@lssm/lib.contracts-integrations 9.0.1

package/dist/integrations/sales-intelligence/operations.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineCommand as P,defineQuery as o}from"@lssm/lib.contracts-spec/operations";import{defineCommand as U}from"@lssm/lib.contracts-spec/operations";import{defaultRestPath as D}from"@lssm/lib.contracts-spec/jsonschema";var a="1.0.0";function m(e){return D(e,a)}function T(e){return`${e.replace(/\./g,"_")}-v1_0_0`}function d(e){return`fullenrich_${e}-v1_0_0`}import{ScalarTypeEnum as f,SchemaModel as E}from"@lssm/lib.schema";var y=f.JSONObject(),A=f.String_unsecure(),l=f.NonEmptyString(),p=new E({name:"FullEnrichResultInput",fields:{connectionId:{type:l,isOptional:!1},jobId:{type:l,isOptional:!1},correlationId:{type:l,isOptional:!0}}}),_=new E({name:"FullEnrichWebhookInput",fields:{connectionId:{type:l,isOptional:!1},headers:{type:y,isOptional:!0},payload:{type:y,isOptional:!1},receivedAt:{type:f.DateTime(),isOptional:!0}}}),s=new E({name:"FullEnrichReceiptOutput",fields:{providerKey:{type:l,isOptional:!1},jobId:{type:l,isOptional:!0},correlationId:{type:l,isOptional:!0},status:{type:A,isOptional:!1},data:{type:y,isOptional:!0},rawRedacted:{type:y,isOptional:!0}}}),M=new E({name:"FullEnrichRemoteMcpOutput",fields:{providerKey:{type:l,isOptional:!1},url:{type:l,isOptional:!1},auth:{type:l,isOptional:!1},toolCategories:{type:A,isOptional:!1,isArray:!0}}});var L="sales-intelligence.fullenrich.contact.enrichment.cancel",j=U({meta:{key:L,version:a,title:"Cancel FullEnrich Contact Enrichment",description:"Cancel a pending FullEnrich contact enrichment job.",goal:"Stop pending credit-bearing work when the provider still permits it.",context:"Cancellation is terminal and requires scoped human approval.",owners:["@platform.integrations"],tags:["sales-intelligence","fullenrich","pii-safe"],stability:"experimental"},io:{input:p,output:s},policy:{auth:"user",policies:[],escalate:"human_review"},execution:{effects:["write","external-side-effect"],approval:{required:!0,effects:["write","external-side-effect"]}},transport:{rest:{method:"POST",path:m(L)},mcp:{toolName:d("contact_enrichment_cancel")}}});import{ScalarTypeEnum as g,SchemaModel as O}from"@lssm/lib.schema";var G=g.JSONObject(),K=g.String_unsecure(),i=g.NonEmptyString(),F=new O({name:"FullEnrichCorrelationInput",fields:{connectionId:{type:i,isOptional:!1},correlationId:{type:i,isOptional:!0},idempotencyKey:{type:i,isOptional:!0}}}),I=new O({name:"FullEnrichSearchInput",fields:{connectionId:{type:i,isOptional:!1},query:{type:i,isOptional:!0},filters:{type:G,isOptional:!0},limit:{type:g.Int_unsecure(),isOptional:!0},correlationId:{type:i,isOptional:!0}}}),w=new O({name:"FullEnrichLookupInput",fields:{connectionId:{type:i,isOptional:!1},identifier:{type:i,isOptional:!1},identifierType:{type:K,isOptional:!1},correlationId:{type:i,isOptional:!0}}}),b=new O({name:"FullEnrichAsyncStartInput",fields:{connectionId:{type:i,isOptional:!1},request:{type:G,isOptional:!1},correlationId:{type:i,isOptional:!0},webhookUrl:{type:K,isOptional:!0}}});import{ScalarTypeEnum as u,SchemaModel as x}from"@lssm/lib.schema";var N=u.JSONObject(),R=u.String_unsecure(),r=u.NonEmptyString(),V=new x({name:"FullEnrichCreditOutput",fields:{providerKey:{type:r,isOptional:!1},creditsRemaining:{type:u.Float_unsecure(),isOptional:!0},raw:{type:N,isOptional:!0},correlationId:{type:r,isOptional:!0}}}),W=new x({name:"FullEnrichValidationOutput",fields:{valid:{type:u.Boolean(),isOptional:!1},providerKey:{type:r,isOptional:!1},message:{type:R,isOptional:!0}}}),h=new x({name:"FullEnrichResultListOutput",fields:{providerKey:{type:r,isOptional:!1},items:{type:N,isOptional:!1},correlationId:{type:r,isOptional:!0}}}),C=new x({name:"FullEnrichAsyncStartOutput",fields:{providerKey:{type:r,isOptional:!1},jobId:{type:r,isOptional:!0},correlationId:{type:r,isOptional:!0},status:{type:R,isOptional:!1},expectedWebhookPath:{type:R,isOptional:!0}}});var J=["@platform.integrations"],t={version:a,owners:J,tags:["sales-intelligence","fullenrich","pii-safe"],stability:"experimental"},c={effects:["read"]},v={effects:["write","cost-bearing","external-side-effect"],approval:{required:!0}};function n(e,S,k){return{rest:{method:S,path:m(e)},mcp:{toolName:k??T(e)}}}var B=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.credits.get",title:"Get FullEnrich Credits",description:"Read FullEnrich credit balance without exposing API keys.",goal:"Preflight enrichment usage and quota availability.",context:"Uses the documented FullEnrich credits API via a secret-backed runtime adapter."},io:{input:F,output:V},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.credits.get","GET")}),z=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.api-key.validate",title:"Validate FullEnrich API Key",description:"Validate configured FullEnrich credentials with redacted output.",goal:"Fail fast on invalid BYOK setup without logging key material.",context:"Uses provider key-validation endpoint through runtime secrets only."