@contractspec/integration.runtime 1.56.1 → 1.58.0

package/dist/secrets/manager.js

@@ -1,104 +1,183 @@
-import { SecretProviderError } from "./provider.js";
+// @bun
+// src/secrets/provider.ts
+import { Buffer } from "buffer";
 
-//#region src/secrets/manager.ts
-/**
-* Composite secret provider that delegates to registered providers.
-* Providers are attempted in order of descending priority, respecting the
-* registration order for ties. This enables privileged overrides (e.g.
-* environment variables) while still supporting durable backends like GCP
-* Secret Manager.
-*/
-var SecretProviderManager = class {
-	id;
-	providers = [];
-	registrationCounter = 0;
-	constructor(options = {}) {
-		this.id = options.id ?? "secret-provider-manager";
-		const initialProviders = options.providers ?? [];
-		for (const entry of initialProviders) this.register(entry.provider, { priority: entry.priority });
-	}
-	register(provider, options = {}) {
-		this.providers.push({
-			provider,
-			priority: options.priority ?? 0,
-			order: this.registrationCounter++
-		});
-		this.providers.sort((a, b) => {
-			if (a.priority !== b.priority) return b.priority - a.priority;
-			return a.order - b.order;
-		});
-		return this;
-	}
-	canHandle(reference) {
-		return this.providers.some(({ provider }) => safeCanHandle(provider, reference));
-	}
-	async getSecret(reference, options) {
-		const errors = [];
-		for (const { provider } of this.providers) {
-			if (!safeCanHandle(provider, reference)) continue;
-			try {
-				return await provider.getSecret(reference, options);
-			} catch (error) {
-				if (error instanceof SecretProviderError) {
-					errors.push(error);
-					if (error.code !== "NOT_FOUND") break;
-					continue;
-				}
-				throw error;
-			}
-		}
-		throw this.composeError("getSecret", reference, errors, options?.version);
-	}
-	async setSecret(reference, payload) {
-		return this.delegateToFirst("setSecret", reference, (provider) => provider.setSecret(reference, payload));
-	}
-	async rotateSecret(reference, payload) {
-		return this.delegateToFirst("rotateSecret", reference, (provider) => provider.rotateSecret(reference, payload));
-	}
-	async deleteSecret(reference) {
-		await this.delegateToFirst("deleteSecret", reference, (provider) => provider.deleteSecret(reference));
-	}
-	async delegateToFirst(operation, reference, invoker) {
-		const errors = [];
-		for (const { provider } of this.providers) {
-			if (!safeCanHandle(provider, reference)) continue;
-			try {
-				return await invoker(provider);
-			} catch (error) {
-				if (error instanceof SecretProviderError) {
-					errors.push(error);
-					continue;
-				}
-				throw error;
-			}
-		}
-		throw this.composeError(operation, reference, errors);
-	}
-	composeError(operation, reference, errors, version) {
-		if (errors.length === 1) {
-			const [singleError] = errors;
-			if (singleError) return singleError;
-		}
-		const messageParts = [`No registered secret provider could ${operation}`, `reference "${reference}"`];
-		if (version) messageParts.push(`(version: ${version})`);
-		if (errors.length > 1) messageParts.push(`Attempts: ${errors.map((error) => `${error.provider}:${error.code}`).join(", ")}`);
-		return new SecretProviderError({
-			message: messageParts.join(" "),
-			provider: this.id,
-			reference,
-			code: errors.length > 0 ? errors[errors.length - 1].code : "UNKNOWN",
-			cause: errors
-		});
-	}
-};
-function safeCanHandle(provider, reference) {
-	try {
-		return provider.canHandle(reference);
-	} catch {
-		return false;
-	}
+class SecretProviderError extends Error {
+  provider;
+  reference;
+  code;
+  cause;
+  constructor(params) {
+    super(params.message);
+    this.name = "SecretProviderError";
+    this.provider = params.provider;
+    this.reference = params.reference;
+    this.code = params.code ?? "UNKNOWN";
+    this.cause = params.cause;
+  }
+}
+function parseSecretUri(reference) {
+  if (!reference) {
+    throw new SecretProviderError({
+      message: "Secret reference cannot be empty",
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const [scheme, rest] = reference.split("://");
+  if (!scheme || !rest) {
+    throw new SecretProviderError({
+      message: `Invalid secret reference: ${reference}`,
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const queryIndex = rest.indexOf("?");
+  if (queryIndex === -1) {
+    return {
+      provider: scheme,
+      path: rest
+    };
+  }
+  const path = rest.slice(0, queryIndex);
+  const query = rest.slice(queryIndex + 1);
+  const extras = Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
+    const [keyRaw, valueRaw] = pair.split("=");
+    const key = keyRaw ?? "";
+    const value = valueRaw ?? "";
+    return [decodeURIComponent(key), decodeURIComponent(value)];
+  }));
+  return {
+    provider: scheme,
+    path,
+    extras
+  };
+}
+function normalizeSecretPayload(payload) {
+  if (payload.data instanceof Uint8Array) {
+    return payload.data;
+  }
+  if (payload.encoding === "base64") {
+    return Buffer.from(payload.data, "base64");
+  }
+  if (payload.encoding === "binary") {
+    return Buffer.from(payload.data, "binary");
+  }
+  return Buffer.from(payload.data, "utf-8");
 }
 
