@ductape/sdk 0.0.4-v51 → 0.0.4-v52

package/dist/secrets/secrets.resolver.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * Secrets Resolver
+ *
+ * Utility for detecting and resolving $Secret{key} patterns at runtime.
+ * This module handles:
+ * - Pattern detection in strings and objects
+ * - Secret fetching and caching
+ * - Validation of scope and environment constraints
+ * - Recursive resolution of nested objects
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretReference = isSecretReference;
+exports.containsSecretReferences = containsSecretReferences;
+exports.extractSecretKeys = extractSecretKeys;
+exports.validateSecret = validateSecret;
+exports.replaceSecretInString = replaceSecretInString;
+exports.findAllSecretReferences = findAllSecretReferences;
+exports.createSecretsResolver = createSecretsResolver;
+exports.mightContainSecrets = mightContainSecrets;
+const secrets_types_1 = require("./secrets.types");
+/**
+ * Check if a string value is a secret reference
+ */
+function isSecretReference(value) {
+    if (typeof value !== 'string') {
+        return { isSecret: false };
+    }
+    const match = value.match(secrets_types_1.SECRET_PATTERN);
+    if (match) {
+        return { isSecret: true, key: match[1] };
+    }
+    return { isSecret: false };
+}
+/**
+ * Check if a string contains any secret references (partial matches)
+ */
+function containsSecretReferences(value) {
+    if (typeof value !== 'string') {
+        return false;
+    }
+    return secrets_types_1.SECRET_PATTERN_GLOBAL.test(value);
+}
+/**
+ * Extract all secret keys from a string
+ */
+function extractSecretKeys(value) {
+    if (typeof value !== 'string') {
+        return [];
+    }
+    const keys = [];
+    let match;
+    const pattern = new RegExp(secrets_types_1.SECRET_PATTERN_GLOBAL.source, 'g');
+    while ((match = pattern.exec(value)) !== null) {
+        keys.push(match[1]);
+    }
+    return keys;
+}
+/**
+ * Validate a secret against scope, environment, expiration, and revocation status
+ */
+function validateSecret(secret, options) {
+    // Check if revoked
+    if (secret.revoked) {
+        throw new secrets_types_1.SecretRevokedError(secret.key);
+    }
+    // Check expiration
+    if (secret.expires_at && secret.expires_at < Math.floor(Date.now() / 1000)) {
+        throw new secrets_types_1.SecretExpiredError(secret.key);
+    }
+    // Check scope (if provided and secret has scope restrictions)
+    if ((options === null || options === void 0 ? void 0 : options.app) && secret.scope && secret.scope.length > 0) {
+        if (!secret.scope.includes(options.app)) {
+            throw new secrets_types_1.SecretScopeError(secret.key, options.app);
+        }
+    }
+    // Check environment (if provided and secret has env restrictions)
+    if ((options === null || options === void 0 ? void 0 : options.env) && secret.envs && secret.envs.length > 0) {
+        if (!secret.envs.includes(options.env)) {
+            throw new secrets_types_1.SecretEnvironmentError(secret.key, options.env);
+        }
+    }
+}
+/**
+ * Replace a single secret reference with its value
+ */
+function replaceSecretInString(value, secretKey, secretValue) {
+    const pattern = new RegExp(`\\$Secret\\{${escapeRegex(secretKey)}\\}`, 'g');
+    return value.replace(pattern, secretValue);
+}
+/**
+ * Escape special regex characters in a string
+ */
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Recursively find all secret references in an object
+ */
+function findAllSecretReferences(obj) {
+    const keys = new Set();
+    function traverse(value) {
+        if (typeof value === 'string') {
+            const secretKeys = extractSecretKeys(value);
+            secretKeys.forEach((key) => keys.add(key));
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(traverse);
+        }
+        else if (value !== null && typeof value === 'object') {
+            Object.values(value).forEach(traverse);
+        }
+    }
+    traverse(obj);
+    return Array.from(keys);
+}
+/**
+ * Create a secrets resolver instance with caching
+ */
+function createSecretsResolver(fetchSecret, options) {
+    var _a;
+    const cache = new Map();
+    const cacheTtl = (_a = options === null || options === void 0 ? void 0 : options.cacheTtl) !== null && _a !== void 0 ? _a : 5 * 60 * 1000; // 5 minutes default
+    /**
+     * Get a secret from cache or fetch it
+     */
+    async function getSecret(key) {
+        const cached = cache.get(key);
+        const now = Date.now();
+        if (cached && now - cached.timestamp < cacheTtl) {
+            return cached.secret;
+        }
+        const secret = await fetchSecret(key);
+        cache.set(key, { secret, timestamp: now });
+        return secret;
+    }
+    /**
+     * Clear the cache
+     */
+    function clearCache() {
+        cache.clear();
+    }
+    /**
+     * Remove a specific key from cache
+     */
+    function invalidate(key) {
+        cache.delete(key);
+    }
+    /**
+     * Resolve a single string value, replacing all $Secret{key} patterns
