@hartl-services/medusa-base 0.3.0 → 1.0.0

package/.medusa/server/src/modules/plugin-features/domain/plugin-action-runs.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toRunRecord = exports.finishedRunColumns = exports.compactActionResult = exports.PLUGIN_ACTION_RESULT_MAX_BYTES = exports.staleCutoff = exports.isStaleRun = exports.PLUGIN_ACTION_RUN_MESSAGE_MAX_LENGTH = exports.PLUGIN_ACTION_RUN_ABORTED_MESSAGE = exports.PLUGIN_ACTION_RUN_STALE_AFTER_MS = void 0;
+/** A run without a sign of life (start or progress) for this long is dead. */
+exports.PLUGIN_ACTION_RUN_STALE_AFTER_MS = 60 * 60 * 1000;
+/** Message of a run that was declared dead by the stale rule. */
+exports.PLUGIN_ACTION_RUN_ABORTED_MESSAGE = "Abgebrochen (Neustart)";
+/** Longest stored error message of a failed run. */
+exports.PLUGIN_ACTION_RUN_MESSAGE_MAX_LENGTH = 1000;
+/**
+ * The lazy restart rule: a `running` run whose last sign of life (start or
+ * reported progress) is older than `PLUGIN_ACTION_RUN_STALE_AFTER_MS` counts
+ * as aborted. The process that ran it restarted or lost it; nothing will
+ * finish it any more.
+ */
+const isStaleRun = (run, now) => run.status === "running" &&
+    now.getTime() - run.last_activity_at.getTime() >=
+        exports.PLUGIN_ACTION_RUN_STALE_AFTER_MS;
+exports.isStaleRun = isStaleRun;
+/** Cutoff for the stale rule as used in queries. */
+const staleCutoff = (now) => new Date(now.getTime() - exports.PLUGIN_ACTION_RUN_STALE_AFTER_MS);
+exports.staleCutoff = staleCutoff;
+/** Largest workflow result (serialized JSON) returned and stored. */
+exports.PLUGIN_ACTION_RESULT_MAX_BYTES = 4096;
+/** JSON copy of `result` when it is serializable and small, else `undefined`. */
+const compactActionResult = (result) => {
+    if (result === undefined) {
+        return undefined;
+    }
+    try {
+        const json = JSON.stringify(result);
+        if (json === undefined ||
+            Buffer.byteLength(json, "utf8") > exports.PLUGIN_ACTION_RESULT_MAX_BYTES) {
+            return undefined;
+        }
+        return JSON.parse(json);
+    }
+    catch {
+        return undefined;
+    }
+};
+exports.compactActionResult = compactActionResult;
+/**
+ * Columns of a finished run. Only a `running` run changes on progress; a
+ * finish always records the real outcome, also for a run the stale rule had
+ * already marked failed.
+ */
+const finishedRunColumns = (outcome) => outcome.status === "completed"
+    ? {
+        status: "completed",
+        message: null,
+        result: (0, exports.compactActionResult)(outcome.result) ?? null,
+    }
+    : {
+        status: "failed",
+        message: outcome.message.slice(0, exports.PLUGIN_ACTION_RUN_MESSAGE_MAX_LENGTH) ||
+            "Unbekannter Fehler",
+        result: null,
+    };
+exports.finishedRunColumns = finishedRunColumns;
+const toDate = (value) => value instanceof Date ? value : new Date(String(value));
+const toProgress = (value) => {
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const candidate = value;
+    if (typeof candidate.current !== "number") {
+        return null;
+    }
+    return {
+        current: candidate.current,
+        total: typeof candidate.total === "number" ? candidate.total : null,
+        label: typeof candidate.label === "string" ? candidate.label : null,
+    };
+};
+/** Row (raw SQL or ORM) to record. */
+const toRunRecord = (row) => ({
+    id: String(row.id),
+    plugin_key: String(row.plugin_key),
+    action_key: String(row.action_key),
+    status: row.status,
+    started_at: toDate(row.started_at),
+    finished_at: row.finished_at === null || row.finished_at === undefined
+        ? null
+        : toDate(row.finished_at),
+    triggered_by: typeof row.triggered_by === "string" ? row.triggered_by : null,
+    message: typeof row.message === "string" ? row.message : null,
+    progress: toProgress(row.progress),
+    result: row.result ?? null,
+});