-//#endregion
-export { SecretProviderManager };
-//# sourceMappingURL=manager.js.map
+// src/secrets/manager.ts
+class SecretProviderManager {
+  id;
+  providers = [];
+  registrationCounter = 0;
+  constructor(options = {}) {
+    this.id = options.id ?? "secret-provider-manager";
+    const initialProviders = options.providers ?? [];
+    for (const entry of initialProviders) {
+      this.register(entry.provider, { priority: entry.priority });
+    }
+  }
+  register(provider, options = {}) {
+    this.providers.push({
+      provider,
+      priority: options.priority ?? 0,
+      order: this.registrationCounter++
+    });
+    this.providers.sort((a, b) => {
+      if (a.priority !== b.priority) {
+        return b.priority - a.priority;
+      }
+      return a.order - b.order;
+    });
+    return this;
+  }
+  canHandle(reference) {
+    return this.providers.some(({ provider }) => safeCanHandle(provider, reference));
+  }
+  async getSecret(reference, options) {
+    const errors = [];
+    for (const { provider } of this.providers) {
+      if (!safeCanHandle(provider, reference)) {
+        continue;
+      }
+      try {
+        return await provider.getSecret(reference, options);
+      } catch (error) {
+        if (error instanceof SecretProviderError) {
+          errors.push(error);
+          if (error.code !== "NOT_FOUND") {
+            break;
+          }
+          continue;
+        }
+        throw error;
+      }
+    }
+    throw this.composeError("getSecret", reference, errors, options?.version);
+  }
+  async setSecret(reference, payload) {
+    return this.delegateToFirst("setSecret", reference, (provider) => provider.setSecret(reference, payload));
+  }
+  async rotateSecret(reference, payload) {
+    return this.delegateToFirst("rotateSecret", reference, (provider) => provider.rotateSecret(reference, payload));
+  }
+  async deleteSecret(reference) {
+    await this.delegateToFirst("deleteSecret", reference, (provider) => provider.deleteSecret(reference));
+  }
+  async delegateToFirst(operation, reference, invoker) {
+    const errors = [];
+    for (const { provider } of this.providers) {
+      if (!safeCanHandle(provider, reference)) {
+        continue;
+      }
+      try {
+        return await invoker(provider);
+      } catch (error) {
+        if (error instanceof SecretProviderError) {
+          errors.push(error);
+          continue;
+        }
+        throw error;
+      }
+    }
+    throw this.composeError(operation, reference, errors);
+  }
+  composeError(operation, reference, errors, version) {
+    if (errors.length === 1) {
+      const [singleError] = errors;
+      if (singleError) {
+        return singleError;
+      }
+    }
+    const messageParts = [
+      `No registered secret provider could ${operation}`,
+      `reference "${reference}"`
+    ];
+    if (version) {
+      messageParts.push(`(version: ${version})`);
+    }
+    if (errors.length > 1) {
+      messageParts.push(`Attempts: ${errors.map((error) => `${error.provider}:${error.code}`).join(", ")}`);
+    }
+    return new SecretProviderError({
+      message: messageParts.join(" "),
+      provider: this.id,
+      reference,
+      code: errors.length > 0 ? errors[errors.length - 1].code : "UNKNOWN",
+      cause: errors
+    });
+  }
+}
+function safeCanHandle(provider, reference) {
+  try {
+    return provider.canHandle(reference);
+  } catch {
+    return false;
+  }
+}
+export {
+  SecretProviderManager
+};

