}:${entryName}. Searched: ${searched.join(', ')}. Use /connect ${engine} ${entryName} to create.`);
+        this.engine = engine;
+        this.entryName = entryName;
+        this.searched = searched;
+        this.name = 'VaultEntryNotFound';
+    }
+}
+export class VaultEntryMalformed extends Error {
+    path;
+    reason;
+    constructor(path, reason) {
+        super(`Vault entry corrupt: ${path} (${reason}). Move it aside and re-create with /connect.`);
+        this.path = path;
+        this.reason = reason;
+        this.name = 'VaultEntryMalformed';
+    }
+}
+export class BindingRefMalformed extends Error {
+    input;
+    constructor(input) {
+        super(`Bad binding: ${input}. Expected <engine>:<name>, e.g., jira:prod.`);
+        this.input = input;
+        this.name = 'BindingRefMalformed';
+    }
+}
+export class BindingNotFound extends Error {
+    ref;
+    constructor(ref) {
+        super(`Vault binding not resolvable: ${ref}. The entry may have been removed. Use /datasource list to inspect.`);
+        this.ref = ref;
+        this.name = 'BindingNotFound';
+    }
+}

package/packages/coworker-vault/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './errors.js';
+export * from './vault-keep.js';
+export * from './engine-registry.js';
+export * from './data-vault.js';
+export * from './injector.js';

package/packages/coworker-vault/dist/index.js

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './errors.js';
+export * from './vault-keep.js';
+export * from './engine-registry.js';
+export * from './data-vault.js';
+export * from './injector.js';

package/packages/coworker-vault/dist/injector.d.ts

@@ -0,0 +1,19 @@
+import { AuditLog } from '@otto/coworker-utils';
+import { LocalDataVault } from './data-vault.js';
+export interface CredentialInjectorOptions {
+    vault: LocalDataVault;
+    audit: AuditLog;
+}
+export interface InjectionContext {
+    scratchpadName: string;
+    sessionId: string;
+    pid: number;
+}
+export declare class CredentialInjector {
+    private readonly opts;
+    constructor(opts: CredentialInjectorOptions);
+    injectEnv(baseEnv: NodeJS.ProcessEnv, bindings: string[], ctx: InjectionContext): Promise<NodeJS.ProcessEnv>;
+    loadForBinding(_serviceName: string): Promise<null>;
+}
+export declare function envVarName(engineId: string, entryName: string, fieldName: string): string;
+export declare function clearEnv(env?: NodeJS.ProcessEnv): number;

package/packages/coworker-vault/dist/injector.js

@@ -0,0 +1,77 @@
+import { LocalDataVault } from './data-vault.js';
+import { BindingNotFound, VaultEntryNotFound } from './errors.js';
+export class CredentialInjector {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async injectEnv(baseEnv, bindings, ctx) {
+        const out = { ...baseEnv };
+        const loose = process.env.OTTO_VAULT_MISSING_OK === '1';
+        for (const refStr of bindings) {
+            const ref = LocalDataVault.parseRef(refStr);
+            let entry;
+            try {
+                entry = await this.opts.vault.get(ref);
+            }
+            catch (err) {
+                if (err instanceof VaultEntryNotFound) {
+                    if (loose) {
+                        process.stderr.write(`vault: binding ${refStr} missing — skipped (OTTO_VAULT_MISSING_OK=1)\n`);
+                        this.opts.audit.append({
+                            _schema: 1,
+                            ts: new Date().toISOString(),
+                            producer: 'vault',
+                            action: 'inject-skipped',
+                            severity: 'warn',
+                            sessionId: ctx.sessionId,
+                            scratchpadName: ctx.scratchpadName,
+                            pid: ctx.pid,
+                            detail: { ref: refStr, reason: 'not-found' },
+                        });
+                        continue;
+                    }
+                    throw new BindingNotFound(refStr);
+                }
+                throw err;
+            }
+            for (const [field, value] of Object.entries(entry.fields)) {
+                out[envVarName(ref.engine, ref.name, field)] = value;
+            }
+            this.opts.audit.append({
+                _schema: 1,
+                ts: new Date().toISOString(),
+                producer: 'vault',
+                action: 'inject',
+                sessionId: ctx.sessionId,
+                scratchpadName: ctx.scratchpadName,
+                pid: ctx.pid,
+                detail: {
+                    engine: ref.engine,
+                    name: ref.name,
+                    fields_injected: Object.keys(entry.fields),
+                },
+            });
+        }
+        return out;
+    }
+    async loadForBinding(_serviceName) {
+        return null; // Phase 3+
+    }
+}
+export function envVarName(engineId, entryName, fieldName) {
+    const e = engineId.replace(/-/g, '_').toUpperCase();
+    const n = entryName.replace(/-/g, '_').toUpperCase();
+    const f = fieldName.toUpperCase();
+    return `OTTO_DS_${e}_${n}__${f}`;
+}
+export function clearEnv(env = process.env) {
+    let n = 0;
+    for (const key of Object.keys(env)) {
+        if (key.startsWith('OTTO_DS_')) {
+            delete env[key];
+            n++;
+        }
+    }
+    return n;
+}

