@endora-commerce/mod-credentials 0.100.0

package/dist/backend/services/credentials.service.js

@@ -0,0 +1,128 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { CredentialConfiguration } from '../entities/credential-configuration.entity.js';
+import { maskSecrets } from './field-validator.js';
+import { decryptSecretValue, secretValueIsSet } from './secret-value-codec.js';
+import { makeCreateConfigurationCommand } from '../commands/create-configuration.command.js';
+import { makeUpdateConfigurationCommand } from '../commands/update-configuration.command.js';
+import { makeDeleteConfigurationCommand } from '../commands/delete-configuration.command.js';
+export class CredentialsService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Registered configuration types powering the admin type picker + form. */
+    describeTypes() {
+        return this.deps.registry.describe();
+    }
+    async list(typeFilter) {
+        const em = this.deps.emFactory();
+        const where = typeFilter ? { typeCode: typeFilter } : {};
+        const rows = await em.find(CredentialConfiguration, where, { orderBy: { name: 'asc' } });
+        return rows.map((r) => this.toDto(r));
+    }
+    async getByCode(code) {
+        const em = this.deps.emFactory();
+        const row = await em.findOne(CredentialConfiguration, { code });
+        return row ? this.toDto(row) : null;
+    }
+    async create(data) {
+        const entity = await this.deps.commandBus.run(makeCreateConfigurationCommand({
+            data,
+            registry: this.deps.registry,
+            secretEncryptionKey: this.deps.secretEncryptionKey,
+        }));
+        return this.toDto(entity);
+    }
+    async update(code, data) {
+        const entity = await this.deps.commandBus.run(makeUpdateConfigurationCommand({
+            code,
+            data,
+            registry: this.deps.registry,
+            secretEncryptionKey: this.deps.secretEncryptionKey,
+        }));
+        return this.toDto(entity);
+    }
+    async delete(code) {
+        // Delete-integrity guard (FR-012): block if any setting references this
+        // configuration, listing the referrers. Read-then-delete — a race is
+        // acceptable for this admin-only, low-volume operation.
+        if (this.deps.settings) {
+            const referencedBy = await this.deps.settings.listReferencesToConfiguration(code);
+            if (referencedBy.length > 0) {
+                throw new HttpError(409, ERROR_CODES.CREDENTIAL_IN_USE, 'Configuration is referenced by one or more settings.', { referencedBy });
+            }
+        }
+        await this.deps.commandBus.run(makeDeleteConfigurationCommand({ code, registry: this.deps.registry }));
+    }
+    /**
+     * Server-side resolution (feature 058 US2) — the single path that returns
+     * DECRYPTED secret values, for a consumer's in-memory use only. Never exposed
+     * over HTTP. Fails closed: an unset reference is `not_configured`; a
+     * deleted/inert one is `unavailable` — never a foreign configuration
+     * (FR-012 / SC-005).
+     */
+    async resolve(configurationCode) {
+        if (!configurationCode || configurationCode.length === 0) {
+            return { status: 'not_configured' };
+        }
+        const em = this.deps.emFactory();
+        const entity = await em.findOne(CredentialConfiguration, { code: configurationCode });
+        if (!entity)
+            return { status: 'unavailable', reason: 'missing' };
+        const descriptor = this.deps.registry.get(entity.typeCode);
+        const variant = descriptor?.providers.find((p) => p.code === entity.providerCode);
+        if (!descriptor || !variant)
+            return { status: 'unavailable', reason: 'inert_type' };
+        const values = {};
+        for (const field of variant.fields) {
+            const stored = entity.values[field.key];
+            if (stored === undefined)
+                continue;
+            if (field.secret) {
+                values[field.key] = secretValueIsSet(stored)
+                    ? decryptSecretValue(stored, this.deps.secretEncryptionKey)
+                    : stored;
+            }
+            else {
+                values[field.key] = stored;
+            }
+        }
+        return {
+            status: 'ok',
+            typeCode: entity.typeCode,
+            providerCode: entity.providerCode,
+            values,
+        };
+    }
+    /**
+     * Map an entity to a masked DTO, marking unregistered-type rows as inert.
+     *
+     * The registry's **diagnostic** read (issue #129): a stored configuration
+     * whose contributing module is merely switched off keeps its label and its
+     * field shape, because deactivation drops no data and an inert row would say
+     * the type is gone. `resolve` above stays on the acting read, so nothing
+     * decrypted leaves for the same configuration.
+     */
+    toDto(entity) {
+        const descriptor = this.deps.registry.entry(entity.typeCode);
+        const variant = descriptor?.providers.find((p) => p.code === entity.providerCode);
+        const inert = !descriptor || !variant;
+        return {
+            id: entity.id,
+            code: entity.code,
+            name: entity.name,
+            typeCode: entity.typeCode,
+            typeLabel: descriptor?.label ?? null,
+            providerCode: entity.providerCode,
+            providerLabel: variant?.label ?? null,
+            inert,
+            // An inert row has no known field shape — expose no fields rather than
+            // risk leaking a value we cannot classify as secret.
+            fields: variant ? maskSecrets(entity.values, variant.fields) : [],
+            version: entity.version,
+            updatedAt: entity.updatedAt.toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=credentials.service.js.map

