@fidelios/server 0.0.1

package/dist/routes/routines.js

@@ -0,0 +1,277 @@
+import { Router } from "express";
+import { createRoutineSchema, createRoutineTriggerSchema, rotateRoutineTriggerSecretSchema, runRoutineSchema, updateRoutineSchema, updateRoutineTriggerSchema, } from "@fidelios/shared";
+import { validate } from "../middleware/validate.js";
+import { accessService, logActivity, routineService } from "../services/index.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
+import { forbidden, unauthorized } from "../errors.js";
+export function routineRoutes(db) {
+    const router = Router();
+    const svc = routineService(db);
+    const access = accessService(db);
+    async function assertBoardCanAssignTasks(req, companyId) {
+        assertCompanyAccess(req, companyId);
+        if (req.actor.type !== "board")
+            return;
+        if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin)
+            return;
+        const allowed = await access.canUser(companyId, req.actor.userId, "tasks:assign");
+        if (!allowed) {
+            throw forbidden("Missing permission: tasks:assign");
+        }
+    }
+    function assertCanManageCompanyRoutine(req, companyId, assigneeAgentId) {
+        assertCompanyAccess(req, companyId);
+        if (req.actor.type === "board")
+            return;
+        if (req.actor.type !== "agent" || !req.actor.agentId)
+            throw unauthorized();
+        if (assigneeAgentId && assigneeAgentId !== req.actor.agentId) {
+            throw forbidden("Agents can only manage routines assigned to themselves");
+        }
+    }
+    async function assertCanManageExistingRoutine(req, routineId) {
+        const routine = await svc.get(routineId);
+        if (!routine)
+            return null;
+        assertCompanyAccess(req, routine.companyId);
+        if (req.actor.type === "board")
+            return routine;
+        if (req.actor.type !== "agent" || !req.actor.agentId)
+            throw unauthorized();
+        if (routine.assigneeAgentId !== req.actor.agentId) {
+            throw forbidden("Agents can only manage routines assigned to themselves");
+        }
+        return routine;
+    }
+    router.get("/companies/:companyId/routines", async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        const result = await svc.list(companyId);
+        res.json(result);
+    });
+    router.post("/companies/:companyId/routines", validate(createRoutineSchema), async (req, res) => {
+        const companyId = req.params.companyId;
+        await assertBoardCanAssignTasks(req, companyId);
+        assertCanManageCompanyRoutine(req, companyId, req.body.assigneeAgentId);
+        const created = await svc.create(companyId, req.body, {
+            agentId: req.actor.type === "agent" ? req.actor.agentId : null,
+            userId: req.actor.type === "board" ? req.actor.userId ?? "board" : null,
+        });
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.created",
+            entityType: "routine",
+            entityId: created.id,
+            details: { title: created.title, assigneeAgentId: created.assigneeAgentId },
+        });
+        res.status(201).json(created);
+    });
+    router.get("/routines/:id", async (req, res) => {
+        const detail = await svc.getDetail(req.params.id);
+        if (!detail) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        assertCompanyAccess(req, detail.companyId);
+        res.json(detail);
+    });
+    router.patch("/routines/:id", validate(updateRoutineSchema), async (req, res) => {
+        const routine = await assertCanManageExistingRoutine(req, req.params.id);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        const assigneeWillChange = req.body.assigneeAgentId !== undefined &&
+            req.body.assigneeAgentId !== routine.assigneeAgentId;
+        if (assigneeWillChange) {
+            await assertBoardCanAssignTasks(req, routine.companyId);
+        }
+        const statusWillActivate = req.body.status !== undefined &&
+            req.body.status === "active" &&
+            routine.status !== "active";
+        if (statusWillActivate) {
+            await assertBoardCanAssignTasks(req, routine.companyId);
+        }
+        if (req.actor.type === "agent" && req.body.assigneeAgentId && req.body.assigneeAgentId !== req.actor.agentId) {
+            throw forbidden("Agents can only assign routines to themselves");
+        }
+        const updated = await svc.update(routine.id, req.body, {
+            agentId: req.actor.type === "agent" ? req.actor.agentId : null,
+            userId: req.actor.type === "board" ? req.actor.userId ?? "board" : null,
+        });
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.updated",
+            entityType: "routine",
+            entityId: routine.id,
+            details: { title: updated?.title ?? routine.title },
+        });
+        res.json(updated);
+    });
+    router.get("/routines/:id/runs", async (req, res) => {
+        const routine = await svc.get(req.params.id);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        assertCompanyAccess(req, routine.companyId);
+        const limit = Number(req.query.limit ?? 50);
