@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/routes/webhooks.js

@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { randomUUID } from 'node:crypto';
+import { Hono } from 'hono';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Webhook triggers — fire a flow run when an HMAC-signed request
+ * arrives at the receiver URL.
+ *
+ * Seven admin routes on this file. The unauthenticated external
+ * receiver is not part of this router.
+ *
+ * Admin URLs use `:triggerId` (the row id) for consistency with
+ * schedules and event-triggers. Response bodies include `webhookId`
+ * (the routable identifier) so clients can compose the receiver URL.
+ *
+ * HMAC secrets — never plaintext on this row. The register body
+ * carries `hmacSecretName`, a handle into the tenant secrets store the
+ * caller wrote to first via `POST /v1/secrets`. Rotation flows through
+ * `POST /v1/secrets/:name/rotate` — trigger row untouched.
+ */
+export function webhooksRouter(binding) {
+    const r = new Hono();
+    // ---------- POST / (register) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const parsed = await parseJsonObject(c, requestId);
+        if (parsed.kind === 'err')
+            return parsed.response;
+        const body = parsed.value;
+        const flowId = requireString(body, 'flowId');
+        const flowVersion = requireString(body, 'flowVersion');
+        const hmacSecretName = requireString(body, 'hmacSecretName');
+        if (flowId.kind === 'err')
+            return bad(c, requestId, flowId.message);
+        if (flowVersion.kind === 'err')
+            return bad(c, requestId, flowVersion.message);
+        if (hmacSecretName.kind === 'err')
+            return bad(c, requestId, hmacSecretName.message);
+        const rawConfig = (body.config ?? {});
+        // Route mints the webhookId — a random UUID, returned so the caller
+        // learns the receiver URL from the response.
+        const webhookId = randomUUID();
+        const registerInput = {
+            kind: 'webhook',
+            tenantId,
+            flowId: flowId.value,
+            flowVersion: flowVersion.value,
+            config: {
+                ...('input' in rawConfig && { input: rawConfig.input }),
+            },
+            webhookId,
+            hmacSecretName: hmacSecretName.value,
+            ...(typeof body.label === 'string' && body.label.length > 0 && { label: body.label }),
+        };
+        const result = await binding.register(registerInput);
+        if (result.kind === 'err') {
+            c.status(statusFor(result.error.code));
+            return c.json(toWireError({ code: result.error.code, message: result.error.message }, requestId));
+        }
+        c.status(201);
+        return c.json(serializeWebhook(result.value));
+    });
+    // ---------- GET / (list) ----------
+    r.get('/', async (c) => {
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const statusRaw = c.req.query('status');
+        let statusFilter;
+        if (statusRaw === 'active' || statusRaw === 'paused')
+            statusFilter = statusRaw;
+        const page = await binding.list({
+            tenantId,
+            kind: 'webhook',
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(statusFilter !== undefined && { status: statusFilter }),
+        });
+        return c.json({
+            data: page.data.map((row) => serializeWebhook(row)),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:triggerId (get) ----------
+    r.get('/:triggerId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const triggerId = c.req.param('triggerId');
+        const rec = await binding.get({ tenantId, triggerId });
+        if (rec === null || rec.kind !== 'webhook')
+            return notFound(c, requestId, triggerId);
+        return c.json(serializeWebhook(rec));
+    });
+    // ---------- PATCH /:triggerId (update) ----------
+    r.patch('/:triggerId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const triggerId = c.req.param('triggerId');
+        const parsed = await parseJsonObject(c, requestId);
+        if (parsed.kind === 'err')
+            return parsed.response;
+        const body = parsed.value;
+        const patchConfig = body.config;
+        const cfg = {};
+        if (patchConfig !== undefined && 'input' in patchConfig)
+            cfg.input = patchConfig.input;
+        const updateInput = {
