@evermore.work/server 2026.509.0-canary.0

package/dist/routes/workspace-runtime-service-authz.d.ts

@@ -0,0 +1,12 @@
+import type { Db } from "@evermore.work/db";
+import type { Request } from "express";
+export declare function assertCanManageProjectWorkspaceRuntimeServices(db: Db, req: Request, input: {
+    companyId: string;
+    projectWorkspaceId: string;
+}): Promise<void>;
+export declare function assertCanManageExecutionWorkspaceRuntimeServices(db: Db, req: Request, input: {
+    companyId: string;
+    executionWorkspaceId: string;
+    sourceIssueId?: string | null;
+}): Promise<void>;
+//# sourceMappingURL=workspace-runtime-service-authz.d.ts.map

package/dist/routes/workspace-runtime-service-authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-runtime-service-authz.d.ts","sourceRoot":"","sources":["../../src/routes/workspace-runtime-service-authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AA6GvC,wBAAsB,8CAA8C,CAClE,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,iBAKF;AAED,wBAAsB,gDAAgD,CACpE,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,iBAKF"}

package/dist/routes/workspace-runtime-service-authz.js

@@ -0,0 +1,96 @@
+import { and, eq, inArray, isNull, ne, or } from "drizzle-orm";
+import { agents, issues } from "@evermore.work/db";
+import { forbidden } from "../errors.js";
+import { assertCompanyAccess } from "./authz.js";
+const WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES = [
+    "backlog",
+    "todo",
+    "in_progress",
+    "in_review",
+    "blocked",
+];
+async function listReportingSubtreeAgentIds(db, companyId, actorAgentId) {
+    const companyAgents = await db
+        .select({
+        id: agents.id,
+        reportsTo: agents.reportsTo,
+    })
+        .from(agents)
+        .where(and(eq(agents.companyId, companyId), ne(agents.status, "terminated")));
+    const reportsByManager = new Map();
+    for (const agent of companyAgents) {
+        if (!agent.reportsTo)
+            continue;
+        const reports = reportsByManager.get(agent.reportsTo) ?? [];
+        reports.push(agent.id);
+        reportsByManager.set(agent.reportsTo, reports);
+    }
+    const visited = new Set([actorAgentId]);
+    const queue = [actorAgentId];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current)
+            continue;
+        const reports = reportsByManager.get(current) ?? [];
+        for (const reportId of reports) {
+            if (visited.has(reportId))
+                continue;
+            visited.add(reportId);
+            queue.push(reportId);
+        }
+    }
+    return [...visited];
+}
+async function assertAgentCanManageRuntimeServicesForWorkspace(db, req, input) {
+    if (req.actor.type !== "agent" || !req.actor.agentId) {
+        throw forbidden("Agent authentication required");
+    }
+    const actorAgent = await db
+        .select({
+        id: agents.id,
+        companyId: agents.companyId,
+        role: agents.role,
+    })
+        .from(agents)
+        .where(eq(agents.id, req.actor.agentId))
+        .then((rows) => rows[0] ?? null);
+    if (!actorAgent || actorAgent.companyId !== input.companyId) {
+        throw forbidden("Agent key cannot access another company");
+    }
+    if (actorAgent.role === "ceo") {
+        return;
+    }
+    const eligibleAgentIds = await listReportingSubtreeAgentIds(db, input.companyId, actorAgent.id);
+    const workspaceScopeConditions = [
+        input.projectWorkspaceId ? eq(issues.projectWorkspaceId, input.projectWorkspaceId) : null,
+        input.executionWorkspaceId ? eq(issues.executionWorkspaceId, input.executionWorkspaceId) : null,
+        input.sourceIssueId ? eq(issues.id, input.sourceIssueId) : null,
+    ].filter((condition) => condition !== null);
+    if (workspaceScopeConditions.length === 0) {
+        throw forbidden("Missing permission to manage workspace runtime services");
+    }
+    const linkedIssue = await db
+        .select({ id: issues.id })
+        .from(issues)
+        .where(and(eq(issues.companyId, input.companyId), isNull(issues.hiddenAt), inArray(issues.status, WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES), inArray(issues.assigneeAgentId, eligibleAgentIds), workspaceScopeConditions.length === 1
+        ? workspaceScopeConditions[0]
+        : or(...workspaceScopeConditions)))
+        .then((rows) => rows[0] ?? null);
+    if (linkedIssue) {
+        return;
+    }
+    throw forbidden("Missing permission to manage workspace runtime services");
+}
+export async function assertCanManageProjectWorkspaceRuntimeServices(db, req, input) {
+    assertCompanyAccess(req, input.companyId);
+    if (req.actor.type === "board")
+        return;
+    await assertAgentCanManageRuntimeServicesForWorkspace(db, req, input);
+}
+export async function assertCanManageExecutionWorkspaceRuntimeServices(db, req, input) {
+    assertCompanyAccess(req, input.companyId);
+    if (req.actor.type === "board")
+        return;
+    await assertAgentCanManageRuntimeServicesForWorkspace(db, req, input);
+}
+//# sourceMappingURL=workspace-runtime-service-authz.js.map

