@ductape/sdk 0.0.4 → 0.0.5

package/dist/secrets/secrets.resolver.js

@@ -0,0 +1,236 @@
+"use strict";
+/**
+ * Secrets Resolver
+ *
+ * Utility for detecting and resolving $Secret{key} patterns at runtime.
+ * This module handles:
+ * - Pattern detection in strings and objects
+ * - Secret fetching and caching
+ * - Validation of scope and environment constraints
+ * - Recursive resolution of nested objects
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretReference = isSecretReference;
+exports.containsSecretReferences = containsSecretReferences;
+exports.extractSecretKeys = extractSecretKeys;
+exports.validateSecret = validateSecret;
+exports.replaceSecretInString = replaceSecretInString;
+exports.findAllSecretReferences = findAllSecretReferences;
+exports.createSecretsResolver = createSecretsResolver;
+exports.mightContainSecrets = mightContainSecrets;
+const secrets_types_1 = require("./secrets.types");
+/**
+ * Check if a string value is a secret reference
+ */
+function isSecretReference(value) {
+    if (typeof value !== 'string') {
+        return { isSecret: false };
+    }
+    const match = value.match(secrets_types_1.SECRET_PATTERN);
+    if (match) {
+        return { isSecret: true, key: match[1] };
+    }
+    return { isSecret: false };
+}
+/**
+ * Check if a string contains any secret references (partial matches)
+ */
+function containsSecretReferences(value) {
+    if (typeof value !== 'string') {
+        return false;
+    }
+    // IMPORTANT: Reset lastIndex before testing - global regex maintains state
+    // which causes alternating true/false results on repeated calls
+    secrets_types_1.SECRET_PATTERN_GLOBAL.lastIndex = 0;
+    return secrets_types_1.SECRET_PATTERN_GLOBAL.test(value);
+}
+/**
+ * Extract all secret keys from a string
+ */
+function extractSecretKeys(value) {
+    if (typeof value !== 'string') {
+        return [];
+    }
+    const keys = [];
+    let match;
+    const pattern = new RegExp(secrets_types_1.SECRET_PATTERN_GLOBAL.source, 'g');
+    while ((match = pattern.exec(value)) !== null) {
+        keys.push(match[1]);
+    }
+    return keys;
+}
+/**
+ * Validate a secret against scope, environment, expiration, and revocation status
+ */
+function validateSecret(secret, options) {
+    // Check if revoked
+    if (secret.revoked) {
+        throw new secrets_types_1.SecretRevokedError(secret.key);
+    }
+    // Check expiration
+    if (secret.expires_at && secret.expires_at < Math.floor(Date.now() / 1000)) {
+        throw new secrets_types_1.SecretExpiredError(secret.key);
+    }
+    // Check scope (if provided and secret has scope restrictions)
+    if ((options === null || options === void 0 ? void 0 : options.app) && secret.scope && secret.scope.length > 0) {
+        if (!secret.scope.includes(options.app)) {
+            throw new secrets_types_1.SecretScopeError(secret.key, options.app);
+        }
+    }
+    // Check environment (if provided and secret has env restrictions)
+    if ((options === null || options === void 0 ? void 0 : options.env) && secret.envs && secret.envs.length > 0) {
+        if (!secret.envs.includes(options.env)) {
+            throw new secrets_types_1.SecretEnvironmentError(secret.key, options.env);
+        }
+    }
+}
+/**
+ * Replace a single secret reference with its value
+ */
+function replaceSecretInString(value, secretKey, secretValue) {
+    const pattern = new RegExp(`\\$[Ss]ecret\\{${escapeRegex(secretKey)}\\}`, 'g');
+    return value.replace(pattern, secretValue);
+}
+/**
+ * Escape special regex characters in a string
+ */
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Recursively find all secret references in an object
+ */
+function findAllSecretReferences(obj) {
+    const keys = new Set();
+    function traverse(value) {
+        if (typeof value === 'string') {
+            const secretKeys = extractSecretKeys(value);
+            secretKeys.forEach((key) => keys.add(key));
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(traverse);
+        }
+        else if (value !== null && typeof value === 'object') {
+            Object.values(value).forEach(traverse);
+        }
+    }
+    traverse(obj);
+    return Array.from(keys);
+}
+/**
+ * Create a secrets resolver instance with caching
+ */
+function createSecretsResolver(fetchSecret, options) {
+    var _a;
+    const cache = new Map();
+    const cacheTtl = (_a = options === null || options === void 0 ? void 0 : options.cacheTtl) !== null && _a !== void 0 ? _a : 5 * 60 * 1000; // 5 minutes default
+    /**
+     * Get a secret from cache or fetch it
+     */
+    async function getSecret(key) {
+        const cached = cache.get(key);
+        const now = Date.now();
+        if (cached && now - cached.timestamp < cacheTtl) {
+            return cached.secret;
+        }
+        const secret = await fetchSecret(key);
+        cache.set(key, { secret, timestamp: now });
+        return secret;
+    }
+    /**
+     * Clear the cache
+     */
+    function clearCache() {
+        cache.clear();
+    }
+    /**
+     * Remove a specific key from cache
+     */
+    function invalidate(key) {
+        cache.delete(key);
+    }
+    /**
+     * Resolve a single string value, replacing all $Secret{key} patterns
+     */
+    async function resolveString(value, resolveOptions) {
+        const keys = extractSecretKeys(value);
+        const resolvedKeys = [];
+        const failedKeys = [];
+        let result = value;
+        for (const key of keys) {
+            try {
+                const secret = await getSecret(key);
+                validateSecret(secret, resolveOptions);
+                result = replaceSecretInString(result, key, secret.value);
+                resolvedKeys.push(key);
+            }
+            catch (error) {
+                failedKeys.push(key);
+                // If throwOnMissing is not specified, we keep the original reference
+                if (error instanceof secrets_types_1.SecretNotFoundError) {
+                    // Keep original $Secret{key} in the string
+                }
+                else {
+                    throw error; // Re-throw scope, env, expired, revoked errors
+                }
+            }
+        }
+        return { value: result, resolvedKeys, failedKeys };
+    }
+    /**
+     * Recursively resolve all $Secret{key} patterns in an object
+     */
+    async function resolveObject(obj, resolveOptions) {
+        const allResolvedKeys = [];
+        const allFailedKeys = [];
+        async function resolve(value) {
+            if (typeof value === 'string') {
+                const result = await resolveString(value, resolveOptions);
+                allResolvedKeys.push(...result.resolvedKeys);
+                allFailedKeys.push(...result.failedKeys);
+                return result.value;
+            }
+            if (Array.isArray(value)) {
+                return Promise.all(value.map(resolve));
+            }
+            if (value !== null && typeof value === 'object') {
+                const resolved = {};
+                for (const [key, val] of Object.entries(value)) {
+                    resolved[key] = await resolve(val);
+                }
+                return resolved;
+            }
+            return value;
+        }
+        const resolvedValue = (await resolve(obj));
+        return {
+            value: resolvedValue,
+            resolvedKeys: [...new Set(allResolvedKeys)],
+            failedKeys: [...new Set(allFailedKeys)],
+        };
+    }
+    return {
+        getSecret,
+        resolveString,
+        resolveObject,
+        clearCache,
+        invalidate,
+        findAllSecretReferences,
+    };
+}
+/**
+ * Type guard to check if a value might contain secrets
+ */
+function mightContainSecrets(value) {
+    if (typeof value === 'string') {
+        return containsSecretReferences(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some(mightContainSecrets);
+    }
+    if (value !== null && typeof value === 'object') {
+        return Object.values(value).some(mightContainSecrets);
+    }
+    return false;
+}
+//# sourceMappingURL=secrets.resolver.js.map

package/dist/secrets/secrets.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.resolver.js","sourceRoot":"","sources":["../../src/secrets/secrets.resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAmBH,8CAWC;AAKD,4DAQC;AAKD,8CAcC;AAKD,wCA2BC;AAKD,sDAOC;AAYD,0DAgBC;AAKD,sDAuHC;AAKD,kDAcC;AAnRD,mDAYyB;AAEzB;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,8BAAc,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,gEAAgE;IAChE,qCAAqB,CAAC,SAAS,GAAG,CAAC,CAAC;IACpC,OAAO,qCAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,qCAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,MAAe,EACf,OAAgC;IAEhC,mBAAmB;IACnB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gCAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,sCAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,KAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,kBAAkB,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,GAAY;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,SAAS,QAAQ,CAAC,KAAc;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,WAA8C,EAC9C,OAA+B;;IAE/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAEzE;;OAEG;IACH,KAAK,UAAU,SAAS,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU;QACjB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU,CAAC,GAAW;QAC7B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,KAAa,EACb,cAAuC;QAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACvC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,KAAK,YAAY,mCAAmB,EAAE,CAAC;oBACzC,2CAA2C;gBAC7C,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC,CAAC,+CAA+C;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,GAAM,EACN,cAAuC;QAEvC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,UAAU,OAAO,CAAC,KAAc;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAC1D,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAM,CAAC;QAEhD,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,aAAa;QACb,aAAa;QACb,UAAU;QACV,UAAU;QACV,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/secrets/secrets.service.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Secrets Service
+ *
+ * High-level service for managing workspace secrets.
+ * Provides CRUD operations and runtime secret resolution.
+ */
+import { EnvType, IRequestExtension } from '../types';
+import { ICreateSecretInput, IUpdateSecretInput, ISecret, ISecretMetadata, ISecretsServiceConfig, IResolveSecretsOptions, ISecretResolutionResult } from './secrets.types';
+export interface ISecretsServiceDeps {
+    environment: EnvType;
+    getAuth: () => IRequestExtension;
+    getPrivateKey: () => string | undefined;
+}
+export declare class SecretsService {
+    private apiService;
+    private getAuth;
+    private getPrivateKey;
+    private resolver;
+    private config;
+    private encryptedCache;
+    private cacheTtl;
+    constructor(deps: ISecretsServiceDeps, config?: ISecretsServiceConfig);
+    /**
+     * Encrypt a value using the workspace's private key
+     * Uses AES-256-GCM for symmetric encryption
+     */
+    private encryptValue;
+    /**
+     * Create a new secret
+     */
+    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
+    /**
+     * Fetch all secrets (metadata only, no values)
+     */
+    fetchAll(): Promise<ISecretMetadata[]>;
+    /**
+     * Fetch a single secret with decrypted value
+     * Uses ultra-secure flow: fetches encrypted value, caches it, decrypts locally
+     */
+    fetch(key: string): Promise<ISecret>;
+    /**
+     * Update an existing secret
+     */
+    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
+    /**
+     * Delete a secret permanently
+     */
+    delete(key: string): Promise<boolean>;
+    /**
+     * Revoke a secret (disable without deleting)
+     */
+    revoke(key: string): Promise<boolean>;
+    /**
+     * Check if a key exists in the workspace
+     */
+    exists(key: string): Promise<boolean>;
+    /**
+     * Resolve all $Secret{key} patterns in a value
+     * Works with strings, objects, and arrays
+     */
+    resolve<T>(value: T, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<T>>;
+    /**
+     * Resolve a single string value
+     */
+    resolveString(value: string, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<string>>;
+    /**
+     * Check if a value is a secret reference
+     */
+    isSecretReference(value: string): boolean;
+    /**
+     * Check if a value might contain secrets
+     */
+    mightContainSecrets(value: unknown): boolean;
+    /**
+     * Find all secret keys referenced in a value
+     */
+    findAllSecretReferences(value: unknown): string[];
+    /**
+     * Validate that all referenced secrets exist
+     * Useful for validation during asset creation/update
+     */
+    validateSecretReferences(value: unknown): Promise<{
+        valid: boolean;
+        missingKeys: string[];
+        existingKeys: string[];
+    }>;
+    /**
+     * Clear the internal caches (both decrypted resolver cache and encrypted cache)
+     */
+    clearCache(): void;
+}
+export declare function getSecretsService(): SecretsService | null;
+export declare function setSecretsService(service: SecretsService): void;

package/dist/secrets/secrets.service.js

@@ -0,0 +1,246 @@
+"use strict";
+/**
+ * Secrets Service
+ *
+ * High-level service for managing workspace secrets.
+ * Provides CRUD operations and runtime secret resolution.
+ */
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsService = void 0;
+exports.getSecretsService = getSecretsService;
+exports.setSecretsService = setSecretsService;
+const secretsApi_service_1 = require("../api/services/secretsApi.service");
+const secrets_types_1 = require("./secrets.types");
+const secrets_resolver_1 = require("./secrets.resolver");
+const processor_utils_1 = require("../processor/utils/processor.utils");
+class SecretsService {
+    constructor(deps, config = {}) {
+        var _a;
+        this.apiService = new secretsApi_service_1.SecretsApiService(deps.environment);
+        this.getAuth = deps.getAuth;
+        this.getPrivateKey = deps.getPrivateKey;
+        this.config = config;
+        this.encryptedCache = new Map();
+        this.cacheTtl = (_a = config.cacheTtl) !== null && _a !== void 0 ? _a : 5 * 60 * 1000; // 5 minutes default
+        // Create resolver with fetch function bound to this service
+        this.resolver = (0, secrets_resolver_1.createSecretsResolver)(async (key) => this.fetch(key), { cacheTtl: config.cacheTtl });
+    }
+    /**
+     * Encrypt a value using the workspace's private key
+     * Uses AES-256-GCM for symmetric encryption
+     */
+    encryptValue(value) {
+        const privateKey = this.getAuth().private_key;
+        if (!privateKey) {
+            throw new Error('Workspace private key not available for encryption');
+        }
+        return (0, processor_utils_1.encrypt)(value, privateKey);
+    }
+    /**
+     * Create a new secret
+     */
+    async create(input) {
+        // Encrypt the value before sending to API
+        const encryptedValue = this.encryptValue(input.value);
+        // Create input with encrypted_value instead of value
+        const encryptedInput = {
+            key: input.key,
+            encrypted_value: encryptedValue,
+            description: input.description,
+            token_type: input.token_type,
+            scope: input.scope,
+            envs: input.envs,
+            expires_at: input.expires_at,
+        };
+        return this.apiService.create(this.getAuth(), encryptedInput);
+    }
+    /**
+     * Fetch all secrets (metadata only, no values)
+     */
+    async fetchAll() {
+        return this.apiService.fetchAll(this.getAuth());
+    }
+    /**
+     * Fetch a single secret with decrypted value
+     * Uses ultra-secure flow: fetches encrypted value, caches it, decrypts locally
+     */
+    async fetch(key) {
+        var _a;
+        try {
+            // Check encrypted cache first
+            const cached = this.encryptedCache.get(key);
+            const now = Date.now();
+            let encrypted_value;
+            let revoked;
+            if (cached && now - cached.timestamp < this.cacheTtl) {
+                encrypted_value = cached.encrypted_value;
+                revoked = cached.revoked;
+            }
+            else {
+                // Fetch encrypted value from backend (never decrypted over HTTP)
+                const response = await this.apiService.fetchEncrypted(this.getAuth(), key);
+                encrypted_value = response.encrypted_value;
+                revoked = response.revoked;
+                // Validate response before caching
+                if (!encrypted_value || typeof encrypted_value !== 'string') {
+                    throw new Error(`Invalid encrypted_value received from backend for secret: ${key}`);
+                }
+                // Cache the encrypted value for performance (only if valid)
+                this.encryptedCache.set(key, { encrypted_value, revoked, timestamp: now });
+            }
+            // Check if secret is revoked
+            if (revoked) {
+                throw new secrets_types_1.SecretRevokedError(key);
+            }
+            // Decrypt locally using workspace private key
+            const privateKey = this.getAuth().private_key;
+            if (!privateKey) {
+                throw new Error('Workspace private key not available for decryption');
+            }
+            const decryptedValue = (0, processor_utils_1.decrypt)(encrypted_value, privateKey);
+            // Return minimal secret object with decrypted value
+            return {
+                key,
+                value: decryptedValue,
+                revoked,
+            };
+        }
+        catch (error) {
+            if (((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 404) {
+                throw new secrets_types_1.SecretNotFoundError(key);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Update an existing secret
+     */
+    async update(key, input) {
+        // Invalidate both caches when updating
+        this.resolver.invalidate(key);
+        this.encryptedCache.delete(key);
+        // If value is provided, encrypt it before sending
+        if (input.value) {
+            const encryptedValue = this.encryptValue(input.value);
+            const { value: _plainValue } = input, restInput = __rest(input, ["value"]);
+            const encryptedInput = Object.assign(Object.assign({}, restInput), { encrypted_value: encryptedValue });
+            return this.apiService.update(this.getAuth(), key, encryptedInput);
+        }
+        return this.apiService.update(this.getAuth(), key, input);
+    }
+    /**
+     * Delete a secret permanently
+     */
+    async delete(key) {
+        // Invalidate both caches when deleting
+        this.resolver.invalidate(key);
+        this.encryptedCache.delete(key);
+        return this.apiService.delete(this.getAuth(), key);
+    }
+    /**
+     * Revoke a secret (disable without deleting)
+     */
+    async revoke(key) {
+        // Invalidate both caches when revoking
+        this.resolver.invalidate(key);
+        this.encryptedCache.delete(key);
+        return this.apiService.revoke(this.getAuth(), key);
+    }
+    /**
+     * Check if a key exists in the workspace
+     */
+    async exists(key) {
+        try {
+            await this.fetch(key);
+            return true;
+        }
+        catch (error) {
+            //if (error instanceof SecretNotFoundError ) {
+            return false;
+            /*}
+            throw error;*/
+        }
+    }
+    /**
+     * Resolve all $Secret{key} patterns in a value
+     * Works with strings, objects, and arrays
+     */
+    async resolve(value, options) {
+        return this.resolver.resolveObject(value, options);
+    }
+    /**
+     * Resolve a single string value
+     */
+    async resolveString(value, options) {
+        return this.resolver.resolveString(value, options);
+    }
+    /**
+     * Check if a value is a secret reference
+     */
+    isSecretReference(value) {
+        return (0, secrets_resolver_1.isSecretReference)(value).isSecret;
+    }
+    /**
+     * Check if a value might contain secrets
+     */
+    mightContainSecrets(value) {
+        return (0, secrets_resolver_1.mightContainSecrets)(value);
+    }
+    /**
+     * Find all secret keys referenced in a value
+     */
+    findAllSecretReferences(value) {
+        return (0, secrets_resolver_1.findAllSecretReferences)(value);
+    }
+    /**
+     * Validate that all referenced secrets exist
+     * Useful for validation during asset creation/update
+     */
+    async validateSecretReferences(value) {
+        const keys = (0, secrets_resolver_1.findAllSecretReferences)(value);
+        const existingKeys = [];
+        const missingKeys = [];
+        for (const key of keys) {
+            const exists = await this.exists(key);
+            if (exists) {
+                existingKeys.push(key);
+            }
+            else {
+                missingKeys.push(key);
+            }
+        }
+        return {
+            valid: missingKeys.length === 0,
+            missingKeys,
+            existingKeys,
+        };
+    }
+    /**
+     * Clear the internal caches (both decrypted resolver cache and encrypted cache)
+     */
+    clearCache() {
+        this.resolver.clearCache();
+        this.encryptedCache.clear();
+    }
+}
+exports.SecretsService = SecretsService;
+// Singleton instance for convenience
+let secretsServiceInstance = null;
+function getSecretsService() {
+    return secretsServiceInstance;
+}
+function setSecretsService(service) {
+    secretsServiceInstance = service;
+}
+//# sourceMappingURL=secrets.service.js.map

package/dist/secrets/secrets.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.service.js","sourceRoot":"","sources":["../../src/secrets/secrets.service.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;AAwSH,8CAEC;AAED,8CAEC;AA3SD,2EAA2F;AAE3F,mDAUyB;AACzB,yDAK4B;AAE5B,wEAAsE;AAQtE,MAAa,cAAc;IASzB,YAAY,IAAyB,EAAE,SAAgC,EAAE;;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,sCAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAA,MAAM,CAAC,QAAQ,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;QAEtE,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAA,wCAAqB,EACnC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACtC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAAa;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAA,yBAAO,EAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,0CAA0C;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEtD,qDAAqD;QACrD,MAAM,cAAc,GAAG;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,eAAe,EAAE,cAAc;YAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAqB,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;;QACrB,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,eAAuB,CAAC;YAC5B,IAAI,OAAgB,CAAC;YAErB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;gBACzC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3E,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;gBAC3C,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAE3B,mCAAmC;gBACnC,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;oBAC5D,MAAM,IAAI,KAAK,CAAC,6DAA6D,GAAG,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,4DAA4D;gBAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,6BAA6B;YAC7B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,kCAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,8CAA8C;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;YAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,yBAAO,EAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAE5D,oDAAoD;YACpD,OAAO;gBACL,GAAG;gBACH,KAAK,EAAE,cAAc;gBACrB,OAAO;aACG,CAAC;QAEf,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,CAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,MAAM,MAAK,GAAG,EAAE,CAAC;gBACpC,MAAM,IAAI,mCAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAyB;QACjD,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEhC,kDAAkD;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,EAAE,KAAK,EAAE,WAAW,KAAmB,KAAK,EAAnB,SAAS,UAAK,KAAK,EAA5C,SAAoC,CAAQ,CAAC;YACnD,MAAM,cAAc,mCACf,SAAS,KACZ,eAAe,EAAE,cAAc,GAChC,CAAC;YAEF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,cAAqB,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8CAA8C;YAC5C,OAAO,KAAK,CAAC;YACf;0BACc;QAChB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,KAAQ,EACR,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAA,oCAAiB,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAc;QAChC,OAAO,IAAA,sCAAmB,EAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,KAAc;QACpC,OAAO,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAc;QAK3C,MAAM,IAAI,GAAG,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;YAC/B,WAAW;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF;AApQD,wCAoQC;AAED,qCAAqC;AACrC,IAAI,sBAAsB,GAA0B,IAAI,CAAC;AAEzD,SAAgB,iBAAiB;IAC/B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,sBAAsB,GAAG,OAAO,CAAC;AACnC,CAAC"}