@kici-dev/shared 0.1.22 → 0.1.24

package/dist/db-admin.d.ts

@@ -221,10 +221,13 @@ export interface SeedEnvironmentBindingOpts {
     orgId: string;
     envName: string;
     scopePattern: string;
+    /** Host selector; defaults to `'**'` (all hosts). */
+    hostPattern?: string;
 }
 /**
- * Upsert an `environment_bindings` row connecting `envName` to `scopePattern`.
- * Throws if the environment does not exist.
+ * Upsert an `environment_bindings` row connecting `envName` to `scopePattern`
+ * (scoped to `hostPattern`, default `'**'`). Throws if the environment does
+ * not exist.
  */
 export declare function seedEnvironmentBindingDirect(databaseUrl: string, opts: SeedEnvironmentBindingOpts): Promise<{
     created: boolean;
@@ -275,6 +278,7 @@ export interface EnvironmentVariableRow {
 }
 export interface EnvironmentBindingRow {
     scope_pattern: string;
+    host_pattern: string;
     created_at: string;
 }
 export interface ShowEnvironmentResult {
@@ -399,6 +403,8 @@ export interface ExecutionJobRow {
     duration_ms: number | null;
     created_at: string;
     error_message: string | null;
+    /** Ordered bound deployment-environment names (JSON-encoded `string[]`), or null. */
+    environments: string | null;
 }
 export interface ListExecutionRunsOpts {
     routingKey?: string;

package/dist/db-admin.js

@@ -433,8 +433,9 @@ async function deleteEnvironmentDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Upsert an `environment_bindings` row connecting `envName` to `scopePattern`.
-* Throws if the environment does not exist.
+* Upsert an `environment_bindings` row connecting `envName` to `scopePattern`
+* (scoped to `hostPattern`, default `'**'`). Throws if the environment does
+* not exist.
 */
 async function seedEnvironmentBindingDirect(databaseUrl, opts) {
 	const pool = new pg.Pool({
@@ -445,13 +446,14 @@ async function seedEnvironmentBindingDirect(databaseUrl, opts) {
 		const envRow = await pool.query(`SELECT id FROM environments WHERE org_id = $1 AND name = $2`, [opts.orgId, opts.envName]);
 		if (envRow.rows.length === 0) throw new Error(`environment: not found (org=${opts.orgId}, name=${opts.envName})`);
 		const envId = envRow.rows[0].id;
-		return { created: (await pool.query(`INSERT INTO environment_bindings (org_id, environment_id, scope_pattern)
-         VALUES ($1, $2, $3)
+		return { created: (await pool.query(`INSERT INTO environment_bindings (org_id, environment_id, scope_pattern, host_pattern)
+         VALUES ($1, $2, $3, $4)
          ON CONFLICT DO NOTHING
          RETURNING (xmax = 0) AS inserted`, [
 			opts.orgId,
 			envId,
-			opts.scopePattern
+			opts.scopePattern,
+			opts.hostPattern ?? "**"
 		])).rows[0]?.inserted ?? false };
 	} finally {
 		await pool.end();
@@ -537,10 +539,10 @@ async function showEnvironmentDirect(databaseUrl, opts) {
          FROM environment_variables
         WHERE environment_id = $1
         ORDER BY key`, [env.id]);
-		const bindings = await pool.query(`SELECT scope_pattern, created_at
+		const bindings = await pool.query(`SELECT scope_pattern, host_pattern, created_at
          FROM environment_bindings
         WHERE environment_id = $1
-        ORDER BY scope_pattern`, [env.id]);
+        ORDER BY scope_pattern, host_pattern`, [env.id]);
 		return {
 			environment: env,
 			variables: variables.rows,
@@ -780,7 +782,7 @@ async function showExecutionRunDirect(databaseUrl, opts) {
 		return {
 			run,
 			jobs: (await pool.query(`SELECT id, run_id, job_id, job_name, status, agent_id,
-              started_at, completed_at, duration_ms, created_at, error_message
+              started_at, completed_at, duration_ms, created_at, error_message, environments
          FROM execution_jobs
         WHERE run_id = $1
         ORDER BY created_at ASC`, [run.run_id])).rows
@@ -797,7 +799,8 @@ async function listExecutionJobsDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
 		return { jobs: (await pool.query(`SELECT j.id, j.run_id, j.job_id, j.job_name, j.status, j.agent_id,
-              j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message
+              j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message,
+              j.environments
          FROM execution_jobs j
          INNER JOIN execution_runs r ON r.run_id = j.run_id
         WHERE r.run_id::text = $1 OR r.id::text = $1

