@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/src/framework/runPluginLifecycle.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Plugin lifecycle execution — extracted from createApp().
+ *
+ * Handles plugin dependency validation, topological sorting,
+ * and execution of the three framework lifecycle phases.
+ */
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { AppEnv, BunshotEventBus, BunshotPlugin } from '../../packages/bunshot-core/src/index.js';
+import type { FrameworkConfig } from './createInfrastructure';
+/**
+ * Validate the plugin dependency graph and return plugins in topological order.
+ * Throws on circular dependencies, missing dependencies, lifecycle-less plugins,
+ * and cross-phase dependency violations.
+ */
+export declare function validateAndSortPlugins(plugins: BunshotPlugin[]): BunshotPlugin[];
+/**
+ * Run the setupMiddleware phase for all sorted plugins.
+ */
+export declare function runPluginMiddleware(sortedPlugins: BunshotPlugin[], app: OpenAPIHono<AppEnv>, frameworkConfig: FrameworkConfig, bus: BunshotEventBus): Promise<void>;
+/**
+ * Run the setupRoutes phase for all sorted plugins.
+ */
+export declare function runPluginRoutes(sortedPlugins: BunshotPlugin[], app: OpenAPIHono<AppEnv>, frameworkConfig: FrameworkConfig, bus: BunshotEventBus): Promise<void>;
+/**
+ * Run the setupPost phase for all sorted plugins.
+ */
+export declare function runPluginPost(sortedPlugins: BunshotPlugin[], app: OpenAPIHono<AppEnv>, frameworkConfig: FrameworkConfig, bus: BunshotEventBus): Promise<void>;

package/dist/src/framework/runPluginLifecycle.js

@@ -0,0 +1,121 @@
+// ---------------------------------------------------------------------------
+// Topological sort
+// ---------------------------------------------------------------------------
+function topologicalSort(plugins) {
+    const nameToPlugin = new Map(plugins.map(p => [p.name, p]));
+    const completed = new Set();
+    const inProgress = new Set();
+    const result = [];
+    function visit(name, path) {
+        if (completed.has(name))
+            return;
+        if (inProgress.has(name)) {
+            const cycleStart = path.indexOf(name);
+            const cycle = [...path.slice(cycleStart), name];
+            throw new Error(`[bunshot] Circular plugin dependency detected: ${cycle.join(' → ')}`);
+        }
+        const plugin = nameToPlugin.get(name);
+        if (!plugin) {
+            throw new Error(`[bunshot] Plugin dependency "${name}" not found (required by "${path[path.length - 1] ?? 'root'}").`);
+        }
+        inProgress.add(name);
+        for (const dep of plugin.dependencies ?? []) {
+            visit(dep, [...path, name]);
+        }
+        inProgress.delete(name);
+        completed.add(name);
+        result.push(plugin);
+    }
+    for (const plugin of plugins) {
+        visit(plugin.name, []);
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Plugin validation
+// ---------------------------------------------------------------------------
+function getEarliestPhase(p) {
+    if (p.setupMiddleware)
+        return 0;
+    if (p.setupRoutes)
+        return 1;
+    if (p.setupPost)
+        return 2;
+    return 3; // setup-only (standalone)
+}
+const PHASE_NAMES = ['setupMiddleware', 'setupRoutes', 'setupPost', 'setup-only (standalone)'];
+/**
+ * Validate the plugin dependency graph and return plugins in topological order.
+ * Throws on circular dependencies, missing dependencies, lifecycle-less plugins,
+ * and cross-phase dependency violations.
+ */
+export function validateAndSortPlugins(plugins) {
+    if (plugins.length === 0)
+        return [];
+    const pluginNames = new Set(plugins.map(p => p.name));
+    const nameToPlugin = new Map(plugins.map(p => [p.name, p]));
+    for (const plugin of plugins) {
+        // Validate all declared dependencies are present
+        for (const dep of plugin.dependencies ?? []) {
+            if (!pluginNames.has(dep)) {
+                throw new Error(`[bunshot] Plugin "${plugin.name}" declares dependency "${dep}" but it is not in the plugins array.`);
+            }
+        }
+        // Each plugin must define at least one lifecycle method
+        if (!plugin.setupMiddleware && !plugin.setupRoutes && !plugin.setupPost && !plugin.setup) {
+            throw new Error(`[bunshot] Plugin "${plugin.name}" must define at least one of: setupMiddleware, setupRoutes, setupPost, or setup.`);
+        }
+        // setup()-only plugins are standalone-only — the framework skips them
+        if (!plugin.setupMiddleware && !plugin.setupRoutes && !plugin.setupPost && plugin.setup) {
+            console.info(`[bunshot] Plugin "${plugin.name}" defines only setup() — standalone-only, skipped by framework. Use setupMiddleware(), setupRoutes(), or setupPost() for framework integration.`);
+        }
+    }
+    // Cross-phase dependency validation
+    for (const plugin of plugins) {
+        const pluginPhase = getEarliestPhase(plugin);
+        if (pluginPhase === 3)
+            continue; // standalone-only: no framework phase to validate
+        for (const depName of plugin.dependencies ?? []) {
+            const dep = nameToPlugin.get(depName);
+            const depPhase = getEarliestPhase(dep);
+            if (depPhase > pluginPhase) {
+                throw new Error(`[bunshot] Plugin "${plugin.name}" (earliest phase: ${PHASE_NAMES[pluginPhase]}) ` +
+                    `depends on "${depName}" (earliest phase: ${PHASE_NAMES[depPhase]}). ` +
+                    `A dependency's earliest phase must be ≤ the dependent's earliest phase.`);
+            }
+        }
+    }
+    // Topological sort — only include plugins that participate in at least one framework phase
+    const frameworkPlugins = plugins.filter(p => p.setupMiddleware || p.setupRoutes || p.setupPost);
+    return topologicalSort(frameworkPlugins);
+}
+// ---------------------------------------------------------------------------
+// Plugin lifecycle execution
+// ---------------------------------------------------------------------------
+/**
+ * Run the setupMiddleware phase for all sorted plugins.
+ */
+export async function runPluginMiddleware(sortedPlugins, app, frameworkConfig, bus) {
+    for (const plugin of sortedPlugins) {
+        if (plugin.setupMiddleware)
+            await plugin.setupMiddleware(app, frameworkConfig, bus);
+    }
+}
+/**
+ * Run the setupRoutes phase for all sorted plugins.
+ */
+export async function runPluginRoutes(sortedPlugins, app, frameworkConfig, bus) {
+    for (const plugin of sortedPlugins) {
+        if (plugin.setupRoutes)
+            await plugin.setupRoutes(app, frameworkConfig, bus);
+    }
+}
+/**
+ * Run the setupPost phase for all sorted plugins.
+ */
+export async function runPluginPost(sortedPlugins, app, frameworkConfig, bus) {
+    for (const plugin of sortedPlugins) {
+        if (plugin.setupPost)
+            await plugin.setupPost(app, frameworkConfig, bus);
+    }
+}

package/dist/src/framework/secrets/frameworkSecretSchema.d.ts

@@ -0,0 +1,58 @@
+export declare const frameworkSecretSchema: {
+    readonly jwtSecret: {
+        readonly path: "JWT_SECRET";
+        readonly required: false;
+    };
+    readonly bearerToken: {
+        readonly path: "BEARER_TOKEN";
+        readonly required: false;
+    };
+    readonly dataEncryptionKey: {
+        readonly path: "BUNSHOT_DATA_ENCRYPTION_KEY";
+        readonly required: false;
+    };
+    readonly redisHost: {
+        readonly path: "REDIS_HOST";
+        readonly required: false;
+    };
+    readonly redisUser: {
+        readonly path: "REDIS_USER";
+        readonly required: false;
+    };
+    readonly redisPassword: {
+        readonly path: "REDIS_PASSWORD";
+        readonly required: false;
+    };
+    readonly mongoUser: {
+        readonly path: "MONGO_USER";
+        readonly required: false;
+    };
+    readonly mongoPassword: {
+        readonly path: "MONGO_PASSWORD";
+        readonly required: false;
+    };
+    readonly mongoHost: {
+        readonly path: "MONGO_HOST";
+        readonly required: false;
+    };
+    readonly mongoDb: {
+        readonly path: "MONGO_DB";
+        readonly required: false;
+    };
+    readonly mongoAuthUser: {
+        readonly path: "MONGO_AUTH_USER";
+        readonly required: false;
+    };
+    readonly mongoAuthPassword: {
+        readonly path: "MONGO_AUTH_PASSWORD";
+        readonly required: false;
+    };
+    readonly mongoAuthHost: {
+        readonly path: "MONGO_AUTH_HOST";
+        readonly required: false;
+    };
+    readonly mongoAuthDb: {
+        readonly path: "MONGO_AUTH_DB";
+        readonly required: false;
+    };
+};

package/dist/src/framework/secrets/frameworkSecretSchema.js

@@ -0,0 +1,20 @@
+export const frameworkSecretSchema = {
+    // Signing & encryption
+    jwtSecret: { path: 'JWT_SECRET', required: false },
+    bearerToken: { path: 'BEARER_TOKEN', required: false },
+    dataEncryptionKey: { path: 'BUNSHOT_DATA_ENCRYPTION_KEY', required: false },
+    // Redis
+    redisHost: { path: 'REDIS_HOST', required: false },
+    redisUser: { path: 'REDIS_USER', required: false },
+    redisPassword: { path: 'REDIS_PASSWORD', required: false },
+    // Mongo (primary / single mode)
+    mongoUser: { path: 'MONGO_USER', required: false },
+    mongoPassword: { path: 'MONGO_PASSWORD', required: false },
+    mongoHost: { path: 'MONGO_HOST', required: false },
+    mongoDb: { path: 'MONGO_DB', required: false },
+    // Mongo (auth — separate mode)
+    mongoAuthUser: { path: 'MONGO_AUTH_USER', required: false },
+    mongoAuthPassword: { path: 'MONGO_AUTH_PASSWORD', required: false },
+    mongoAuthHost: { path: 'MONGO_AUTH_HOST', required: false },
+    mongoAuthDb: { path: 'MONGO_AUTH_DB', required: false },
+};

package/dist/src/framework/secrets/index.d.ts

@@ -0,0 +1,9 @@
+export { resolveSecrets } from './resolveSecrets';
+export { frameworkSecretSchema } from './frameworkSecretSchema';
+export { resolveSecretBundle, resolveSecretRepo_fromInput, resolveSecretRepo, secretRepositoryFactories, } from './resolveSecretBundle';
+export type { SecretStoreConfig, SecretRepositoryFactories, SecretStoreInput, SecretStoreInfra, SecretRepoFactories, ResolvedSecretBundle, RegisteredSecretRepository, EnvSecretStoreConfig, SsmSecretStoreConfig, FileSecretStoreConfig, } from './resolveSecretBundle';
+export { createEnvSecretRepository } from './providers/envProvider';
+export { createSsmSecretRepository } from './providers/ssmProvider';
+export type { SsmProviderOptions } from './providers/ssmProvider';
+export { createFileSecretRepository } from './providers/fileProvider';
+export type { FileProviderOptions } from './providers/fileProvider';

package/dist/src/framework/secrets/index.js

@@ -0,0 +1,7 @@
+// Barrel export for framework secrets module
+export { resolveSecrets } from './resolveSecrets';
+export { frameworkSecretSchema } from './frameworkSecretSchema';
+export { resolveSecretBundle, resolveSecretRepo_fromInput, resolveSecretRepo, secretRepositoryFactories, } from './resolveSecretBundle';
+export { createEnvSecretRepository } from './providers/envProvider';
+export { createSsmSecretRepository } from './providers/ssmProvider';
+export { createFileSecretRepository } from './providers/fileProvider';

package/dist/src/framework/secrets/providers/envProvider.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Environment variable secret repository.
+ *
+ * Reads secrets from process.env. Covers:
+ * - Local .env files (loaded by Bun automatically)
+ * - GitHub Actions secrets (injected as env vars in CI)
+ * - Any platform that maps secrets to environment variables
+ *
+ * Factory pattern: closure-owned prefix, no module-level state.
+ */
+import type { ISecretRepository } from '../../../../packages/bunshot-core/src/index.js';
+export declare function createEnvSecretRepository(opts?: {
+    /** Optional prefix stripped from env var names (e.g., 'MYAPP_') */
+    prefix?: string;
+}): ISecretRepository;

package/dist/src/framework/secrets/providers/envProvider.js

@@ -0,0 +1,18 @@
+export function createEnvSecretRepository(opts) {
+    const prefix = opts?.prefix ?? '';
+    return {
+        name: 'env',
+        async get(key) {
+            return process.env[prefix + key] ?? null;
+        },
+        async getMany(keys) {
+            const result = new Map();
+            for (const key of keys) {
+                const val = process.env[prefix + key];
+                if (val !== undefined)
+                    result.set(key, val);
+            }
+            return result;
+        },
+    };
+}

package/dist/src/framework/secrets/providers/fileProvider.d.ts

@@ -0,0 +1,8 @@
+import type { ISecretRepository } from '../../../../packages/bunshot-core/src/index.js';
+export interface FileProviderOptions {
+    /** Directory containing secret files (e.g., '/run/secrets') */
+    directory: string;
+    /** File extension to strip when deriving key names. Default: none. */
+    extension?: string;
+}
+export declare function createFileSecretRepository(opts: FileProviderOptions): ISecretRepository;

package/dist/src/framework/secrets/providers/fileProvider.js

@@ -0,0 +1,82 @@
+/**
+ * File-based secret repository.
+ *
+ * Reads secrets from individual files in a directory. Each file name is the
+ * secret key, file content is the secret value (trailing newline trimmed).
+ *
+ * Use cases:
+ * - Docker Swarm secrets mounted at /run/secrets/
+ * - Kubernetes mounted secret volumes
+ * - Any file-based secret injection
+ *
+ * Factory pattern: closure-owned cache + directory ref, no module-level state.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+export function createFileSecretRepository(opts) {
+    const { directory, extension } = opts;
+    // Closure-owned cache — populated on initialize(), keyed by secret name
+    const cache = new Map();
+    let initialized = false;
+    function stripExtension(filename) {
+        if (extension && filename.endsWith(extension)) {
+            return filename.slice(0, -extension.length);
+        }
+        return filename;
+    }
+    async function readSecret(key) {
+        const filename = extension ? key + extension : key;
+        try {
+            const content = await readFile(join(directory, filename), 'utf-8');
+            return content.replace(/\n$/, '');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    }
+    return {
+        name: 'file',
+        async initialize() {
+            try {
+                const files = await readdir(directory);
+                for (const file of files) {
+                    const key = stripExtension(file);
+                    const content = await readFile(join(directory, file), 'utf-8');
+                    cache.set(key, content.replace(/\n$/, ''));
+                }
+                initialized = true;
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    throw new Error(`[secrets/file] Directory not found: ${directory}`);
+                }
+                throw err;
+            }
+        },
+        async get(key) {
+            if (initialized)
+                return cache.get(key) ?? null;
+            return readSecret(key);
+        },
+        async getMany(keys) {
+            const result = new Map();
+            for (const key of keys) {
+                const value = initialized ? (cache.get(key) ?? null) : await readSecret(key);
+                if (value !== null)
+                    result.set(key, value);
+            }
+            return result;
+        },
+        async refresh() {
+            cache.clear();
+            initialized = false;
+            await this.initialize?.();
+        },
+        async destroy() {
+            cache.clear();
+            initialized = false;
+        },
+    };
+}

package/dist/src/framework/secrets/providers/ssmProvider.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AWS Systems Manager Parameter Store secret repository.
+ *
+ * Batch-loads parameters by path prefix on initialize(), caches locally.
+ * Lazy SDK import — @aws-sdk/client-ssm is only loaded when this repository is used.
+ *
+ * Factory pattern: closure-owned cache + client, no module-level state.
+ */
+import type { ISecretRepository } from '../../../../packages/bunshot-core/src/index.js';
+export interface SsmProviderOptions {
+    /** SSM path prefix, e.g., '/myapp/prod/' — must end with '/' */
+    pathPrefix: string;
+    /** AWS region. Defaults to AWS_REGION env var or 'us-east-1'. */
+    region?: string;
+    /** Cache TTL in milliseconds. Default: 300_000 (5 min). */
+    cacheTtlMs?: number;
+    /** Whether to decrypt SecureString params. Default: true. */
+    withDecryption?: boolean;
+}
+export declare function createSsmSecretRepository(opts: SsmProviderOptions): ISecretRepository;

package/dist/src/framework/secrets/providers/ssmProvider.js

@@ -0,0 +1,127 @@
+export function createSsmSecretRepository(opts) {
+    const { pathPrefix, region, withDecryption = true } = opts;
+    const cacheTtl = opts.cacheTtlMs ?? 300_000;
+    // Closure-owned state — no module globals
+    const cache = new Map();
+    let ssmClient = null;
+    async function requireSsm() {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-implied-eval
+            return await new Function('specifier', 'return import(specifier)')('@aws-sdk/client-ssm');
+        }
+        catch {
+            throw new Error('SSM secret repository requires @aws-sdk/client-ssm to be installed');
+        }
+    }
+    async function getClient() {
+        if (ssmClient)
+            return ssmClient;
+        const { SSMClient } = await requireSsm();
+        ssmClient = new SSMClient({ region: region ?? process.env.AWS_REGION ?? 'us-east-1' });
+        return ssmClient;
+    }
+    function stripPrefix(name) {
+        return name.startsWith(pathPrefix) ? name.slice(pathPrefix.length) : name;
+    }
+    function getCached(key) {
+        const entry = cache.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt <= Date.now()) {
+            cache.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    function setCache(key, value) {
+        cache.set(key, { value, expiresAt: Date.now() + cacheTtl });
+    }
+    return {
+        name: 'ssm',
+        async initialize() {
+            const client = await getClient();
+            const { GetParametersByPathCommand } = await requireSsm();
+            let nextToken;
+            do {
+                const cmd = new GetParametersByPathCommand({
+                    Path: pathPrefix,
+                    Recursive: true,
+                    WithDecryption: withDecryption,
+                    NextToken: nextToken,
+                });
+                const resp = await client.send(cmd);
+                for (const param of resp.Parameters ?? []) {
+                    if (param.Name && param.Value) {
+                        setCache(stripPrefix(param.Name), param.Value);
+                    }
+                }
+                nextToken = resp.NextToken;
+            } while (nextToken);
+        },
+        async get(key) {
+            const cached = getCached(key);
+            if (cached !== null)
+                return cached;
+            const client = await getClient();
+            const { GetParameterCommand } = await requireSsm();
+            try {
+                const cmd = new GetParameterCommand({
+                    Name: pathPrefix + key,
+                    WithDecryption: withDecryption,
+                });
+                const resp = await client.send(cmd);
+                const value = resp.Parameter?.Value ?? null;
+                if (value !== null)
+                    setCache(key, value);
+                return value;
+            }
+            catch (err) {
+                if (err.name === 'ParameterNotFound')
+                    return null;
+                throw err;
+            }
+        },
+        async getMany(keys) {
+            const result = new Map();
+            const uncached = [];
+            for (const key of keys) {
+                const cached = getCached(key);
+                if (cached !== null) {
+                    result.set(key, cached);
+                }
+                else {
+                    uncached.push(key);
+                }
+            }
+            if (uncached.length > 0) {
+                const client = await getClient();
+                const { GetParametersCommand } = await requireSsm();
+                // GetParameters supports max 10 names per call
+                for (let i = 0; i < uncached.length; i += 10) {
+                    const batch = uncached.slice(i, i + 10);
+                    const cmd = new GetParametersCommand({
+                        Names: batch.map(k => pathPrefix + k),
+                        WithDecryption: withDecryption,
+                    });
+                    const resp = await client.send(cmd);
+                    for (const param of resp.Parameters ?? []) {
+                        if (param.Name && param.Value) {
+                            const key = stripPrefix(param.Name);
+                            setCache(key, param.Value);
+                            result.set(key, param.Value);
+                        }
+                    }
+                }
+            }
+            return result;
+        },
+        async refresh() {
+            cache.clear();
+            await this.initialize?.();
+        },
+        async destroy() {
+            cache.clear();
+            ssmClient = null;
+        },
+    };
+}

package/dist/src/framework/secrets/resolveSecretBundle.d.ts

@@ -0,0 +1,53 @@
+import type { ISecretRepository, ResolvedSecrets, SecretSchema, SecretStoreType } from '../../../packages/bunshot-core/src/index.js';
+import { frameworkSecretSchema } from './frameworkSecretSchema';
+/** Infrastructure options for secret store resolution — equivalent to StoreInfra */
+export interface SecretStoreInfra {
+    readonly prefix?: string;
+    readonly pathPrefix?: string;
+    readonly region?: string;
+    readonly directory?: string;
+    readonly extension?: string;
+    readonly cacheTtlMs?: number;
+    readonly withDecryption?: boolean;
+}
+export type SecretRepoFactories<T> = Record<SecretStoreType, (infra: SecretStoreInfra) => T | Promise<T>>;
+export declare function resolveSecretRepo<T>(factories: SecretRepoFactories<T>, storeType: SecretStoreType, infra: SecretStoreInfra): T | Promise<T>;
+export interface EnvSecretStoreConfig {
+    provider: 'env';
+    prefix?: string;
+    schema?: SecretSchema;
+}
+export interface SsmSecretStoreConfig {
+    provider: 'ssm';
+    pathPrefix: string;
+    region?: string;
+    schema?: SecretSchema;
+}
+export interface FileSecretStoreConfig {
+    provider: 'file';
+    directory: string;
+    schema?: SecretSchema;
+}
+export interface RegisteredSecretRepository {
+    provider: ISecretRepository;
+    schema?: SecretSchema;
+}
+export type SecretStoreConfig = EnvSecretStoreConfig | SsmSecretStoreConfig | FileSecretStoreConfig;
+export type SecretStoreInput = ISecretRepository | SecretStoreConfig | RegisteredSecretRepository | undefined;
+type MergeSchemas<A extends SecretSchema, B extends SecretSchema | undefined> = B extends SecretSchema ? A & B : A;
+type SecretRepoFactory<K extends SecretStoreType> = (config: Extract<SecretStoreConfig, {
+    provider: K;
+}>) => Promise<ISecretRepository> | ISecretRepository;
+export type SecretRepositoryFactories = {
+    [K in SecretStoreType]: SecretRepoFactory<K>;
+};
+export declare const secretRepositoryFactories: SecretRepositoryFactories;
+export interface ResolvedSecretBundle<S extends SecretSchema | undefined = undefined> {
+    readonly provider: ISecretRepository;
+    readonly framework: ResolvedSecrets<typeof frameworkSecretSchema>;
+    readonly app: S extends SecretSchema ? ResolvedSecrets<S> : null;
+    readonly merged: ResolvedSecrets<MergeSchemas<typeof frameworkSecretSchema, S>>;
+}
+export declare function resolveSecretRepo_fromInput(input: SecretStoreInput): Promise<ISecretRepository>;
+export declare function resolveSecretBundle<S extends SecretSchema | undefined = undefined>(input: SecretStoreInput): Promise<ResolvedSecretBundle<S>>;
+export {};

package/dist/src/framework/secrets/resolveSecretBundle.js

@@ -0,0 +1,84 @@
+import { frameworkSecretSchema } from './frameworkSecretSchema';
+import { createEnvSecretRepository } from './providers/envProvider';
+import { resolveSecrets } from './resolveSecrets';
+export function resolveSecretRepo(factories, storeType, infra) {
+    const factory = factories[storeType];
+    if (!factory)
+        throw new Error(`[secrets] Unsupported store type: ${storeType}`);
+    return factory(infra);
+}
+export const secretRepositoryFactories = {
+    env: config => createEnvSecretRepository({ prefix: config.prefix }),
+    ssm: async (config) => {
+        const { createSsmSecretRepository } = await import('./providers/ssmProvider');
+        return createSsmSecretRepository({
+            pathPrefix: config.pathPrefix,
+            region: config.region,
+        });
+    },
+    file: async (config) => {
+        const { createFileSecretRepository } = await import('./providers/fileProvider');
+        return createFileSecretRepository({ directory: config.directory });
+    },
+};
+function isSecretRepository(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    return 'name' in value && 'get' in value && 'getMany' in value;
+}
+function isRegisteredSecretRepository(value) {
+    if (!value || typeof value !== 'object' || !('provider' in value))
+        return false;
+    const provider = value.provider;
+    return !!provider && isSecretRepository(provider);
+}
+function getAppSecretSchema(input) {
+    if (!input || isSecretRepository(input))
+        return undefined;
+    if (isRegisteredSecretRepository(input))
+        return input.schema;
+    return input.schema;
+}
+function mergeSecretSchemas(frameworkSchema, appSchema) {
+    if (!appSchema) {
+        return frameworkSchema;
+    }
+    return {
+        ...frameworkSchema,
+        ...appSchema,
+    };
+}
+function pickResolvedSecrets(resolved, schema) {
+    const picked = {};
+    for (const key of Object.keys(schema)) {
+        picked[key] = resolved[key];
+    }
+    return Object.freeze(picked);
+}
+export async function resolveSecretRepo_fromInput(input) {
+    if (!input)
+        return createEnvSecretRepository();
+    if (isSecretRepository(input))
+        return input;
+    if (isRegisteredSecretRepository(input))
+        return input.provider;
+    const factory = secretRepositoryFactories[input.provider];
+    if (!factory) {
+        throw new Error(`[secrets] Unsupported provider type: ${input.provider}`);
+    }
+    return await factory(input);
+}
+export async function resolveSecretBundle(input) {
+    const provider = await resolveSecretRepo_fromInput(input);
+    const appSchema = getAppSecretSchema(input);
+    const mergedSchema = mergeSecretSchemas(frameworkSecretSchema, appSchema);
+    const merged = await resolveSecrets(provider, mergedSchema);
+    return {
+        provider,
+        framework: pickResolvedSecrets(merged, frameworkSecretSchema),
+        app: (appSchema
+            ? pickResolvedSecrets(merged, appSchema)
+            : null),
+        merged,
+    };
+}