package/dist/backend/services/credentials.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.service.js","sourceRoot":"","sources":["../../../src/backend/services/credentials.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,GAOZ,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAiC7F,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;IAAG,CAAC;IAE7D,4EAA4E;IAC5E,aAAa;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAmB;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAyB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAC3C,8BAA8B,CAAC;YAC7B,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;SACnD,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAyB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAC3C,8BAA8B,CAAC;YAC7B,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;SACnD,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,wEAAwE;QACxE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,sDAAsD,EACtD,EAAE,YAAY,EAAE,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAC5B,8BAA8B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CACvE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,iBAAyB;QACrC,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAEpF,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS;YACnC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC1C,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;oBAC3D,CAAC,CAAC,MAAM,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,MAA+B;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI;YACpC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;YACrC,KAAK;YACL,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YACjE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;SAC1C,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/field-validator.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import type { ConfigurationFieldDto, ConfigurationTypeDescriptor, FieldDefinition, ProviderVariant } from '@endora-commerce/contracts';
+/** Sentinel a masked secret is echoed back as; submitting it preserves the stored envelope. */
+export declare const SECRET_MASK = "[redacted]";
+export interface FieldError {
+    field: string;
+    message: string;
+}
+export interface BuildValuesResult {
+    values: Record<string, unknown>;
+    errors: FieldError[];
+}
+/**
+ * Field validation + secret masking derived from a configuration-type
+ * descriptor (feature 058, research §R2). The credentials core stays
+ * type-agnostic (Principle XIV): the write-validator is built purely from the
+ * selected provider's `FieldDefinition[]` — the same technique custom-fields
+ * uses to derive a validator from a stored definition.
+ */
+/** Resolve a provider variant within a type descriptor, or throw. */
+export declare function providerVariantFor(descriptor: ConfigurationTypeDescriptor, providerCode: string): ProviderVariant;
+/**
+ * Build a Zod object schema validating a values bag against the provider
+ * variant's field definitions. Required fields must be present; required
+ * string/select fields must be non-empty. Unknown keys are stripped.
+ *
+ * Note: write-only secret semantics (a blank/`[redacted]` secret on update
+ * preserving the stored envelope) are applied by the update command BEFORE
+ * validation, not here — this validator sees the effective values to persist.
+ */
+export declare function buildFieldValidator(descriptor: ConfigurationTypeDescriptor, providerCode: string): z.ZodType<Record<string, unknown>>;
+/**
+ * Compute the effective values bag to persist, validating each field against the
+ * provider descriptor and applying write-only secret semantics (FR-015):
+ *
+ *  - a secret field submitted blank / omitted / equal to the `[redacted]` mask
+ *    keeps the existing envelope; a non-empty secret is re-encrypted;
+ *  - a non-secret field absent from `submitted` keeps its existing value (so a
+ *    partial update need not resend every field);
+ *  - required fields must be present and non-empty (per-field error otherwise).
+ *
+ * `existing` is `{}` on create. Errors are collected per field (never throws for
+ * a validation problem) so the caller can surface a `CREDENTIAL_VALIDATION_FAILED`
+ * envelope carrying every offending field at once.
+ */
+export declare function buildPersistableValues(opts: {
+    fields: FieldDefinition[];
+    submitted: Record<string, unknown>;
+    existing: Record<string, unknown>;
+    secretEncryptionKey: string | undefined;
+}): BuildValuesResult;
+/**
+ * Redact secret field values for an audit snapshot: a set secret becomes the
+ * `[redacted]` mask, non-secret values pass through (FR-014). Never emits a
+ * plaintext or an envelope.
+ */
+export declare function redactSecretsForAudit(values: Record<string, unknown>, fields: FieldDefinition[]): Record<string, unknown>;
+/**
+ * Mask a stored values bag for a read DTO: secret fields expose only an `isSet`
+ * boolean (never a value); non-secret fields expose their plain value. Returned
+ * in descriptor field order. A `maskSecrets` guarantee: a secret value is never
+ * emitted (SC-003 / FR-005).
+ */
+export declare function maskSecrets(values: Record<string, unknown>, fields: FieldDefinition[]): ConfigurationFieldDto[];
+//# sourceMappingURL=field-validator.d.ts.map