+     */
+    async function resolveString(value, resolveOptions) {
+        const keys = extractSecretKeys(value);
+        const resolvedKeys = [];
+        const failedKeys = [];
+        let result = value;
+        for (const key of keys) {
+            try {
+                const secret = await getSecret(key);
+                validateSecret(secret, resolveOptions);
+                result = replaceSecretInString(result, key, secret.value);
+                resolvedKeys.push(key);
+            }
+            catch (error) {
+                failedKeys.push(key);
+                // If throwOnMissing is not specified, we keep the original reference
+                if (error instanceof secrets_types_1.SecretNotFoundError) {
+                    // Keep original $Secret{key} in the string
+                }
+                else {
+                    throw error; // Re-throw scope, env, expired, revoked errors
+                }
+            }
+        }
+        return { value: result, resolvedKeys, failedKeys };
+    }
+    /**
+     * Recursively resolve all $Secret{key} patterns in an object
+     */
+    async function resolveObject(obj, resolveOptions) {
+        const allResolvedKeys = [];
+        const allFailedKeys = [];
+        async function resolve(value) {
+            if (typeof value === 'string') {
+                const result = await resolveString(value, resolveOptions);
+                allResolvedKeys.push(...result.resolvedKeys);
+                allFailedKeys.push(...result.failedKeys);
+                return result.value;
+            }
+            if (Array.isArray(value)) {
+                return Promise.all(value.map(resolve));
+            }
+            if (value !== null && typeof value === 'object') {
+                const resolved = {};
+                for (const [key, val] of Object.entries(value)) {
+                    resolved[key] = await resolve(val);
+                }
+                return resolved;
+            }
+            return value;
+        }
+        const resolvedValue = (await resolve(obj));
+        return {
+            value: resolvedValue,
+            resolvedKeys: [...new Set(allResolvedKeys)],
+            failedKeys: [...new Set(allFailedKeys)],
+        };
+    }
+    return {
+        getSecret,
+        resolveString,
+        resolveObject,
+        clearCache,
+        invalidate,
+        findAllSecretReferences,
+    };
+}
+/**
+ * Type guard to check if a value might contain secrets
+ */
+function mightContainSecrets(value) {
+    if (typeof value === 'string') {
+        return containsSecretReferences(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some(mightContainSecrets);
+    }
+    if (value !== null && typeof value === 'object') {
+        return Object.values(value).some(mightContainSecrets);
+    }
+    return false;
+}
+//# sourceMappingURL=secrets.resolver.js.map

package/dist/secrets/secrets.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.resolver.js","sourceRoot":"","sources":["../../src/secrets/secrets.resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAmBH,8CAWC;AAKD,4DAKC;AAKD,8CAcC;AAKD,wCA2BC;AAKD,sDAOC;AAYD,0DAgBC;AAKD,sDAuHC;AAKD,kDAcC;AAhRD,mDAYyB;AAEzB;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,8BAAc,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,qCAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,qCAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,MAAe,EACf,OAAgC;IAEhC,mBAAmB;IACnB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gCAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,sCAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,KAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,eAAe,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,GAAY;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,SAAS,QAAQ,CAAC,KAAc;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,WAA8C,EAC9C,OAA+B;;IAE/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAEzE;;OAEG;IACH,KAAK,UAAU,SAAS,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU;QACjB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU,CAAC,GAAW;QAC7B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,KAAa,EACb,cAAuC;QAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACvC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,KAAK,YAAY,mCAAmB,EAAE,CAAC;oBACzC,2CAA2C;gBAC7C,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC,CAAC,+CAA+C;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,GAAM,EACN,cAAuC;QAEvC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,UAAU,OAAO,CAAC,KAAc;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAC1D,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAM,CAAC;QAEhD,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,aAAa;QACb,aAAa;QACb,UAAU;QACV,UAAU;QACV,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/secrets/secrets.service.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Secrets Service
+ *
+ * High-level service for managing workspace secrets.
