@ductape/sdk 0.1.6 → 0.1.8

package/dist/secrets/secrets.resolver.js

@@ -1,236 +0,0 @@
-"use strict";
-/**
- * Secrets Resolver
- *
- * Utility for detecting and resolving $Secret{key} patterns at runtime.
- * This module handles:
- * - Pattern detection in strings and objects
- * - Secret fetching and caching
- * - Validation of scope and environment constraints
- * - Recursive resolution of nested objects
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isSecretReference = isSecretReference;
-exports.containsSecretReferences = containsSecretReferences;
-exports.extractSecretKeys = extractSecretKeys;
-exports.validateSecret = validateSecret;
-exports.replaceSecretInString = replaceSecretInString;
-exports.findAllSecretReferences = findAllSecretReferences;
-exports.createSecretsResolver = createSecretsResolver;
-exports.mightContainSecrets = mightContainSecrets;
-const secrets_types_1 = require("./secrets.types");
-/**
- * Check if a string value is a secret reference
- */
-function isSecretReference(value) {
-    if (typeof value !== 'string') {
-        return { isSecret: false };
-    }
-    const match = value.match(secrets_types_1.SECRET_PATTERN);
-    if (match) {
-        return { isSecret: true, key: match[1] };
-    }
-    return { isSecret: false };
-}
-/**
- * Check if a string contains any secret references (partial matches)
- */
-function containsSecretReferences(value) {
-    if (typeof value !== 'string') {
-        return false;
-    }
-    // IMPORTANT: Reset lastIndex before testing - global regex maintains state
-    // which causes alternating true/false results on repeated calls
-    secrets_types_1.SECRET_PATTERN_GLOBAL.lastIndex = 0;
-    return secrets_types_1.SECRET_PATTERN_GLOBAL.test(value);
-}
-/**
- * Extract all secret keys from a string
- */
-function extractSecretKeys(value) {
-    if (typeof value !== 'string') {
-        return [];
-    }
-    const keys = [];
-    let match;
-    const pattern = new RegExp(secrets_types_1.SECRET_PATTERN_GLOBAL.source, 'g');
-    while ((match = pattern.exec(value)) !== null) {
-        keys.push(match[1]);
-    }
-    return keys;
-}
-/**
- * Validate a secret against scope, environment, expiration, and revocation status
- */
-function validateSecret(secret, options) {
-    // Check if revoked
-    if (secret.revoked) {
-        throw new secrets_types_1.SecretRevokedError(secret.key);
-    }
-    // Check expiration
-    if (secret.expires_at && secret.expires_at < Math.floor(Date.now() / 1000)) {
-        throw new secrets_types_1.SecretExpiredError(secret.key);
-    }
-    // Check scope (if provided and secret has scope restrictions)
-    if ((options === null || options === void 0 ? void 0 : options.app) && secret.scope && secret.scope.length > 0) {
-        if (!secret.scope.includes(options.app)) {
-            throw new secrets_types_1.SecretScopeError(secret.key, options.app);
-        }
-    }
-    // Check environment (if provided and secret has env restrictions)
-    if ((options === null || options === void 0 ? void 0 : options.env) && secret.envs && secret.envs.length > 0) {
-        if (!secret.envs.includes(options.env)) {
-            throw new secrets_types_1.SecretEnvironmentError(secret.key, options.env);
-        }
-    }
-}
-/**
- * Replace a single secret reference with its value
- */
-function replaceSecretInString(value, secretKey, secretValue) {
-    const pattern = new RegExp(`\\$[Ss]ecret\\{${escapeRegex(secretKey)}\\}`, 'g');
-    return value.replace(pattern, secretValue);
-}
-/**
- * Escape special regex characters in a string
- */
-function escapeRegex(str) {
-    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-/**
- * Recursively find all secret references in an object
- */
-function findAllSecretReferences(obj) {
-    const keys = new Set();
-    function traverse(value) {
-        if (typeof value === 'string') {
-            const secretKeys = extractSecretKeys(value);
-            secretKeys.forEach((key) => keys.add(key));
-        }
-        else if (Array.isArray(value)) {
-            value.forEach(traverse);
-        }
-        else if (value !== null && typeof value === 'object') {
-            Object.values(value).forEach(traverse);
-        }
-    }
-    traverse(obj);
-    return Array.from(keys);
-}
-/**
- * Create a secrets resolver instance with caching
- */
-function createSecretsResolver(fetchSecret, options) {
-    var _a;
-    const cache = new Map();
-    const cacheTtl = (_a = options === null || options === void 0 ? void 0 : options.cacheTtl) !== null && _a !== void 0 ? _a : 5 * 60 * 1000; // 5 minutes default