package/dist/routes/workspace-runtime-service-authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-runtime-service-authz.js","sourceRoot":"","sources":["../../src/routes/workspace-runtime-service-authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,yCAAyC,GAAa;IAC1D,SAAS;IACT,MAAM;IACN,aAAa;IACb,WAAW;IACX,SAAS;CACV,CAAC;AAEF,KAAK,UAAU,4BAA4B,CAAC,EAAM,EAAE,SAAiB,EAAE,YAAoB;IACzF,MAAM,aAAa,GAAG,MAAM,EAAE;SAC3B,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;SACD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,+CAA+C,CAC5D,EAAM,EACN,GAAY,EACZ,KAKC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,wBAAwB,GAAG;QAC/B,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QACzF,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/F,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC,MAAM,CAAC,CAAC,SAAS,EAA8C,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAExF,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,SAAS,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC,EACjE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC,EACjD,wBAAwB,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAE;QAC9B,CAAC,CAAC,EAAE,CAAC,GAAG,wBAAwB,CAAC,CACpC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEnC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,SAAS,CAAC,yDAAyD,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8CAA8C,CAClE,EAAM,EACN,GAAY,EACZ,KAGC;IAED,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACvC,MAAM,+CAA+C,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gDAAgD,CACpE,EAAM,EACN,GAAY,EACZ,KAIC;IAED,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IACvC,MAAM,+CAA+C,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC"}

package/dist/runtime-api.d.ts

@@ -0,0 +1,19 @@
+import os from "node:os";
+export declare function choosePrimaryRuntimeApiUrl(input: {
+    authPublicBaseUrl?: string | null;
+    allowedHostnames: string[];
+    bindHost: string;
+    port: number;
+}): string;
+export declare function collectReachableInterfaceHosts(input?: {
+    networkInterfacesMap?: NodeJS.Dict<os.NetworkInterfaceInfo[]>;
+}): string[];
+export declare function buildRuntimeApiCandidateUrls(input: {
+    preferredApiUrl?: string | null;
+    authPublicBaseUrl?: string | null;
+    allowedHostnames: string[];
+    bindHost: string;
+    port: number;
+    networkInterfacesMap?: NodeJS.Dict<os.NetworkInterfaceInfo[]>;
+}): string[];
+//# sourceMappingURL=runtime-api.d.ts.map

package/dist/runtime-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-api.d.ts","sourceRoot":"","sources":["../src/runtime-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAgDzB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAuBT;AAED,wBAAgB,8BAA8B,CAAC,KAAK,GAAE;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;CAC1D,GAAG,MAAM,EAAE,CAwBhB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;CAC/D,GAAG,MAAM,EAAE,CAqDX"}