package/dist/index.d.ts

@@ -1,8 +1,10 @@
 export * from '@kici-dev/core';
+export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from './secret-crypto.js';
 export { RingBuffer } from './ring-buffer.js';
 export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
 export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
+export { isPgUniqueViolation } from './pg-errors.js';
 export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';

package/dist/index.js

@@ -2,9 +2,11 @@ import "./chunk-BTugEXQM.js";
 import { createDb, createPool } from "./db.js";
 import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
+import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
 import { MAX_LOG_BYTES, addLogsToArchive, redactConfig } from "./diagnostics/bundle-archive.js";
 import { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer } from "./diagnostics/bundle-chunks.js";
+import { isPgUniqueViolation } from "./pg-errors.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
 import { createHealthRoutes } from "./routes/health.js";
 import { getReconnectDelay } from "./reconnect-delay.js";
@@ -24,4 +26,4 @@ import { ChunkLru } from "./cold-store/lru.js";
 import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/dist/pg-errors.d.ts

@@ -0,0 +1,8 @@
+/**
+ * True iff `err` is a Postgres unique-violation, optionally scoped to a named
+ * constraint. Pure guard over `unknown` — no `pg` import — so callers in the
+ * data layer can translate a raw driver error into a domain error, and it can
+ * be unit-tested without a live database.
+ */
+export declare function isPgUniqueViolation(err: unknown, constraint?: string): boolean;
+//# sourceMappingURL=pg-errors.d.ts.map

package/dist/pg-errors.js

@@ -0,0 +1,21 @@
+import "./chunk-BTugEXQM.js";
+//#region src/pg-errors.ts
+/** Postgres SQLSTATE for a unique-violation. */
+const PG_UNIQUE_VIOLATION = "23505";
+/**
+* True iff `err` is a Postgres unique-violation, optionally scoped to a named
+* constraint. Pure guard over `unknown` — no `pg` import — so callers in the
+* data layer can translate a raw driver error into a domain error, and it can
+* be unit-tested without a live database.
+*/
+function isPgUniqueViolation(err, constraint) {
+	if (typeof err !== "object" || err === null) return false;
+	const e = err;
+	if (e.code !== PG_UNIQUE_VIOLATION) return false;
+	if (constraint !== void 0 && e.constraint !== constraint) return false;
+	return true;
+}
+//#endregion
+export { isPgUniqueViolation };
+
+//# sourceMappingURL=pg-errors.js.map

package/dist/pg-errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pg-errors.test.d.ts.map

package/dist/secret-crypto.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Encrypted value with key version tracking.
+ * The data field contains base64-encoded IV || AuthTag || Ciphertext.
+ */
+export interface EncryptedValue {
+    /** Base64-encoded IV + auth tag + ciphertext. */
+    data: string;
+    /** Version of the encryption key used. */
+    keyVersion: number;
+}
+/**
+ * Encrypt a plaintext string using AES-256-GCM with AAD.
+ *
+ * @param plaintext - The string to encrypt
+ * @param key - 32-byte encryption key
+ * @param keyVersion - Version number for key rotation tracking
+ * @param aad - Additional authenticated data (e.g., "contextId:keyName")
+ * @returns Encrypted value with key version
+ */
+export declare function encrypt(plaintext: string, key: Buffer, keyVersion: number, aad: string): EncryptedValue;
+/**
+ * Decrypt an encrypted value using AES-256-GCM with AAD verification.
+ *
+ * @param encrypted - The encrypted value to decrypt
+ * @param key - 32-byte encryption key (must match the key used for encryption)
+ * @param aad - Additional authenticated data (must match the AAD used for encryption)
+ * @returns Decrypted plaintext string
+ * @throws If decryption fails (wrong key, wrong AAD, tampered data)
+ */
+export declare function decrypt(encrypted: EncryptedValue, key: Buffer, aad: string): string;
+/**
+ * Derive a 32-byte encryption key from a string input.
+ *
+ * Accepts two formats:
+ * - 64-character hex string (e.g., from generateMasterKey())
+ * - Base64-encoded 32-byte key
+ *
+ * @param input - Hex or base64 encoded key material
+ * @returns 32-byte Buffer suitable for use with encrypt/decrypt
+ * @throws If the derived key is not exactly 32 bytes
+ */
+export declare function deriveKey(input: string): Buffer;
+/**
+ * Generate a new random 32-byte master key as a hex string.
+ *
+ * @returns 64-character hex string suitable for KICI_SECRET_KEY env var
+ */
+export declare function generateMasterKey(): string;
+//# sourceMappingURL=secret-crypto.d.ts.map

