@growthub/cli 0.3.1 → 0.3.3

package/dist/runtime/server/dist/routes/tickets.js

@@ -0,0 +1,112 @@
+import { Router } from "express";
+import { createTicketSchema, updateTicketSchema } from "@paperclipai/shared";
+import { validate } from "../middleware/validate.js";
+import { ticketService } from "../services/tickets.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
+export function ticketRoutes(db) {
+    const router = Router();
+    const svc = ticketService(db);
+    router.get("/companies/:companyId/tickets", async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        const result = await svc.list(companyId);
+        res.json(result);
+    });
+    router.get("/companies/:companyId/tickets/:id", async (req, res) => {
+        const companyId = req.params.companyId;
+        const id = req.params.id;
+        assertCompanyAccess(req, companyId);
+        const ticket = await svc.getById(id);
+        if (!ticket) {
+            res.status(404).json({ error: "Ticket not found" });
+            return;
+        }
+        const ticketIssues = await svc.getIssues(id);
+        res.json({ ...ticket, issues: ticketIssues });
+    });
+    router.post("/companies/:companyId/tickets", validate(createTicketSchema), async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        const actor = getActorInfo(req);
+        const ticket = await svc.create(companyId, req.body, actor.actorId ?? undefined);
+        res.status(201).json(ticket);
+    });
+    router.patch("/companies/:companyId/tickets/:id", validate(updateTicketSchema), async (req, res) => {
+        const companyId = req.params.companyId;
+        const id = req.params.id;
+        assertCompanyAccess(req, companyId);
+        const ticket = await svc.update(id, req.body);
+        if (!ticket) {
+            res.status(404).json({ error: "Ticket not found" });
+            return;
+        }
+        res.json(ticket);
+    });
+    router.post("/companies/:companyId/tickets/:id/advance", async (req, res) => {
+        const companyId = req.params.companyId;
+        const id = req.params.id;
+        assertCompanyAccess(req, companyId);
+        const ticket = await svc.advanceStage(id);
+        if (!ticket) {
+            res.status(404).json({ error: "Ticket not found" });
+            return;
+        }
+        res.json(ticket);
+    });
+    router.delete("/companies/:companyId/tickets/:id", async (req, res) => {
+        const companyId = req.params.companyId;
+        const id = req.params.id;
+        assertCompanyAccess(req, companyId);
+        const ticket = await svc.remove(id);
+        if (!ticket) {
+            res.status(404).json({ error: "Ticket not found" });
+            return;
+        }
+        res.json({ ok: true });
+    });
+    router.get("/companies/:companyId/github/prs", async (req, res) => {
+        const repo = typeof req.query.repo === "string" ? req.query.repo.trim() : "";
+        const state = req.query.state || "open";
+        if (!repo) {
+            res.json([]);
+            return;
+        }
+        const { execSync } = await import("child_process");
+        try {
+            const raw = execSync(`gh api "/repos/${repo}/pulls?state=${state}&per_page=50" 2>/dev/null`, { encoding: "utf8", timeout: 8000 });
+            const prs = JSON.parse(raw);
+            res.json(prs.map((p) => ({
+                number: p.number,
+                title: p.title,
+                state: p.state,
+                url: p.html_url,
+                branch: p.head?.ref,
+                repo,
+                createdAt: p.created_at,
+                user: p.user?.login,
+                draft: p.draft,
+            })));
+        }
+        catch {
+            res.json([]);
+        }
+    });
+    router.get("/companies/:companyId/github/repos", async (req, res) => {
+        const { execSync } = await import("child_process");
+        try {
+            const raw = execSync(`gh api "/user/repos?per_page=50&sort=pushed&type=all" 2>/dev/null`, { encoding: "utf8", timeout: 8000 });
+            const repos = JSON.parse(raw);
+            res.json(repos.map((r) => ({
+                fullName: r.full_name,
+                name: r.name,
+                private: r.private,
+                pushedAt: r.pushed_at,
+            })));
+        }
+        catch {
+            res.json([]);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=tickets.js.map