+ * Provides CRUD operations and runtime secret resolution.
+ */
+import { EnvType, IRequestExtension } from '../types';
+import { ICreateSecretInput, IUpdateSecretInput, ISecret, ISecretMetadata, ISecretsServiceConfig, IResolveSecretsOptions, ISecretResolutionResult } from './secrets.types';
+export interface ISecretsServiceDeps {
+    environment: EnvType;
+    getAuth: () => IRequestExtension;
+}
+export declare class SecretsService {
+    private apiService;
+    private getAuth;
+    private resolver;
+    private config;
+    constructor(deps: ISecretsServiceDeps, config?: ISecretsServiceConfig);
+    /**
+     * Create a new secret
+     */
+    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
+    /**
+     * Fetch all secrets (metadata only, no values)
+     */
+    fetchAll(): Promise<ISecretMetadata[]>;
+    /**
+     * Fetch a single secret with decrypted value
+     */
+    fetch(key: string): Promise<ISecret>;
+    /**
+     * Update an existing secret
+     */
+    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
+    /**
+     * Delete a secret permanently
+     */
+    delete(key: string): Promise<boolean>;
+    /**
+     * Revoke a secret (disable without deleting)
+     */
+    revoke(key: string): Promise<boolean>;
+    /**
+     * Check if a key exists in the workspace
+     */
+    exists(key: string): Promise<boolean>;
+    /**
+     * Resolve all $Secret{key} patterns in a value
+     * Works with strings, objects, and arrays
+     */
+    resolve<T>(value: T, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<T>>;
+    /**
+     * Resolve a single string value
+     */
+    resolveString(value: string, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<string>>;
+    /**
+     * Check if a value is a secret reference
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Check if a value might contain secrets
+     */
+    mightContainSecrets(value: unknown): boolean;
+    /**
+     * Find all secret keys referenced in a value
+     */
+    findAllSecretReferences(value: unknown): string[];
+    /**
+     * Validate that all referenced secrets exist
+     * Useful for validation during asset creation/update
+     */
+    validateSecretReferences(value: unknown): Promise<{
+        valid: boolean;
+        missingKeys: string[];
+        existingKeys: string[];
+    }>;
+    /**
+     * Clear the internal cache
+     */
+    clearCache(): void;
+}
+export declare function getSecretsService(): SecretsService | null;
+export declare function setSecretsService(service: SecretsService): void;

package/dist/secrets/secrets.service.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Secrets Service
+ *
+ * High-level service for managing workspace secrets.
+ * Provides CRUD operations and runtime secret resolution.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsService = void 0;
+exports.getSecretsService = getSecretsService;
+exports.setSecretsService = setSecretsService;
+const secretsApi_service_1 = require("../api/services/secretsApi.service");
+const secrets_types_1 = require("./secrets.types");
+const secrets_resolver_1 = require("./secrets.resolver");
+class SecretsService {
+    constructor(deps, config = {}) {
+        this.apiService = new secretsApi_service_1.SecretsApiService(deps.environment);
+        this.getAuth = deps.getAuth;
+        this.config = config;
+        // Create resolver with fetch function bound to this service
+        this.resolver = (0, secrets_resolver_1.createSecretsResolver)(async (key) => this.fetch(key), { cacheTtl: config.cacheTtl });
+    }
+    /**
+     * Create a new secret
+     */
+    async create(input) {
+        return this.apiService.create(this.getAuth(), input);
+    }
+    /**
+     * Fetch all secrets (metadata only, no values)
+     */
+    async fetchAll() {
+        return this.apiService.fetchAll(this.getAuth());
+    }
+    /**
+     * Fetch a single secret with decrypted value
+     */
+    async fetch(key) {
+        var _a;
+        try {
+            return await this.apiService.fetch(this.getAuth(), key);
+        }
+        catch (error) {
+            if (((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 404) {
+                throw new secrets_types_1.SecretNotFoundError(key);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Update an existing secret
+     */
+    async update(key, input) {
+        // Invalidate cache when updating
+        this.resolver.invalidate(key);
+        return this.apiService.update(this.getAuth(), key, input);
+    }
+    /**
+     * Delete a secret permanently