+exports.toRunRecord = toRunRecord;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWFjdGlvbi1ydW5zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vc3JjL21vZHVsZXMvcGx1Z2luLWZlYXR1cmVzL2RvbWFpbi9wbHVnaW4tYWN0aW9uLXJ1bnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBSUEsOEVBQThFO0FBQ2pFLFFBQUEsZ0NBQWdDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUE7QUFFOUQsaUVBQWlFO0FBQ3BELFFBQUEsaUNBQWlDLEdBQUcsd0JBQXdCLENBQUE7QUFFekUsb0RBQW9EO0FBQ3ZDLFFBQUEsb0NBQW9DLEdBQUcsSUFBSSxDQUFBO0FBbUJ4RDs7Ozs7R0FLRztBQUNJLE1BQU0sVUFBVSxHQUFHLENBQ3hCLEdBQThELEVBQzlELEdBQVMsRUFDQSxFQUFFLENBQ1gsR0FBRyxDQUFDLE1BQU0sS0FBSyxTQUFTO0lBQ3hCLEdBQUcsQ0FBQyxPQUFPLEVBQUUsR0FBRyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFO1FBQzVDLHdDQUFnQyxDQUFBO0FBTnZCLFFBQUEsVUFBVSxjQU1hO0FBRXBDLG9EQUFvRDtBQUM3QyxNQUFNLFdBQVcsR0FBRyxDQUFDLEdBQVMsRUFBUSxFQUFFLENBQzdDLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsR0FBRyx3Q0FBZ0MsQ0FBQyxDQUFBO0FBRC9DLFFBQUEsV0FBVyxlQUNvQztBQUU1RCxxRUFBcUU7QUFDeEQsUUFBQSw4QkFBOEIsR0FBRyxJQUFJLENBQUE7QUFFbEQsaUZBQWlGO0FBQzFFLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxNQUFlLEVBQVcsRUFBRTtJQUM5RCxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6QixPQUFPLFNBQVMsQ0FBQTtJQUNsQixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtRQUNuQyxJQUNFLElBQUksS0FBSyxTQUFTO1lBQ2xCLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxHQUFHLHNDQUE4QixFQUNoRSxDQUFDO1lBQ0QsT0FBTyxTQUFTLENBQUE7UUFDbEIsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUN6QixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUE7SUFDbEIsQ0FBQztBQUNILENBQUMsQ0FBQTtBQWhCWSxRQUFBLG1CQUFtQix1QkFnQi9CO0FBRUQ7Ozs7R0FJRztBQUNJLE1BQU0sa0JBQWtCLEdBQUcsQ0FDaEMsT0FBK0IsRUFLL0IsRUFBRSxDQUNGLE9BQU8sQ0FBQyxNQUFNLEtBQUssV0FBVztJQUM1QixDQUFDLENBQUM7UUFDRSxNQUFNLEVBQUUsV0FBVztRQUNuQixPQUFPLEVBQUUsSUFBSTtRQUNiLE1BQU0sRUFBRSxJQUFBLDJCQUFtQixFQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJO0tBQ3BEO0lBQ0gsQ0FBQyxDQUFDO1FBQ0UsTUFBTSxFQUFFLFFBQVE7UUFDaEIsT0FBTyxFQUNMLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSw0Q0FBb0MsQ0FBQztZQUM5RCxvQkFBb0I7UUFDdEIsTUFBTSxFQUFFLElBQUk7S0FDYixDQUFBO0FBbkJNLFFBQUEsa0JBQWtCLHNCQW1CeEI7QUFFUCxNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBUSxFQUFFLENBQ3RDLEtBQUssWUFBWSxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUE7QUFFekQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFjLEVBQStCLEVBQUU7SUFDakUsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QyxPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxLQUFnQyxDQUFBO0lBQ2xELElBQUksT0FBTyxTQUFTLENBQUMsT0FBTyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzFDLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUNELE9BQU87UUFDTCxPQUFPLEVBQUUsU0FBUyxDQUFDLE9BQU87UUFDMUIsS0FBSyxFQUFFLE9BQU8sU0FBUyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUk7UUFDbkUsS0FBSyxFQUFFLE9BQU8sU0FBUyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUk7S0FDcEUsQ0FBQTtBQUNILENBQUMsQ0FBQTtBQUVELHNDQUFzQztBQUMvQixNQUFNLFdBQVcsR0FBRyxDQUFDLEdBQTRCLEVBQXlCLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLEVBQUUsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztJQUNsQixVQUFVLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUM7SUFDbEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO0lBQ2xDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBK0I7SUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO0lBQ2xDLFdBQVcsRUFDVCxHQUFHLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxHQUFHLENBQUMsV0FBVyxLQUFLLFNBQVM7UUFDdkQsQ0FBQyxDQUFDLElBQUk7UUFDTixDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUM7SUFDN0IsWUFBWSxFQUFFLE9BQU8sR0FBRyxDQUFDLFlBQVksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUk7SUFDNUUsT0FBTyxFQUFFLE9BQU8sR0FBRyxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUk7SUFDN0QsUUFBUSxFQUFFLFVBQVUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDO0lBQ2xDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxJQUFJLElBQUk7Q0FDM0IsQ0FBQyxDQUFBO0FBZFcsUUFBQSxXQUFXLGVBY3RCIn0=

package/.medusa/server/src/modules/plugin-features/domain/plugin-settings.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toStoredSettingValues = exports.missingSettingKeys = exports.isSealed = void 0;
+exports.normalizeSettingValue = normalizeSettingValue;
+exports.validateSettingsUpdate = validateSettingsUpdate;
+exports.mergeStoredSettings = mergeStoredSettings;
+exports.resolveSettingValues = resolveSettingValues;
+const utils_1 = require("@medusajs/framework/utils");
+const isHttpUrl = (value) => {
+    try {
+        const url = new URL(value);
+        return url.protocol === "http:" || url.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+};
+const isSealed = (value) => typeof value === "object" &&
+    value !== null &&
+    typeof value.enc === "string";
+exports.isSealed = isSealed;
+/**
+ * Normalizes `value` for `definition` or returns why it is invalid. Strings
+ * and URLs are trimmed; secrets are kept exactly as entered.