package/dist/backend/services/field-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-validator.d.ts","sourceRoot":"","sources":["../../../src/backend/services/field-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAIpC,+FAA+F;AAC/F,eAAO,MAAM,WAAW,eAAe,CAAC;AAExC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;;;;;GAMG;AAEH,qEAAqE;AACrE,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,2BAA2B,EACvC,YAAY,EAAE,MAAM,GACnB,eAAe,CAMjB;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,2BAA2B,EACvC,YAAY,EAAE,MAAM,GACnB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAepC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,GAAG,iBAAiB,CAqCpB;AAqBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,eAAe,EAAE,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,eAAe,EAAE,GACxB,qBAAqB,EAAE,CAOzB"}

package/dist/backend/services/field-validator.js

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+import { ConfigurationTypeUnknown } from './configuration-type-registry.js';
+import { encryptSecretValue, secretValueIsSet } from './secret-value-codec.js';
+/** Sentinel a masked secret is echoed back as; submitting it preserves the stored envelope. */
+export const SECRET_MASK = '[redacted]';
+/**
+ * Field validation + secret masking derived from a configuration-type
+ * descriptor (feature 058, research §R2). The credentials core stays
+ * type-agnostic (Principle XIV): the write-validator is built purely from the
+ * selected provider's `FieldDefinition[]` — the same technique custom-fields
+ * uses to derive a validator from a stored definition.
+ */
+/** Resolve a provider variant within a type descriptor, or throw. */
+export function providerVariantFor(descriptor, providerCode) {
+    const variant = descriptor.providers.find((p) => p.code === providerCode);
+    if (!variant) {
+        throw new ConfigurationTypeUnknown(`${descriptor.code}/${providerCode}`);
+    }
+    return variant;
+}
+function baseSchemaForField(field) {
+    switch (field.kind) {
+        case 'number':
+            return z.number();
+        case 'boolean':
+            return z.boolean();
+        case 'select': {
+            const allowed = (field.options ?? []).map((o) => o.value);
+            return z
+                .string()
+                .refine((v) => allowed.includes(v), { message: `must be one of: ${allowed.join(', ')}` });
+        }
+        case 'string':
+        default:
+            return z.string();
+    }
+}
+/**
+ * Build a Zod object schema validating a values bag against the provider
+ * variant's field definitions. Required fields must be present; required
+ * string/select fields must be non-empty. Unknown keys are stripped.
+ *
+ * Note: write-only secret semantics (a blank/`[redacted]` secret on update
+ * preserving the stored envelope) are applied by the update command BEFORE
+ * validation, not here — this validator sees the effective values to persist.
+ */
+export function buildFieldValidator(descriptor, providerCode) {
+    const variant = providerVariantFor(descriptor, providerCode);
+    const shape = {};
+    for (const field of variant.fields) {
+        let schema = baseSchemaForField(field);
+        if (field.required) {
+            if (field.kind === 'string' || field.kind === 'select') {
+                schema = schema.min(1, { message: 'is required' });
+            }
+        }
+        else {
+            schema = schema.optional();
+        }
+        shape[field.key] = schema;
+    }
+    return z.object(shape).strip();
+}
+/**
+ * Compute the effective values bag to persist, validating each field against the
+ * provider descriptor and applying write-only secret semantics (FR-015):
+ *
+ *  - a secret field submitted blank / omitted / equal to the `[redacted]` mask
+ *    keeps the existing envelope; a non-empty secret is re-encrypted;
+ *  - a non-secret field absent from `submitted` keeps its existing value (so a
+ *    partial update need not resend every field);
+ *  - required fields must be present and non-empty (per-field error otherwise).
+ *
+ * `existing` is `{}` on create. Errors are collected per field (never throws for
+ * a validation problem) so the caller can surface a `CREDENTIAL_VALIDATION_FAILED`
+ * envelope carrying every offending field at once.
+ */
+export function buildPersistableValues(opts) {
+    const { fields, submitted, existing, secretEncryptionKey } = opts;
+    const values = {};
+    const errors = [];
+    for (const field of fields) {
+        if (field.secret) {
+            const raw = submitted[field.key];
+            const providesNew = typeof raw === 'string' && raw.length > 0 && raw !== SECRET_MASK;