},io:{input:F,output:W},policy:{auth:"admin",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.api-key.validate","GET")}),Q=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.people.search",title:"Search FullEnrich People",description:"Search people through FullEnrich Search API.",goal:"Find candidate contacts with synthetic-test-safe result handling.",context:"Synchronous FullEnrich people search; no live calls in tests."},io:{input:I,output:h},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.people.search","POST")}),Y=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.companies.search",title:"Search FullEnrich Companies",description:"Search companies through FullEnrich Search API.",goal:"Find candidate company records.",context:"Synchronous FullEnrich company search; no live calls in tests."},io:{input:I,output:h},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.companies.search","POST")}),H=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.people.lookup",title:"Lookup FullEnrich Person",description:"Lookup/enrich a known person record.",goal:"Resolve a known person identifier through FullEnrich.",context:"Uses lookup/search surface only when provider supports the identifier type."},io:{input:w,output:h},policy:{auth:"user",policies:[]},execution:v,transport:n("sales-intelligence.fullenrich.people.lookup","POST")}),X=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.companies.lookup",title:"Lookup FullEnrich Company",description:"Lookup/enrich a known company record.",goal:"Resolve a known company identifier through FullEnrich.",context:"Uses lookup/search surface only when provider supports the identifier type."},io:{input:w,output:h},policy:{auth:"user",policies:[]},execution:v,transport:n("sales-intelligence.fullenrich.companies.lookup","POST")}),Z=P({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.contact.enrichment.start",title:"Start FullEnrich Contact Enrichment",description:"Start async FullEnrich contact enrichment.",goal:"Start enrichment and return correlation/job metadata.",context:"Webhook-first async flow; polling is fallback only."},io:{input:b,output:C},policy:{auth:"user",policies:[]},execution:v,transport:n("sales-intelligence.fullenrich.contact.enrichment.start","POST")}),ee=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.contact.enrichment.result.get",title:"Get FullEnrich Contact Enrichment Result",description:"Slow polling fallback for async enrichment results.",goal:"Retrieve a result when webhook delivery is unavailable.",context:"Fallback-only because FullEnrich recommends webhooks for async results."},io:{input:p,output:s},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.contact.enrichment.result.get","GET",d("contact_result_get"))}),te=P({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.reverse-email.start",title:"Start FullEnrich Reverse Email Lookup",description:"Start async reverse-email lookup.",goal:"Resolve a contact from an email address with correlation metadata.",context:"Webhook-first async reverse-email flow."},io:{input:b,output:C},policy:{auth:"user",policies:[]},execution:v,transport:n("sales-intelligence.fullenrich.reverse-email.start","POST")}),ie=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.reverse-email.result.get",title:"Get FullEnrich Reverse Email Result",description:"Slow polling fallback for reverse-email results.",goal:"Retrieve a reverse-email result when webhook delivery is unavailable.",context:"Fallback-only; callers should prefer webhook receipt."},io:{input:p,output:s},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.reverse-email.result.get","GET")}),ne=P({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.webhook.enrichment.received",title:"Receive FullEnrich Enrichment Webhook",description:"Normalize inbound enrichment webhook payloads.",goal:"Produce an idempotent receipt without leaking raw PII or secrets.",context:"Signature verification is only enabled when official signing docs exist."},io:{input:_,output:s},policy:{auth:"admin",policies:[]},execution:{effects:["external-side-effect"]}}),le=o({meta:{...t,version:"1.0.0",key:"sales-intelligence.fullenrich.mcp.remote.describe",title:"Describe FullEnrich Remote MCP",description:"Describe the official FullEnrich remote MCP endpoint and auth.",goal:"Let agents discover remote MCP metadata without proxying OAuth secrets.",context:"Declares https://mcp.fullenrich.com/mcp with OAuth metadata."},io:{input:F,output:M},policy:{auth:"user",policies:[]},execution:c,transport:n("sales-intelligence.fullenrich.mcp.remote.describe","GET")}),q=[B,z,Q,Y,H,X,Z,ee,j,te,ie,ne,le],Se=Object.fromEntries(q.map((e)=>[e.meta.key,e]));function ke(e){return q.reduce((S,k)=>S.register(k),e)}export{z as FullEnrichApiKeyValidate,X as FullEnrichCompaniesLookup,Y as FullEnrichCompaniesSearch,ee as FullEnrichContactEnrichmentResultGet,Z as FullEnrichContactEnrichmentStart,B as FullEnrichCreditsGet,le as FullEnrichMcpRemoteDescribe,H as FullEnrichPeopleLookup,Q as FullEnrichPeopleSearch,ie as FullEnrichReverseEmailResultGet,te as FullEnrichReverseEmailStart,ne as FullEnrichWebhookEnrichmentReceived,q as fullEnrichSalesIntelligenceOperations,ke as registerSalesIntelligenceContracts,Se as salesIntelligenceOperations};