+ */
+function normalizeSettingValue(definition, value) {
+    switch (definition.type) {
+        case "string":
+        case "url": {
+            if (typeof value !== "string" || !value.trim()) {
+                return { ok: false, message: "muss ein nicht-leerer Text sein" };
+            }
+            const trimmed = value.trim();
+            if (definition.type === "url" && !isHttpUrl(trimmed)) {
+                return { ok: false, message: "muss eine http(s)-URL sein" };
+            }
+            return { ok: true, value: trimmed };
+        }
+        case "secret":
+            return typeof value === "string" && value.trim()
+                ? { ok: true, value }
+                : { ok: false, message: "muss ein nicht-leerer Text sein" };
+        case "number": {
+            if (typeof value !== "number" || !Number.isFinite(value)) {
+                return { ok: false, message: "muss eine endliche Zahl sein" };
+            }
+            if (definition.min !== undefined && value < definition.min) {
+                return { ok: false, message: `muss mindestens ${definition.min} sein` };
+            }
+            if (definition.max !== undefined && value > definition.max) {
+                return { ok: false, message: `darf höchstens ${definition.max} sein` };
+            }
+            return { ok: true, value };
+        }
+        case "select": {
+            const options = definition.options ?? [];
+            return typeof value === "string" &&
+                options.some((option) => option.value === value)
+                ? { ok: true, value }
+                : {
+                    ok: false,
+                    message: `muss einer der Werte ${options
+                        .map((option) => `"${option.value}"`)
+                        .join(", ")} sein`,
+                };
+        }
+        case "boolean":
+            return typeof value === "boolean"
+                ? { ok: true, value }
+                : { ok: false, message: "muss true oder false sein" };
+        default:
+            return { ok: false, message: "hat einen unbekannten Typ" };
+    }
+}
+const invalid = (pluginKey, message) => new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Ungültige Einstellungen für Plugin "${pluginKey}": ${message}`);
+/**
+ * Validates an Admin update against the declared settings. `null` clears a
+ * key; any other value is normalized. Throws `INVALID_DATA` naming the key.
+ */
+function validateSettingsUpdate(descriptor, values) {
+    const declared = new Map((descriptor.settings ?? []).map((setting) => [setting.key, setting]));
+    const unknown = Object.keys(values).filter((key) => !declared.has(key));
+    if (unknown.length) {
+        throw invalid(descriptor.plugin_key, `unbekannte Einstellungen ${unknown.map((key) => `"${key}"`).join(", ")}.`);
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(values)) {
+        if (value === null) {
+            result[key] = null;
+            continue;
+        }
+        const checked = normalizeSettingValue(declared.get(key), value);
+        if (!checked.ok) {
+            throw invalid(descriptor.plugin_key, `"${key}" ${checked.message}.`);
+        }
+        result[key] = checked.value;
+    }
+    return result;
+}
+const sameStored = (left, right) => (0, exports.isSealed)(left) || (0, exports.isSealed)(right) ? false : left === right;
+/**
+ * Applies a validated update to the stored values: `null` deletes, secrets
+ * are sealed, secrets not sent keep their stored value, keys the descriptor
+ * no longer declares are dropped. When a setting with `invalidates` changed,
+ * the stored values of the listed secrets are deleted too, unless the same
+ * update sets them anew. `changed_keys` lists every declared key whose
+ * stored value was set, replaced or removed (a re-sent secret counts), in
+ * declaration order.
+ */
+function mergeStoredSettings(descriptor, current, update, seal) {
+    const values = {};
+    const changed = [];
+    for (const definition of descriptor.settings ?? []) {
+        const key = definition.key;
+        const before = current[key];
+        if (!(key in update)) {
+            if (before !== undefined) {
+                values[key] = before;
+            }
+            continue;
+        }
+        const next = update[key];
+        if (next === null || next === undefined) {
+            if (before !== undefined) {
+                changed.push(key);
+            }
+            continue;
+        }
+        const stored = definition.type === "secret" ? { enc: seal(String(next), key) } : next;
+        values[key] = stored;
+        if (!sameStored(before, stored)) {
+            changed.push(key);
+        }
+    }
+    const invalidated = new Set();
+    for (const definition of descriptor.settings ?? []) {
+        if (!changed.includes(definition.key)) {
+            continue;
+        }
+        for (const target of definition.invalidates ?? []) {
+            const resent = update[target] !== null && update[target] !== undefined;
+            if (!resent && values[target] !== undefined) {
+                delete values[target];
+                invalidated.add(target);
+            }
+        }
+    }
+    const changedKeys = (descriptor.settings ?? [])
+        .map(({ key }) => key)
+        .filter((key) => changed.includes(key) || invalidated.has(key));
+    return { values, changed_keys: changedKeys };
+}
+/**
+ * Current value and source of every declared setting. Precedence:
+ * stored > config fallback > default > none. A stored or fallback value that
+ * no longer fits the declared type is skipped; `open` returns `undefined` for
+ * a stored secret that cannot be decrypted, which is then skipped as well.
