@contractspec/lib.contracts 1.61.0 → 1.63.0

package/dist/integrations/secrets/scaleway-secret-manager.js

@@ -1,405 +0,0 @@
-// @bun
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __moduleCache = /* @__PURE__ */ new WeakMap;
-var __toCommonJS = (from) => {
-  var entry = __moduleCache.get(from), desc;
-  if (entry)
-    return entry;
-  entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function")
-    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    }));
-  __moduleCache.set(from, entry);
-  return entry;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: (newValue) => all[name] = () => newValue
-    });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
-
-// src/integrations/secrets/provider.ts
-import { Buffer } from "buffer";
-
-class SecretProviderError extends Error {
-  provider;
-  reference;
-  code;
-  cause;
-  constructor(params) {
-    super(params.message);
-    this.name = "SecretProviderError";
-    this.provider = params.provider;
-    this.reference = params.reference;
-    this.code = params.code ?? "UNKNOWN";
-    this.cause = params.cause;
-  }
-}
-function parseSecretUri(reference) {
-  if (!reference) {
-    throw new SecretProviderError({
-      message: "Secret reference cannot be empty",
-      provider: "unknown",
-      reference,
-      code: "INVALID"
-    });
-  }
-  const [scheme, rest] = reference.split("://");
-  if (!scheme || !rest) {
-    throw new SecretProviderError({
-      message: `Invalid secret reference: ${reference}`,
-      provider: "unknown",
-      reference,
-      code: "INVALID"
-    });
-  }
-  const queryIndex = rest.indexOf("?");
-  if (queryIndex === -1) {
-    return {
-      provider: scheme,
-      path: rest
-    };
-  }
-  const path = rest.slice(0, queryIndex);
-  const query = rest.slice(queryIndex + 1);
-  const extras = Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
-    const [keyRaw, valueRaw] = pair.split("=");
-    const key = keyRaw ?? "";
-    const value = valueRaw ?? "";
-    return [decodeURIComponent(key), decodeURIComponent(value)];
-  }));
-  return {
-    provider: scheme,
-    path,
-    extras
-  };
-}
-function normalizeSecretPayload(payload) {
-  if (payload.data instanceof Uint8Array) {
-    return payload.data;
-  }
-  if (payload.encoding === "base64") {
-    return Buffer.from(payload.data, "base64");
-  }
-  if (payload.encoding === "binary") {
-    return Buffer.from(payload.data, "binary");
-  }
-  return Buffer.from(payload.data, "utf-8");
-}
-
-// src/integrations/secrets/scaleway-secret-manager.ts
-import { Buffer as Buffer2 } from "buffer";
-var UUID_V4_LIKE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-class ScalewaySecretManagerProvider {
-  id = "scaleway-secret-manager";
-  token;
-  defaultRegion;
-  defaultProjectId;
-  baseUrl;
-  fetchFn;
-  constructor(options = {}) {
-    this.token = options.token ?? process.env.SCW_SECRET_KEY ?? process.env.SCALEWAY_SECRET_KEY ?? "";
-    this.defaultRegion = options.defaultRegion ?? process.env.SCW_DEFAULT_REGION ?? process.env.SCW_REGION;
-    this.defaultProjectId = options.defaultProjectId ?? process.env.SCW_DEFAULT_PROJECT_ID ?? process.env.SCW_PROJECT_ID;
-    this.baseUrl = options.baseUrl ?? "https://api.scaleway.com";
-    this.fetchFn = options.fetch ?? fetch;
-  }
-  canHandle(reference) {
-    try {
-      const parsed = parseSecretUri(reference);
-      return parsed.provider === "scw" && (parsed.path === "secret-manager" || parsed.path.startsWith("secret-manager/"));
-    } catch {
-      return false;
-    }
-  }
-  async getSecret(reference, options) {
-    const location = this.parseReference(reference);
-    if (!this.token) {
-      throw new SecretProviderError({
-        message: "Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",
-        provider: this.id,
-        reference,
-        code: "FORBIDDEN"
-      });
-    }
-    if (!UUID_V4_LIKE.test(location.secretIdOrName)) {
-      throw new SecretProviderError({
-        message: "Scaleway getSecret requires a secretId (uuid) reference, not a secret name.",