+        const result = await svc.listRuns(routine.id, Number.isFinite(limit) ? limit : 50);
+        res.json(result);
+    });
+    router.post("/routines/:id/triggers", validate(createRoutineTriggerSchema), async (req, res) => {
+        const routine = await assertCanManageExistingRoutine(req, req.params.id);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        await assertBoardCanAssignTasks(req, routine.companyId);
+        const created = await svc.createTrigger(routine.id, req.body, {
+            agentId: req.actor.type === "agent" ? req.actor.agentId : null,
+            userId: req.actor.type === "board" ? req.actor.userId ?? "board" : null,
+        });
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.trigger_created",
+            entityType: "routine_trigger",
+            entityId: created.trigger.id,
+            details: { routineId: routine.id, kind: created.trigger.kind },
+        });
+        res.status(201).json(created);
+    });
+    router.patch("/routine-triggers/:id", validate(updateRoutineTriggerSchema), async (req, res) => {
+        const trigger = await svc.getTrigger(req.params.id);
+        if (!trigger) {
+            res.status(404).json({ error: "Routine trigger not found" });
+            return;
+        }
+        const routine = await assertCanManageExistingRoutine(req, trigger.routineId);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        await assertBoardCanAssignTasks(req, routine.companyId);
+        const updated = await svc.updateTrigger(trigger.id, req.body, {
+            agentId: req.actor.type === "agent" ? req.actor.agentId : null,
+            userId: req.actor.type === "board" ? req.actor.userId ?? "board" : null,
+        });
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.trigger_updated",
+            entityType: "routine_trigger",
+            entityId: trigger.id,
+            details: { routineId: routine.id, kind: updated?.kind ?? trigger.kind },
+        });
+        res.json(updated);
+    });
+    router.delete("/routine-triggers/:id", async (req, res) => {
+        const trigger = await svc.getTrigger(req.params.id);
+        if (!trigger) {
+            res.status(404).json({ error: "Routine trigger not found" });
+            return;
+        }
+        const routine = await assertCanManageExistingRoutine(req, trigger.routineId);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        await svc.deleteTrigger(trigger.id);
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.trigger_deleted",
+            entityType: "routine_trigger",
+            entityId: trigger.id,
+            details: { routineId: routine.id, kind: trigger.kind },
+        });
+        res.status(204).end();
+    });
+    router.post("/routine-triggers/:id/rotate-secret", validate(rotateRoutineTriggerSecretSchema), async (req, res) => {
+        const trigger = await svc.getTrigger(req.params.id);
+        if (!trigger) {
+            res.status(404).json({ error: "Routine trigger not found" });
+            return;
+        }
+        const routine = await assertCanManageExistingRoutine(req, trigger.routineId);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        const rotated = await svc.rotateTriggerSecret(trigger.id, {
+            agentId: req.actor.type === "agent" ? req.actor.agentId : null,
+            userId: req.actor.type === "board" ? req.actor.userId ?? "board" : null,
+        });
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.trigger_secret_rotated",
+            entityType: "routine_trigger",
+            entityId: trigger.id,
+            details: { routineId: routine.id },
+        });
+        res.json(rotated);
+    });
+    router.post("/routines/:id/run", validate(runRoutineSchema), async (req, res) => {
+        const routine = await assertCanManageExistingRoutine(req, req.params.id);
+        if (!routine) {
+            res.status(404).json({ error: "Routine not found" });
+            return;
+        }
+        await assertBoardCanAssignTasks(req, routine.companyId);
+        const run = await svc.runRoutine(routine.id, req.body);
+        const actor = getActorInfo(req);
+        await logActivity(db, {
+            companyId: routine.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "routine.run_triggered",
+            entityType: "routine_run",
+            entityId: run.id,
+            details: { routineId: routine.id, source: run.source, status: run.status },
+        });
+        res.status(202).json(run);
+    });
+    router.post("/routine-triggers/public/:publicId/fire", async (req, res) => {
+        const result = await svc.firePublicTrigger(req.params.publicId, {
+            authorizationHeader: req.header("authorization"),
+            signatureHeader: req.header("x-fidelios-signature"),
+            timestampHeader: req.header("x-fidelios-timestamp"),
+            idempotencyKey: req.header("idempotency-key"),
+            rawBody: req.rawBody ?? null,
+            payload: typeof req.body === "object" && req.body !== null ? req.body : null,
+        });
+        res.status(202).json(result);
+    });
+    return router;
+}
+//# sourceMappingURL=routines.js.map