+ */
+function resolveSettingValues(descriptor, stored, fallback, open) {
+    return (descriptor.settings ?? []).map((definition) => {
+        const key = definition.key;
+        const raw = stored[key];
+        if (raw !== undefined) {
+            const candidate = definition.type === "secret"
+                ? (0, exports.isSealed)(raw)
+                    ? open(key, raw.enc)
+                    : undefined
+                : (0, exports.isSealed)(raw)
+                    ? undefined
+                    : raw;
+            const checked = candidate === undefined
+                ? undefined
+                : normalizeSettingValue(definition, candidate);
+            if (checked?.ok) {
+                return { definition, source: "stored", value: checked.value };
+            }
+        }
+        const configured = fallback?.[key];
+        if (configured !== undefined && configured !== null && configured !== "") {
+            const checked = normalizeSettingValue(definition, configured);
+            if (checked.ok) {
+                return { definition, source: "config", value: checked.value };
+            }
+        }
+        if (definition.default !== undefined && definition.type !== "secret") {
+            return { definition, source: "default", value: definition.default };
+        }
+        return { definition, source: "none" };
+    });
+}
+/** Required settings without a value. */
+const missingSettingKeys = (resolved) => resolved
+    .filter((setting) => setting.definition.required === true && setting.source === "none")
+    .map((setting) => setting.definition.key);
+exports.missingSettingKeys = missingSettingKeys;
+/** Reads a persisted `values` column defensively. */
+const toStoredSettingValues = (raw) => {
+    const values = {};
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return values;
+    }
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value === "string" ||
+            typeof value === "boolean" ||
+            (typeof value === "number" && Number.isFinite(value)) ||
+            (0, exports.isSealed)(value)) {
+            values[key] = (0, exports.isSealed)(value) ? { enc: value.enc } : value;
+        }
+    }
+    return values;
+};
+exports.toStoredSettingValues = toStoredSettingValues;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLXNldHRpbmdzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vc3JjL21vZHVsZXMvcGx1Z2luLWZlYXR1cmVzL2RvbWFpbi9wbHVnaW4tc2V0dGluZ3MudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBMkNBLHNEQW1EQztBQVlELHdEQTRCQztBQWlCRCxrREFxREM7QUFRRCxvREF5Q0M7QUE3UEQscURBQXVEO0FBeUJ2RCxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWEsRUFBVyxFQUFFO0lBQzNDLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQzFCLE9BQU8sR0FBRyxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUE7SUFDOUQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFBO0lBQ2QsQ0FBQztBQUNILENBQUMsQ0FBQTtBQUVNLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUErQixFQUFFLENBQ3RFLE9BQU8sS0FBSyxLQUFLLFFBQVE7SUFDekIsS0FBSyxLQUFLLElBQUk7SUFDZCxPQUFRLEtBQTJCLENBQUMsR0FBRyxLQUFLLFFBQVEsQ0FBQTtBQUh6QyxRQUFBLFFBQVEsWUFHaUM7QUFFdEQ7OztHQUdHO0FBQ0gsU0FBZ0IscUJBQXFCLENBQ25DLFVBQW1DLEVBQ25DLEtBQWM7SUFFZCxRQUFRLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixLQUFLLFFBQVEsQ0FBQztRQUNkLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNYLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQy9DLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxpQ0FBaUMsRUFBRSxDQUFBO1lBQ2xFLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUE7WUFDNUIsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUNyRCxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQTtZQUM3RCxDQUFDO1lBQ0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFBO1FBQ3JDLENBQUM7UUFDRCxLQUFLLFFBQVE7WUFDWCxPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFO2dCQUM5QyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRTtnQkFDckIsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQTtRQUMvRCxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDZCxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDekQsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLDhCQUE4QixFQUFFLENBQUE7WUFDL0QsQ0FBQztZQUNELElBQUksVUFBVSxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDM0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLG1CQUFtQixVQUFVLENBQUMsR0FBRyxPQUFPLEVBQUUsQ0FBQTtZQUN6RSxDQUFDO1lBQ0QsSUFBSSxVQUFVLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxLQUFLLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUMzRCxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsa0JBQWtCLFVBQVUsQ0FBQyxHQUFHLE9BQU8sRUFBRSxDQUFBO1lBQ3hFLENBQUM7WUFDRCxPQUFPLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQTtRQUM1QixDQUFDO1FBQ0QsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQ2QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUE7WUFDeEMsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRO2dCQUM5QixPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxLQUFLLEtBQUssQ0FBQztnQkFDaEQsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUU7Z0JBQ3JCLENBQUMsQ0FBQztvQkFDRSxFQUFFLEVBQUUsS0FBSztvQkFDVCxPQUFPLEVBQUUsd0JBQXdCLE9BQU87eUJBQ3JDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxHQUFHLENBQUM7eUJBQ3BDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTztpQkFDckIsQ0FBQTtRQUNQLENBQUM7UUFDRCxLQUFLLFNBQVM7WUFDWixPQUFPLE9BQU8sS0FBSyxLQUFLLFNBQVM7Z0JBQy9CLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFO2dCQUNyQixDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxDQUFBO1FBQ3pEO1lBQ0UsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLDJCQUEyQixFQUFFLENBQUE7SUFDOUQsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLE9BQU8sR0FBRyxDQUFDLFNBQWlCLEVBQUUsT0FBZSxFQUFlLEVBQUUsQ0FDbEUsSUFBSSxtQkFBVyxDQUNiLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsdUNBQXVDLFNBQVMsTUFBTSxPQUFPLEVBQUUsQ0FDaEUsQ0FBQTtBQUVIOzs7R0FHRztBQUNILFNBQWdCLHNCQUFzQixDQUNwQyxVQUFtQyxFQUNuQyxNQUErQjtJQUUvQixNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FDdEIsQ0FBQyxVQUFVLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQ3JFLENBQUE7SUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7SUFDdkUsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxPQUFPLENBQ1gsVUFBVSxDQUFDLFVBQVUsRUFDckIsNEJBQTRCLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLElBQUksR0FBRyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FDM0UsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBbUIsRUFBRSxDQUFBO0lBQ2pDLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDbEQsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDbkIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQTtZQUNsQixTQUFRO1FBQ1YsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFFLEVBQUUsS0FBSyxDQUFDLENBQUE7UUFDaEUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNoQixNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLElBQUksR0FBRyxLQUFLLE9BQU8sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFBO1FBQ3RFLENBQUM7UUFDRCxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQTtJQUM3QixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDO0FBRUQsTUFBTSxVQUFVLEdBQUcsQ0FDakIsSUFBb0MsRUFDcEMsS0FBcUMsRUFDNUIsRUFBRSxDQUNYLElBQUEsZ0JBQVEsRUFBQyxJQUFJLENBQUMsSUFBSSxJQUFBLGdCQUFRLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQTtBQUU1RDs7Ozs7Ozs7R0FRRztBQUNILFNBQWdCLG1CQUFtQixDQUNqQyxVQUFtQyxFQUNuQyxPQUE0QixFQUM1QixNQUFzQixFQUN0QixJQUFnRDtJQUVoRCxNQUFNLE1BQU0sR0FBd0IsRUFBRSxDQUFBO0lBQ3RDLE1BQU0sT0FBTyxHQUFhLEVBQUUsQ0FBQTtJQUU1QixLQUFLLE1BQU0sVUFBVSxJQUFJLFVBQVUsQ0FBQyxRQUFRLElBQUksRUFBRSxFQUFFLENBQUM7UUFDbkQsTUFBTSxHQUFHLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQTtRQUMxQixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDM0IsSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDckIsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUE7WUFDdEIsQ0FBQztZQUNELFNBQVE7UUFDVixDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ3hCLElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEMsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3pCLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUE7WUFDbkIsQ0FBQztZQUNELFNBQVE7UUFDVixDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQ1YsVUFBVSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBO1FBQ3hFLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUE7UUFDcEIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNoQyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ25CLENBQUM7SUFDSCxDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQTtJQUNyQyxLQUFLLE1BQU0sVUFBVSxJQUFJLFVBQVUsQ0FBQyxRQUFRLElBQUksRUFBRSxFQUFFLENBQUM7UUFDbkQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEMsU0FBUTtRQUNWLENBQUM7UUFDRCxLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsQ0FBQyxXQUFXLElBQUksRUFBRSxFQUFFLENBQUM7WUFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssU0FBUyxDQUFBO1lBQ3RFLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM1QyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQTtnQkFDckIsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQTtZQUN6QixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxDQUFDLFVBQVUsQ0FBQyxRQUFRLElBQUksRUFBRSxDQUFDO1NBQzVDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNyQixNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksV0FBVyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO0lBRWpFLE9BQU8sRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxDQUFBO0FBQzlDLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQWdCLG9CQUFvQixDQUNsQyxVQUFtQyxFQUNuQyxNQUEyQixFQUMzQixRQUE0QyxFQUM1QyxJQUF5RDtJQUV6RCxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRTtRQUNwRCxNQUFNLEdBQUcsR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFBO1FBQzFCLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUN2QixJQUFJLEdBQUcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0QixNQUFNLFNBQVMsR0FDYixVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVE7Z0JBQzFCLENBQUMsQ0FBQyxJQUFBLGdCQUFRLEVBQUMsR0FBRyxDQUFDO29CQUNiLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUM7b0JBQ3BCLENBQUMsQ0FBQyxTQUFTO2dCQUNiLENBQUMsQ0FBQyxJQUFBLGdCQUFRLEVBQUMsR0FBRyxDQUFDO29CQUNiLENBQUMsQ0FBQyxTQUFTO29CQUNYLENBQUMsQ0FBQyxHQUFHLENBQUE7WUFDWCxNQUFNLE9BQU8sR0FDWCxTQUFTLEtBQUssU0FBUztnQkFDckIsQ0FBQyxDQUFDLFNBQVM7Z0JBQ1gsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsQ0FBQTtZQUNsRCxJQUFJLE9BQU8sRUFBRSxFQUFFLEVBQUUsQ0FBQztnQkFDaEIsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUE7WUFDL0QsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxRQUFRLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNsQyxJQUFJLFVBQVUsS0FBSyxTQUFTLElBQUksVUFBVSxLQUFLLElBQUksSUFBSSxVQUFVLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDekUsTUFBTSxPQUFPLEdBQUcscUJBQXFCLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFBO1lBQzdELElBQUksT0FBTyxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUNmLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFBO1lBQy9ELENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxVQUFVLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3JFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFBO1FBQ3JFLENBQUM7UUFFRCxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsQ0FBQTtJQUN2QyxDQUFDLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFFRCx5Q0FBeUM7QUFDbEMsTUFBTSxrQkFBa0IsR0FBRyxDQUNoQyxRQUEwQyxFQUNoQyxFQUFFLENBQ1osUUFBUTtLQUNMLE1BQU0sQ0FDTCxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUMvRTtLQUNBLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtBQVBoQyxRQUFBLGtCQUFrQixzQkFPYztBQUU3QyxxREFBcUQ7QUFDOUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLEdBQVksRUFBdUIsRUFBRTtJQUN6RSxNQUFNLE1BQU0sR0FBd0IsRUFBRSxDQUFBO0lBQ3RDLElBQUksQ0FBQyxHQUFHLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRCxPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUM7SUFDRCxLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQy9DLElBQ0UsT0FBTyxLQUFLLEtBQUssUUFBUTtZQUN6QixPQUFPLEtBQUssS0FBSyxTQUFTO1lBQzFCLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckQsSUFBQSxnQkFBUSxFQUFDLEtBQUssQ0FBQyxFQUNmLENBQUM7WUFDRCxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBQSxnQkFBUSxFQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQTtRQUM1RCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQyxDQUFBO0FBaEJZLFFBQUEscUJBQXFCLHlCQWdCakMifQ==

package/.medusa/server/src/modules/plugin-features/domain/secret-box.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretBinding = void 0;
+exports.sealSecret = sealSecret;
+exports.openSecret = openSecret;
+const node_crypto_1 = require("node:crypto");
+const HKDF_INFO = "hartl-base-plugin-settings";
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const deriveKey = (keyMaterial) => {
+    if (!keyMaterial) {
+        throw new Error("Schlüsselmaterial für geheime Einstellungen fehlt.");
+    }
+    return Buffer.from((0, node_crypto_1.hkdfSync)("sha256", keyMaterial, Buffer.alloc(0), HKDF_INFO, KEY_BYTES));
+};
+/**
+ * Additional authenticated data of one stored secret: binds the ciphertext to
+ * its plugin and setting key, so it cannot be moved to another key or plugin.