package/dist/secrets/provider.d.ts

@@ -1,53 +1,50 @@
-//#region src/secrets/provider.d.ts
-type SecretReference = string;
-interface SecretValue {
-  data: Uint8Array;
-  version?: string;
-  metadata?: Record<string, string>;
-  retrievedAt: Date;
+export type SecretReference = string;
+export interface SecretValue {
+    data: Uint8Array;
+    version?: string;
+    metadata?: Record<string, string>;
+    retrievedAt: Date;
 }
-interface SecretFetchOptions {
-  version?: string;
+export interface SecretFetchOptions {
+    version?: string;
 }
-type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';
-interface SecretWritePayload {
-  data: string | Uint8Array;
-  encoding?: SecretPayloadEncoding;
-  contentType?: string;
-  labels?: Record<string, string>;
+export type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';
+export interface SecretWritePayload {
+    data: string | Uint8Array;
+    encoding?: SecretPayloadEncoding;
+    contentType?: string;
+    labels?: Record<string, string>;
 }
-interface SecretRotationResult {
-  reference: SecretReference;
-  version: string;
-}
-interface SecretProvider {
-  readonly id: string;
-  canHandle(reference: SecretReference): boolean;
-  getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
-  setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
-  rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
-  deleteSecret(reference: SecretReference): Promise<void>;
+export interface SecretRotationResult {
+    reference: SecretReference;
+    version: string;
 }
-interface ParsedSecretUri {
-  provider: string;
-  path: string;
-  extras?: Record<string, string>;
+export interface SecretProvider {
+    readonly id: string;
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
 }
-declare class SecretProviderError extends Error {
-  readonly provider: string;
-  readonly reference: SecretReference;
-  readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';
-  readonly cause?: unknown;
-  constructor(params: {
-    message: string;
+export interface ParsedSecretUri {
     provider: string;
-    reference: SecretReference;
-    code?: SecretProviderError['code'];
-    cause?: unknown;
-  });
+    path: string;
+    extras?: Record<string, string>;
+}
+export declare class SecretProviderError extends Error {
+    readonly provider: string;
+    readonly reference: SecretReference;
+    readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';
+    readonly cause?: unknown;
+    constructor(params: {
+        message: string;
+        provider: string;
+        reference: SecretReference;
+        code?: SecretProviderError['code'];
+        cause?: unknown;
+    });
 }
-declare function parseSecretUri(reference: SecretReference): ParsedSecretUri;
-declare function normalizeSecretPayload(payload: SecretWritePayload): Uint8Array;
-//#endregion
-export { ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri };
+export declare function parseSecretUri(reference: SecretReference): ParsedSecretUri;
+export declare function normalizeSecretPayload(payload: SecretWritePayload): Uint8Array;
 //# sourceMappingURL=provider.d.ts.map

package/dist/secrets/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","names":[],"sources":["../../src/secrets/provider.ts"],"sourcesContent":[],"mappings":";KAEY,eAAA;AAAA,UAEK,WAAA,CAFU;EAEV,IAAA,EACT,UADoB;EACpB,OAAA,CAAA,EAAA,MAAA;EAEK,QAAA,CAAA,EAAA,MAAA,CAAA,MAAA,EAAA,MAAA,CAAA;EACE,WAAA,EAAA,IAAA;;AAGE,UAAA,kBAAA,CAAkB;EAIvB,OAAA,CAAA,EAAA,MAAA;AAEZ;AACiB,KAHL,qBAAA,GAGK,OAAA,GAAA,QAAA,GAAA,QAAA;AACJ,UAFI,kBAAA,CAEJ;EAEF,IAAA,EAAA,MAAA,GAHM,UAGN;EAAM,QAAA,CAAA,EAFJ,qBAEI;EAGA,WAAA,CAAA,EAAA,MAAA;EAKA,MAAA,CAAA,EARN,MAQM,CAAA,MAAc,EAAA,MAAA,CAAA;;AAIhB,UATE,oBAAA,CASF;EACD,SAAA,EATD,eASC;EACD,OAAA,EAAA,MAAA;;AAEE,UARE,cAAA,CAQF;EACF,SAAA,EAAA,EAAA,MAAA;EACA,SAAA,CAAA,SAAA,EARU,eAQV,CAAA,EAAA,OAAA;EAAR,SAAA,CAAA,SAAA,EANU,eAMV,EAAA,OAAA,CAAA,EALS,kBAKT,CAAA,EAJA,OAIA,CAJQ,WAIR,CAAA;EAEU,SAAA,CAAA,SAAA,EAJA,eAIA,EAAA,OAAA,EAHF,kBAGE,CAAA,EAFV,OAEU,CAFF,oBAEE,CAAA;EACF,YAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EACa,eADb,CAAA,EAC+B,OAD/B,CAAA,IAAA,CAAA;;AACa,UAGT,eAAA,CAHS;EAAkB,QAAA,EAAA,MAAA;EAAO,IAAA,EAAA,MAAA;EAGlC,MAAA,CAAA,EAGN,MAHM,CAAA,MAAe,EAAA,MAGrB,CAAA;AAGX;AAEsB,cAFT,mBAAA,SAA4B,KAAA,CAEnB;EAOP,SAAA,QAAA,EAAA,MAAA;EACJ,SAAA,SAAA,EARW,eAQX;EAV8B,SAAA,IAAA,EAAA,WAAA,GAAA,WAAA,GAAA,SAAA,GAAA,SAAA;EAAK,SAAA,KAAA,CAAA,EAAA,OAAA;EAsB9B,WAAA,CAAA,MAAc,EAAA;IAiDd,OAAA,EAAA,MAAA;;eA9DD;WACJ;;;;iBAYK,cAAA,YAA0B,kBAAkB;iBAiD5C,sBAAA,UACL,qBACR"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/secrets/provider.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC;IAC/C,SAAS,CACP,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,SAAS,CACP,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,YAAY,CACV,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,YAAY,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,MAAM,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,eAAe,CAAC;QAC3B,IAAI,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CAQF;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,GAAG,eAAe,CA+C1E;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,GAC1B,UAAU,CAcZ"}