package/dist/runtime-api.js

@@ -0,0 +1,137 @@
+import os from "node:os";
+function normalizeHost(value) {
+    return (value ?? "").trim();
+}
+function isLoopbackHost(host) {
+    const normalized = normalizeHost(host).toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+function isWildcardHost(host) {
+    const normalized = normalizeHost(host).toLowerCase();
+    return normalized === "0.0.0.0" || normalized === "::";
+}
+function isLinkLocalHost(host) {
+    const normalized = normalizeHost(host).toLowerCase();
+    if (normalized.startsWith("169.254."))
+        return true;
+    // IPv6 link-local block is fe80::/10 (fe80:: through febf::)
+    if (/^fe[89ab][0-9a-f]:/.test(normalized))
+        return true;
+    return false;
+}
+function formatOrigin(protocol, host, port) {
+    const normalizedHost = host.includes(":") && !host.startsWith("[") && !host.endsWith("]")
+        ? `[${host}]`
+        : host;
+    return `${protocol}//${normalizedHost}:${port}`;
+}
+function pushCandidate(candidates, seen, rawUrl) {
+    const trimmed = rawUrl?.trim();
+    if (!trimmed)
+        return;
+    try {
+        const normalized = new URL(trimmed).origin;
+        if (seen.has(normalized))
+            return;
+        seen.add(normalized);
+        candidates.push(normalized);
+    }
+    catch {
+        // Ignore malformed candidates.
+    }
+}
+export function choosePrimaryRuntimeApiUrl(input) {
+    const explicitPublicBaseUrl = input.authPublicBaseUrl?.trim();
+    if (explicitPublicBaseUrl) {
+        try {
+            return new URL(explicitPublicBaseUrl).origin;
+        }
+        catch {
+            // Fall through to derived candidates if config parsing drifted.
+        }
+    }
+    const allowedHostname = input.allowedHostnames
+        .map((value) => value.trim())
+        .find(Boolean);
+    if (allowedHostname) {
+        return formatOrigin("http:", allowedHostname, input.port);
+    }
+    const bindHost = normalizeHost(input.bindHost);
+    if (bindHost && !isWildcardHost(bindHost)) {
+        return formatOrigin("http:", bindHost, input.port);
+    }
+    return formatOrigin("http:", "localhost", input.port);
+}
+export function collectReachableInterfaceHosts(input = {}) {
+    const interfaces = input.networkInterfacesMap ?? os.networkInterfaces();
+    const rankedHosts = [];
+    const seen = new Set();
+    let index = 0;
+    for (const entries of Object.values(interfaces)) {
+        for (const entry of entries ?? []) {
+            if (entry.internal)
+                continue;
+            const host = normalizeHost(entry.address);
+            if (!host || isLoopbackHost(host) || isWildcardHost(host) || isLinkLocalHost(host))
+                continue;
+            if (seen.has(host))
+                continue;
+            seen.add(host);
+            rankedHosts.push({
+                host,
+                rank: entry.family === "IPv4" ? 0 : 1,
+                index: index++,
+            });
+        }
+    }
+    return rankedHosts
+        .sort((left, right) => left.rank - right.rank || left.index - right.index)
+        .map((entry) => entry.host);
+}
+export function buildRuntimeApiCandidateUrls(input) {
+    const candidates = [];
+    const seen = new Set();
+    const explicitPublicBaseUrl = input.authPublicBaseUrl?.trim() ?? "";
+    const explicitOrigin = (() => {
+        if (!explicitPublicBaseUrl)
+            return null;
+        try {
+            return new URL(explicitPublicBaseUrl).origin;
+        }
+        catch {
+            return null;
+        }
+    })();
+    const protocol = explicitOrigin ? new URL(explicitOrigin).protocol : "http:";
+    pushCandidate(candidates, seen, input.preferredApiUrl);
+    pushCandidate(candidates, seen, explicitOrigin);
+    for (const rawHost of input.allowedHostnames) {
+        const host = normalizeHost(rawHost);
+        if (!host)
+            continue;
+        pushCandidate(candidates, seen, formatOrigin(protocol, host, input.port));
+    }
+    const bindHost = normalizeHost(input.bindHost);
+    if (bindHost && !isWildcardHost(bindHost)) {
+        pushCandidate(candidates, seen, formatOrigin(protocol, bindHost, input.port));
+    }
+    if (explicitOrigin) {
+        const hostname = new URL(explicitOrigin).hostname;
+        if (isLoopbackHost(hostname)) {
+            pushCandidate(candidates, seen, formatOrigin(protocol, "host.docker.internal", input.port));
+        }
+    }
+    for (const host of collectReachableInterfaceHosts({ networkInterfacesMap: input.networkInterfacesMap })) {
+        pushCandidate(candidates, seen, formatOrigin(protocol, host, input.port));
+    }
+    if (candidates.length === 0) {
+        pushCandidate(candidates, seen, choosePrimaryRuntimeApiUrl({
+            authPublicBaseUrl: input.authPublicBaseUrl,
+            allowedHostnames: input.allowedHostnames,
+            bindHost: input.bindHost,
+            port: input.port,
+        }));
+    }
+    return candidates;
+}
+//# sourceMappingURL=runtime-api.js.map

package/dist/runtime-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-api.js","sourceRoot":"","sources":["../src/runtime-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,SAAS,aAAa,CAAC,KAAgC;IACrD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,6DAA6D;IAC7D,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAY;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvF,CAAC,CAAC,IAAI,IAAI,GAAG;QACb,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,GAAG,QAAQ,KAAK,cAAc,IAAI,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CACpB,UAAoB,EACpB,IAAiB,EACjB,MAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,qBAAqB,GAAG,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,qBAAqB,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAE3C,EAAE;IACJ,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAyD,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,QAAQ;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7F,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,EAAE,KAAK,EAAE;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,WAAW;SACf,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;SACzE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAO5C;IACC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,qBAAqB,GAAG,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAE7E,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAEhD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,CAAC;QACxG,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CACX,UAAU,EACV,IAAI,EACJ,0BAA0B,CAAC;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/secrets/external-stub-providers.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const awsSecretsManagerProvider: SecretProviderModule;
+export declare const gcpSecretManagerProvider: SecretProviderModule;
+export declare const vaultProvider: SecretProviderModule;
+//# sourceMappingURL=external-stub-providers.d.ts.map

package/dist/secrets/external-stub-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.d.ts","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAsBvD,eAAO,MAAM,yBAAyB,sBAGrC,CAAC;AACF,eAAO,MAAM,wBAAwB,sBAGpC,CAAC;AACF,eAAO,MAAM,aAAa,sBAAkD,CAAC"}

package/dist/secrets/external-stub-providers.js

@@ -0,0 +1,21 @@
+import { unprocessable } from "../errors.js";
+function unavailableProvider(id, label) {
+    return {
+        id,
+        descriptor: {
+            id,
+            label,
+            requiresExternalRef: true,
+        },
+        async createVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+        async resolveVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+    };
+}
+export const awsSecretsManagerProvider = unavailableProvider("aws_secrets_manager", "AWS Secrets Manager");
+export const gcpSecretManagerProvider = unavailableProvider("gcp_secret_manager", "GCP Secret Manager");
+export const vaultProvider = unavailableProvider("vault", "HashiCorp Vault");
+//# sourceMappingURL=external-stub-providers.js.map

package/dist/secrets/external-stub-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.js","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,SAAS,mBAAmB,CAC1B,EAA0D,EAC1D,KAAa;IAEb,OAAO;QACL,EAAE;QACF,UAAU,EAAE;YACV,EAAE;YACF,KAAK;YACL,mBAAmB,EAAE,IAAI;SAC1B;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAC1D,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CACzD,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC"}

package/dist/secrets/local-encrypted-provider.d.ts

@@ -0,0 +1,3 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const localEncryptedProvider: SecretProviderModule;
+//# sourceMappingURL=local-encrypted-provider.d.ts.map

package/dist/secrets/local-encrypted-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.d.ts","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,YAAY,CAAC;AAgHpF,eAAO,MAAM,sBAAsB,EAAE,oBAmBpC,CAAC"}

package/dist/secrets/local-encrypted-provider.js

@@ -0,0 +1,116 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { badRequest } from "../errors.js";
+function resolveMasterKeyFilePath() {
+    const fromEnv = process.env.EVERMORE_SECRETS_MASTER_KEY_FILE;
+    if (fromEnv && fromEnv.trim().length > 0)
+        return path.resolve(fromEnv.trim());
+    return path.resolve(process.cwd(), "data/secrets/master.key");
+}
+function decodeMasterKey(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    if (/^[A-Fa-f0-9]{64}$/.test(trimmed)) {
+        return Buffer.from(trimmed, "hex");
+    }
+    try {
+        const decoded = Buffer.from(trimmed, "base64");
+        if (decoded.length === 32)
+            return decoded;
+    }
+    catch {
+        // ignored
+    }
+    if (Buffer.byteLength(trimmed, "utf8") === 32) {
+        return Buffer.from(trimmed, "utf8");
+    }
+    return null;
+}
+function loadOrCreateMasterKey() {
+    const envKeyRaw = process.env.EVERMORE_SECRETS_MASTER_KEY;
+    if (envKeyRaw && envKeyRaw.trim().length > 0) {
+        const fromEnv = decodeMasterKey(envKeyRaw);
+        if (!fromEnv) {
+            throw badRequest("Invalid EVERMORE_SECRETS_MASTER_KEY (expected 32-byte base64, 64-char hex, or raw 32-char string)");
+        }
+        return fromEnv;
+    }
+    const keyPath = resolveMasterKeyFilePath();
+    if (existsSync(keyPath)) {
+        const raw = readFileSync(keyPath, "utf8");
+        const decoded = decodeMasterKey(raw);
+        if (!decoded) {
+            throw badRequest(`Invalid secrets master key at ${keyPath}`);
+        }
+        return decoded;
+    }
+    const dir = path.dirname(keyPath);
+    mkdirSync(dir, { recursive: true });
+    const generated = randomBytes(32);
+    writeFileSync(keyPath, generated.toString("base64"), { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(keyPath, 0o600);
+    }
+    catch {
+        // best effort
+    }
+    return generated;
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function encryptValue(masterKey, value) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", masterKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        scheme: "local_encrypted_v1",
+        iv: iv.toString("base64"),
+        tag: tag.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+function decryptValue(masterKey, material) {
+    const iv = Buffer.from(material.iv, "base64");
+    const tag = Buffer.from(material.tag, "base64");
+    const ciphertext = Buffer.from(material.ciphertext, "base64");
+    const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+    decipher.setAuthTag(tag);
+    const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plain.toString("utf8");
+}
+function asLocalEncryptedMaterial(value) {
+    if (value &&
+        typeof value === "object" &&
+        value.scheme === "local_encrypted_v1" &&
+        typeof value.iv === "string" &&
+        typeof value.tag === "string" &&
+        typeof value.ciphertext === "string") {
+        return value;
+    }
+    throw badRequest("Invalid local_encrypted secret material");
+}
+export const localEncryptedProvider = {
+    id: "local_encrypted",
+    descriptor: {
+        id: "local_encrypted",
+        label: "Local encrypted (default)",
+        requiresExternalRef: false,
+    },
+    async createVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return {
+            material: encryptValue(masterKey, input.value),
+            valueSha256: sha256Hex(input.value),
+            externalRef: null,
+        };
+    },
+    async resolveVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return decryptValue(masterKey, asLocalEncryptedMaterial(input.material));
+    },
+};
+//# sourceMappingURL=local-encrypted-provider.js.map