package/dist/routes/routines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routines.js","sourceRoot":"","sources":["../../src/routes/routines.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,MAAM,SAAS,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gCAAgC,EAChC,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,UAAU,aAAa,CAAC,EAAM;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAEjC,KAAK,UAAU,yBAAyB,CAAC,GAAY,EAAE,SAAiB;QACtE,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO;QACvC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe;YAAE,OAAO;QAC/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,SAAS,6BAA6B,CAAC,GAAY,EAAE,SAAiB,EAAE,eAA+B;QACrG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO;QACvC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QAC3E,IAAI,eAAe,IAAI,eAAe,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7D,MAAM,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,UAAU,8BAA8B,CAAC,GAAY,EAAE,SAAiB;QAC3E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAC/C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,YAAY,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAClD,MAAM,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9F,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChD,6BAA6B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE;YACpD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;SAC5E,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,kBAAkB,GACtB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC;QACvD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,kBAAkB,GACtB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAC7B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC5B,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC9B,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7G,MAAM,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE;YACrD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE;SACpD,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7F,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE;YAC5D,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7F,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE;YAC5D,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE;SACxE,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,yBAAyB;YACjC,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SACvD,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACT,qCAAqC,EACrC,QAAQ,CAAC,gCAAgC,CAAC,EAC1C,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE;YACxD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC9D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAC3E,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAkB,EAAE;YACxE,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YAChD,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACnD,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACnD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC7C,OAAO,EAAG,GAA4B,CAAC,OAAO,IAAI,IAAI;YACtD,OAAO,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAA+B,CAAC,CAAC,CAAC,IAAI;SACxG,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/secrets.d.ts

@@ -0,0 +1,3 @@
+import type { Db } from "@fidelios/db";
+export declare function secretRoutes(db: Db): import("express-serve-static-core").Router;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/routes/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/routes/secrets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAYvC,wBAAgB,YAAY,CAAC,EAAE,EAAE,EAAE,8CAuJlC"}