package/dist/integrations/sales-intelligence/operations.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/sales-intelligence/schemas-events.d.ts

@@ -0,0 +1,78 @@
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const FullEnrichResultInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    jobId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichWebhookInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    headers: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: true;
+    };
+    payload: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+    receivedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichReceiptOutput: SchemaModel<{
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    jobId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    status: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    data: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: true;
+    };
+    rawRedacted: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichRemoteMcpOutput: SchemaModel<{
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    url: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    auth: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    toolCategories: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+        isArray: true;
+    };
+}>;

package/dist/integrations/sales-intelligence/schemas-events.js

@@ -0,0 +1,2 @@
+// @bun
+import{ScalarTypeEnum as i,SchemaModel as n}from"@lssm/lib.schema";var e=i.JSONObject(),p=i.String_unsecure(),t=i.NonEmptyString(),o=new n({name:"FullEnrichResultInput",fields:{connectionId:{type:t,isOptional:!1},jobId:{type:t,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),a=new n({name:"FullEnrichWebhookInput",fields:{connectionId:{type:t,isOptional:!1},headers:{type:e,isOptional:!0},payload:{type:e,isOptional:!1},receivedAt:{type:i.DateTime(),isOptional:!0}}}),s=new n({name:"FullEnrichReceiptOutput",fields:{providerKey:{type:t,isOptional:!1},jobId:{type:t,isOptional:!0},correlationId:{type:t,isOptional:!0},status:{type:p,isOptional:!1},data:{type:e,isOptional:!0},rawRedacted:{type:e,isOptional:!0}}}),r=new n({name:"FullEnrichRemoteMcpOutput",fields:{providerKey:{type:t,isOptional:!1},url:{type:t,isOptional:!1},auth:{type:t,isOptional:!1},toolCategories:{type:p,isOptional:!1,isArray:!0}}});export{s as FullEnrichReceiptOutput,r as FullEnrichRemoteMcpOutput,o as FullEnrichResultInput,a as FullEnrichWebhookInput};

package/dist/integrations/sales-intelligence/schemas-results.d.ts

@@ -0,0 +1,69 @@
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const FullEnrichCreditOutput: SchemaModel<{
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    creditsRemaining: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: true;
+    };
+    raw: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: true;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichValidationOutput: SchemaModel<{
+    valid: {
+        type: import("@lssm/lib.schema").FieldType<boolean, boolean>;
+        isOptional: false;
+    };
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    message: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichResultListOutput: SchemaModel<{
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    items: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichAsyncStartOutput: SchemaModel<{
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    jobId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    status: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expectedWebhookPath: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;