+            kind: 'webhook',
+            tenantId,
+            triggerId,
+            ...(Object.keys(cfg).length > 0 && { config: cfg }),
+            ...('label' in body && { label: body.label === null ? null : body.label }),
+            ...(typeof body.flowVersion === 'string' && { flowVersion: body.flowVersion }),
+        };
+        const result = await binding.update(updateInput);
+        if (result.kind === 'err') {
+            c.status(statusFor(result.error.code));
+            return c.json(toWireError({
+                code: result.error.code,
+                message: result.error.message,
+                triggerId: triggerId,
+            }, requestId));
+        }
+        return c.json(serializeWebhook(result.value));
+    });
+    // ---------- POST /:triggerId/pause ----------
+    r.post('/:triggerId/pause', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const triggerId = c.req.param('triggerId');
+        const result = await binding.pause({ tenantId, triggerId });
+        if (result.kind === 'err')
+            return lifecycleError(c, requestId, result.error, triggerId);
+        return c.json(serializeWebhook(result.value));
+    });
+    // ---------- POST /:triggerId/resume ----------
+    r.post('/:triggerId/resume', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const triggerId = c.req.param('triggerId');
+        const result = await binding.resume({ tenantId, triggerId });
+        if (result.kind === 'err')
+            return lifecycleError(c, requestId, result.error, triggerId);
+        return c.json(serializeWebhook(result.value));
+    });
+    // ---------- POST /:triggerId/unregister (soft delete) ----------
+    r.post('/:triggerId/unregister', async (c) => {
+        const tenantId = c.get('tenantId');
+        const triggerId = c.req.param('triggerId');
+        const outcome = await binding.unregister({ tenantId, triggerId });
+        return c.json({
+            triggerId: triggerId,
+            unregistered: outcome.unregistered,
+        });
+    });
+    return r;
+}
+function serializeWebhook(r) {
+    return {
+        triggerId: r.triggerId,
+        webhookId: r.webhookId,
+        flowId: r.flowId,
+        flowVersion: r.flowVersion,
+        ...(r.config.input !== undefined && { input: r.config.input }),
+        hmacSecretName: r.hmacSecretName,
+        label: r.label,
+        status: r.status,
+        lastFiredAt: r.lastFiredAt,
+        createdAt: r.createdAt,
+        updatedAt: r.updatedAt,
+    };
+}
+async function parseJsonObject(c, requestId) {
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        c.status(statusFor('bad-input'));
+        return {
+            kind: 'err',
+            response: c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId)),
+        };
+    }
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        c.status(statusFor('bad-input'));
+        return {
+            kind: 'err',
+            response: c.json(toWireError({ code: 'bad-input', message: 'Request body must be a JSON object' }, requestId)),
+        };
+    }
+    return { kind: 'ok', value: body };
+}
+function requireString(obj, path) {
+    const parts = path.split('.');
+    let cur = obj;
+    for (const part of parts) {
+        if (cur === null || typeof cur !== 'object') {
+            return { kind: 'err', message: `\`${path}\` is required` };
+        }
+        cur = cur[part];
+    }
+    if (typeof cur !== 'string' || cur.length === 0) {
+        return { kind: 'err', message: `\`${path}\` is required` };
+    }
+    return { kind: 'ok', value: cur };
+}
+function bad(c, requestId, message) {
+    c.status(statusFor('bad-input'));
+    return c.json(toWireError({ code: 'bad-input', message }, requestId));
+}
+function notFound(c, requestId, triggerId) {
+    c.status(statusFor('trigger-not-found'));
+    return c.json(toWireError({
+        code: 'trigger-not-found',
+        message: `No trigger with id "${triggerId}"`,
+        triggerId: triggerId,
+    }, requestId));
+}
+function lifecycleError(c, requestId, error, triggerId) {
+    c.status(statusFor(error.code));
+    return c.json(toWireError({ code: error.code, message: error.message, triggerId: triggerId }, requestId));