+ */
+const secretBinding = (pluginKey, settingKey) => `${pluginKey}:${settingKey}`;
+exports.secretBinding = secretBinding;
+/**
+ * AES-256-GCM with a key derived by HKDF-SHA256 from `keyMaterial` and
+ * `binding` (see `secretBinding`) as additional authenticated data. Returns
+ * base64 of `iv (12) | tag (16) | ciphertext`.
+ */
+function sealSecret(plaintext, keyMaterial, binding) {
+    const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-gcm", deriveKey(keyMaterial), iv);
+    cipher.setAAD(Buffer.from(binding, "utf8"));
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64");
+}
+/**
+ * Reverses `sealSecret`. Throws when the value was tampered with, is
+ * malformed, or was sealed with different key material or another binding
+ * (including values sealed without one).
+ */
+function openSecret(sealed, keyMaterial, binding) {
+    const raw = Buffer.from(sealed, "base64");
+    if (raw.length < IV_BYTES + TAG_BYTES) {
+        throw new Error("Verschlüsselter Wert ist unvollständig.");
+    }
+    const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", deriveKey(keyMaterial), raw.subarray(0, IV_BYTES));
+    decipher.setAAD(Buffer.from(binding, "utf8"));
+    decipher.setAuthTag(raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES));
+    return Buffer.concat([
+        decipher.update(raw.subarray(IV_BYTES + TAG_BYTES)),
+        decipher.final(),
+    ]).toString("utf8");
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LWJveC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uL3NyYy9tb2R1bGVzL3BsdWdpbi1mZWF0dXJlcy9kb21haW4vc2VjcmV0LWJveC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFpQ0EsZ0NBYUM7QUFPRCxnQ0FvQkM7QUF6RUQsNkNBS29CO0FBRXBCLE1BQU0sU0FBUyxHQUFHLDRCQUE0QixDQUFBO0FBQzlDLE1BQU0sUUFBUSxHQUFHLEVBQUUsQ0FBQTtBQUNuQixNQUFNLFNBQVMsR0FBRyxFQUFFLENBQUE7QUFDcEIsTUFBTSxTQUFTLEdBQUcsRUFBRSxDQUFBO0FBRXBCLE1BQU0sU0FBUyxHQUFHLENBQUMsV0FBbUIsRUFBVSxFQUFFO0lBQ2hELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUE7SUFDdkUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FDaEIsSUFBQSxzQkFBUSxFQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQ3ZFLENBQUE7QUFDSCxDQUFDLENBQUE7QUFFRDs7O0dBR0c7QUFDSSxNQUFNLGFBQWEsR0FBRyxDQUFDLFNBQWlCLEVBQUUsVUFBa0IsRUFBVSxFQUFFLENBQzdFLEdBQUcsU0FBUyxJQUFJLFVBQVUsRUFBRSxDQUFBO0FBRGpCLFFBQUEsYUFBYSxpQkFDSTtBQUU5Qjs7OztHQUlHO0FBQ0gsU0FBZ0IsVUFBVSxDQUN4QixTQUFpQixFQUNqQixXQUFtQixFQUNuQixPQUFlO0lBRWYsTUFBTSxFQUFFLEdBQUcsSUFBQSx5QkFBVyxFQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ2hDLE1BQU0sTUFBTSxHQUFHLElBQUEsNEJBQWMsRUFBQyxhQUFhLEVBQUUsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBQ3hFLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQTtJQUMzQyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQy9CLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQztRQUNoQyxNQUFNLENBQUMsS0FBSyxFQUFFO0tBQ2YsQ0FBQyxDQUFBO0lBQ0YsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtBQUNoRixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQWdCLFVBQVUsQ0FDeEIsTUFBYyxFQUNkLFdBQW1CLEVBQ25CLE9BQWU7SUFFZixNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUN6QyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEdBQUcsUUFBUSxHQUFHLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBSSxLQUFLLENBQUMseUNBQXlDLENBQUMsQ0FBQTtJQUM1RCxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsSUFBQSw4QkFBZ0IsRUFDL0IsYUFBYSxFQUNiLFNBQVMsQ0FBQyxXQUFXLENBQUMsRUFDdEIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQzFCLENBQUE7SUFDRCxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUE7SUFDN0MsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxRQUFRLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQTtJQUNqRSxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDbkIsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLFFBQVEsR0FBRyxTQUFTLENBQUMsQ0FBQztRQUNuRCxRQUFRLENBQUMsS0FBSyxFQUFFO0tBQ2pCLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUE7QUFDckIsQ0FBQyJ9

package/.medusa/server/src/modules/plugin-features/migrations/Migration20260928205031.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Migration20260928205031 = void 0;
+const migrations_1 = require("@medusajs/framework/mikro-orm/migrations");
+class Migration20260928205031 extends migrations_1.Migration {
+    async up() {