package/dist/integrations/sales-intelligence/schemas-results.js

@@ -0,0 +1,2 @@
+// @bun
+import{ScalarTypeEnum as e,SchemaModel as i}from"@lssm/lib.schema";var l=e.JSONObject(),n=e.String_unsecure(),t=e.NonEmptyString(),o=new i({name:"FullEnrichCreditOutput",fields:{providerKey:{type:t,isOptional:!1},creditsRemaining:{type:e.Float_unsecure(),isOptional:!0},raw:{type:l,isOptional:!0},correlationId:{type:t,isOptional:!0}}}),s=new i({name:"FullEnrichValidationOutput",fields:{valid:{type:e.Boolean(),isOptional:!1},providerKey:{type:t,isOptional:!1},message:{type:n,isOptional:!0}}}),r=new i({name:"FullEnrichResultListOutput",fields:{providerKey:{type:t,isOptional:!1},items:{type:l,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),a=new i({name:"FullEnrichAsyncStartOutput",fields:{providerKey:{type:t,isOptional:!1},jobId:{type:t,isOptional:!0},correlationId:{type:t,isOptional:!0},status:{type:n,isOptional:!1},expectedWebhookPath:{type:n,isOptional:!0}}});export{a as FullEnrichAsyncStartOutput,o as FullEnrichCreditOutput,r as FullEnrichResultListOutput,s as FullEnrichValidationOutput};

package/dist/integrations/sales-intelligence/schemas.d.ts

@@ -0,0 +1,73 @@
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const FullEnrichCorrelationInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    idempotencyKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichSearchInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    query: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    filters: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: true;
+    };
+    limit: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: true;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichLookupInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    identifier: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    identifierType: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const FullEnrichAsyncStartInput: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    request: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+    correlationId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    webhookUrl: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;

package/dist/integrations/sales-intelligence/schemas.js

@@ -0,0 +1,2 @@
+// @bun
+import{ScalarTypeEnum as e,SchemaModel as n}from"@lssm/lib.schema";var i=e.JSONObject(),o=e.String_unsecure(),t=e.NonEmptyString(),p=new n({name:"FullEnrichCorrelationInput",fields:{connectionId:{type:t,isOptional:!1},correlationId:{type:t,isOptional:!0},idempotencyKey:{type:t,isOptional:!0}}}),r=new n({name:"FullEnrichSearchInput",fields:{connectionId:{type:t,isOptional:!1},query:{type:t,isOptional:!0},filters:{type:i,isOptional:!0},limit:{type:e.Int_unsecure(),isOptional:!0},correlationId:{type:t,isOptional:!0}}}),s=new n({name:"FullEnrichLookupInput",fields:{connectionId:{type:t,isOptional:!1},identifier:{type:t,isOptional:!1},identifierType:{type:o,isOptional:!1},correlationId:{type:t,isOptional:!0}}}),a=new n({name:"FullEnrichAsyncStartInput",fields:{connectionId:{type:t,isOptional:!1},request:{type:i,isOptional:!1},correlationId:{type:t,isOptional:!0},webhookUrl:{type:o,isOptional:!0}}});export{a as FullEnrichAsyncStartInput,p as FullEnrichCorrelationInput,s as FullEnrichLookupInput,r as FullEnrichSearchInput};

package/dist/integrations/secrets/aws-secret-manager.d.ts

@@ -0,0 +1,28 @@
+import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
+import type { SecretFetchOptions, SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from './provider.js';
+type AwsSecretsManagerClient = Pick<SecretsManagerClient, 'send'>;
+type AwsSecretsManagerClientConfig = ConstructorParameters<typeof SecretsManagerClient>[0];
+interface AwsSecretsManagerProviderOptions {
+    region?: string;
+    client?: AwsSecretsManagerClient;
+    clientConfig?: AwsSecretsManagerClientConfig;
+}
+export declare class AwsSecretsManagerProvider implements SecretProvider {
+    readonly id = "aws-secrets-manager";
+    private readonly explicitRegion?;
+    private readonly injectedClient?;
+    private readonly clientConfig?;
+    private readonly clientsByRegion;
+    constructor(options?: AwsSecretsManagerProviderOptions);
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+    private getClient;
+    private parseReference;
+    private resolveRegion;
+    private buildVersionSelector;
+    private buildReference;
+}
+export {};