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/routes/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/routes/webhooks.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,OAA+B;IAC5D,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;QAE1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9E,IAAI,cAAc,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QAEpF,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;QACjE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAgC;YACjD,IAAI,EAAE,SAAS;YACf,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,MAAM,EAAE;gBACN,GAAG,CAAC,OAAO,IAAI,SAAS,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aACxD;YACD,SAAS;YACT,cAAc,EAAE,cAAc,CAAC,KAAK;YACpC,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,YAA6C,CAAC;QAClD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ;YAAE,YAAY,GAAG,SAAS,CAAC;QAE/E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAA2B,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAc,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAc,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAA6C,CAAC;QACvE,MAAM,GAAG,GAAgC,EAAE,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,IAAI,WAAW;YAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEvF,MAAM,WAAW,GAA8B;YAC7C,IAAI,EAAE,SAAS;YACf,QAAQ;YACR,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAgB,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SAC/E,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,SAAS,EAAE,SAA8B;aAC1C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAc,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAc,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAc,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,SAA8B;YACzC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAuB;IAC/C,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAKD,KAAK,UAAU,eAAe,CAC5B,CAAkB,EAClB,SAAiB;IAEjB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,CAAC,CAAC,IAAI,CACd,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,CAAC,CAAC,IAAI,CACd,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,EACpE,SAAS,CACV,CACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAA+B,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CACpB,GAAY,EACZ,IAAY;IAIZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,gBAAgB,EAAE,CAAC;QAC7D,CAAC;QACD,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAkB,EAAE,SAAiB,EAAE,OAAe;IACjE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAkB,EAAE,SAAiB,EAAE,SAAoB;IAC3E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,uBAAuB,SAA8B,GAAG;QACjE,SAAS,EAAE,SAA8B;KAC1C,EACD,SAAS,CACV,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,CAAkB,EAClB,SAAiB,EACjB,KAA0D,EAC1D,SAAoB;IAEpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,SAA8B,EAAE,EACvF,SAAS,CACV,CACF,CAAC;AACJ,CAAC"}

package/dist/s3-credential-binding.d.ts

@@ -0,0 +1,54 @@
+import type { TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for AWS-style credentials that authenticate
+ * against the S3-compat `/s3/*` wire surface. Mirrors the
+ * `TokenResolver` shape (auth.ts): resolve an `accessKeyId` to a
+ * `S3Credential`, or `null` for missing / expired / revoked.
+ *
+ * Every deployment owns credential issuance out-of-band (an admin
+ * route or an operator console). This binding only resolves; it
+ * does not mint. Deployments typically issue credentials paired 1-to-1
+ * with a bucket + tenant.
+ *
+ * The SigV4 middleware calls `resolve(accessKeyId)` on every request,
+ * uses `secretKey` to recompute the expected signature, and if the
+ * comparison passes, sets `c.set('tenantId', credential.tenantId)` +
+ * `c.set('bucket', credential.bucket)` for downstream routes. The
+ * caller-supplied bucket in the URL is compared to `credential.bucket`
+ * — mismatch → `403 AccessDenied` (bucket-scoped credentials).
+ *
+ * ## Scope classification
+ *
+ * S3 credentials are a policy/config-scoped resource. This binding
+ * does not carry the uniform `{ scope?: Scope, inherit?: boolean }`
+ * filter fields because it exposes only a runtime-bound
+ * `resolve(accessKeyId)` entry-point — no `list()` / `*ListInput` /
+ * filter surface. The Scope discipline still applies to stored
+ * credentials (each carries a tenant / org / project scope, like MCP
+ * endpoints), and a `list()` method — if added for an admin plane —
+ * must gain the same `{ scope?: Scope, inherit?: boolean }` shape
+ * (policy/config semantics: `inherit` load-bearing). There is no admin
+ * list surface.
+ */
+export type S3CredentialBinding = {
+    resolve(accessKeyId: string): Promise<S3Credential | null>;
+};
+export interface S3Credential {
+    /** Long-form secret paired with `accessKeyId`; used to recompute SigV4. */
+    readonly secretKey: string;
+    /** Which tenant this credential belongs to. */
+    readonly tenantId: TenantId;
+    /**
+     * Which bucket this credential is authorized for. One bucket per
+     * credential. Requests for other buckets return `403 AccessDenied`.
+     * The `artifacts` bucket is where bespoke uploads conventionally land
+     * — credentials granted this bucket see bespoke uploads too.
+     */
+    readonly bucket: string;
+    /**
+     * Optional expiration. If set and past, the middleware treats the
+     * credential as expired even if this resolver returned it.
+     */
+    readonly expiresAt?: Date;
+}
+//# sourceMappingURL=s3-credential-binding.d.ts.map

package/dist/s3-credential-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-credential-binding.d.ts","sourceRoot":"","sources":["../src/s3-credential-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B"}

package/dist/s3-credential-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=s3-credential-binding.js.map

package/dist/s3-credential-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-credential-binding.js","sourceRoot":"","sources":["../src/s3-credential-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/secrets-binding.d.ts

@@ -0,0 +1,281 @@
+import type { TupleEnqueueHook } from '@kindgi/authz';
+import type { Scope } from '@kindgi/platform';
+import type { Cursor, EnvName, Result } from '@kindgi/types';
+/**
+ * Secret names starting with this prefix are reserved for framework-internal
+ * material (e.g. webhook HMAC keys the runtime manages). `SecretBinding.set` rejects them
+ * from callers unless the adapter was constructed to allow reserved names.
+ * Every adapter enforces the same prefix — import it, don't redefine it.
+ */
+export declare const RESERVED_SECRET_NAME_PREFIX = "kindgi.";
+/**
+ * Caller-plugged secret store — the framework consumer's surface for
+ * every secret-lifecycle op. Every method is scope + env-scoped, where
+ * `scope` is the discriminated primitive from `@kindgi/platform`
+ * (Tenant / Org / Project). Writes declare the scope explicitly; reads
+ * resolve via most-specific-wins walk across the scope hierarchy.
+ *
+ * Callers (routes, runtime dispatch, SDK clients) speak this interface
+ * ONLY. Concrete storage — envelope-encrypted bytes in a database,
+ * delegation to an external secret manager, etc. — is a `SecretBinding`
+ * implementation choice.
+ *
+ * Wire-safety: plaintext is returned only by `resolve`. `SecretRecord`
+ * carries no value, and `SecretVersionRecord.value` is always `null`
+ * from `getVersion` / `listVersions`. All list / get paths return
+ * metadata only. This is a STRUCTURAL guardrail of the interface, not
+ * a caller convention.
+ *
+ * Env-safety: cross-env reads are refused. A caller in `envName:
+ * staging` cannot resolve a secret written under `envName: production`
+ * — adapter returns `secret-not-found` (indistinguishable from
+ * "doesn't exist" by design; refuses to leak the existence of a
+ * cross-env sibling).
+ */
+export interface SecretBinding {
+    /** Cursor-paginated list of secret metadata. Never returns `value`. */
+    list(input: SecretListInput): Promise<SecretListPage>;
+    /** Fetch metadata for a single secret. `null` when unknown. */
+    get(input: SecretGetInput): Promise<SecretRecord | null>;
+    /**
+     * Resolve a secret's plaintext value at dispatch time. Distinct
+     * method from `get` — different capability gate, different audit
+     * event, different rate profile. Called by the runtime (handler
+     * dispatch, deploy-time sync, boot — see `ResolveContext.caller`),
+     * not by the HTTP routes. Emits a `secret-resolved` compliance-evidence
+     * event on every call.