+        this.addSql(`create table if not exists "plugin_setting_state" ("id" text not null, "plugin_key" text not null, "values" jsonb not null, "version" integer not null default 1, "created_at" timestamptz not null default now(), "updated_at" timestamptz not null default now(), "deleted_at" timestamptz null, constraint "plugin_setting_state_pkey" primary key ("id"));`);
+        this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_plugin_setting_state_deleted_at" ON "plugin_setting_state" ("deleted_at") WHERE deleted_at IS NULL;`);
+        this.addSql(`CREATE UNIQUE INDEX IF NOT EXISTS "IDX_plugin_setting_state_plugin_key" ON "plugin_setting_state" ("plugin_key") WHERE deleted_at IS NULL;`);
+    }
+    async down() {
+        this.addSql(`drop table if exists "plugin_setting_state" cascade;`);
+    }
+}
+exports.Migration20260928205031 = Migration20260928205031;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiTWlncmF0aW9uMjAyNjA5MjgyMDUwMzEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9wbHVnaW4tZmVhdHVyZXMvbWlncmF0aW9ucy9NaWdyYXRpb24yMDI2MDkyODIwNTAzMS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSx5RUFBcUU7QUFFckUsTUFBYSx1QkFBd0IsU0FBUSxzQkFBUztJQUUzQyxLQUFLLENBQUMsRUFBRTtRQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsZ1dBQWdXLENBQUMsQ0FBQztRQUM5VyxJQUFJLENBQUMsTUFBTSxDQUFDLHFJQUFxSSxDQUFDLENBQUM7UUFDbkosSUFBSSxDQUFDLE1BQU0sQ0FBQyw0SUFBNEksQ0FBQyxDQUFDO0lBQzVKLENBQUM7SUFFUSxLQUFLLENBQUMsSUFBSTtRQUNqQixJQUFJLENBQUMsTUFBTSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztDQUVGO0FBWkQsMERBWUMifQ==

package/.medusa/server/src/modules/plugin-features/migrations/Migration20260928215428.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Migration20260928215428 = void 0;
+const migrations_1 = require("@medusajs/framework/mikro-orm/migrations");
+class Migration20260928215428 extends migrations_1.Migration {
+    async up() {
+        this.addSql(`create table if not exists "plugin_action_run" ("id" text not null, "plugin_key" text not null, "action_key" text not null, "status" text check ("status" in ('running', 'completed', 'failed')) not null, "started_at" timestamptz not null, "finished_at" timestamptz null, "triggered_by" text null, "message" text null, "progress" jsonb null, "result" jsonb null, "created_at" timestamptz not null default now(), "updated_at" timestamptz not null default now(), "deleted_at" timestamptz null, constraint "plugin_action_run_pkey" primary key ("id"));`);
+        this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_plugin_action_run_deleted_at" ON "plugin_action_run" ("deleted_at") WHERE deleted_at IS NULL;`);
+        this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_plugin_action_run_plugin_action_status" ON "plugin_action_run" ("plugin_key", "action_key", "status") WHERE deleted_at IS NULL;`);
+        this.addSql(`CREATE UNIQUE INDEX IF NOT EXISTS "IDX_plugin_action_run_single_running" ON "plugin_action_run" ("plugin_key", "action_key") WHERE status = 'running' AND deleted_at IS NULL;`);
+    }
+    async down() {
+        this.addSql(`drop table if exists "plugin_action_run" cascade;`);
+    }
+}
+exports.Migration20260928215428 = Migration20260928215428;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiTWlncmF0aW9uMjAyNjA5MjgyMTU0MjguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9wbHVnaW4tZmVhdHVyZXMvbWlncmF0aW9ucy9NaWdyYXRpb24yMDI2MDkyODIxNTQyOC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSx5RUFBcUU7QUFFckUsTUFBYSx1QkFBd0IsU0FBUSxzQkFBUztJQUUzQyxLQUFLLENBQUMsRUFBRTtRQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsb2lCQUFvaUIsQ0FBQyxDQUFDO1FBQ2xqQixJQUFJLENBQUMsTUFBTSxDQUFDLCtIQUErSCxDQUFDLENBQUM7UUFDN0ksSUFBSSxDQUFDLE1BQU0sQ0FBQyxpS0FBaUssQ0FBQyxDQUFDO1FBQy9LLElBQUksQ0FBQyxNQUFNLENBQUMsK0tBQStLLENBQUMsQ0FBQztJQUMvTCxDQUFDO0lBRVEsS0FBSyxDQUFDLElBQUk7UUFDakIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7Q0FFRjtBQWJELDBEQWFDIn0=

package/.medusa/server/src/modules/plugin-features/models/plugin-action-run.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * One run of a plugin action started through the base (sync or background).
+ * At most one `running` row per plugin action (partial unique index), which
+ * is what rejects a second start.