package/dist/runtime/server/dist/routes/tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.js","sourceRoot":"","sources":["../../src/routes/tickets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,UAAU,YAAY,CAAC,EAAM;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAE9B,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5F,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjG,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QACnC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,MAAM,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAClB,kBAAkB,IAAI,gBAAgB,KAAK,2BAA2B,EACtE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,GAAG,CAAC,IAAI,CACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACvC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,EAAG,CAAS,CAAC,QAAQ;gBACxB,MAAM,EAAG,CAAS,CAAC,IAAI,EAAE,GAAG;gBAC5B,IAAI;gBACJ,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,IAAI,EAAG,CAAS,CAAC,IAAI,EAAE,KAAK;gBAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAClB,mEAAmE,EACnE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACzC,QAAQ,EAAE,CAAC,CAAC,SAAS;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,SAAS;aACtB,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/server/dist/secrets/external-stub-providers.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const awsSecretsManagerProvider: SecretProviderModule;
+export declare const gcpSecretManagerProvider: SecretProviderModule;
+export declare const vaultProvider: SecretProviderModule;
+//# sourceMappingURL=external-stub-providers.d.ts.map

package/dist/runtime/server/dist/secrets/external-stub-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.d.ts","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAsBvD,eAAO,MAAM,yBAAyB,sBAGrC,CAAC;AACF,eAAO,MAAM,wBAAwB,sBAGpC,CAAC;AACF,eAAO,MAAM,aAAa,sBAAkD,CAAC"}

package/dist/runtime/server/dist/secrets/external-stub-providers.js

@@ -0,0 +1,21 @@
+import { unprocessable } from "../errors.js";
+function unavailableProvider(id, label) {
+    return {
+        id,
+        descriptor: {
+            id,
+            label,
+            requiresExternalRef: true,
+        },
+        async createVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+        async resolveVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+    };
+}
+export const awsSecretsManagerProvider = unavailableProvider("aws_secrets_manager", "AWS Secrets Manager");
+export const gcpSecretManagerProvider = unavailableProvider("gcp_secret_manager", "GCP Secret Manager");
+export const vaultProvider = unavailableProvider("vault", "HashiCorp Vault");
+//# sourceMappingURL=external-stub-providers.js.map

package/dist/runtime/server/dist/secrets/external-stub-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.js","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,SAAS,mBAAmB,CAC1B,EAA0D,EAC1D,KAAa;IAEb,OAAO;QACL,EAAE;QACF,UAAU,EAAE;YACV,EAAE;YACF,KAAK;YACL,mBAAmB,EAAE,IAAI;SAC1B;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAC1D,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CACzD,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC"}

package/dist/runtime/server/dist/secrets/local-encrypted-provider.d.ts

@@ -0,0 +1,3 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const localEncryptedProvider: SecretProviderModule;
+//# sourceMappingURL=local-encrypted-provider.d.ts.map

package/dist/runtime/server/dist/secrets/local-encrypted-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.d.ts","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,YAAY,CAAC;AAgHpF,eAAO,MAAM,sBAAsB,EAAE,oBAmBpC,CAAC"}

package/dist/runtime/server/dist/secrets/local-encrypted-provider.js

@@ -0,0 +1,116 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { badRequest } from "../errors.js";
+function resolveMasterKeyFilePath() {
+    const fromEnv = process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+    if (fromEnv && fromEnv.trim().length > 0)
+        return path.resolve(fromEnv.trim());
+    return path.resolve(process.cwd(), "data/secrets/master.key");
+}
+function decodeMasterKey(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    if (/^[A-Fa-f0-9]{64}$/.test(trimmed)) {
+        return Buffer.from(trimmed, "hex");
+    }
+    try {
+        const decoded = Buffer.from(trimmed, "base64");
+        if (decoded.length === 32)
+            return decoded;
+    }
+    catch {
+        // ignored
+    }
+    if (Buffer.byteLength(trimmed, "utf8") === 32) {
+        return Buffer.from(trimmed, "utf8");
+    }
+    return null;
+}
+function loadOrCreateMasterKey() {
+    const envKeyRaw = process.env.PAPERCLIP_SECRETS_MASTER_KEY;
+    if (envKeyRaw && envKeyRaw.trim().length > 0) {
+        const fromEnv = decodeMasterKey(envKeyRaw);
+        if (!fromEnv) {
+            throw badRequest("Invalid PAPERCLIP_SECRETS_MASTER_KEY (expected 32-byte base64, 64-char hex, or raw 32-char string)");
+        }
+        return fromEnv;
+    }
+    const keyPath = resolveMasterKeyFilePath();
+    if (existsSync(keyPath)) {
+        const raw = readFileSync(keyPath, "utf8");
+        const decoded = decodeMasterKey(raw);
+        if (!decoded) {
+            throw badRequest(`Invalid secrets master key at ${keyPath}`);
+        }
+        return decoded;
+    }
+    const dir = path.dirname(keyPath);
+    mkdirSync(dir, { recursive: true });
+    const generated = randomBytes(32);
+    writeFileSync(keyPath, generated.toString("base64"), { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(keyPath, 0o600);
+    }
+    catch {
+        // best effort
+    }
+    return generated;
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function encryptValue(masterKey, value) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", masterKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        scheme: "local_encrypted_v1",
+        iv: iv.toString("base64"),
+        tag: tag.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+function decryptValue(masterKey, material) {
+    const iv = Buffer.from(material.iv, "base64");
+    const tag = Buffer.from(material.tag, "base64");
+    const ciphertext = Buffer.from(material.ciphertext, "base64");
+    const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+    decipher.setAuthTag(tag);
+    const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plain.toString("utf8");
+}
+function asLocalEncryptedMaterial(value) {
+    if (value &&
+        typeof value === "object" &&
+        value.scheme === "local_encrypted_v1" &&
+        typeof value.iv === "string" &&
+        typeof value.tag === "string" &&
+        typeof value.ciphertext === "string") {
+        return value;
+    }
+    throw badRequest("Invalid local_encrypted secret material");
+}
+export const localEncryptedProvider = {
+    id: "local_encrypted",
+    descriptor: {
+        id: "local_encrypted",
+        label: "Local encrypted (default)",
+        requiresExternalRef: false,
+    },
+    async createVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return {
+            material: encryptValue(masterKey, input.value),
+            valueSha256: sha256Hex(input.value),
+            externalRef: null,
+        };
+    },
+    async resolveVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return decryptValue(masterKey, asLocalEncryptedMaterial(input.material));
+    },
+};
+//# sourceMappingURL=local-encrypted-provider.js.map

