@integrity-labs/agt-cli 0.28.593 → 0.28.595

package/dist/{chunk-BYCE4V7Q.js → chunk-RC6V6QN2.js}

@@ -1,9 +1,18 @@
+import {
+  LATE_BOUND_VARS,
+  buildLiveHeaderRemoteMcpProxyEntry,
+  buildNativeMcpEntry,
+  buildOAuthRemoteMcpProxyEntry,
+  buildRemoteMcpEntry,
+  expandTemplateVars,
+  isolationMode,
+  parseEnvIntegrations
+} from "./chunk-6NVRWZ5W.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   INTEGRATION_REGISTRY,
-  LATE_BOUND_VARS,
   MIN_PROVISIONING_MAX_FOR_QUARANTINE_ORDERING,
   OAUTH_PROVIDERS,
   REMOTE_MCP_PROXY_ENV,
@@ -16,23 +25,16 @@ import {
   bestConnectivityEvidence,
   buildForwardHeaders,
   buildIntegrationsSection,
-  buildLiveHeaderRemoteMcpProxyEntry,
-  buildNativeMcpEntry,
-  buildOAuthRemoteMcpProxyEntry,
-  buildRemoteMcpEntry,
   coerceEnvValue,
-  expandTemplateVars,
   generateClaudeMd,
   getFlagDefinition,
   getFramework,
   handshakeToolsListOutcome,
   isControlPlaneOnlyConfigKey,
   isDefaultRemoteMcpConnection,
-  isolationMode,
   listFlagDefinitions,
   mcpWildcardsForServers,
   normalizeFlagValue,
-  parseEnvIntegrations,
   probeComposioAccount,
   probeComposioMcpToolCall,
   probeHttpProvider,
@@ -46,7 +48,7 @@ import {
   resolveConnectivityProbe,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-TKWDYMM3.js";
+} from "./chunk-3PNRUCHD.js";
 import {
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
@@ -627,9 +629,6 @@ function writeXurlStoreForIntegrations(integrations, filePath = getXurlStorePath
   return filePath;
 }
 
-// ../../packages/core/dist/crypto/secret.js
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-
 // ../../packages/core/dist/crypto/envelope.js
 import { createHash } from "crypto";
 
@@ -869,10 +868,23 @@ function parseEnvelope(encoded) {
 function contextString(ctx) {
   return `org:${ctx.orgId}:${ctx.table}:${ctx.column}:${ctx.field}:${ctx.rowId}`;
 }
+var DIRECT_COLUMN_FIELD_SENTINEL = "";
+function buildDecryptContext(coords, runtime) {
+  return {
+    orgId: runtime.orgId,
+    table: coords.table,
+    column: coords.column,
+    field: coords.field ?? DIRECT_COLUMN_FIELD_SENTINEL,
+    rowId: runtime.rowId
+  };
+}
 function buildAad(headerBytes, ctx) {
   return Buffer.concat([headerBytes, Buffer.from(contextString(ctx), "utf8")]);
 }
 
+// ../../packages/core/dist/crypto/secret.js
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
 // ../../packages/core/dist/crypto/keyring.js
 var ACTIVE_ENV = "AUTH_ENCRYPTION_KEY";
 var PREVIOUS_ENV = "AUTH_ENCRYPTION_KEY_PREVIOUS";
@@ -982,12 +994,16 @@ var SENSITIVE_INTEGRATION_FIELDS = [
   "client_secret",
   "private_key"
 ];
-function decryptIntegrationCredentials(credentials) {
+var SENSITIVE_SET = new Set(SENSITIVE_INTEGRATION_FIELDS);
+function integrationCredentialsFieldContext(row, field) {
+  return buildDecryptContext({ table: row.table, column: "credentials", field }, { orgId: row.orgId, rowId: row.rowId });
+}
+function decryptIntegrationCredentials(credentials, row) {
   const out = { ...credentials };
   for (const field of SENSITIVE_INTEGRATION_FIELDS) {
     const value = out[field];
     if (typeof value === "string" && value && isEncrypted(value)) {
-      out[field] = decryptSecret(value);
+      out[field] = decryptSecret(value, row ? integrationCredentialsFieldContext(row, field) : void 0);
     }
   }
   return out;
@@ -5971,7 +5987,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.593" : "dev";
+var agtCliVersion = true ? "0.28.595" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -9416,4 +9432,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-BYCE4V7Q.js.map
+//# sourceMappingURL=chunk-RC6V6QN2.js.map