package/dist/routes/secrets.js

@@ -0,0 +1,128 @@
+import { Router } from "express";
+import { SECRET_PROVIDERS, createSecretSchema, rotateSecretSchema, updateSecretSchema, } from "@fidelios/shared";
+import { validate } from "../middleware/validate.js";
+import { assertBoard, assertCompanyAccess } from "./authz.js";
+import { logActivity, secretService } from "../services/index.js";
+export function secretRoutes(db) {
+    const router = Router();
+    const svc = secretService(db);
+    const configuredDefaultProvider = process.env.FIDELIOS_SECRETS_PROVIDER;
+    const defaultProvider = (configuredDefaultProvider && SECRET_PROVIDERS.includes(configuredDefaultProvider)
+        ? configuredDefaultProvider
+        : "local_encrypted");
+    router.get("/companies/:companyId/secret-providers", (req, res) => {
+        assertBoard(req);
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        res.json(svc.listProviders());
+    });
+    router.get("/companies/:companyId/secrets", async (req, res) => {
+        assertBoard(req);
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        const secrets = await svc.list(companyId);
+        res.json(secrets);
+    });
+    router.post("/companies/:companyId/secrets", validate(createSecretSchema), async (req, res) => {
+        assertBoard(req);
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        const created = await svc.create(companyId, {
+            name: req.body.name,
+            provider: req.body.provider ?? defaultProvider,
+            value: req.body.value,
+            description: req.body.description,
+            externalRef: req.body.externalRef,
+        }, { userId: req.actor.userId ?? "board", agentId: null });
+        await logActivity(db, {
+            companyId,
+            actorType: "user",
+            actorId: req.actor.userId ?? "board",
+            action: "secret.created",
+            entityType: "secret",
+            entityId: created.id,
+            details: { name: created.name, provider: created.provider },
+        });
+        res.status(201).json(created);
+    });
+    router.post("/secrets/:id/rotate", validate(rotateSecretSchema), async (req, res) => {
+        assertBoard(req);
+        const id = req.params.id;
+        const existing = await svc.getById(id);
+        if (!existing) {
+            res.status(404).json({ error: "Secret not found" });
+            return;
+        }
+        assertCompanyAccess(req, existing.companyId);
+        const rotated = await svc.rotate(id, {
+            value: req.body.value,
+            externalRef: req.body.externalRef,
+        }, { userId: req.actor.userId ?? "board", agentId: null });
+        await logActivity(db, {
+            companyId: rotated.companyId,
+            actorType: "user",
+            actorId: req.actor.userId ?? "board",
+            action: "secret.rotated",
+            entityType: "secret",
+            entityId: rotated.id,
+            details: { version: rotated.latestVersion },
+        });
+        res.json(rotated);
+    });
+    router.patch("/secrets/:id", validate(updateSecretSchema), async (req, res) => {
+        assertBoard(req);
+        const id = req.params.id;
+        const existing = await svc.getById(id);
+        if (!existing) {
+            res.status(404).json({ error: "Secret not found" });
+            return;
+        }
+        assertCompanyAccess(req, existing.companyId);
+        const updated = await svc.update(id, {
+            name: req.body.name,
+            description: req.body.description,
+            externalRef: req.body.externalRef,
+        });
+        if (!updated) {
+            res.status(404).json({ error: "Secret not found" });
+            return;
+        }
+        await logActivity(db, {
+            companyId: updated.companyId,
+            actorType: "user",
+            actorId: req.actor.userId ?? "board",
+            action: "secret.updated",
+            entityType: "secret",
+            entityId: updated.id,
+            details: { name: updated.name },
+        });
+        res.json(updated);
+    });
+    router.delete("/secrets/:id", async (req, res) => {
+        assertBoard(req);
+        const id = req.params.id;
+        const existing = await svc.getById(id);
+        if (!existing) {
+            res.status(404).json({ error: "Secret not found" });
+            return;
+        }
+        assertCompanyAccess(req, existing.companyId);
+        const removed = await svc.remove(id);
+        if (!removed) {
+            res.status(404).json({ error: "Secret not found" });
+            return;
+        }
+        await logActivity(db, {
+            companyId: removed.companyId,
+            actorType: "user",
+            actorId: req.actor.userId ?? "board",
+            action: "secret.deleted",
+            entityType: "secret",
+            entityId: removed.id,
+            details: { name: removed.name },
+        });
+        res.json({ ok: true });
+    });
+    return router;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/routes/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/routes/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAEhB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAElE,MAAM,UAAU,YAAY,CAAC,EAAM;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACxE,MAAM,eAAe,GAAG,CACtB,yBAAyB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,yBAA2C,CAAC;QACjG,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,iBAAiB,CACJ,CAAC;IAEpB,MAAM,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5F,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAC9B,SAAS,EACT;YACE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,eAAe;YAC9C,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;YACjC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;SAClC,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACvD,CAAC;QAEF,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;SAC5D,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAC9B,EAAE,EACF;YACE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;SAClC,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACvD,CAAC;QAEF,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE;SAC5C,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5E,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACnC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;YACjC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;YACpC,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/sidebar-badges.d.ts

@@ -0,0 +1,3 @@
+import type { Db } from "@fidelios/db";
+export declare function sidebarBadgeRoutes(db: Db): import("express-serve-static-core").Router;
+//# sourceMappingURL=sidebar-badges.d.ts.map

package/dist/routes/sidebar-badges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidebar-badges.d.ts","sourceRoot":"","sources":["../../src/routes/sidebar-badges.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAQvC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,EAAE,8CAyCxC"}