package/dist/secret-crypto.js

@@ -0,0 +1,92 @@
+import "./chunk-BTugEXQM.js";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+//#region src/secret-crypto.ts
+/**
+* AES-256-GCM encryption layer for secrets management.
+*
+* Provides authenticated encryption with additional data (AAD)
+* to prevent cross-context secret swaps. The AAD is typically
+* "contextId:keyName" binding the ciphertext to its location.
+*
+* Wire format (base64 encoded): IV (12 bytes) || AuthTag (16 bytes) || Ciphertext
+*/
+/** Length of the initialization vector in bytes. */
+const IV_LENGTH = 12;
+/** Length of the GCM authentication tag in bytes. */
+const TAG_LENGTH = 16;
+/** Algorithm identifier for Node.js crypto. */
+const ALGO = "aes-256-gcm";
+/**
+* Encrypt a plaintext string using AES-256-GCM with AAD.
+*
+* @param plaintext - The string to encrypt
+* @param key - 32-byte encryption key
+* @param keyVersion - Version number for key rotation tracking
+* @param aad - Additional authenticated data (e.g., "contextId:keyName")
+* @returns Encrypted value with key version
+*/
+function encrypt(plaintext, key, keyVersion, aad) {
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv(ALGO, key, iv, { authTagLength: TAG_LENGTH });
+	cipher.setAAD(Buffer.from(aad, "utf-8"));
+	const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		data: Buffer.concat([
+			iv,
+			authTag,
+			encrypted
+		]).toString("base64"),
+		keyVersion
+	};
+}
+/**
+* Decrypt an encrypted value using AES-256-GCM with AAD verification.
+*
+* @param encrypted - The encrypted value to decrypt
+* @param key - 32-byte encryption key (must match the key used for encryption)
+* @param aad - Additional authenticated data (must match the AAD used for encryption)
+* @returns Decrypted plaintext string
+* @throws If decryption fails (wrong key, wrong AAD, tampered data)
+*/
+function decrypt(encrypted, key, aad) {
+	const packed = Buffer.from(encrypted.data, "base64");
+	if (packed.length < 28) throw new Error("Invalid encrypted data: too short");
+	const iv = packed.subarray(0, IV_LENGTH);
+	const authTag = packed.subarray(IV_LENGTH, 28);
+	const ciphertext = packed.subarray(28);
+	const decipher = createDecipheriv(ALGO, key, iv, { authTagLength: TAG_LENGTH });
+	decipher.setAuthTag(authTag);
+	decipher.setAAD(Buffer.from(aad, "utf-8"));
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
+}
+/**
+* Derive a 32-byte encryption key from a string input.
+*
+* Accepts two formats:
+* - 64-character hex string (e.g., from generateMasterKey())
+* - Base64-encoded 32-byte key
+*
+* @param input - Hex or base64 encoded key material
+* @returns 32-byte Buffer suitable for use with encrypt/decrypt
+* @throws If the derived key is not exactly 32 bytes
+*/
+function deriveKey(input) {
+	let key;
+	if (/^[0-9a-fA-F]{64}$/.test(input)) key = Buffer.from(input, "hex");
+	else key = Buffer.from(input, "base64");
+	if (key.length !== 32) throw new Error(`Encryption key must be exactly 32 bytes, got ${key.length} bytes. Provide a 64-character hex string or a base64-encoded 32-byte value.`);
+	return key;
+}
+/**
+* Generate a new random 32-byte master key as a hex string.
+*
+* @returns 64-character hex string suitable for KICI_SECRET_KEY env var
+*/
+function generateMasterKey() {
+	return randomBytes(32).toString("hex");
+}
+//#endregion
+export { decrypt, deriveKey, encrypt, generateMasterKey };
+
+//# sourceMappingURL=secret-crypto.js.map

package/dist/secret-crypto.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-crypto.test.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -70,6 +70,10 @@
       "import": "./dist/db-collation.js",
       "types": "./dist/db-collation.d.ts"
     },
+    "./secret-crypto": {
+      "import": "./dist/secret-crypto.js",
+      "types": "./dist/secret-crypto.d.ts"
+    },
     "./package-manager": {
       "import": "./dist/package-manager.js",
       "types": "./dist/package-manager.d.ts"
@@ -101,7 +105,7 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.22"
+    "@kici-dev/core": "0.1.24"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.7.1",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/shared@0.1.22",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.22/4ad51631-4f2e-44f4-b188-501f882737e9",
+  "name": "@kici-dev/shared@0.1.24",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.1.24/6bcbb358-8666-476c-a539-39b29265ee1b",
   "creationInfo": {
-    "created": "2026-06-24T06:02:52Z",
+    "created": "2026-06-28T16:24:12Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -696,9 +696,9 @@
       "homepage": "https://js-sdsl.org"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.24",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -709,7 +709,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.24"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
@@ -718,7 +718,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -729,7 +729,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.24"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -5202,32 +5202,32 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -5238,7 +5238,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {