@ductape/sdk 0.0.4-v9 → 0.0.4-v91

package/dist/secrets/secrets.types.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Secrets Types
+ *
+ * Type definitions for the workspace secrets system that allows
+ * users to reference secrets using $Secret{key} syntax.
+ */
+/**
+ * Regex pattern to detect $Secret{key} syntax (full string match)
+ * Matches: $Secret{my-key}, $Secret{api_key}, $Secret{DB_PASSWORD}
+ */
+export declare const SECRET_PATTERN: RegExp;
+/**
+ * Regex pattern to find all $Secret{key} occurrences in a string
+ */
+export declare const SECRET_PATTERN_GLOBAL: RegExp;
+/**
+ * Token type for secrets
+ */
+export type SecretTokenType = 'api' | 'access';
+/**
+ * Input for creating a new secret
+ */
+export interface ICreateSecretInput {
+    /** Unique identifier for the secret */
+    key: string;
+    /** The secret value (will be encrypted) */
+    value: string;
+    /** Human-readable description */
+    description?: string;
+    /** Type of token: 'api' or 'access' */
+    token_type?: SecretTokenType;
+    /** Array of app tags this secret can be used with */
+    scope?: string[];
+    /** Array of environment slugs where this secret is available */
+    envs?: string[];
+    /** Unix timestamp for expiration (null = no expiry) */
+    expires_at?: number | null;
+}
+/**
+ * Input for updating an existing secret
+ */
+export interface IUpdateSecretInput {
+    /** New secret value (will be re-encrypted) */
+    value?: string;
+    /** Updated description */
+    description?: string;
+    /** Updated token type */
+    token_type?: SecretTokenType;
+    /** Updated scope array */
+    scope?: string[];
+    /** Updated environments array */
+    envs?: string[];
+    /** Updated expiration timestamp */
+    expires_at?: number | null;
+}
+/**
+ * Secret metadata (returned from list operations - no value)
+ */
+export interface ISecretMetadata {
+    /** MongoDB ObjectId */
+    _id: string;
+    /** Workspace ID */
+    workspace_id: string;
+    /** Unique key/identifier */
+    key: string;
+    /** Human-readable description */
+    description?: string;
+    /** Type of token */
+    token_type?: SecretTokenType;
+    /** Array of app tags this secret can be used with */
+    scope?: string[];
+    /** Array of environment slugs */
+    envs?: string[];
+    /** Unix timestamp for expiration */
+    expires_at?: number | null;
+    /** Whether the secret has been revoked */
+    revoked?: boolean;
+    /** Creation timestamp */
+    createdAt: string;
+    /** Last update timestamp */
+    updatedAt: string;
+}
+/**
+ * Full secret including decrypted value (returned from fetch)
+ */
+export interface ISecret extends ISecretMetadata {
+    /** Decrypted secret value */
+    value: string;
+}
+/**
+ * Result of checking if a value is a secret reference
+ */
+export interface ISecretCheck {
+    /** Whether the value is a secret reference */
+    isSecret: boolean;
+    /** The secret key if it's a secret reference */
+    key?: string;
+}
+/**
+ * Options for resolving secrets at runtime
+ */
+export interface IResolveSecretsOptions {
+    /** Current app tag (for scope validation) */
+    app?: string;
+    /** Current environment slug (for env validation) */
+    env?: string;
+}
+/**
+ * Result of secret resolution
+ */
+export interface ISecretResolutionResult<T = unknown> {
+    /** The resolved value with secrets replaced */
+    value: T;
+    /** Keys that were resolved */
+    resolvedKeys: string[];
+    /** Keys that failed to resolve */
+    failedKeys: string[];
+}
+/**
+ * Configuration for the secrets service
+ */
+export interface ISecretsServiceConfig {
+    /** Cache TTL in milliseconds (default: 5 minutes) */
+    cacheTtl?: number;
+    /** Whether to throw on missing secrets or return the original value */
+    throwOnMissing?: boolean;
+}
+/**
+ * Secrets service interface
+ */
+export interface ISecretsService {
+    /** Create a new secret */
+    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
+    /** Fetch all secrets (metadata only) */
+    fetchAll(): Promise<ISecretMetadata[]>;
+    /** Fetch a single secret with decrypted value */
+    fetch(key: string): Promise<ISecret>;
+    /** Update an existing secret */
+    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
+    /** Delete a secret */
+    delete(key: string): Promise<boolean>;
+    /** Revoke a secret (disable without deleting) */
+    revoke(key: string): Promise<boolean>;
+}
+/**
+ * Error thrown when a secret is not found
+ */
+export declare class SecretNotFoundError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret scope doesn't match
+ */
+export declare class SecretScopeError extends Error {
+    readonly key: string;
+    readonly app: string;
+    constructor(key: string, app: string);
+}
+/**
+ * Error thrown when secret environment doesn't match
+ */
+export declare class SecretEnvironmentError extends Error {
+    readonly key: string;
+    readonly env: string;
+    constructor(key: string, env: string);
+}
+/**
+ * Error thrown when secret has expired
+ */
+export declare class SecretExpiredError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret has been revoked
+ */
+export declare class SecretRevokedError extends Error {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Error thrown when secret resolution fails
+ */
+export declare class SecretResolutionError extends Error {
+    readonly failedKeys: string[];
+    constructor(message: string, failedKeys: string[]);
+}

package/dist/secrets/secrets.types.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Secrets Types
+ *
+ * Type definitions for the workspace secrets system that allows
+ * users to reference secrets using $Secret{key} syntax.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretResolutionError = exports.SecretRevokedError = exports.SecretExpiredError = exports.SecretEnvironmentError = exports.SecretScopeError = exports.SecretNotFoundError = exports.SECRET_PATTERN_GLOBAL = exports.SECRET_PATTERN = void 0;
+/**
+ * Regex pattern to detect $Secret{key} syntax (full string match)
+ * Matches: $Secret{my-key}, $Secret{api_key}, $Secret{DB_PASSWORD}
+ */
+exports.SECRET_PATTERN = /^\$Secret\{([a-zA-Z0-9._-]+)\}$/;
+/**
+ * Regex pattern to find all $Secret{key} occurrences in a string
+ */
+exports.SECRET_PATTERN_GLOBAL = /\$Secret\{([a-zA-Z0-9._-]+)\}/g;
+/**
+ * Error thrown when a secret is not found
+ */
+class SecretNotFoundError extends Error {
+    constructor(key) {
+        super(`Secret '${key}' not found`);
+        this.key = key;
+        this.name = 'SecretNotFoundError';
+    }
+}
+exports.SecretNotFoundError = SecretNotFoundError;
+/**
+ * Error thrown when secret scope doesn't match
+ */
+class SecretScopeError extends Error {
+    constructor(key, app) {
+        super(`Secret '${key}' is not accessible by app '${app}'`);
+        this.key = key;
+        this.app = app;
+        this.name = 'SecretScopeError';
+    }
+}
+exports.SecretScopeError = SecretScopeError;
+/**
+ * Error thrown when secret environment doesn't match
+ */
+class SecretEnvironmentError extends Error {
+    constructor(key, env) {
+        super(`Secret '${key}' is not available in environment '${env}'`);
+        this.key = key;
+        this.env = env;
+        this.name = 'SecretEnvironmentError';
+    }
+}
+exports.SecretEnvironmentError = SecretEnvironmentError;
+/**
+ * Error thrown when secret has expired
+ */
+class SecretExpiredError extends Error {
+    constructor(key) {
+        super(`Secret '${key}' has expired`);
+        this.key = key;
+        this.name = 'SecretExpiredError';
+    }
+}
+exports.SecretExpiredError = SecretExpiredError;
+/**
+ * Error thrown when secret has been revoked
+ */
+class SecretRevokedError extends Error {
+    constructor(key) {
+        super(`Secret '${key}' has been revoked`);
+        this.key = key;
+        this.name = 'SecretRevokedError';
+    }
+}
+exports.SecretRevokedError = SecretRevokedError;