package/dist/runtime/server/dist/secrets/local-encrypted-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.js","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS1C,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAC9D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CACd,oGAAoG,CACrG,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,KAAa;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,oBAAoB;QAC5B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAkC;IAClE,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,oBAAoB;QACrC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,KAA+B,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,EAAE,EAAE,iBAAiB;IACrB,UAAU,EAAE;QACV,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,2BAA2B;QAClC,mBAAmB,EAAE,KAAK;KAC3B;IACD,KAAK,CAAC,aAAa,CAAC,KAAK;QACvB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO;YACL,QAAQ,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9C,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,KAAK;QACxB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/dist/runtime/server/dist/secrets/provider-registry.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@paperclipai/shared";
+import type { SecretProviderModule } from "./types.js";
+export declare function getSecretProvider(id: SecretProvider): SecretProviderModule;
+export declare function listSecretProviders(): SecretProviderDescriptor[];
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/runtime/server/dist/secrets/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAOpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAcvD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,oBAAoB,CAI1E;AAED,wBAAgB,mBAAmB,IAAI,wBAAwB,EAAE,CAEhE"}

package/dist/runtime/server/dist/secrets/provider-registry.js

@@ -0,0 +1,20 @@
+import { localEncryptedProvider } from "./local-encrypted-provider.js";
+import { awsSecretsManagerProvider, gcpSecretManagerProvider, vaultProvider, } from "./external-stub-providers.js";
+import { unprocessable } from "../errors.js";
+const providers = [
+    localEncryptedProvider,
+    awsSecretsManagerProvider,
+    gcpSecretManagerProvider,
+    vaultProvider,
+];
+const providerById = new Map(providers.map((provider) => [provider.id, provider]));
+export function getSecretProvider(id) {
+    const provider = providerById.get(id);
+    if (!provider)
+        throw unprocessable(`Unsupported secret provider: ${id}`);
+    return provider;
+}
+export function listSecretProviders() {
+    return providers.map((provider) => provider.descriptor);
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/runtime/server/dist/secrets/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,SAAS,GAA2B;IACxC,sBAAsB;IACtB,yBAAyB;IACzB,wBAAwB;IACxB,aAAa;CACd,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACrD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAkB;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,aAAa,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC1D,CAAC"}

package/dist/runtime/server/dist/secrets/types.d.ts

@@ -0,0 +1,21 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@paperclipai/shared";
+export interface StoredSecretVersionMaterial {
+    [key: string]: unknown;
+}
+export interface SecretProviderModule {
+    id: SecretProvider;
+    descriptor: SecretProviderDescriptor;
+    createVersion(input: {
+        value: string;
+        externalRef: string | null;
+    }): Promise<{
+        material: StoredSecretVersionMaterial;
+        valueSha256: string;
+        externalRef: string | null;
+    }>;
+    resolveVersion(input: {
+        material: StoredSecretVersionMaterial;
+        externalRef: string | null;
+    }): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/runtime/server/dist/secrets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,WAAW,2BAA2B;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAC;IACnB,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC;QACV,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB"}