package/dist/integrations/secrets/aws-secret-manager.js

@@ -0,0 +1,2 @@
+// @bun
+import{Buffer as f}from"buffer";import{CreateSecretCommand as w,DeleteSecretCommand as v,GetSecretValueCommand as y,PutSecretValueCommand as R,SecretsManagerClient as I}from"@aws-sdk/client-secrets-manager";import{Buffer as g}from"buffer";class c extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function S(e){if(!e)throw new c({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[r,t]=e.split("://");if(!r||!t)throw new c({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let n=t.indexOf("?");if(n===-1)return{provider:r,path:t};let s=t.slice(0,n),i=t.slice(n+1),o=Object.fromEntries(i.split("&").filter(Boolean).map((a)=>{let[p,u]=a.split("="),m=p??"",h=u??"";return[decodeURIComponent(m),decodeURIComponent(h)]}));return{provider:r,path:s,extras:o}}function l(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return g.from(e.data,"base64");if(e.encoding==="binary")return g.from(e.data,"binary");return g.from(e.data,"utf-8")}var A=7;class C{id="aws-secrets-manager";explicitRegion;injectedClient;clientConfig;clientsByRegion=new Map;constructor(e={}){this.explicitRegion=e.region,this.injectedClient=e.client,this.clientConfig=e.clientConfig}canHandle(e){try{let r=S(e);return r.provider==="aws"&&(r.path==="secretsmanager"||r.path.startsWith("secretsmanager/"))}catch{return!1}}async getSecret(e,r){let t=this.parseReference(e),n=this.getClient(t.region),s=r?.version??t.stage??t.version,i={SecretId:t.secretId,...this.buildVersionSelector(s)};try{let o=await n.send(new y(i));return{data:N(o,e,this.id),version:typeof o.VersionId==="string"&&o.VersionId?o.VersionId:s,metadata:{region:t.region,secretId:t.secretId,...s?{requestedVersion:s}:{}},retrievedAt:new Date}}catch(o){throw d({error:o,provider:this.id,reference:e,operation:"getSecret"})}}async setSecret(e,r){let t=this.parseReference(e),n=this.getClient(t.region),s=l(r);try{let i=await n.send(new R({SecretId:t.secretId,SecretBinary:s})),o=typeof i.VersionId==="string"&&i.VersionId?i.VersionId:"latest";return{reference:this.buildReference(t.region,t.secretId,{version:o}),version:o}}catch(i){if(!V(i))throw d({error:i,provider:this.id,reference:e,operation:"putSecretValue"});if(P(t.secretId))throw new c({message:`Secret not found: ${t.secretId}`,provider:this.id,reference:e,code:"NOT_FOUND",cause:i});try{let o=await n.send(new w({Name:t.secretId,SecretBinary:s})),a=typeof o.VersionId==="string"&&o.VersionId?o.VersionId:"latest";return{reference:this.buildReference(t.region,t.secretId,{version:a}),version:a}}catch(o){throw d({error:o,provider:this.id,reference:e,operation:"createSecret"})}}}async rotateSecret(e,r){return this.setSecret(e,r)}async deleteSecret(e){let r=this.parseReference(e),t=this.getClient(r.region);try{await t.send(new v({SecretId:r.secretId,RecoveryWindowInDays:A}))}catch(n){throw d({error:n,provider:this.id,reference:e,operation:"deleteSecret"})}}getClient(e){if(this.injectedClient)return this.injectedClient;let r=this.clientsByRegion.get(e);if(r)return r;let t=new I({...this.clientConfig??{},region:e});return this.clientsByRegion.set(e,t),t}parseReference(e){let r=S(e);if(r.provider!=="aws")throw new c({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:e,code:"INVALID"});let t=r.path.split("/").filter(Boolean);if(t.length<3||t[0]!=="secretsmanager")throw new c({message:"Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]",provider:this.id,reference:e,code:"INVALID"});let n=t[1],s=this.resolveRegion(n),i=t.slice(2).join("/");if(!i)throw new c({message:`Unable to resolve secret id from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});return{region:s,secretId:i,version:r.extras?.version,stage:r.extras?.stage}}resolveRegion(e){let r=e??this.explicitRegion??process.env.AWS_REGION??process.env.AWS_DEFAULT_REGION;if(!r)throw new c({message:"AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.",provider:this.id,reference:"aws://secretsmanager//",code:"INVALID"});return r}buildVersionSelector(e){if(!e)return{};if(e==="latest"||e==="current")return{VersionStage:"AWSCURRENT"};if(e.startsWith("AWS"))return{VersionStage:e};return{VersionId:e}}buildReference(e,r,t){let n=`aws://secretsmanager/${e}/${r}`,s=t?Object.entries(t).filter(([,i])=>Boolean(i)).map(([i,o])=>`${encodeURIComponent(i)}=${encodeURIComponent(o)}`).join("&"):"";return s?`${n}?${s}`:n}}function N(e,r,t){if(!e||typeof e!=="object")throw new c({message:"Invalid AWS Secrets Manager response",provider:t,reference:r,code:"UNKNOWN",cause:e});let n=e;if(n.SecretBinary instanceof Uint8Array)return n.SecretBinary;if(typeof n.SecretBinary==="string")return f.from(n.SecretBinary,"base64");if(typeof n.SecretString==="string")return f.from(n.SecretString,"utf-8");throw new c({message:"AWS secret value is empty",provider:t,reference:r,code:"NOT_FOUND",cause:e})}function P(e){return e.startsWith("arn:aws:secretsmanager:")}function V(e){if(!e||typeof e!=="object")return!1;let r=e;if(typeof r.$metadata?.httpStatusCode==="number")return r.$metadata.httpStatusCode===404;return r.name==="ResourceNotFoundException"}function d(e){let{error:r,provider:t,reference:n,operation:s}=e;if(r instanceof c)return r;let i=typeof r==="object"&&r!==null&&"$metadata"in r&&typeof r.$metadata==="object"&&r.$metadata?.httpStatusCode,o=i===404?"NOT_FOUND":i===401||i===403?"FORBIDDEN":i===400?"INVALID":"UNKNOWN",a=r instanceof Error?r.message:`Unknown error during ${s}`;return new c({message:a,provider:t,reference:n,code:o,cause:r})}export{C as AwsSecretsManagerProvider};

package/dist/integrations/secrets/env-secret-provider.d.ts

@@ -0,0 +1,28 @@
+import type { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from './provider.js';
+interface EnvSecretProviderOptions {
+    /**
+     * Optional map to alias secret references to environment variable names.
+     * Useful when referencing secrets from other providers (e.g. gcp://...)
+     * while still allowing local overrides.
+     */
+    aliases?: Record<string, string>;
+}
+/**
+ * Environment-variable backed secret provider. Read-only by design.
+ * Allows overriding other secret providers by deriving environment variable
+ * names from secret references (or by using explicit aliases).
+ */
+export declare class EnvSecretProvider implements SecretProvider {
+    readonly id = "env";
+    private readonly aliases;
+    constructor(options?: EnvSecretProviderOptions);
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference): Promise<SecretValue>;
+    setSecret(reference: SecretReference, _payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, _payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+    private resolveEnvKey;
+    private deriveEnvKey;
+    private forbiddenError;
+}
+export {};

package/dist/integrations/secrets/env-secret-provider.js

@@ -0,0 +1,2 @@
+// @bun
+import{Buffer as i}from"buffer";class n extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function c(e){if(!e)throw new n({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[r,t]=e.split("://");if(!r||!t)throw new n({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let o=t.indexOf("?");if(o===-1)return{provider:r,path:t};let s=t.slice(0,o),a=t.slice(o+1),d=Object.fromEntries(a.split("&").filter(Boolean).map((f)=>{let[l,v]=f.split("="),S=l??"",u=v??"";return[decodeURIComponent(S),decodeURIComponent(u)]}));return{provider:r,path:s,extras:d}}function g(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return i.from(e.data,"base64");if(e.encoding==="binary")return i.from(e.data,"binary");return i.from(e.data,"utf-8")}class p{id="env";aliases;constructor(e={}){this.aliases=e.aliases??{}}canHandle(e){let r=this.resolveEnvKey(e);return r!==void 0&&process.env[r]!==void 0}async getSecret(e){let r=this.resolveEnvKey(e);if(!r)throw new n({message:`Unable to resolve environment variable for reference "${e}".`,provider:this.id,reference:e,code:"INVALID"});let t=process.env[r];if(t===void 0)throw new n({message:`Environment variable "${r}" not found for reference "${e}".`,provider:this.id,reference:e,code:"NOT_FOUND"});return{data:Buffer.from(t,"utf-8"),version:"current",metadata:{source:"env",envKey:r},retrievedAt:new Date}}async setSecret(e,r){throw this.forbiddenError("setSecret",e)}async rotateSecret(e,r){throw this.forbiddenError("rotateSecret",e)}async deleteSecret(e){throw this.forbiddenError("deleteSecret",e)}resolveEnvKey(e){if(!e)return;if(this.aliases[e])return this.aliases[e];if(!e.includes("://"))return e;try{let r=c(e);if(r.provider==="env")return r.path;if(r.extras?.env)return r.extras.env;return this.deriveEnvKey(r.path)}catch{return e}}deriveEnvKey(e){if(!e)return;return e.split(/[\/:\-\.]/).filter(Boolean).map((r)=>r.replace(/[^a-zA-Z0-9]/g,"_").replace(/_{2,}/g,"_").toUpperCase()).join("_")}forbiddenError(e,r){return new n({message:`EnvSecretProvider is read-only. "${e}" is not allowed for ${r}.`,provider:this.id,reference:r,code:"FORBIDDEN"})}}export{p as EnvSecretProvider};

package/dist/integrations/secrets/gcp-secret-manager.d.ts

@@ -0,0 +1,29 @@
+import { protos, SecretManagerServiceClient } from '@google-cloud/secret-manager';
+import type { CallOptions } from 'google-gax';
+import type { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from './provider.js';
+type SecretManagerClient = SecretManagerServiceClient;
+interface GcpSecretManagerProviderOptions {
+    projectId?: string;
+    client?: SecretManagerClient;
+    clientOptions?: ConstructorParameters<typeof SecretManagerServiceClient>[0];
+    defaultReplication?: protos.google.cloud.secretmanager.v1.IReplication;
+}
+export declare class GcpSecretManagerProvider implements SecretProvider {
+    readonly id = "gcp-secret-manager";
+    private readonly client;
+    private readonly explicitProjectId?;
+    private readonly replication;
+    constructor(options?: GcpSecretManagerProviderOptions);
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: {
+        version?: string;
+    }, callOptions?: CallOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+    private parseReference;
+    private buildNames;
+    private buildVersionName;
+    private ensureSecretExists;
+}
+export {};

package/dist/integrations/secrets/gcp-secret-manager.js

@@ -0,0 +1,2 @@
+// @bun
+import{SecretManagerServiceClient as m}from"@google-cloud/secret-manager";import{Buffer as f}from"buffer";class s extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function S(e){if(!e)throw new s({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[t,r]=e.split("://");if(!t||!r)throw new s({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let o=r.indexOf("?");if(o===-1)return{provider:t,path:r};let c=r.slice(0,o),n=r.slice(o+1),a=Object.fromEntries(n.split("&").filter(Boolean).map((i)=>{let[d,l]=i.split("="),u=d??"",h=l??"";return[decodeURIComponent(u),decodeURIComponent(h)]}));return{provider:t,path:c,extras:a}}function g(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return f.from(e.data,"base64");if(e.encoding==="binary")return f.from(e.data,"binary");return f.from(e.data,"utf-8")}var N={automatic:{}};class I{id="gcp-secret-manager";client;explicitProjectId;replication;constructor(e={}){this.client=e.client??new m(e.clientOptions??{}),this.explicitProjectId=e.projectId,this.replication=e.defaultReplication??N}canHandle(e){try{return S(e).provider==="gcp"}catch{return!1}}async getSecret(e,t,r){let o=this.parseReference(e),c=this.buildVersionName(o,t?.version);try{let n=await this.client.accessSecretVersion({name:c},r??{}),[a]=n,i=a.payload;if(!i?.data)throw new s({message:`Secret payload empty for ${c}`,provider:this.id,reference:e,code:"UNKNOWN"});let d=v(a.name??c);return{data:i.data,version:d,metadata:i.dataCrc32c?{crc32c:i.dataCrc32c.toString()}:void 0,retrievedAt:new Date}}catch(n){throw p({error:n,provider:this.id,reference:e,operation:"access"})}}async setSecret(e,t){let r=this.parseReference(e),{secretName:o}=this.buildNames(r),c=g(t);await this.ensureSecretExists(r,t);try{let n=await this.client.addSecretVersion({parent:o,payload:{data:c}});if(!n)throw new s({message:`No version returned when adding secret version for ${o}`,provider:this.id,reference:e,code:"UNKNOWN"});let[a]=n,i=a?.name??`${o}/versions/latest`;return{reference:`gcp://${i}`,version:v(i)??"latest"}}catch(n){throw p({error:n,provider:this.id,reference:e,operation:"addSecretVersion"})}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(e){let t=this.parseReference(e),{secretName:r}=this.buildNames(t);try{await this.client.deleteSecret({name:r})}catch(o){throw p({error:o,provider:this.id,reference:e,operation:"delete"})}}parseReference(e){let t=S(e);if(t.provider!=="gcp")throw new s({message:`Unsupported secret provider: ${t.provider}`,provider:this.id,reference:e,code:"INVALID"});let r=t.path.split("/").filter(Boolean);if(r.length<4||r[0]!=="projects")throw new s({message:`Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received "${t.path}"`,provider:this.id,reference:e,code:"INVALID"});let o=r[1]??this.explicitProjectId;if(!o)throw new s({message:`Unable to resolve project or secret from reference "${t.path}"`,provider:this.id,reference:e,code:"INVALID"});let c=r.indexOf("secrets");if(c===-1||c+1>=r.length)throw new s({message:`Unable to resolve project or secret from reference "${t.path}"`,provider:this.id,reference:e,code:"INVALID"});let n=o,a=r[c+1];if(!a)throw new s({message:`Unable to resolve secret ID from reference "${t.path}"`,provider:this.id,reference:e,code:"INVALID"});let i=a,d=r.indexOf("versions"),l=t.extras?.version??(d!==-1&&d+1<r.length?r[d+1]:void 0);return{projectId:n,secretId:i,version:l}}buildNames(e){let t=e.projectId??this.explicitProjectId;if(!t)throw new s({message:"Project ID must be provided either in reference or provider configuration",provider:this.id,reference:`gcp://projects//secrets/${e.secretId}`,code:"INVALID"});let r=`projects/${t}`,o=`${r}/secrets/${e.secretId}`;return{projectParent:r,secretName:o}}buildVersionName(e,t){let{secretName:r}=this.buildNames(e),o=t??e.version??"latest";return`${r}/versions/${o}`}async ensureSecretExists(e,t){let{secretName:r,projectParent:o}=this.buildNames(e);try{await this.client.getSecret({name:r})}catch(c){let n=p({error:c,provider:this.id,reference:`gcp://${r}`,operation:"getSecret",suppressThrow:!0});if(!n||n.code!=="NOT_FOUND"){if(n)throw n;throw c}try{await this.client.createSecret({parent:o,secretId:e.secretId,secret:{replication:this.replication,labels:t.labels}})}catch(a){throw p({error:a,provider:this.id,reference:`gcp://${r}`,operation:"createSecret"})}}}}function v(e){let t=e.split("/").filter(Boolean),r=t.indexOf("versions");if(r===-1||r+1>=t.length)return;return t[r+1]}function p(e){let{error:t,provider:r,reference:o,operation:c,suppressThrow:n}=e;if(t instanceof s)return t;let a=y(t),i=t instanceof Error?t.message:`Unknown error during ${c}`,d=new s({message:i,provider:r,reference:o,code:a,cause:t});if(n)return d;throw d}function y(e){if(typeof e!=="object"||e===null)return"UNKNOWN";let r=e.code;if(r===5||r==="NOT_FOUND")return"NOT_FOUND";if(r===6||r==="ALREADY_EXISTS")return"INVALID";if(r===7||r==="PERMISSION_DENIED"||r===403)return"FORBIDDEN";if(r===3||r==="INVALID_ARGUMENT")return"INVALID";return"UNKNOWN"}export{I as GcpSecretManagerProvider};