-    /**
-     * Get a secret from cache or fetch it
-     */
-    async function getSecret(key) {
-        const cached = cache.get(key);
-        const now = Date.now();
-        if (cached && now - cached.timestamp < cacheTtl) {
-            return cached.secret;
-        }
-        const secret = await fetchSecret(key);
-        cache.set(key, { secret, timestamp: now });
-        return secret;
-    }
-    /**
-     * Clear the cache
-     */
-    function clearCache() {
-        cache.clear();
-    }
-    /**
-     * Remove a specific key from cache
-     */
-    function invalidate(key) {
-        cache.delete(key);
-    }
-    /**
-     * Resolve a single string value, replacing all $Secret{key} patterns
-     */
-    async function resolveString(value, resolveOptions) {
-        const keys = extractSecretKeys(value);
-        const resolvedKeys = [];
-        const failedKeys = [];
-        let result = value;
-        for (const key of keys) {
-            try {
-                const secret = await getSecret(key);
-                validateSecret(secret, resolveOptions);
-                result = replaceSecretInString(result, key, secret.value);
-                resolvedKeys.push(key);
-            }
-            catch (error) {
-                failedKeys.push(key);
-                // If throwOnMissing is not specified, we keep the original reference
-                if (error instanceof secrets_types_1.SecretNotFoundError) {
-                    // Keep original $Secret{key} in the string
-                }
-                else {
-                    throw error; // Re-throw scope, env, expired, revoked errors
-                }
-            }
-        }
-        return { value: result, resolvedKeys, failedKeys };
-    }
-    /**
-     * Recursively resolve all $Secret{key} patterns in an object
-     */
-    async function resolveObject(obj, resolveOptions) {
-        const allResolvedKeys = [];
-        const allFailedKeys = [];
-        async function resolve(value) {
-            if (typeof value === 'string') {
-                const result = await resolveString(value, resolveOptions);
-                allResolvedKeys.push(...result.resolvedKeys);
-                allFailedKeys.push(...result.failedKeys);
-                return result.value;
-            }
-            if (Array.isArray(value)) {
-                return Promise.all(value.map(resolve));
-            }
-            if (value !== null && typeof value === 'object') {
-                const resolved = {};
-                for (const [key, val] of Object.entries(value)) {
-                    resolved[key] = await resolve(val);
-                }
-                return resolved;
-            }
-            return value;
-        }
-        const resolvedValue = (await resolve(obj));
-        return {
-            value: resolvedValue,
-            resolvedKeys: [...new Set(allResolvedKeys)],
-            failedKeys: [...new Set(allFailedKeys)],
-        };
-    }
-    return {
-        getSecret,
-        resolveString,
-        resolveObject,
-        clearCache,
-        invalidate,
-        findAllSecretReferences,
-    };
-}
-/**
- * Type guard to check if a value might contain secrets
- */
-function mightContainSecrets(value) {
-    if (typeof value === 'string') {
-        return containsSecretReferences(value);
-    }
-    if (Array.isArray(value)) {
-        return value.some(mightContainSecrets);
-    }
-    if (value !== null && typeof value === 'object') {
-        return Object.values(value).some(mightContainSecrets);
-    }
-    return false;
-}
-//# sourceMappingURL=secrets.resolver.js.map

package/dist/secrets/secrets.resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.resolver.js","sourceRoot":"","sources":["../../src/secrets/secrets.resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAmBH,8CAWC;AAKD,4DAQC;AAKD,8CAcC;AAKD,wCA2BC;AAKD,sDAOC;AAYD,0DAgBC;AAKD,sDAuHC;AAKD,kDAcC;AAnRD,mDAYyB;AAEzB;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,8BAAc,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,gEAAgE;IAChE,qCAAqB,CAAC,SAAS,GAAG,CAAC,CAAC;IACpC,OAAO,qCAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC;IACV,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,qCAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAC5B,MAAe,EACf,OAAgC;IAEhC,mBAAmB;IACnB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gCAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,sCAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,KAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,kBAAkB,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,GAAY;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,SAAS,QAAQ,CAAC,KAAc;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,WAA8C,EAC9C,OAA+B;;IAE/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAEzE;;OAEG;IACH,KAAK,UAAU,SAAS,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU;QACjB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,UAAU,CAAC,GAAW;QAC7B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,KAAa,EACb,cAAuC;QAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACvC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,qEAAqE;gBACrE,IAAI,KAAK,YAAY,mCAAmB,EAAE,CAAC;oBACzC,2CAA2C;gBAC7C,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC,CAAC,+CAA+C;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,aAAa,CAC1B,GAAM,EACN,cAAuC;QAEvC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,UAAU,OAAO,CAAC,KAAc;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAC1D,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAA4B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAM,CAAC;QAEhD,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,aAAa;QACb,aAAa;QACb,UAAU;QACV,UAAU;QACV,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/secrets/secrets.service.d.ts

@@ -1,93 +0,0 @@
-/**
- * Secrets Service
- *
- * High-level service for managing workspace secrets.
- * Provides CRUD operations and runtime secret resolution.
- */
-import { EnvType, IRequestExtension } from '../types';
-import { ICreateSecretInput, IUpdateSecretInput, ISecret, ISecretMetadata, ISecretsServiceConfig, IResolveSecretsOptions, ISecretResolutionResult } from './secrets.types';
-export interface ISecretsServiceDeps {
-    environment: EnvType;
-    getAuth: () => IRequestExtension;
-    getPrivateKey: () => string | undefined;
-}
-export declare class SecretsService {
-    private apiService;
-    private getAuth;
-    private getPrivateKey;
-    private resolver;
-    private config;
-    private encryptedCache;
-    private cacheTtl;
-    constructor(deps: ISecretsServiceDeps, config?: ISecretsServiceConfig);
-    /**
-     * Encrypt a value using the workspace's private key
-     * Uses AES-256-GCM for symmetric encryption
-     */
-    private encryptValue;
-    /**
-     * Create a new secret
-     */
-    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
-    /**
-     * Fetch all secrets (metadata only, no values)
-     */
-    fetchAll(): Promise<ISecretMetadata[]>;
-    /**
-     * Fetch a single secret with decrypted value
-     * Uses ultra-secure flow: fetches encrypted value, caches it, decrypts locally
-     */
-    fetch(key: string): Promise<ISecret>;
-    /**
-     * Update an existing secret
-     */
-    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
-    /**
-     * Delete a secret permanently
-     */
-    delete(key: string): Promise<boolean>;
-    /**
-     * Revoke a secret (disable without deleting)
-     */
-    revoke(key: string): Promise<boolean>;
-    /**
-     * Check if a key exists in the workspace
-     */
-    exists(key: string): Promise<boolean>;
-    /**
-     * Resolve all $Secret{key} patterns in a value
-     * Works with strings, objects, and arrays
-     */
-    resolve<T>(value: T, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<T>>;
-    /**
-     * Resolve a single string value
-     */
-    resolveString(value: string, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<string>>;
-    /**
-     * Check if a value is a secret reference
-     */
-    isSecretReference(value: string): boolean;
-    /**
-     * Check if a value might contain secrets
-     */
-    mightContainSecrets(value: unknown): boolean;
-    /**
-     * Find all secret keys referenced in a value
-     */
-    findAllSecretReferences(value: unknown): string[];
-    /**
-     * Validate that all referenced secrets exist
-     * Useful for validation during asset creation/update
-     */
-    validateSecretReferences(value: unknown): Promise<{
-        valid: boolean;
-        missingKeys: string[];
-        existingKeys: string[];
-    }>;
-    /**
-     * Clear the internal caches (both decrypted resolver cache and encrypted cache)
-     */
-    clearCache(): void;
-}
-export declare function getSecretsService(): SecretsService | null;
-export declare function setSecretsService(service: SecretsService): void;

package/dist/secrets/secrets.service.js

@@ -1,246 +0,0 @@
-"use strict";
-/**
- * Secrets Service
- *
- * High-level service for managing workspace secrets.
- * Provides CRUD operations and runtime secret resolution.
- */
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecretsService = void 0;
-exports.getSecretsService = getSecretsService;
-exports.setSecretsService = setSecretsService;
-const secretsApi_service_1 = require("../api/services/secretsApi.service");
-const secrets_types_1 = require("./secrets.types");
-const secrets_resolver_1 = require("./secrets.resolver");
-const processor_utils_1 = require("../processor/utils/processor.utils");
-class SecretsService {
-    constructor(deps, config = {}) {
-        var _a;
-        this.apiService = new secretsApi_service_1.SecretsApiService(deps.environment);
-        this.getAuth = deps.getAuth;
-        this.getPrivateKey = deps.getPrivateKey;
-        this.config = config;
-        this.encryptedCache = new Map();
-        this.cacheTtl = (_a = config.cacheTtl) !== null && _a !== void 0 ? _a : 5 * 60 * 1000; // 5 minutes default
-        // Create resolver with fetch function bound to this service
-        this.resolver = (0, secrets_resolver_1.createSecretsResolver)(async (key) => this.fetch(key), { cacheTtl: config.cacheTtl });
-    }
-    /**
-     * Encrypt a value using the workspace's private key
-     * Uses AES-256-GCM for symmetric encryption
-     */
-    encryptValue(value) {
-        const privateKey = this.getAuth().private_key;
-        if (!privateKey) {
-            throw new Error('Workspace private key not available for encryption');
-        }
-        return (0, processor_utils_1.encrypt)(value, privateKey);
-    }
-    /**
-     * Create a new secret
-     */
-    async create(input) {
-        // Encrypt the value before sending to API
-        const encryptedValue = this.encryptValue(input.value);
-        // Create input with encrypted_value instead of value
-        const encryptedInput = {
-            key: input.key,
-            encrypted_value: encryptedValue,
-            description: input.description,
-            token_type: input.token_type,
-            scope: input.scope,
-            envs: input.envs,
-            expires_at: input.expires_at,
-        };
-        return this.apiService.create(this.getAuth(), encryptedInput);
-    }
-    /**
-     * Fetch all secrets (metadata only, no values)
-     */
-    async fetchAll() {
-        return this.apiService.fetchAll(this.getAuth());
-    }
-    /**
-     * Fetch a single secret with decrypted value
-     * Uses ultra-secure flow: fetches encrypted value, caches it, decrypts locally
-     */
-    async fetch(key) {
-        var _a;
-        try {
-            // Check encrypted cache first
-            const cached = this.encryptedCache.get(key);
-            const now = Date.now();
-            let encrypted_value;
-            let revoked;
-            if (cached && now - cached.timestamp < this.cacheTtl) {
-                encrypted_value = cached.encrypted_value;
-                revoked = cached.revoked;
-            }
-            else {
-                // Fetch encrypted value from backend (never decrypted over HTTP)
-                const response = await this.apiService.fetchEncrypted(this.getAuth(), key);
-                encrypted_value = response.encrypted_value;
-                revoked = response.revoked;
-                // Validate response before caching
-                if (!encrypted_value || typeof encrypted_value !== 'string') {
-                    throw new Error(`Invalid encrypted_value received from backend for secret: ${key}`);
-                }
-                // Cache the encrypted value for performance (only if valid)
-                this.encryptedCache.set(key, { encrypted_value, revoked, timestamp: now });
-            }
-            // Check if secret is revoked
-            if (revoked) {
-                throw new secrets_types_1.SecretRevokedError(key);
-            }
-            // Decrypt locally using workspace private key
-            const privateKey = this.getAuth().private_key;
-            if (!privateKey) {
-                throw new Error('Workspace private key not available for decryption');
-            }
-            const decryptedValue = (0, processor_utils_1.decrypt)(encrypted_value, privateKey);
-            // Return minimal secret object with decrypted value
-            return {
-                key,
-                value: decryptedValue,
-                revoked,
-            };
-        }
-        catch (error) {
-            if (((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 404) {
-                throw new secrets_types_1.SecretNotFoundError(key);
-            }
-            throw error;
-        }
-    }
-    /**
-     * Update an existing secret
-     */
-    async update(key, input) {
-        // Invalidate both caches when updating
-        this.resolver.invalidate(key);
-        this.encryptedCache.delete(key);
-        // If value is provided, encrypt it before sending
-        if (input.value) {
-            const encryptedValue = this.encryptValue(input.value);
-            const { value: _plainValue } = input, restInput = __rest(input, ["value"]);
-            const encryptedInput = Object.assign(Object.assign({}, restInput), { encrypted_value: encryptedValue });
-            return this.apiService.update(this.getAuth(), key, encryptedInput);
-        }
-        return this.apiService.update(this.getAuth(), key, input);
-    }
-    /**
-     * Delete a secret permanently
-     */
-    async delete(key) {
-        // Invalidate both caches when deleting
-        this.resolver.invalidate(key);
-        this.encryptedCache.delete(key);
-        return this.apiService.delete(this.getAuth(), key);
-    }
-    /**
-     * Revoke a secret (disable without deleting)
-     */
-    async revoke(key) {
-        // Invalidate both caches when revoking
-        this.resolver.invalidate(key);
-        this.encryptedCache.delete(key);
-        return this.apiService.revoke(this.getAuth(), key);
-    }
-    /**
-     * Check if a key exists in the workspace
-     */
-    async exists(key) {
-        try {
-            await this.fetch(key);
-            return true;
-        }
-        catch (error) {
-            //if (error instanceof SecretNotFoundError ) {
-            return false;
-            /*}
-            throw error;*/
-        }
-    }
-    /**
-     * Resolve all $Secret{key} patterns in a value
-     * Works with strings, objects, and arrays
-     */
-    async resolve(value, options) {
-        return this.resolver.resolveObject(value, options);
-    }
-    /**
-     * Resolve a single string value
-     */
-    async resolveString(value, options) {
-        return this.resolver.resolveString(value, options);
-    }
-    /**
-     * Check if a value is a secret reference
-     */
-    isSecretReference(value) {
-        return (0, secrets_resolver_1.isSecretReference)(value).isSecret;
-    }
-    /**
-     * Check if a value might contain secrets
-     */
-    mightContainSecrets(value) {
-        return (0, secrets_resolver_1.mightContainSecrets)(value);
-    }
-    /**
-     * Find all secret keys referenced in a value
-     */
-    findAllSecretReferences(value) {
-        return (0, secrets_resolver_1.findAllSecretReferences)(value);
-    }
-    /**
-     * Validate that all referenced secrets exist
-     * Useful for validation during asset creation/update
-     */
-    async validateSecretReferences(value) {
-        const keys = (0, secrets_resolver_1.findAllSecretReferences)(value);
-        const existingKeys = [];
-        const missingKeys = [];
-        for (const key of keys) {
-            const exists = await this.exists(key);
-            if (exists) {
-                existingKeys.push(key);
-            }
-            else {
-                missingKeys.push(key);
-            }
-        }
-        return {
-            valid: missingKeys.length === 0,
-            missingKeys,
-            existingKeys,
-        };
-    }
-    /**
-     * Clear the internal caches (both decrypted resolver cache and encrypted cache)
-     */
-    clearCache() {
-        this.resolver.clearCache();
-        this.encryptedCache.clear();
-    }
-}
-exports.SecretsService = SecretsService;
-// Singleton instance for convenience
-let secretsServiceInstance = null;
-function getSecretsService() {
-    return secretsServiceInstance;
-}
-function setSecretsService(service) {
-    secretsServiceInstance = service;
-}
-//# sourceMappingURL=secrets.service.js.map

package/dist/secrets/secrets.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.service.js","sourceRoot":"","sources":["../../src/secrets/secrets.service.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;AAwSH,8CAEC;AAED,8CAEC;AA3SD,2EAA2F;AAE3F,mDAUyB;AACzB,yDAK4B;AAE5B,wEAAsE;AAQtE,MAAa,cAAc;IASzB,YAAY,IAAyB,EAAE,SAAgC,EAAE;;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,sCAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAA,MAAM,CAAC,QAAQ,mCAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;QAEtE,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAA,wCAAqB,EACnC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACtC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC9B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAAa;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAA,yBAAO,EAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,0CAA0C;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEtD,qDAAqD;QACrD,MAAM,cAAc,GAAG;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,eAAe,EAAE,cAAc;YAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAqB,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;;QACrB,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,eAAuB,CAAC;YAC5B,IAAI,OAAgB,CAAC;YAErB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrD,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;gBACzC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3E,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;gBAC3C,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAE3B,mCAAmC;gBACnC,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;oBAC5D,MAAM,IAAI,KAAK,CAAC,6DAA6D,GAAG,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,4DAA4D;gBAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,6BAA6B;YAC7B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,kCAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,8CAA8C;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;YAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,yBAAO,EAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAE5D,oDAAoD;YACpD,OAAO;gBACL,GAAG;gBACH,KAAK,EAAE,cAAc;gBACrB,OAAO;aACG,CAAC;QAEf,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,CAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,MAAM,MAAK,GAAG,EAAE,CAAC;gBACpC,MAAM,IAAI,mCAAmB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAyB;QACjD,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEhC,kDAAkD;QAClD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,EAAE,KAAK,EAAE,WAAW,KAAmB,KAAK,EAAnB,SAAS,UAAK,KAAK,EAA5C,SAAoC,CAAQ,CAAC;YACnD,MAAM,cAAc,mCACf,SAAS,KACZ,eAAe,EAAE,cAAc,GAChC,CAAC;YAEF,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,cAAqB,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,uCAAuC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8CAA8C;YAC5C,OAAO,KAAK,CAAC;YACf;0BACc;QAChB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,KAAQ,EACR,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAA,oCAAiB,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAc;QAChC,OAAO,IAAA,sCAAmB,EAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,KAAc;QACpC,OAAO,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAc;QAK3C,MAAM,IAAI,GAAG,IAAA,0CAAuB,EAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;YAC/B,WAAW;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF;AApQD,wCAoQC;AAED,qCAAqC;AACrC,IAAI,sBAAsB,GAA0B,IAAI,CAAC;AAEzD,SAAgB,iBAAiB;IAC/B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,sBAAsB,GAAG,OAAO,CAAC;AACnC,CAAC"}