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    const revision = options?.version ?? location.revision ?? "latest";
-    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(location.region)}/secrets/${encodeURIComponent(location.secretIdOrName)}/versions/${encodeURIComponent(revision)}/access`;
-    const response = await this.fetchFn(url, {
-      method: "GET",
-      headers: {
-        "X-Auth-Token": this.token
-      }
-    });
-    if (!response.ok) {
-      throw await toScalewayError({
-        response,
-        provider: this.id,
-        reference,
-        operation: "getSecret"
-      });
-    }
-    const payload = await response.json();
-    const dataB64 = extractScalewayData(payload);
-    return {
-      data: Buffer2.from(dataB64, "base64"),
-      version: revision,
-      metadata: {
-        region: location.region,
-        secretId: location.secretIdOrName
-      },
-      retrievedAt: new Date
-    };
-  }
-  async setSecret(reference, payload) {
-    const location = this.parseReference(reference);
-    if (!this.token) {
-      throw new SecretProviderError({
-        message: "Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",
-        provider: this.id,
-        reference,
-        code: "FORBIDDEN"
-      });
-    }
-    const bytes = normalizeSecretPayload(payload);
-    const encoded = Buffer2.from(bytes).toString("base64");
-    const secretId = UUID_V4_LIKE.test(location.secretIdOrName) ? location.secretIdOrName : await this.createSecret({
-      region: location.region,
-      name: location.secretIdOrName,
-      reference
-    });
-    const version = await this.createSecretVersion({
-      region: location.region,
-      secretId,
-      dataB64: encoded,
-      reference
-    });
-    return {
-      reference: this.buildReference(location.region, secretId, {
-        version
-      }),
-      version
-    };
-  }
-  async rotateSecret(reference, payload) {
-    return this.setSecret(reference, payload);
-  }
-  async deleteSecret(reference) {
-    const location = this.parseReference(reference);
-    if (!this.token) {
-      throw new SecretProviderError({
-        message: "Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",
-        provider: this.id,
-        reference,
-        code: "FORBIDDEN"
-      });
-    }
-    if (!UUID_V4_LIKE.test(location.secretIdOrName)) {
-      throw new SecretProviderError({
-        message: "Scaleway deleteSecret requires a secretId (uuid) reference, not a secret name.",
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(location.region)}/secrets/${encodeURIComponent(location.secretIdOrName)}`;
-    const response = await this.fetchFn(url, {
-      method: "DELETE",
-      headers: {
-        "X-Auth-Token": this.token
-      }
-    });
-    if (!response.ok) {
-      throw await toScalewayError({
-        response,
-        provider: this.id,
-        reference,
-        operation: "deleteSecret"
-      });
-    }
-  }
-  parseReference(reference) {
-    const parsed = parseSecretUri(reference);
-    if (parsed.provider !== "scw") {
-      throw new SecretProviderError({
-        message: `Unsupported secret provider: ${parsed.provider}`,
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    const segments = parsed.path.split("/").filter(Boolean);
-    if (segments.length < 2 || segments[0] !== "secret-manager") {
-      throw new SecretProviderError({
-        message: "Expected secret reference format scw://secret-manager/{region}/{secretIdOrName}[?version=...]",
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    const region = segments[1] ?? this.defaultRegion;
-    if (!region) {
-      throw new SecretProviderError({
-        message: "Scaleway region must be provided either in reference (scw://secret-manager/{region}/...) or via SCW_DEFAULT_REGION/SCW_REGION.",
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    const secretIdOrName = segments.slice(2).join("/");
-    if (!secretIdOrName) {
-      throw new SecretProviderError({
-        message: `Unable to resolve secret id/name from reference "${parsed.path}"`,
-        provider: this.id,
-        reference,
-        code: "INVALID"