package/packages/coworker-vault/dist/types.d.ts

@@ -0,0 +1,28 @@
+export interface EntryRef {
+    engine: string;
+    name: string;
+}
+export interface EngineField {
+    name: string;
+    label: string;
+    secret: boolean;
+    required: boolean;
+    default?: string;
+}
+export interface EngineDefinition {
+    schema_version: 1;
+    id: string;
+    label: string;
+    description?: string;
+    fields: EngineField[];
+}
+export interface VaultEntry {
+    _schema: 1;
+    engine: string;
+    name: string;
+    fields: Record<string, string>;
+    created_at: string;
+    last_modified_at: string;
+}
+export type EngineSource = 'builtin' | 'user' | 'workspace';
+export type VaultScope = 'global' | 'workspace';

package/packages/coworker-vault/dist/types.js

@@ -0,0 +1 @@
+export {};

package/packages/coworker-vault/dist/vault-keep.d.ts

@@ -0,0 +1,4 @@
+import type { EngineField } from './types.js';
+export declare const VAULT_KEEP: "[VAULT_KEEP]";
+export declare function mergeWithSentinel(fields: EngineField[], stored: Record<string, string>, submitted: Record<string, string>): Record<string, string>;
+export declare function assertNoSentinelInCreate(fields: EngineField[], submitted: Record<string, string>): void;

package/packages/coworker-vault/dist/vault-keep.js

@@ -0,0 +1,21 @@
+export const VAULT_KEEP = '[VAULT_KEEP]';
+export function mergeWithSentinel(fields, stored, submitted) {
+    const out = {};
+    for (const f of fields) {
+        const sub = submitted[f.name];
+        if (f.secret && sub === VAULT_KEEP) {
+            out[f.name] = stored[f.name] ?? '';
+        }
+        else {
+            out[f.name] = sub ?? '';
+        }
+    }
+    return out;
+}
+export function assertNoSentinelInCreate(fields, submitted) {
+    for (const f of fields) {
+        if (f.secret && submitted[f.name] === VAULT_KEEP) {
+            throw new Error(`VAULT_KEEP is reserved; pick a real value for field "${f.name}".`);
+        }
+    }
+}

package/packages/coworker-vault/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@otto/coworker-vault",
+  "version": "0.0.1",
+  "description": "Otto co-worker package: coworker-vault",
+  "type": "module",
+  "otto": {
+    "linkable": true,
+    "scope": "@otto",
+    "name": "coworker-vault"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@otto/coworker-utils": "*",
+    "yaml": "^2.8.2",
+    "zod": "^4.4.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node -e \"const fs=require('fs');const path=require('path');const src='src/engines';const dst='dist/engines';fs.mkdirSync(dst,{recursive:true});for(const f of fs.readdirSync(src))if(f.endsWith('.yaml')||f.endsWith('.yml'))fs.copyFileSync(path.join(src,f),path.join(dst,f));\"",
+    "build:publish": "tsc -p tsconfig.publish.json && node -e \"const fs=require('fs');const path=require('path');const src='src/engines';const dst='dist/engines';fs.mkdirSync(dst,{recursive:true});for(const f of fs.readdirSync(src))if(f.endsWith('.yaml')||f.endsWith('.yml'))fs.copyFileSync(path.join(src,f),path.join(dst,f));\""
+  },
+  "files": ["dist"]
+}