+            if (providesNew) {
+                values[field.key] = encryptSecretValue(raw, secretEncryptionKey);
+            }
+            else if (secretValueIsSet(existing[field.key])) {
+                values[field.key] = existing[field.key];
+            }
+            if (field.required && !(field.key in values)) {
+                errors.push({ field: field.key, message: 'is required' });
+            }
+            continue;
+        }
+        const hasSubmitted = Object.prototype.hasOwnProperty.call(submitted, field.key);
+        const candidate = hasSubmitted ? submitted[field.key] : existing[field.key];
+        if (candidate === undefined || candidate === null) {
+            if (field.required)
+                errors.push({ field: field.key, message: 'is required' });
+            continue;
+        }
+        const typeError = validateNonSecretValue(field, candidate);
+        if (typeError) {
+            errors.push({ field: field.key, message: typeError });
+            continue;
+        }
+        values[field.key] = candidate;
+    }
+    return { values, errors };
+}
+function validateNonSecretValue(field, value) {
+    switch (field.kind) {
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value) ? null : 'must be a number';
+        case 'boolean':
+            return typeof value === 'boolean' ? null : 'must be a boolean';
+        case 'select': {
+            if (typeof value !== 'string')
+                return 'must be a string';
+            const allowed = (field.options ?? []).map((o) => o.value);
+            return allowed.includes(value) ? null : `must be one of: ${allowed.join(', ')}`;
+        }
+        case 'string':
+        default:
+            if (typeof value !== 'string')
+                return 'must be a string';
+            if (field.required && value.length === 0)
+                return 'is required';
+            return null;
+    }
+}
+/**
+ * Redact secret field values for an audit snapshot: a set secret becomes the
+ * `[redacted]` mask, non-secret values pass through (FR-014). Never emits a
+ * plaintext or an envelope.
+ */
+export function redactSecretsForAudit(values, fields) {
+    const out = {};
+    for (const field of fields) {
+        if (field.secret) {
+            out[field.key] = secretValueIsSet(values[field.key]) ? SECRET_MASK : null;
+        }
+        else if (Object.prototype.hasOwnProperty.call(values, field.key)) {
+            out[field.key] = values[field.key];
+        }
+    }
+    return out;
+}
+/**
+ * Mask a stored values bag for a read DTO: secret fields expose only an `isSet`
+ * boolean (never a value); non-secret fields expose their plain value. Returned
+ * in descriptor field order. A `maskSecrets` guarantee: a secret value is never
+ * emitted (SC-003 / FR-005).
+ */
+export function maskSecrets(values, fields) {
+    return fields.map((field) => {
+        if (field.secret) {
+            return { key: field.key, secret: true, isSet: secretValueIsSet(values[field.key]) };
+        }
+        return { key: field.key, secret: false, value: values[field.key] };
+    });
+}
+//# sourceMappingURL=field-validator.js.map

package/dist/backend/services/field-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-validator.js","sourceRoot":"","sources":["../../../src/backend/services/field-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AAYxC;;;;;;GAMG;AAEH,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAChC,UAAuC,EACvC,YAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB;IAChD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,CAAC;iBACL,MAAM,EAAE;iBACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAuC,EACvC,YAAoB;IAEpB,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAiC,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,GAAI,MAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAwC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAClE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,WAAW,CAAC;YACrF,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACnE,CAAC;iBAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAsB,EAAE,KAAc;IACpE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACjE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,kBAAkB,CAAC;YACzD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,KAAK,QAAQ,CAAC;QACd;YACE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,kBAAkB,CAAC;YACzD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAC/D,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA+B,EAC/B,MAAyB;IAEzB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAA+B,EAC/B,MAAyB;IAEzB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/services/registry-singleton.d.ts