+     */
+    resolve(input: SecretResolveInput): Promise<Result<SecretResolveOutcome, SecretError>>;
+    /** Metadata for a specific version. */
+    getVersion(input: SecretGetVersionInput): Promise<SecretVersionRecord | null>;
+    /** List all versions for a secret. Metadata only. */
+    listVersions(input: SecretListVersionsInput): Promise<SecretVersionPage>;
+    /**
+     * Create a secret OR write a new version. `writeMode` discriminates:
+     *   - `'create-new'` fails with `already-exists` if the secret exists
+     *   - `'add-version'` writes a new version, bumps counter atomically
+     */
+    set(input: SecretSetInput): Promise<SecretSetOutcome>;
+    /**
+     * Explicit rotation. Adapters that support caller-driven rotation
+     * accept `newValue`; provider-driven rotation (a secret manager's own
+     * rotation workflow) ignores it and returns the new version once the
+     * provider workflow completes. Emits a `secret-rotated` event.
+     */
+    rotate(input: SecretRotateInput): Promise<Result<SecretRotateOutcome, SecretError>>;
+    /**
+     * Revoke a secret. Retains the record (soft-delete) so audit trails
+     * remain resolvable; adapters MUST return `null` from `get` /
+     * `resolve` for revoked secrets. `hard: true` performs irreversible
+     * destroy for GDPR right-to-erasure. Emits a `secret-revoked` event.
+     */
+    revoke(input: SecretRevokeInput): Promise<Result<SecretRevokeOutcome, SecretError>>;
+}
+export interface SecretRecord {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly currentVersion: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly revokedAt?: string;
+    readonly revokeReason?: string;
+    readonly tags?: Readonly<Record<string, string>>;
+    readonly rotationDueAt?: string;
+}
+export interface SecretVersionRecord {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly versionId: number;
+    readonly createdAt: string;
+    /**
+     * Always `null` from `getVersion` / `listVersions`; plaintext comes only
+     * from `resolve` (`SecretResolveOutcome.value`).
+     */
+    readonly value: string | null;
+    readonly revokedAt?: string;
+}
+export interface SecretListInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    readonly namePrefix?: string;
+    readonly tagFilter?: Readonly<Record<string, string>>;
+    readonly includeRevoked?: boolean;
+}
+export interface SecretListPage {
+    readonly data: readonly SecretRecord[];
+    readonly nextCursor?: Cursor;
+}
+export interface SecretGetInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+}
+export interface SecretResolveInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly version?: number;
+    readonly resolveContext: ResolveContext;
+}
+/**
+ * Uniform across `EnvBinding.resolve` + `SecretBinding.resolve`.
+ * Names the caller of the resolution for audit-emit attribution.
+ *
+ * Declared here (rather than in a separate module) because the
+ * `SecretBinding` interface is the larger of the two — env-binding.ts
+ * imports the type back from this module to keep the ownership flow
+ * one-directional (env → secrets, not both).
+ */
+export interface ResolveContext {
+    readonly runId?: string;
+    readonly deploymentId?: string;
+    readonly nodeId?: string;
+    readonly caller: 'dispatch' | 'deploy-sync' | 'admin-cli' | 'boot-bridge';
+}
+export interface SecretResolveOutcome {
+    readonly name: string;
+    readonly versionId: number;
+    readonly value: string;
+}
+export interface SecretGetVersionInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly versionId: number;
+}
+export interface SecretListVersionsInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+}
+export interface SecretVersionPage {
+    readonly data: readonly SecretVersionRecord[];
+    readonly nextCursor?: Cursor;
+}
+export interface SecretSetInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly value: string;
+    readonly writeMode: 'create-new' | 'add-version';
+    readonly tags?: Readonly<Record<string, string>>;
+    readonly rotationDueAt?: string;
+    readonly ifVersion?: number;
+    /**
+     * REQUIRED. Called inside the binding's write tx on FRESH insert
+     * (writeMode: 'create-new' → new secret identity). Receives the new
+     * secret's id as the FGA subject id. Returns tuples for
+     * the same tx — typically `tuplesForCreate({kind:'secret', id,
+     * tenantId, scope}, creatorUserId?)`. Not invoked on `add-version`
+     * (identity already exists in FGA). See `AgentPublishInput.enqueueTuples`
+     * for the design rationale.