+ */
+const PluginActionRun = utils_1.model
+    .define({
+    name: "plugin_action_run",
+    tableName: "plugin_action_run",
+}, {
+    id: utils_1.model.id({ prefix: "plgrun" }).primaryKey(),
+    plugin_key: utils_1.model.text(),
+    action_key: utils_1.model.text(),
+    status: utils_1.model.enum(["running", "completed", "failed"]),
+    started_at: utils_1.model.dateTime(),
+    finished_at: utils_1.model.dateTime().nullable(),
+    /** Admin user id that started the run. */
+    triggered_by: utils_1.model.text().nullable(),
+    /** Error message of a failed run. */
+    message: utils_1.model.text().nullable(),
+    /** `{ current, total, label }` reported by the running workflow. */
+    progress: utils_1.model.json().nullable(),
+    /** Workflow result when it is JSON and at most 4 KB. */
+    result: utils_1.model.json().nullable(),
+})
+    .indexes([
+    {
+        name: "IDX_plugin_action_run_plugin_action_status",
+        on: ["plugin_key", "action_key", "status"],
+        where: "deleted_at IS NULL",
+    },
+    {
+        name: "IDX_plugin_action_run_single_running",
+        on: ["plugin_key", "action_key"],
+        unique: true,
+        where: "status = 'running' AND deleted_at IS NULL",
+    },
+]);
+exports.default = PluginActionRun;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWFjdGlvbi1ydW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9wbHVnaW4tZmVhdHVyZXMvbW9kZWxzL3BsdWdpbi1hY3Rpb24tcnVuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEscURBQWlEO0FBRWpEOzs7O0dBSUc7QUFDSCxNQUFNLGVBQWUsR0FBRyxhQUFLO0tBQzFCLE1BQU0sQ0FDTDtJQUNFLElBQUksRUFBRSxtQkFBbUI7SUFDekIsU0FBUyxFQUFFLG1CQUFtQjtDQUMvQixFQUNEO0lBQ0UsRUFBRSxFQUFFLGFBQUssQ0FBQyxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxVQUFVLEVBQUU7SUFDL0MsVUFBVSxFQUFFLGFBQUssQ0FBQyxJQUFJLEVBQUU7SUFDeEIsVUFBVSxFQUFFLGFBQUssQ0FBQyxJQUFJLEVBQUU7SUFDeEIsTUFBTSxFQUFFLGFBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3RELFVBQVUsRUFBRSxhQUFLLENBQUMsUUFBUSxFQUFFO0lBQzVCLFdBQVcsRUFBRSxhQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ3hDLDBDQUEwQztJQUMxQyxZQUFZLEVBQUUsYUFBSyxDQUFDLElBQUksRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNyQyxxQ0FBcUM7SUFDckMsT0FBTyxFQUFFLGFBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxRQUFRLEVBQUU7SUFDaEMsb0VBQW9FO0lBQ3BFLFFBQVEsRUFBRSxhQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ2pDLHdEQUF3RDtJQUN4RCxNQUFNLEVBQUUsYUFBSyxDQUFDLElBQUksRUFBRSxDQUFDLFFBQVEsRUFBRTtDQUNoQyxDQUNGO0tBQ0EsT0FBTyxDQUFDO0lBQ1A7UUFDRSxJQUFJLEVBQUUsNENBQTRDO1FBQ2xELEVBQUUsRUFBRSxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDO1FBQzFDLEtBQUssRUFBRSxvQkFBb0I7S0FDNUI7SUFDRDtRQUNFLElBQUksRUFBRSxzQ0FBc0M7UUFDNUMsRUFBRSxFQUFFLENBQUMsWUFBWSxFQUFFLFlBQVksQ0FBQztRQUNoQyxNQUFNLEVBQUUsSUFBSTtRQUNaLEtBQUssRUFBRSwyQ0FBMkM7S0FDbkQ7Q0FDRixDQUFDLENBQUE7QUFFSixrQkFBZSxlQUFlLENBQUEifQ==

package/.medusa/server/src/modules/plugin-features/models/plugin-setting-state.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * One row per plugin with the settings stored through the Admin. No row (or
+ * a missing key) means the setting falls back to medusa-config or its
+ * declared default.
+ */
+const PluginSettingState = utils_1.model
+    .define({
+    name: "plugin_setting_state",
+    tableName: "plugin_setting_state",
+}, {
+    id: utils_1.model.id({ prefix: "plgset" }).primaryKey(),
+    plugin_key: utils_1.model.text(),
+    /**
+     * `{ [settingKey]: string | number | boolean }`; a secret is stored as
+     * `{ enc: "<base64 iv|tag|ciphertext>" }`.
+     */
+    values: utils_1.model.json(),
+    version: utils_1.model.number().default(1),
+})
+    .indexes([
+    {
+        name: "IDX_plugin_setting_state_plugin_key",
+        on: ["plugin_key"],
+        unique: true,
+        where: "deleted_at IS NULL",
+    },
+]);
+exports.default = PluginSettingState;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLXNldHRpbmctc3RhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9wbHVnaW4tZmVhdHVyZXMvbW9kZWxzL3BsdWdpbi1zZXR0aW5nLXN0YXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEscURBQWlEO0FBRWpEOzs7O0dBSUc7QUFDSCxNQUFNLGtCQUFrQixHQUFHLGFBQUs7S0FDN0IsTUFBTSxDQUNMO0lBQ0UsSUFBSSxFQUFFLHNCQUFzQjtJQUM1QixTQUFTLEVBQUUsc0JBQXNCO0NBQ2xDLEVBQ0Q7SUFDRSxFQUFFLEVBQUUsYUFBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLFVBQVUsRUFBRTtJQUMvQyxVQUFVLEVBQUUsYUFBSyxDQUFDLElBQUksRUFBRTtJQUN4Qjs7O09BR0c7SUFDSCxNQUFNLEVBQUUsYUFBSyxDQUFDLElBQUksRUFBRTtJQUNwQixPQUFPLEVBQUUsYUFBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7Q0FDbkMsQ0FDRjtLQUNBLE9BQU8sQ0FBQztJQUNQO1FBQ0UsSUFBSSxFQUFFLHFDQUFxQztRQUMzQyxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUM7UUFDbEIsTUFBTSxFQUFFLElBQUk7UUFDWixLQUFLLEVBQUUsb0JBQW9CO0tBQzVCO0NBQ0YsQ0FBQyxDQUFBO0FBRUosa0JBQWUsa0JBQWtCLENBQUEifQ==