+     */
+    async delete(key) {
+        // Invalidate cache when deleting
+        this.resolver.invalidate(key);
+        return this.apiService.delete(this.getAuth(), key);
+    }
+    /**
+     * Revoke a secret (disable without deleting)
+     */
+    async revoke(key) {
+        // Invalidate cache when revoking
+        this.resolver.invalidate(key);
+        return this.apiService.revoke(this.getAuth(), key);
+    }
+    /**
+     * Check if a key exists in the workspace
+     */
+    async exists(key) {
+        try {
+            await this.fetch(key);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof secrets_types_1.SecretNotFoundError) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    /**
+     * Resolve all $Secret{key} patterns in a value
+     * Works with strings, objects, and arrays
+     */
+    async resolve(value, options) {
+        return this.resolver.resolveObject(value, options);
+    }
+    /**
+     * Resolve a single string value
+     */
+    async resolveString(value, options) {
+        return this.resolver.resolveString(value, options);
+    }
+    /**
+     * Check if a value is a secret reference
+     */
+    isSecretReference(value) {
+        return (0, secrets_resolver_1.isSecretReference)(value).isSecret;
+    }
+    /**
+     * Check if a value might contain secrets
+     */
+    mightContainSecrets(value) {
+        return (0, secrets_resolver_1.mightContainSecrets)(value);
+    }
+    /**
+     * Find all secret keys referenced in a value
+     */
+    findAllSecretReferences(value) {
+        return (0, secrets_resolver_1.findAllSecretReferences)(value);
+    }
+    /**
+     * Validate that all referenced secrets exist
+     * Useful for validation during asset creation/update
+     */
+    async validateSecretReferences(value) {
+        const keys = (0, secrets_resolver_1.findAllSecretReferences)(value);
+        const existingKeys = [];
+        const missingKeys = [];
+        for (const key of keys) {
+            const exists = await this.exists(key);
+            if (exists) {
+                existingKeys.push(key);
+            }
+            else {
+                missingKeys.push(key);
+            }
+        }
+        return {
+            valid: missingKeys.length === 0,
+            missingKeys,
+            existingKeys,
+        };
+    }
+    /**
+     * Clear the internal cache
+     */
+    clearCache() {
+        this.resolver.clearCache();
+    }
+}
+exports.SecretsService = SecretsService;
+// Singleton instance for convenience
+let secretsServiceInstance = null;
+function getSecretsService() {
+    return secretsServiceInstance;
+}
+function setSecretsService(service) {
+    secretsServiceInstance = service;
+}
+//# sourceMappingURL=secrets.service.js.map

package/dist/secrets/secrets.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.service.js","sourceRoot":"","sources":["../../src/secrets/secrets.service.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoMH,8CAEC;AAED,8CAEC;AAxMD,2EAA2F;AAE3F,mDASyB;AACzB,yDAK4B;AAO5B,MAAa,cAAc;IAMzB,YAAY,IAAyB,EAAE,SAAgC,EAAE;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,sCAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAA,wCAAqB,EACnC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACtC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,CAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,MAAM,MAAK,GAAG,EAAE,CAAC;gBACpC,MAAM,IAAI,mCAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAyB;QACjD,iCAAiC;QACjC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,iCAAiC;QACjC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,iCAAiC;QACjC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAmB,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,KAAQ,EACR,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAA,oCAAiB,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAc;QAChC,OAAO,IAAA,sCAAmB,EAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,KAAc;QACpC,OAAO,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAc;QAK3C,MAAM,IAAI,GAAG,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;YAC/B,WAAW;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;CACF;AArKD,wCAqKC;AAED,qCAAqC;AACrC,IAAI,sBAAsB,GAA0B,IAAI,CAAC;AAEzD,SAAgB,iBAAiB;IAC/B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,sBAAsB,GAAG,OAAO,CAAC;AACnC,CAAC"}

package/dist/secrets/secrets.types.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Secrets Types
+ *
+ * Type definitions for the workspace secrets system that allows
+ * users to reference secrets using $Secret{key} syntax.
+ */
+/**
+ * Regex pattern to detect $Secret{key} syntax (full string match)
+ * Matches: $Secret{my-key}, $Secret{api_key}, $Secret{DB_PASSWORD}
+ */
+export declare const SECRET_PATTERN: RegExp;
+/**
+ * Regex pattern to find all $Secret{key} occurrences in a string
+ */
+export declare const SECRET_PATTERN_GLOBAL: RegExp;
+/**
+ * Token type for secrets
+ */
+export type SecretTokenType = 'api' | 'access';
+/**
+ * Input for creating a new secret
+ */
+export interface ICreateSecretInput {
+    /** Unique identifier for the secret */
+    key: string;
+    /** The secret value (will be encrypted) */
+    value: string;
+    /** Human-readable description */
+    description?: string;
+    /** Type of token: 'api' or 'access' */
+    token_type?: SecretTokenType;
+    /** Array of app tags this secret can be used with */
+    scope?: string[];
+    /** Array of environment slugs where this secret is available */
+    envs?: string[];
+    /** Unix timestamp for expiration (null = no expiry) */
+    expires_at?: number | null;
+}
+/**
+ * Input for updating an existing secret
+ */
+export interface IUpdateSecretInput {
+    /** New secret value (will be re-encrypted) */
+    value?: string;
+    /** Updated description */
+    description?: string;
+    /** Updated token type */
+    token_type?: SecretTokenType;
+    /** Updated scope array */
+    scope?: string[];
+    /** Updated environments array */
+    envs?: string[];
+    /** Updated expiration timestamp */
+    expires_at?: number | null;
+}
+/**
+ * Secret metadata (returned from list operations - no value)
+ */
+export interface ISecretMetadata {
+    /** MongoDB ObjectId */
+    _id: string;
+    /** Workspace ID */
+    workspace_id: string;
+    /** Unique key/identifier */
+    key: string;
+    /** Human-readable description */
+    description?: string;
+    /** Type of token */
+    token_type?: SecretTokenType;
+    /** Array of app tags this secret can be used with */
+    scope?: string[];
+    /** Array of environment slugs */
+    envs?: string[];
+    /** Unix timestamp for expiration */
+    expires_at?: number | null;
+    /** Whether the secret has been revoked */
+    revoked?: boolean;
+    /** Creation timestamp */
+    createdAt: string;
+    /** Last update timestamp */
+    updatedAt: string;
+}
+/**
+ * Full secret including decrypted value (returned from fetch)
+ */
+export interface ISecret extends ISecretMetadata {
+    /** Decrypted secret value */
+    value: string;
+}
+/**
+ * Result of checking if a value is a secret reference
+ */
+export interface ISecretCheck {
+    /** Whether the value is a secret reference */
+    isSecret: boolean;
+    /** The secret key if it's a secret reference */
+    key?: string;
+}
+/**
+ * Options for resolving secrets at runtime
+ */
+export interface IResolveSecretsOptions {
+    /** Current app tag (for scope validation) */
+    app?: string;
+    /** Current environment slug (for env validation) */
+    env?: string;
+}
+/**
+ * Result of secret resolution
+ */
+export interface ISecretResolutionResult<T = unknown> {
+    /** The resolved value with secrets replaced */
+    value: T;
+    /** Keys that were resolved */
+    resolvedKeys: string[];
+    /** Keys that failed to resolve */
+    failedKeys: string[];
+}
+/**
+ * Configuration for the secrets service
+ */
+export interface ISecretsServiceConfig {
+    /** Cache TTL in milliseconds (default: 5 minutes) */
+    cacheTtl?: number;
+    /** Whether to throw on missing secrets or return the original value */
+    throwOnMissing?: boolean;
+}
+/**
+ * Secrets service interface
+ */
+export interface ISecretsService {
+    /** Create a new secret */
+    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
+    /** Fetch all secrets (metadata only) */
+    fetchAll(): Promise<ISecretMetadata[]>;
+    /** Fetch a single secret with decrypted value */
+    fetch(key: string): Promise<ISecret>;
+    /** Update an existing secret */
+    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
+    /** Delete a secret */
+    delete(key: string): Promise<boolean>;
+    /** Revoke a secret (disable without deleting) */
+    revoke(key: string): Promise<boolean>;
+}
+/**
+ * Error thrown when a secret is not found
+ */
+export declare class SecretNotFoundError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret scope doesn't match
+ */
+export declare class SecretScopeError extends Error {
+    readonly key: string;
+    readonly app: string;
+    constructor(key: string, app: string);
+}
+/**
+ * Error thrown when secret environment doesn't match
+ */
+export declare class SecretEnvironmentError extends Error {
+    readonly key: string;
+    readonly env: string;
+    constructor(key: string, env: string);
+}
+/**
+ * Error thrown when secret has expired
+ */
+export declare class SecretExpiredError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret has been revoked
+ */
+export declare class SecretRevokedError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret resolution fails
+ */
+export declare class SecretResolutionError extends Error {
+    readonly failedKeys: string[];
+    constructor(message: string, failedKeys: string[]);
+}