package/dist/secrets/provider.js

@@ -1,59 +1,74 @@
-import { Buffer } from "node:buffer";
+// @bun
+// src/secrets/provider.ts
+import { Buffer } from "buffer";
 
-//#region src/secrets/provider.ts
-var SecretProviderError = class extends Error {
-	provider;
-	reference;
-	code;
-	cause;
-	constructor(params) {
-		super(params.message);
-		this.name = "SecretProviderError";
-		this.provider = params.provider;
-		this.reference = params.reference;
-		this.code = params.code ?? "UNKNOWN";
-		this.cause = params.cause;
-	}
-};
+class SecretProviderError extends Error {
+  provider;
+  reference;
+  code;
+  cause;
+  constructor(params) {
+    super(params.message);
+    this.name = "SecretProviderError";
+    this.provider = params.provider;
+    this.reference = params.reference;
+    this.code = params.code ?? "UNKNOWN";
+    this.cause = params.cause;
+  }
+}
 function parseSecretUri(reference) {
-	if (!reference) throw new SecretProviderError({
-		message: "Secret reference cannot be empty",
-		provider: "unknown",
-		reference,
-		code: "INVALID"
-	});
-	const [scheme, rest] = reference.split("://");
-	if (!scheme || !rest) throw new SecretProviderError({
-		message: `Invalid secret reference: ${reference}`,
-		provider: "unknown",
-		reference,
-		code: "INVALID"
-	});
-	const queryIndex = rest.indexOf("?");
-	if (queryIndex === -1) return {
-		provider: scheme,
-		path: rest
-	};
-	const path = rest.slice(0, queryIndex);
-	const query = rest.slice(queryIndex + 1);
-	return {
-		provider: scheme,
-		path,
-		extras: Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
-			const [keyRaw, valueRaw] = pair.split("=");
-			const key = keyRaw ?? "";
-			const value = valueRaw ?? "";
-			return [decodeURIComponent(key), decodeURIComponent(value)];
-		}))
-	};
+  if (!reference) {
+    throw new SecretProviderError({
+      message: "Secret reference cannot be empty",
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const [scheme, rest] = reference.split("://");
+  if (!scheme || !rest) {
+    throw new SecretProviderError({
+      message: `Invalid secret reference: ${reference}`,
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const queryIndex = rest.indexOf("?");
+  if (queryIndex === -1) {
+    return {
+      provider: scheme,
+      path: rest
+    };
+  }
+  const path = rest.slice(0, queryIndex);
+  const query = rest.slice(queryIndex + 1);
+  const extras = Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
+    const [keyRaw, valueRaw] = pair.split("=");
+    const key = keyRaw ?? "";
+    const value = valueRaw ?? "";
+    return [decodeURIComponent(key), decodeURIComponent(value)];
+  }));
+  return {
+    provider: scheme,
+    path,
+    extras
+  };
 }
 function normalizeSecretPayload(payload) {
-	if (payload.data instanceof Uint8Array) return payload.data;
-	if (payload.encoding === "base64") return Buffer.from(payload.data, "base64");
-	if (payload.encoding === "binary") return Buffer.from(payload.data, "binary");
-	return Buffer.from(payload.data, "utf-8");
+  if (payload.data instanceof Uint8Array) {
+    return payload.data;
+  }
+  if (payload.encoding === "base64") {
+    return Buffer.from(payload.data, "base64");
+  }
+  if (payload.encoding === "binary") {
+    return Buffer.from(payload.data, "binary");
+  }
+  return Buffer.from(payload.data, "utf-8");
 }
-
-//#endregion
-export { SecretProviderError, normalizeSecretPayload, parseSecretUri };
-//# sourceMappingURL=provider.js.map
+export {
+  parseSecretUri,
+  normalizeSecretPayload,
+  SecretProviderError
+};