@@ -0,0 +1,28 @@
+import { ConfigurationTypeRegistry } from './configuration-type-registry.js';
+/**
+ * Process-wide ConfigurationTypeRegistry (feature 058).
+ *
+ * The module lifecycle install-hook context is fixed (`{ em, redis, log,
+ * module }`) and cannot carry services, so an external / overlay module cannot
+ * receive the registry through dependency injection. This shared singleton is
+ * the explicit cross-module seam a module imports to contribute a configuration
+ * type on enable (mirrors `delivery_methods/services/registry-singleton.ts`):
+ *
+ *   import { configurationTypeRegistry } from '.../credentials/services/registry-singleton.js';
+ *   configurationTypeRegistry.register(myConfigurationType);
+ *
+ * `composition.ts` populates this same instance with the core types (LLM, email
+ * adapter) at boot and passes it to the credentials plugin, so a type registered
+ * from an install hook is immediately recognised by the live admin + resolve
+ * paths. Registering without editing the shared core registry satisfies
+ * Principle XV.
+ *
+ * The presence probe is wired here rather than in the class: this is the one
+ * instance that participates in the platform's lifecycle, and a registry a test
+ * builds for itself should keep answering about the types that test registered
+ * (issue #129). `presenceOf` rather than `isPresent`, because a type contributed
+ * through this seam may name an owner no manifest declares, and collapsing
+ * "unknown id" into "absent" would filter the extension point away.
+ */
+export declare const configurationTypeRegistry: ConfigurationTypeRegistry;
+//# sourceMappingURL=registry-singleton.d.ts.map

package/dist/backend/services/registry-singleton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-singleton.d.ts","sourceRoot":"","sources":["../../../src/backend/services/registry-singleton.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB,2BAErC,CAAC"}

package/dist/backend/services/registry-singleton.js

@@ -0,0 +1,29 @@
+import { effectiveState } from '@endora-commerce/platform/kernel';
+import { ConfigurationTypeRegistry } from './configuration-type-registry.js';
+/**
+ * Process-wide ConfigurationTypeRegistry (feature 058).
+ *
+ * The module lifecycle install-hook context is fixed (`{ em, redis, log,
+ * module }`) and cannot carry services, so an external / overlay module cannot
+ * receive the registry through dependency injection. This shared singleton is
+ * the explicit cross-module seam a module imports to contribute a configuration
+ * type on enable (mirrors `delivery_methods/services/registry-singleton.ts`):
+ *
+ *   import { configurationTypeRegistry } from '.../credentials/services/registry-singleton.js';
+ *   configurationTypeRegistry.register(myConfigurationType);
+ *
+ * `composition.ts` populates this same instance with the core types (LLM, email
+ * adapter) at boot and passes it to the credentials plugin, so a type registered
+ * from an install hook is immediately recognised by the live admin + resolve
+ * paths. Registering without editing the shared core registry satisfies
+ * Principle XV.
+ *
+ * The presence probe is wired here rather than in the class: this is the one
+ * instance that participates in the platform's lifecycle, and a registry a test
+ * builds for itself should keep answering about the types that test registered
+ * (issue #129). `presenceOf` rather than `isPresent`, because a type contributed
+ * through this seam may name an owner no manifest declares, and collapsing
+ * "unknown id" into "absent" would filter the extension point away.
+ */
+export const configurationTypeRegistry = new ConfigurationTypeRegistry(undefined, (moduleId) => effectiveState.presenceOf(moduleId));
+//# sourceMappingURL=registry-singleton.js.map

package/dist/backend/services/registry-singleton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-singleton.js","sourceRoot":"","sources":["../../../src/backend/services/registry-singleton.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,yBAAyB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC7F,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CACpC,CAAC"}

package/dist/backend/services/secret-value-codec.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Secret-value codec for credential-configuration secret fields (feature 058,
+ * research §R4).
+ *
+ * This is a verbatim duplication of the codec that used to live at
+ * `settings/services/secret-value-codec.ts`. The original justification —
+ * importing the settings module's private codec across a module boundary would
+ * couple the two modules (Principle I) and break independent removability — no
+ * longer holds: feature 072 T018 moved that codec into the kernel
+ * (`kernel/settings/secret-value-codec.ts`), and a module may import the kernel.
+ * The duplication is therefore now debt, not a trade; it is left in place here
+ * because collapsing it is a behaviour-carrying change, not part of the
+ * relocation. Both codecs read the SAME
+ * env key `SETTINGS_SECRET_ENCRYPTION_KEY` (base64, 32 bytes) — no new secret to
+ * provision — and produce self-describing envelopes, so a value written by one
+ * decrypts under the other.
+ *
+ * There is NO plaintext fallback on write: encrypting without a key throws
+ * {@link SecretKeyMissing} (fail-closed, the desired behaviour for credentials).
+ */
+declare const ALGORITHM = "aes-256-gcm";
+export interface SecretEnvelope {
+    v: 1;
+    alg: typeof ALGORITHM;
+    iv: string;
+    ct: string;
+    tag: string;
+}
+export declare class SecretKeyMissing extends Error {
+    readonly name = "SecretKeyMissing";
+    readonly code: "SETTING_SECRET_KEY_MISSING";
+    constructor();
+}
+/**
+ * The encryption key is present but not a valid AES-256 key (must decode to
+ * exactly 32 bytes). Carries the same error code as {@link SecretKeyMissing} so
+ * callers surface a clear 5xx instead of a bare "Internal server error".
+ */
+export declare class SecretKeyInvalid extends Error {
+    readonly name = "SecretKeyInvalid";
+    readonly code: "SETTING_SECRET_KEY_MISSING";
+    constructor(actualBytes: number);
+}
+export declare function isSecretEnvelope(value: unknown): value is SecretEnvelope;
+export declare function encryptSecretValue(plaintext: string, keyBase64: string | undefined): SecretEnvelope;
+/**
+ * Resolve a stored secret value to its plaintext. Plain strings are legacy
+ * pre-encryption values and pass through unchanged; envelopes require the key
+ * and an intact auth tag.
+ */
+export declare function decryptSecretValue(stored: unknown, keyBase64: string | undefined): string;
+/** A secret counts as "set" when it is an envelope or a non-empty legacy string. */
+export declare function secretValueIsSet(stored: unknown): boolean;
+export {};
+//# sourceMappingURL=secret-value-codec.d.ts.map

package/dist/backend/services/secret-value-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value-codec.d.ts","sourceRoot":"","sources":["../../../src/backend/services/secret-value-codec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,QAAA,MAAM,SAAS,gBAAgB,CAAC;AAIhC,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,OAAO,SAAS,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;;CAMvD;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,WAAW,EAAE,MAAM;CAMhC;AAUD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAUxE;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,cAAc,CAahB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAcR;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/backend/services/secret-value-codec.js