-      });
-    }
-    return {
-      region,
-      secretIdOrName,
-      revision: parsed.extras?.version
-    };
-  }
-  async createSecret(params) {
-    const projectId = this.defaultProjectId;
-    if (!projectId) {
-      throw new SecretProviderError({
-        message: "Scaleway project id is required to create secrets by name (set SCW_DEFAULT_PROJECT_ID/SCW_PROJECT_ID).",
-        provider: this.id,
-        reference: params.reference,
-        code: "INVALID"
-      });
-    }
-    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(params.region)}/secrets`;
-    const response = await this.fetchFn(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Auth-Token": this.token
-      },
-      body: JSON.stringify({
-        name: params.name,
-        project_id: projectId
-      })
-    });
-    if (!response.ok) {
-      throw await toScalewayError({
-        response,
-        provider: this.id,
-        reference: params.reference,
-        operation: "createSecret"
-      });
-    }
-    const payload = await response.json();
-    const secretId = extractScalewaySecretId(payload);
-    return secretId;
-  }
-  async createSecretVersion(params) {
-    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(params.region)}/secrets/${encodeURIComponent(params.secretId)}/versions`;
-    const response = await this.fetchFn(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Auth-Token": this.token
-      },
-      body: JSON.stringify({
-        data: params.dataB64
-      })
-    });
-    if (!response.ok) {
-      throw await toScalewayError({
-        response,
-        provider: this.id,
-        reference: params.reference,
-        operation: "createSecretVersion"
-      });
-    }
-    const payload = await response.json();
-    return extractScalewayRevision(payload) ?? "latest";
-  }
-  buildReference(region, secretId, extras) {
-    const base = `scw://secret-manager/${region}/${secretId}`;
-    const query = extras ? Object.entries(extras).filter(([, value]) => Boolean(value)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&") : "";
-    return query ? `${base}?${query}` : base;
-  }
-}
-function extractScalewayData(payload) {
-  if (!payload || typeof payload !== "object") {
-    throw new Error("Invalid scaleway secret payload");
-  }
-  const record = payload;
-  if (typeof record.data === "string" && record.data) {
-    return record.data;
-  }
-  throw new Error("Scaleway secret payload is missing data");
-}
-function extractScalewaySecretId(payload) {
-  if (!payload || typeof payload !== "object") {
-    throw new Error("Invalid scaleway createSecret payload");
-  }
-  const record = payload;
-  if (typeof record.id === "string" && record.id) {
-    return record.id;
-  }
-  throw new Error("Scaleway createSecret response is missing id");
-}
-function extractScalewayRevision(payload) {
-  if (!payload || typeof payload !== "object") {
-    return;
-  }
-  const record = payload;
-  if (typeof record.revision === "number") {
-    return String(record.revision);
-  }
-  if (typeof record.revision === "string" && record.revision) {
-    return record.revision;
-  }
-  if (typeof record.id === "string" && record.id) {
-    return record.id;
-  }
-  return;
-}
-async function toScalewayError(params) {
-  const { response, provider, reference, operation } = params;
-  const code = response.status === 404 ? "NOT_FOUND" : response.status === 401 || response.status === 403 ? "FORBIDDEN" : response.status >= 400 && response.status < 500 ? "INVALID" : "UNKNOWN";
-  const bodyText = await safeReadBody(response);
-  const message = bodyText ? `Scaleway Secret Manager ${operation} failed (${response.status}): ${bodyText}` : `Scaleway Secret Manager ${operation} failed (${response.status})`;
-  return new SecretProviderError({
-    message,
-    provider,
-    reference,
-    code
-  });
-}
-async function safeReadBody(response) {
-  try {
-    const text = await response.text();
-    const trimmed = text.trim();
-    return trimmed.length ? trimmed : undefined;
-  } catch {
-    return;
-  }
-}
-export {
-  ScalewaySecretManagerProvider
-};