package/dist/secrets/local-encrypted-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.js","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS1C,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAC7D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC1D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CACd,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,KAAa;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,oBAAoB;QAC5B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAkC;IAClE,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,oBAAoB;QACrC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,KAA+B,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,EAAE,EAAE,iBAAiB;IACrB,UAAU,EAAE;QACV,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,2BAA2B;QAClC,mBAAmB,EAAE,KAAK;KAC3B;IACD,KAAK,CAAC,aAAa,CAAC,KAAK;QACvB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO;YACL,QAAQ,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9C,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,KAAK;QACxB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/dist/secrets/provider-registry.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@evermore.work/shared";
+import type { SecretProviderModule } from "./types.js";
+export declare function getSecretProvider(id: SecretProvider): SecretProviderModule;
+export declare function listSecretProviders(): SecretProviderDescriptor[];
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/secrets/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAOtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAcvD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,oBAAoB,CAI1E;AAED,wBAAgB,mBAAmB,IAAI,wBAAwB,EAAE,CAEhE"}

package/dist/secrets/provider-registry.js

@@ -0,0 +1,20 @@
+import { localEncryptedProvider } from "./local-encrypted-provider.js";
+import { awsSecretsManagerProvider, gcpSecretManagerProvider, vaultProvider, } from "./external-stub-providers.js";
+import { unprocessable } from "../errors.js";
+const providers = [
+    localEncryptedProvider,
+    awsSecretsManagerProvider,
+    gcpSecretManagerProvider,
+    vaultProvider,
+];
+const providerById = new Map(providers.map((provider) => [provider.id, provider]));
+export function getSecretProvider(id) {
+    const provider = providerById.get(id);
+    if (!provider)
+        throw unprocessable(`Unsupported secret provider: ${id}`);
+    return provider;
+}
+export function listSecretProviders() {
+    return providers.map((provider) => provider.descriptor);
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/secrets/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,SAAS,GAA2B;IACxC,sBAAsB;IACtB,yBAAyB;IACzB,wBAAwB;IACxB,aAAa;CACd,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACrD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAkB;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,aAAa,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC1D,CAAC"}

package/dist/secrets/types.d.ts

@@ -0,0 +1,21 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@evermore.work/shared";
+export interface StoredSecretVersionMaterial {
+    [key: string]: unknown;
+}
+export interface SecretProviderModule {
+    id: SecretProvider;
+    descriptor: SecretProviderDescriptor;
+    createVersion(input: {
+        value: string;
+        externalRef: string | null;
+    }): Promise<{
+        material: StoredSecretVersionMaterial;
+        valueSha256: string;
+        externalRef: string | null;
+    }>;
+    resolveVersion(input: {
+        material: StoredSecretVersionMaterial;
+        externalRef: string | null;
+    }): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secrets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,WAAW,2BAA2B;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAC;IACnB,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC;QACV,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB"}

package/dist/secrets/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/secrets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":""}