@@ -0,0 +1,105 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+/**
+ * Secret-value codec for credential-configuration secret fields (feature 058,
+ * research §R4).
+ *
+ * This is a verbatim duplication of the codec that used to live at
+ * `settings/services/secret-value-codec.ts`. The original justification —
+ * importing the settings module's private codec across a module boundary would
+ * couple the two modules (Principle I) and break independent removability — no
+ * longer holds: feature 072 T018 moved that codec into the kernel
+ * (`kernel/settings/secret-value-codec.ts`), and a module may import the kernel.
+ * The duplication is therefore now debt, not a trade; it is left in place here
+ * because collapsing it is a behaviour-carrying change, not part of the
+ * relocation. Both codecs read the SAME
+ * env key `SETTINGS_SECRET_ENCRYPTION_KEY` (base64, 32 bytes) — no new secret to
+ * provision — and produce self-describing envelopes, so a value written by one
+ * decrypts under the other.
+ *
+ * There is NO plaintext fallback on write: encrypting without a key throws
+ * {@link SecretKeyMissing} (fail-closed, the desired behaviour for credentials).
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+export class SecretKeyMissing extends Error {
+    name = 'SecretKeyMissing';
+    code = 'SETTING_SECRET_KEY_MISSING';
+    constructor() {
+        super('SETTINGS_SECRET_ENCRYPTION_KEY is not configured — secret credential fields cannot be processed.');
+    }
+}
+/**
+ * The encryption key is present but not a valid AES-256 key (must decode to
+ * exactly 32 bytes). Carries the same error code as {@link SecretKeyMissing} so
+ * callers surface a clear 5xx instead of a bare "Internal server error".
+ */
+export class SecretKeyInvalid extends Error {
+    name = 'SecretKeyInvalid';
+    code = 'SETTING_SECRET_KEY_MISSING';
+    constructor(actualBytes) {
+        super(`SETTINGS_SECRET_ENCRYPTION_KEY is misconfigured — it must decode to ${KEY_LENGTH} bytes ` +
+            `(got ${actualBytes}). Set it to 32 random bytes, base64-encoded (e.g. \`openssl rand -base64 32\`).`);
+    }
+}
+function keyBuffer(keyBase64) {
+    const key = Buffer.from(keyBase64, 'base64');
+    if (key.length !== KEY_LENGTH) {
+        throw new SecretKeyInvalid(key.length);
+    }
+    return key;
+}
+export function isSecretEnvelope(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (v['v'] === 1 &&
+        v['alg'] === ALGORITHM &&
+        typeof v['iv'] === 'string' &&
+        typeof v['ct'] === 'string' &&
+        typeof v['tag'] === 'string');
+}
+export function encryptSecretValue(plaintext, keyBase64) {
+    if (!keyBase64)
+        throw new SecretKeyMissing();
+    const key = keyBuffer(keyBase64);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return {
+        v: 1,
+        alg: ALGORITHM,
+        iv: iv.toString('base64'),
+        ct: ct.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+    };
+}
+/**
+ * Resolve a stored secret value to its plaintext. Plain strings are legacy
+ * pre-encryption values and pass through unchanged; envelopes require the key
+ * and an intact auth tag.
+ */
+export function decryptSecretValue(stored, keyBase64) {
+    if (typeof stored === 'string')
+        return stored;
+    if (!isSecretEnvelope(stored)) {
+        throw new Error('Stored secret value is neither a string nor a v1 secret envelope.');
+    }
+    if (!keyBase64)
+        throw new SecretKeyMissing();
+    const key = keyBuffer(keyBase64);
+    const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(stored.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(stored.tag, 'base64'));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(stored.ct, 'base64')),
+        decipher.final(),
+    ]);
+    return plaintext.toString('utf8');
+}
+/** A secret counts as "set" when it is an envelope or a non-empty legacy string. */
+export function secretValueIsSet(stored) {
+    if (isSecretEnvelope(stored))
+        return true;
+    return typeof stored === 'string' && stored.length > 0;
+}
+//# sourceMappingURL=secret-value-codec.js.map

package/dist/backend/services/secret-value-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value-codec.js","sourceRoot":"","sources":["../../../src/backend/services/secret-value-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAUtB,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,IAAI,GAAG,4BAAqC,CAAC;IACtD;QACE,KAAK,CACH,kGAAkG,CACnG,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,IAAI,GAAG,4BAAqC,CAAC;IACtD,YAAY,WAAmB;QAC7B,KAAK,CACH,uEAAuE,UAAU,SAAS;YACxF,QAAQ,WAAW,kFAAkF,CACxG,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,SAAS;QACd,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAe,EACf,SAA6B;IAE7B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/backend/types/email-adapter.type.d.ts

@@ -0,0 +1,10 @@
+import type { ConfigurationTypeDescriptor } from '@endora-commerce/contracts';
+/**
+ * Core `email_adapter` configuration type (feature 058, US1 / research §R2).
+ *
+ * Mirrors the newsletter SMTP/SES field set. Each provider declares exactly one
+ * secret field (`password` / `secretAccessKey` / `apiKey`); the rest are plain.
+ * Provider meaning (how mail is actually sent) is owned by the consumer.
+ */
+export declare const emailAdapterConfigurationType: ConfigurationTypeDescriptor;
+//# sourceMappingURL=email-adapter.type.d.ts.map

package/dist/backend/types/email-adapter.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-adapter.type.d.ts","sourceRoot":"","sources":["../../../src/backend/types/email-adapter.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE9E;;;;;;GAMG;AAEH,eAAO,MAAM,6BAA6B,EAAE,2BAwC3C,CAAC"}