@cotal-ai/workspace 0.11.6 → 0.12.0

package/dist/secret-store-fs.js

@@ -0,0 +1,80 @@
+import { readFileSync, rmSync } from "node:fs";
+import { join, dirname, isAbsolute, normalize, relative, resolve, sep } from "node:path";
+import { mkSecretDir, writeSecretFileAtomic } from "@cotal-ai/core";
+/** THE local composition of the secret keyspace: a filesystem store rooted at the workspace's
+ *  `.cotal/` dir, so every canonical key (`delivery.creds`, `auth/<space>/callout.json`, …)
+ *  lands byte-for-byte on today's paths. Every local caller composes through here — a hand-rolled
+ *  root that drifted from `.cotal` would silently split the keyspace in two. */
+export function workspaceSecretStore(root) {
+    return new FsSecretStore(join(root, ".cotal"));
+}
+/**
+ * The default filesystem {@link SecretStore}: the workstation adapter behind core's abstract seam.
+ *
+ * Keys are opaque logical strings the owning packages build to MIRROR today's exact `.cotal` layout
+ * per kind — `delivery.creds`, `auth/callout.json`, `<agent>.creds`, and so on — so a local
+ * `cotal up` writes byte-for-byte the same files it does today. That layout is heterogeneous (a few
+ * kinds are already space-segmented on disk, most are not), so each key builder reproduces its
+ * kind's current path verbatim. Crucially the key carries NO injected tenant / `<space>` prefix: a
+ * hosted KMS/Vault adapter adds per-tenant scope inside ITS OWN resolve from its injection context,
+ * which keeps one backend-agnostic key per kind and preserves local byte-for-byte.
+ *
+ * This adapter adds nothing of its own: it delegates to the `secret-fs` primitives for the
+ * 0600 / icacls / atomic-replace / fail-closed guarantees. Constructed with an EXPLICIT base root
+ * (no ambient `~/.cotal`), absolutized so keys are cwd-independent. Lives in `@cotal-ai/workspace`,
+ * not core, because on-disk layout is a workstation concern, not the wire protocol.
+ *
+ * Residual (documented): a symlink UNDER the root that points outside is not caught (no realpath) —
+ * acceptable for a single-tenant workstation; a multi-tenant FS deployment should realpath-check.
+ */
+export class FsSecretStore {
+    root;
+    constructor(root) {
+        if (!root)
+            throw new Error("FsSecretStore: root is required");
+        this.root = normalize(resolve(root)); // absolutize so keys are cwd-independent
+    }
+    /** Resolve a logical key to an absolute path strictly UNDER `root`, fail-closed: reject empty,
+     *  NUL, absolute keys, the root itself (`.`), and any key that normalizes outside the root
+     *  (`..` traversal). Containment is checked via `path.relative`, not a `root + sep` prefix —
+     *  the prefix form breaks at a filesystem-root base (`/` doubles the separator and rejects
+     *  every key). A malformed key must never read or clobber a path outside the store's tree. */
+    resolve(key) {
+        if (!key || key.includes("\0"))
+            throw new Error(`FsSecretStore: invalid key ${JSON.stringify(key)}`);
+        if (isAbsolute(key))
+            throw new Error(`FsSecretStore: key must be relative, got ${JSON.stringify(key)}`);
+        const abs = normalize(join(this.root, key));
+        const rel = relative(this.root, abs);
+        if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            throw new Error(`FsSecretStore: key must name a file under the root: ${JSON.stringify(key)}`);
+        return abs;
+    }
+    async get(key) {
+        const p = this.resolve(key);
+        try {
+            return readFileSync(p, "utf8");
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined; // absent → undefined, race-safe
+            throw e;
+        }
+    }
+    async put(key, value) {
+        const p = this.resolve(key);
+        mkSecretDir(dirname(p)); // harden the parent dir before the secret lands (0700 / private ACL)
+        writeSecretFileAtomic(p, value); // temp + rename: a concurrent get sees old or new, never torn
+    }
+    async delete(key) {
+        const p = this.resolve(key);
+        try {
+            rmSync(p);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e; // already-absent is success (idempotent)
+        }
+    }
+}
+//# sourceMappingURL=secret-store-fs.js.map

package/dist/secret-store-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store-fs.js","sourceRoot":"","sources":["../src/secret-store-fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAoB,MAAM,gBAAgB,CAAC;AAEtF;;;gFAGgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,aAAa;IACP,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yCAAyC;IACjF,CAAC;IAED;;;;kGAI8F;IACtF,OAAO,CAAC,GAAW;QACzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,GAAG,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,CAAC,gCAAgC;YACtG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qEAAqE;QAC9F,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,8DAA8D;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC,CAAC,yCAAyC;QACxG,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/workspace",
   "description": "Cotal machine-local workstation layer: the ~/.cotal mesh registry, target resolution, preflight, on-disk auth-path I/O, and the command-copy renderer — operator concerns over a local checkout, kept separate from the wire protocol in @cotal-ai/core.",
-  "version": "0.11.6",
+  "version": "0.12.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.11.6"
+    "@cotal-ai/core": "0.12.0"
   },
   "files": [
     "dist"
@@ -29,6 +29,6 @@
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "tsc -p tsconfig.json",
-    "test": "tsx smoke/preflight.smoke.ts"
+    "test": "tsx smoke/preflight.smoke.ts && tsx smoke/maintenance.smoke.ts"
   }
 }