+     */
+    readonly enqueueTuples: TupleEnqueueHook;
+}
+export type SecretSetOutcome = {
+    readonly kind: 'ok';
+    readonly record: SecretRecord;
+    readonly versionId: number;
+} | {
+    readonly kind: 'already-exists';
+    readonly record: SecretRecord;
+} | {
+    readonly kind: 'version-conflict';
+    readonly currentVersion: number;
+} | {
+    readonly kind: 'error';
+    readonly code: string;
+    readonly message: string;
+};
+export interface SecretRotateInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly newValue?: string;
+    readonly revokeOldAfterMs?: number;
+}
+/**
+ * Discriminated `SecretRotateOutcome`.
+ *
+ * Sync providers (stores that write the new version immediately)
+ * return `{ kind: 'ok', newVersionId, oldVersionId, oldVersionRevokedAt? }`
+ * inline. The `/v1/secrets` HTTP route translates this to a 201
+ * response.
+ *
+ * Async providers (a secret manager whose rotation workflow completes
+ * later) return `{ kind: 'rotation-pending', resumeToken, provider }`.
+ * The HTTP route mints a `rotationId`, records it in the caller-plugged
+ * `RotationStatusStore`, and returns 202 with `{ rotationId, statusUrl,
+ * eventsUrl }`. `resumeToken` is the provider-native handle a
+ * background process uses to poll the async workflow to terminal.
+ */
+export type SecretRotateOutcome = {
+    readonly kind: 'ok';
+    readonly newVersionId: number;
+    readonly oldVersionId: number;
+    readonly oldVersionRevokedAt?: string;
+} | {
+    readonly kind: 'rotation-pending';
+    readonly resumeToken: string;
+    readonly provider: string;
+};
+export interface SecretRevokeInput {
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly hard?: boolean;
+    readonly reason?: string;
+}
+export interface SecretRevokeOutcome {
+    readonly revoked: boolean;
+    readonly hard: boolean;
+}
+export type SecretError = {
+    readonly code: 'secret-not-found';
+    readonly message: string;
+    readonly name: string;
+} | {
+    readonly code: 'secret-revoked';
+    readonly message: string;
+    readonly name: string;
+} | {
+    readonly code: 'secret-version-not-found';
+    readonly message: string;
+    readonly name: string;
+    readonly versionId: number;
+} | {
+    readonly code: 'secret-encryption-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'secret-decryption-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'secret-provider-unavailable';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'secret-provider-unauthorized';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'secret-provider-rate-limited';
+    readonly message: string;
+    readonly retryAfterMs?: number;
+} | {
+    readonly code: 'secret-write-conflict';
+    readonly message: string;
+    readonly currentVersion: number;
+} | {
+    readonly code: 'secret-store-error';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+//# sourceMappingURL=secrets-binding.d.ts.map

package/dist/secrets-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-binding.d.ts","sourceRoot":"","sources":["../src/secrets-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,aAAa;IAG5B,uEAAuE;IACvE,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtD,+DAA+D;IAC/D,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEvF,uCAAuC;IACvC,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAE9E,qDAAqD;IACrD,YAAY,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAIzE;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEtD;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;CACrF;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,YAAY,GAAG,aAAa,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;CAC1C;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC"}

package/dist/secrets-binding.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Secret names starting with this prefix are reserved for framework-internal
+ * material (e.g. webhook HMAC keys the runtime manages). `SecretBinding.set` rejects them
+ * from callers unless the adapter was constructed to allow reserved names.
+ * Every adapter enforces the same prefix — import it, don't redefine it.
+ */
+export const RESERVED_SECRET_NAME_PREFIX = 'kindgi.';
+//# sourceMappingURL=secrets-binding.js.map

package/dist/secrets-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-binding.js","sourceRoot":"","sources":["../src/secrets-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAMjC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC"}