+/**
+ * Error thrown when secret resolution fails
+ */
+class SecretResolutionError extends Error {
+    constructor(message, failedKeys) {
+        super(message);
+        this.failedKeys = failedKeys;
+        this.name = 'SecretResolutionError';
+    }
+}
+exports.SecretResolutionError = SecretResolutionError;
+//# sourceMappingURL=secrets.types.js.map

package/dist/secrets/secrets.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.types.js","sourceRoot":"","sources":["../../src/secrets/secrets.types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH;;;GAGG;AACU,QAAA,cAAc,GAAG,iCAAiC,CAAC;AAEhE;;GAEG;AACU,QAAA,qBAAqB,GAAG,gCAAgC,CAAC;AA6ItE;;GAEG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAA4B,GAAW;QACrC,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;QADT,QAAG,GAAH,GAAG,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IACzC,YACkB,GAAW,EACX,GAAW;QAE3B,KAAK,CAAC,WAAW,GAAG,+BAA+B,GAAG,GAAG,CAAC,CAAC;QAH3C,QAAG,GAAH,GAAG,CAAQ;QACX,QAAG,GAAH,GAAG,CAAQ;QAG3B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YACkB,GAAW,EACX,GAAW;QAE3B,KAAK,CAAC,WAAW,GAAG,sCAAsC,GAAG,GAAG,CAAC,CAAC;QAHlD,QAAG,GAAH,GAAG,CAAQ;QACX,QAAG,GAAH,GAAG,CAAQ;QAG3B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AARD,wDAQC;AAED;;GAEG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAA4B,GAAW;QACrC,KAAK,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;QADX,QAAG,GAAH,GAAG,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED;;GAEG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAA4B,GAAW;QACrC,KAAK,CAAC,WAAW,GAAG,oBAAoB,CAAC,CAAC;QADhB,QAAG,GAAH,GAAG,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YACE,OAAe,EACC,UAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAU;QAGpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AARD,sDAQC"}

package/dist/sessions/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Ductape Sessions Module
+ *
+ * Provides a unified API for JWT-based session management including
+ * creating, refreshing, verifying, and revoking sessions.
+ *
+ * @example
+ * ```ts
+ * import { SessionsService } from '@ductape/sdk';
+ *
+ * const sessions = new SessionsService({
+ *   workspace_id: 'your-workspace-id',
+ *   public_key: 'your-public-key',
+ *   user_id: 'your-user-id',
+ *   token: 'your-token',
+ *   env_type: 'prd',
+ * });
+ *
+ * // Create a session
+ * const result = await sessions.create({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   data: { userId: '123', email: 'user@example.com' },
+ * });
+ *
+ * // Verify a session
+ * const verifyResult = await sessions.verify({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   token: result.token,
+ * });
+ *
+ * // Refresh a session
+ * const refreshResult = await sessions.refresh({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   refreshToken: result.refreshToken,
+ * });
+ * ```
+ */
+export { SessionsService, SessionError } from './sessions.service';
+export { default as SessionsServiceDefault } from './sessions.service';
+export { SESSION_PATTERN, SESSION_PATTERN_GLOBAL, parseSessionToken, isSessionReference, containsSessionReferences, extractSessionReferences, getNestedValue, verifySessionToken, extractSessionContext, mightContainSessions, findAllSessionReferences, createSessionsResolver, SessionResolutionError, } from './sessions.resolver';
+export type { ISessionTokenParts, ISessionData, ISessionCheck, IResolveSessionOptions, ISessionResolutionResult, ISessionContext, } from './sessions.resolver';
+export { verifyAndExtractSession, getSessionLogFields, resolveSessionReferences, processSessionForExecution, } from './sessions.helper';
+export type { ISessionVerificationResult, ISessionLogFields, } from './sessions.helper';
+export * from './types';

package/dist/sessions/index.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Ductape Sessions Module
+ *
+ * Provides a unified API for JWT-based session management including
+ * creating, refreshing, verifying, and revoking sessions.
+ *
+ * @example
+ * ```ts
+ * import { SessionsService } from '@ductape/sdk';
+ *
+ * const sessions = new SessionsService({
+ *   workspace_id: 'your-workspace-id',
+ *   public_key: 'your-public-key',
+ *   user_id: 'your-user-id',
+ *   token: 'your-token',
+ *   env_type: 'prd',
+ * });
+ *
+ * // Create a session
+ * const result = await sessions.create({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   data: { userId: '123', email: 'user@example.com' },
+ * });
+ *
+ * // Verify a session
+ * const verifyResult = await sessions.verify({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   token: result.token,
+ * });
+ *
+ * // Refresh a session
+ * const refreshResult = await sessions.refresh({
+ *   product: 'my-product',
+ *   env: 'production',
+ *   tag: 'user-session',
+ *   refreshToken: result.refreshToken,
+ * });
+ * ```
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.processSessionForExecution = exports.resolveSessionReferences = exports.getSessionLogFields = exports.verifyAndExtractSession = exports.SessionResolutionError = exports.createSessionsResolver = exports.findAllSessionReferences = exports.mightContainSessions = exports.extractSessionContext = exports.verifySessionToken = exports.getNestedValue = exports.extractSessionReferences = exports.containsSessionReferences = exports.isSessionReference = exports.parseSessionToken = exports.SESSION_PATTERN_GLOBAL = exports.SESSION_PATTERN = exports.SessionsServiceDefault = exports.SessionError = exports.SessionsService = void 0;
+// Main service
+var sessions_service_1 = require("./sessions.service");
+Object.defineProperty(exports, "SessionsService", { enumerable: true, get: function () { return sessions_service_1.SessionsService; } });
+Object.defineProperty(exports, "SessionError", { enumerable: true, get: function () { return sessions_service_1.SessionError; } });
+var sessions_service_2 = require("./sessions.service");
+Object.defineProperty(exports, "SessionsServiceDefault", { enumerable: true, get: function () { return __importDefault(sessions_service_2).default; } });
+// Session resolver
+var sessions_resolver_1 = require("./sessions.resolver");
+Object.defineProperty(exports, "SESSION_PATTERN", { enumerable: true, get: function () { return sessions_resolver_1.SESSION_PATTERN; } });
+Object.defineProperty(exports, "SESSION_PATTERN_GLOBAL", { enumerable: true, get: function () { return sessions_resolver_1.SESSION_PATTERN_GLOBAL; } });
+Object.defineProperty(exports, "parseSessionToken", { enumerable: true, get: function () { return sessions_resolver_1.parseSessionToken; } });
+Object.defineProperty(exports, "isSessionReference", { enumerable: true, get: function () { return sessions_resolver_1.isSessionReference; } });
+Object.defineProperty(exports, "containsSessionReferences", { enumerable: true, get: function () { return sessions_resolver_1.containsSessionReferences; } });
+Object.defineProperty(exports, "extractSessionReferences", { enumerable: true, get: function () { return sessions_resolver_1.extractSessionReferences; } });
+Object.defineProperty(exports, "getNestedValue", { enumerable: true, get: function () { return sessions_resolver_1.getNestedValue; } });
+Object.defineProperty(exports, "verifySessionToken", { enumerable: true, get: function () { return sessions_resolver_1.verifySessionToken; } });
+Object.defineProperty(exports, "extractSessionContext", { enumerable: true, get: function () { return sessions_resolver_1.extractSessionContext; } });
+Object.defineProperty(exports, "mightContainSessions", { enumerable: true, get: function () { return sessions_resolver_1.mightContainSessions; } });
+Object.defineProperty(exports, "findAllSessionReferences", { enumerable: true, get: function () { return sessions_resolver_1.findAllSessionReferences; } });
+Object.defineProperty(exports, "createSessionsResolver", { enumerable: true, get: function () { return sessions_resolver_1.createSessionsResolver; } });
+Object.defineProperty(exports, "SessionResolutionError", { enumerable: true, get: function () { return sessions_resolver_1.SessionResolutionError; } });
+// Session helper for executors
+var sessions_helper_1 = require("./sessions.helper");
+Object.defineProperty(exports, "verifyAndExtractSession", { enumerable: true, get: function () { return sessions_helper_1.verifyAndExtractSession; } });
+Object.defineProperty(exports, "getSessionLogFields", { enumerable: true, get: function () { return sessions_helper_1.getSessionLogFields; } });
+Object.defineProperty(exports, "resolveSessionReferences", { enumerable: true, get: function () { return sessions_helper_1.resolveSessionReferences; } });
+Object.defineProperty(exports, "processSessionForExecution", { enumerable: true, get: function () { return sessions_helper_1.processSessionForExecution; } });
+// Types
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/sessions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;;;;;;;;;;;;;;AAEH,eAAe;AACf,uDAAmE;AAA1D,mHAAA,eAAe,OAAA;AAAE,gHAAA,YAAY,OAAA;AACtC,uDAAuE;AAA9D,2IAAA,OAAO,OAA0B;AAE1C,mBAAmB;AACnB,yDAc6B;AAb3B,oHAAA,eAAe,OAAA;AACf,2HAAA,sBAAsB,OAAA;AACtB,sHAAA,iBAAiB,OAAA;AACjB,uHAAA,kBAAkB,OAAA;AAClB,8HAAA,yBAAyB,OAAA;AACzB,6HAAA,wBAAwB,OAAA;AACxB,mHAAA,cAAc,OAAA;AACd,uHAAA,kBAAkB,OAAA;AAClB,0HAAA,qBAAqB,OAAA;AACrB,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AACxB,2HAAA,sBAAsB,OAAA;AACtB,2HAAA,sBAAsB,OAAA;AAWxB,+BAA+B;AAC/B,qDAK2B;AAJzB,0HAAA,uBAAuB,OAAA;AACvB,sHAAA,mBAAmB,OAAA;AACnB,2HAAA,wBAAwB,OAAA;AACxB,6HAAA,0BAA0B,OAAA;AAO5B,QAAQ;AACR,0CAAwB"}

package/dist/sessions/sessions.helper.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Sessions Helper
+ *
+ * Utility functions for session verification and context extraction
+ * to be used across all executors (actions, database, graph, vector, etc.)
+ *
+ * Session token format: session_tag:jwt_token
+ * The token contains both the session tag and JWT in a single string.
+ */
+import { ISessionData, ISessionContext } from './sessions.resolver';
+/**
+ * Result of session verification for an executor
+ */
+export interface ISessionVerificationResult {
+    /** Whether session was provided and is valid */
+    valid: boolean;
+    /** Session data if valid */
+    sessionData?: ISessionData;
+    /** Session context for logging (identifier, session_id, session_tag) */
+    context?: ISessionContext;
+    /** Error message if invalid */
+    error?: string;
+}
+/**
+ * Log fields extracted from session for ILogData
+ */
+export interface ISessionLogFields {
+    identifier?: string;
+    session_id?: string;
+    session_tag?: string;
+}
+/**
+ * Verify a session token and extract context for logging
+ *
+ * @param sessionToken - Session token string in format: session_tag:jwt_token
+ * @param privateKey - Product private key for JWT verification
+ * @param env - Current environment slug
+ * @param selector - Optional selector path for identifier extraction
+ * @returns Session verification result with context for logging
+ */
+export declare function verifyAndExtractSession(sessionToken: string | undefined, privateKey: string, env?: string, selector?: string): Promise<ISessionVerificationResult>;
+/**
+ * Extract log fields from session context
+ */
+export declare function getSessionLogFields(context: ISessionContext | undefined): ISessionLogFields;
+/**
+ * Resolve $Session{key}{...} references in input data
+ *
+ * @param input - Input data that may contain session references
+ * @param sessionData - Verified session data
+ * @returns Resolved input with session references replaced
+ */
+export declare function resolveSessionReferences<T>(input: T, sessionData: ISessionData | undefined): T;
+/**
+ * Combined helper that verifies session and resolves references in one call
+ *
+ * @param sessionToken - Session token string in format: session_tag:jwt_token
+ * @param privateKey - Product private key for JWT verification
+ * @param input - Input data that may contain $Session{} references
+ * @param env - Current environment slug
+ * @param selector - Optional selector path for identifier extraction
+ */
+export declare function processSessionForExecution<T>(sessionToken: string | undefined, privateKey: string, input: T, env?: string, selector?: string): Promise<{
+    input: T;
+    logFields: ISessionLogFields;
+    sessionData?: ISessionData;
+    error?: string;
+}>;

package/dist/sessions/sessions.helper.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Sessions Helper
+ *
+ * Utility functions for session verification and context extraction
+ * to be used across all executors (actions, database, graph, vector, etc.)
+ *
+ * Session token format: session_tag:jwt_token
+ * The token contains both the session tag and JWT in a single string.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAndExtractSession = verifyAndExtractSession;
+exports.getSessionLogFields = getSessionLogFields;
+exports.resolveSessionReferences = resolveSessionReferences;
+exports.processSessionForExecution = processSessionForExecution;
+const sessions_resolver_1 = require("./sessions.resolver");
+/**
+ * Verify a session token and extract context for logging
+ *
+ * @param sessionToken - Session token string in format: session_tag:jwt_token
+ * @param privateKey - Product private key for JWT verification
+ * @param env - Current environment slug
+ * @param selector - Optional selector path for identifier extraction
+ * @returns Session verification result with context for logging
+ */
+async function verifyAndExtractSession(sessionToken, privateKey, env, selector) {
+    // No session provided - return valid (session is optional)
+    if (!sessionToken) {
+        return { valid: true };
+    }
+    // Parse the token format (session_tag:jwt)
+    const parts = (0, sessions_resolver_1.parseSessionToken)(sessionToken);
+    if (!parts) {
+        return {
+            valid: false,
+            error: 'Invalid session token format. Expected format: session_tag:jwt_token',
+        };
+    }
+    // Verify the JWT
+    const sessionData = await (0, sessions_resolver_1.verifySessionToken)(sessionToken, privateKey, parts.tag, env);
+    if (!sessionData) {
+        return {
+            valid: false,
+            error: 'Session token verification failed. Token may be invalid or expired.',
+        };
+    }
+    // Extract session context for logging
+    const context = (0, sessions_resolver_1.extractSessionContext)(sessionData, selector);
+    return {
+        valid: true,
+        sessionData,
+        context,
+    };
+}
+/**
+ * Extract log fields from session context
+ */
+function getSessionLogFields(context) {
+    if (!context) {
+        return {};
+    }
+    return {
+        identifier: context.identifier,
+        session_id: context.session_id,
+        session_tag: context.session_tag,
+    };
+}
+/**
+ * Resolve $Session{key}{...} references in input data
+ *
+ * @param input - Input data that may contain session references
+ * @param sessionData - Verified session data
+ * @returns Resolved input with session references replaced
+ */
+function resolveSessionReferences(input, sessionData) {
+    if (!sessionData || !(0, sessions_resolver_1.mightContainSessions)(input)) {
+        return input;
+    }
+    const resolver = (0, sessions_resolver_1.createSessionsResolver)(sessionData);
+    const result = resolver.resolveObject(input);
+    return result.value;
+}
+/**
+ * Combined helper that verifies session and resolves references in one call
+ *
+ * @param sessionToken - Session token string in format: session_tag:jwt_token
+ * @param privateKey - Product private key for JWT verification
+ * @param input - Input data that may contain $Session{} references
+ * @param env - Current environment slug
+ * @param selector - Optional selector path for identifier extraction
+ */
+async function processSessionForExecution(sessionToken, privateKey, input, env, selector) {
+    // No session - return input as-is
+    if (!sessionToken) {
+        return { input, logFields: {} };
+    }
+    // Verify session
+    const verification = await verifyAndExtractSession(sessionToken, privateKey, env, selector);
+    if (!verification.valid) {
+        return {
+            input,
+            logFields: {},
+            error: verification.error,
+        };
+    }
+    // Resolve session references in input
+    const resolvedInput = resolveSessionReferences(input, verification.sessionData);
+    // Get log fields
+    const logFields = getSessionLogFields(verification.context);
+    return {
+        input: resolvedInput,
+        logFields,
+        sessionData: verification.sessionData,
+    };
+}
+//# sourceMappingURL=sessions.helper.js.map

package/dist/sessions/sessions.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.helper.js","sourceRoot":"","sources":["../../src/sessions/sessions.helper.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA4CH,0DAqCC;AAKD,kDAUC;AASD,4DAWC;AAWD,gEAsCC;AAnKD,2DAQ6B;AAyB7B;;;;;;;;GAQG;AACI,KAAK,UAAU,uBAAuB,CAC3C,YAAgC,EAChC,UAAkB,EAClB,GAAY,EACZ,QAAiB;IAEjB,2DAA2D;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,2CAA2C;IAC3C,MAAM,KAAK,GAAG,IAAA,qCAAiB,EAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,sEAAsE;SAC9E,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,IAAA,sCAAkB,EAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,qEAAqE;SAC7E,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,IAAA,yCAAqB,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7D,OAAO;QACL,KAAK,EAAE,IAAI;QACX,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAoC;IACtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,KAAQ,EACR,WAAqC;IAErC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,wCAAoB,EAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,0CAAsB,EAAC,WAAW,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,0BAA0B,CAC9C,YAAgC,EAChC,UAAkB,EAClB,KAAQ,EACR,GAAY,EACZ,QAAiB;IAOjB,kCAAkC;IAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;IAED,iBAAiB;IACjB,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,KAAK;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IAEhF,iBAAiB;IACjB,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAE5D,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,SAAS;QACT,WAAW,EAAE,YAAY,CAAC,WAAW;KACtC,CAAC;AACJ,CAAC"}