package/dist/routes/sidebar-badges.js

@@ -0,0 +1,45 @@
+import { Router } from "express";
+import { and, eq, sql } from "drizzle-orm";
+import { joinRequests } from "@fidelios/db";
+import { sidebarBadgeService } from "../services/sidebar-badges.js";
+import { accessService } from "../services/access.js";
+import { dashboardService } from "../services/dashboard.js";
+import { assertCompanyAccess } from "./authz.js";
+export function sidebarBadgeRoutes(db) {
+    const router = Router();
+    const svc = sidebarBadgeService(db);
+    const access = accessService(db);
+    const dashboard = dashboardService(db);
+    router.get("/companies/:companyId/sidebar-badges", async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        let canApproveJoins = false;
+        if (req.actor.type === "board") {
+            canApproveJoins =
+                req.actor.source === "local_implicit" ||
+                    Boolean(req.actor.isInstanceAdmin) ||
+                    (await access.canUser(companyId, req.actor.userId, "joins:approve"));
+        }
+        else if (req.actor.type === "agent" && req.actor.agentId) {
+            canApproveJoins = await access.hasPermission(companyId, "agent", req.actor.agentId, "joins:approve");
+        }
+        const joinRequestCount = canApproveJoins
+            ? await db
+                .select({ count: sql `count(*)` })
+                .from(joinRequests)
+                .where(and(eq(joinRequests.companyId, companyId), eq(joinRequests.status, "pending_approval")))
+                .then((rows) => Number(rows[0]?.count ?? 0))
+            : 0;
+        const badges = await svc.get(companyId, {
+            joinRequests: joinRequestCount,
+        });
+        const summary = await dashboard.summary(companyId);
+        const hasFailedRuns = badges.failedRuns > 0;
+        const alertsCount = (summary.agents.error > 0 && !hasFailedRuns ? 1 : 0) +
+            (summary.costs.monthBudgetCents > 0 && summary.costs.monthUtilizationPercent >= 80 ? 1 : 0);
+        badges.inbox = badges.failedRuns + alertsCount + joinRequestCount + badges.approvals;
+        res.json(badges);
+    });
+    return router;
+}
+//# sourceMappingURL=sidebar-badges.js.map

package/dist/routes/sidebar-badges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidebar-badges.js","sourceRoot":"","sources":["../../src/routes/sidebar-badges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,UAAU,kBAAkB,CAAC,EAAM;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAEvC,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,eAAe;gBACb,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB;oBACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;oBAClC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3D,eAAe,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,gBAAgB,GAAG,eAAe;YACtC,CAAC,CAAC,MAAM,EAAE;iBACP,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC;iBACxC,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC,CAAC;QAEN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE;YACtC,YAAY,EAAE,gBAAgB;SAC/B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5C,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,GAAG,WAAW,GAAG,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC;QAErF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/secrets/external-stub-providers.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const awsSecretsManagerProvider: SecretProviderModule;
+export declare const gcpSecretManagerProvider: SecretProviderModule;
+export declare const vaultProvider: SecretProviderModule;
+//# sourceMappingURL=external-stub-providers.d.ts.map

package/dist/secrets/external-stub-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.d.ts","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAsBvD,eAAO,MAAM,yBAAyB,sBAGrC,CAAC;AACF,eAAO,MAAM,wBAAwB,sBAGpC,CAAC;AACF,eAAO,MAAM,aAAa,sBAAkD,CAAC"}

package/dist/secrets/external-stub-providers.js

@@ -0,0 +1,21 @@
+import { unprocessable } from "../errors.js";
+function unavailableProvider(id, label) {
+    return {
+        id,
+        descriptor: {
+            id,
+            label,
+            requiresExternalRef: true,
+        },
+        async createVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+        async resolveVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+    };
+}
+export const awsSecretsManagerProvider = unavailableProvider("aws_secrets_manager", "AWS Secrets Manager");
+export const gcpSecretManagerProvider = unavailableProvider("gcp_secret_manager", "GCP Secret Manager");
+export const vaultProvider = unavailableProvider("vault", "HashiCorp Vault");
+//# sourceMappingURL=external-stub-providers.js.map

package/dist/secrets/external-stub-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.js","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,SAAS,mBAAmB,CAC1B,EAA0D,EAC1D,KAAa;IAEb,OAAO;QACL,EAAE;QACF,UAAU,EAAE;YACV,EAAE;YACF,KAAK;YACL,mBAAmB,EAAE,IAAI;SAC1B;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAC1D,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CACzD,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC"}

package/dist/secrets/local-encrypted-provider.d.ts

@@ -0,0 +1,3 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const localEncryptedProvider: SecretProviderModule;
+//# sourceMappingURL=local-encrypted-provider.d.ts.map

package/dist/secrets/local-encrypted-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.d.ts","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,YAAY,CAAC;AAgHpF,eAAO,MAAM,sBAAsB,EAAE,oBAmBpC,CAAC"}