package/dist/runtime/server/dist/secrets/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runtime/server/dist/secrets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":""}

package/dist/runtime/server/dist/services/access.d.ts

@@ -0,0 +1,93 @@
+import type { Db } from "@paperclipai/db";
+import { companyMemberships } from "@paperclipai/db";
+import type { PermissionKey, PrincipalType } from "@paperclipai/shared";
+type MembershipRow = typeof companyMemberships.$inferSelect;
+type GrantInput = {
+    permissionKey: PermissionKey;
+    scope?: Record<string, unknown> | null;
+};
+export declare function accessService(db: Db): {
+    isInstanceAdmin: (userId: string | null | undefined) => Promise<boolean>;
+    canUser: (companyId: string, userId: string | null | undefined, permissionKey: PermissionKey) => Promise<boolean>;
+    hasPermission: (companyId: string, principalType: PrincipalType, principalId: string, permissionKey: PermissionKey) => Promise<boolean>;
+    getMembership: (companyId: string, principalType: PrincipalType, principalId: string) => Promise<MembershipRow | null>;
+    ensureMembership: (companyId: string, principalType: PrincipalType, principalId: string, membershipRole?: string | null, status?: "pending" | "active" | "suspended") => Promise<{
+        id: string;
+        status: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }>;
+    listMembers: (companyId: string) => Promise<{
+        id: string;
+        status: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setMemberPermissions: (companyId: string, memberId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<{
+        id: string;
+        status: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    } | null>;
+    promoteInstanceAdmin: (userId: string) => Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        userId: string;
+    }>;
+    demoteInstanceAdmin: (userId: string) => Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        userId: string;
+    }>;
+    listUserCompanyAccess: (userId: string) => Promise<{
+        id: string;
+        status: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setUserCompanyAccess: (userId: string, companyIds: string[]) => Promise<{
+        id: string;
+        status: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setPrincipalGrants: (companyId: string, principalType: PrincipalType, principalId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<void>;
+    listPrincipalGrants: (companyId: string, principalType: PrincipalType, principalId: string) => Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        scope: Record<string, unknown> | null;
+        principalType: string;
+        principalId: string;
+        permissionKey: string;
+        grantedByUserId: string | null;
+    }[]>;
+    setPrincipalPermission: (companyId: string, principalType: PrincipalType, principalId: string, permissionKey: PermissionKey, enabled: boolean, grantedByUserId: string | null, scope?: Record<string, unknown> | null) => Promise<void>;
+};
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/runtime/server/dist/services/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/services/access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExE,KAAK,aAAa,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC5D,KAAK,UAAU,GAAG;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE;8BACK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAAO,CAAC,OAAO,CAAC;yBAoDtE,MAAM,UACT,MAAM,GAAG,IAAI,GAAG,SAAS,iBAClB,aAAa,KAC3B,OAAO,CAAC,OAAO,CAAC;+BA1BN,MAAM,iBACF,aAAa,eACf,MAAM,iBACJ,aAAa,KAC3B,OAAO,CAAC,OAAO,CAAC;+BAtBN,MAAM,iBACF,aAAa,eACf,MAAM,KAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;kCA6JnB,MAAM,iBACF,aAAa,eACf,MAAM,mBACH,MAAM,GAAG,IAAI,WACrB,SAAS,GAAG,QAAQ,GAAG,WAAW;;;;;;;;;;6BAlHN,MAAM;;;;;;;;;;sCAS/B,MAAM,YACP,MAAM,UACR,UAAU,EAAE,mBACH,MAAM,GAAG,IAAI;;;;;;;;;;mCAsCY,MAAM;;;;;;;kCAiBP,MAAM;;;;;;;oCAQJ,MAAM;;;;;;;;;;mCAQP,MAAM,cAAc,MAAM,EAAE;;;;;;;;;;oCA6D3D,MAAM,iBACF,aAAa,eACf,MAAM,UACX,UAAU,EAAE,mBACH,MAAM,GAAG,IAAI;qCA6BnB,MAAM,iBACF,aAAa,eACf,MAAM;;;;;;;;;;;wCAgBR,MAAM,iBACF,aAAa,eACf,MAAM,iBACJ,aAAa,WACnB,OAAO,mBACC,MAAM,GAAG,IAAI,UACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;EAuExC"}