package/dist/integrations/secrets-types.d.ts

@@ -1,15 +0,0 @@
-/**
- * Secret Provider types for integrations
- * These are core type definitions that don't require runtime dependencies.
- */
-export interface SecretValue {
-    data: Uint8Array;
-    version?: string;
-    metadata?: Record<string, string>;
-}
-export interface SecretProvider {
-    id: string;
-    canHandle(reference: string): boolean;
-    getSecret(reference: string): Promise<SecretValue>;
-}
-//# sourceMappingURL=secrets-types.d.ts.map

package/dist/integrations/secrets-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets-types.d.ts","sourceRoot":"","sources":["../../src/integrations/secrets-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACpD"}

package/dist/integrations/secrets-types.js

@@ -1 +0,0 @@
-// @bun

package/dist/integrations/spec.d.ts

@@ -1,73 +0,0 @@
-import type { OwnerShipMeta } from '../ownership';
-import type { CapabilityRef, CapabilityRequirement } from '../capabilities';
-import { SpecContractRegistry } from '../registry';
-export type IntegrationCategory = 'payments' | 'email' | 'calendar' | 'sms' | 'ai-llm' | 'ai-voice' | 'analytics' | 'speech-to-text' | 'vector-db' | 'storage' | 'accounting' | 'crm' | 'helpdesk' | 'project-management' | 'open-banking' | 'meeting-recorder' | 'database' | 'custom';
-export type IntegrationOwnershipMode = 'managed' | 'byok';
-export interface IntegrationMeta extends OwnerShipMeta {
-    category: IntegrationCategory;
-}
-export interface IntegrationCapabilityMapping {
-    /** Which CapabilitySpec this integration provides. */
-    provides: CapabilityRef[];
-    /** Optional: which capabilities it requires (e.g., storage for caching). */
-    requires?: CapabilityRequirement[];
-}
-export interface IntegrationConfigSchema {
-    /** JSON Schema or SchemaModel defining required config fields. */
-    schema: unknown;
-    /** Example configuration (for docs/UI). */
-    example?: Record<string, unknown>;
-}
-export interface IntegrationSecretSchema {
-    /** JSON Schema or SchemaModel describing secret fields. */
-    schema: unknown;
-    /** Redacted example for documentation/UI. */
-    example?: Record<string, string>;
-}
-export interface IntegrationByokSetup {
-    /** Human-readable instructions for tenants configuring BYOK accounts. */
-    setupInstructions?: string;
-    /** Required scopes/permissions for BYOK accounts. */
-    requiredScopes?: string[];
-}
-export interface IntegrationHealthCheck {
-    /** Endpoint or method to validate connection health. */
-    method?: 'ping' | 'list' | 'custom';
-    /** Timeout in ms for health check. */
-    timeoutMs?: number;
-}
-export interface IntegrationSpec {
-    meta: IntegrationMeta;
-    /** Supported ownership modes for this provider. */
-    supportedModes: IntegrationOwnershipMode[];
-    /** Which capabilities this integration provides/requires. */
-    capabilities: IntegrationCapabilityMapping;
-    /** Configuration schema (API keys, endpoints, etc.). */
-    configSchema: IntegrationConfigSchema;
-    /** Secret schema (API/key material stored via secretRef). */
-    secretSchema: IntegrationSecretSchema;
-    /** Optional health check configuration. */
-    healthCheck?: IntegrationHealthCheck;
-    /** Documentation URL. */
-    docsUrl?: string;
-    /** Rate limits or usage constraints. */
-    constraints?: {
-        rateLimit?: {
-            rpm?: number;
-            rph?: number;
-        };
-        quotas?: Record<string, number>;
-    };
-    /** Provider-specific metadata for BYOK setup flows. */
-    byokSetup?: IntegrationByokSetup;
-}
-export declare class IntegrationSpecRegistry extends SpecContractRegistry<'integration', IntegrationSpec> {
-    constructor(items?: IntegrationSpec[]);
-    getByCategory(category: IntegrationCategory): IntegrationSpec[];
-}
-export declare function makeIntegrationSpecKey(meta: IntegrationMeta): string;
-/**
- * Helper to define an Integration.
- */
-export declare const defineIntegration: (spec: IntegrationSpec) => IntegrationSpec;
-//# sourceMappingURL=spec.d.ts.map

package/dist/integrations/spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/integrations/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,OAAO,GACP,UAAU,GACV,KAAK,GACL,QAAQ,GACR,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,WAAW,GACX,SAAS,GACT,YAAY,GACZ,KAAK,GACL,UAAU,GACV,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,UAAU,GACV,QAAQ,CAAC;AAEb,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,sDAAsD;IACtD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpC,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,cAAc,EAAE,wBAAwB,EAAE,CAAC;IAC3C,6DAA6D;IAC7D,YAAY,EAAE,4BAA4B,CAAC;IAC3C,wDAAwD;IACxD,YAAY,EAAE,uBAAuB,CAAC;IACtC,6DAA6D;IAC7D,YAAY,EAAE,uBAAuB,CAAC;IACtC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,WAAW,CAAC,EAAE;QACZ,SAAS,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IACF,uDAAuD;IACvD,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAKD,qBAAa,uBAAwB,SAAQ,oBAAoB,CAC/D,aAAa,EACb,eAAe,CAChB;gBACoB,KAAK,CAAC,EAAE,eAAe,EAAE;IAIrC,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,eAAe,EAAE;CAGvE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,UAE3D;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,eAAe,KAAG,eACpD,CAAC"}