package/dist/integrations/secrets/index.d.ts

@@ -0,0 +1,6 @@
+export * from './aws-secret-manager.js';
+export * from './env-secret-provider.js';
+export * from './gcp-secret-manager.js';
+export * from './manager.js';
+export * from './provider.js';
+export * from './scaleway-secret-manager.js';

package/dist/integrations/secrets/index.js

@@ -0,0 +1,2 @@
+// @bun
+import{Buffer as y}from"buffer";import{CreateSecretCommand as E,DeleteSecretCommand as N,GetSecretValueCommand as C,PutSecretValueCommand as O,SecretsManagerClient as A}from"@aws-sdk/client-secrets-manager";import{Buffer as v}from"buffer";class s extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function d(e){if(!e)throw new s({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[r,t]=e.split("://");if(!r||!t)throw new s({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let n=t.indexOf("?");if(n===-1)return{provider:r,path:t};let i=t.slice(0,n),o=t.slice(n+1),c=Object.fromEntries(o.split("&").filter(Boolean).map((a)=>{let[p,u]=a.split("="),I=p??"",P=u??"";return[decodeURIComponent(I),decodeURIComponent(P)]}));return{provider:r,path:i,extras:c}}function l(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return v.from(e.data,"base64");if(e.encoding==="binary")return v.from(e.data,"binary");return v.from(e.data,"utf-8")}var b=7;class D{id="aws-secrets-manager";explicitRegion;injectedClient;clientConfig;clientsByRegion=new Map;constructor(e={}){this.explicitRegion=e.region,this.injectedClient=e.client,this.clientConfig=e.clientConfig}canHandle(e){try{let r=d(e);return r.provider==="aws"&&(r.path==="secretsmanager"||r.path.startsWith("secretsmanager/"))}catch{return!1}}async getSecret(e,r){let t=this.parseReference(e),n=this.getClient(t.region),i=r?.version??t.stage??t.version,o={SecretId:t.secretId,...this.buildVersionSelector(i)};try{let c=await n.send(new C(o));return{data:U(c,e,this.id),version:typeof c.VersionId==="string"&&c.VersionId?c.VersionId:i,metadata:{region:t.region,secretId:t.secretId,...i?{requestedVersion:i}:{}},retrievedAt:new Date}}catch(c){throw g({error:c,provider:this.id,reference:e,operation:"getSecret"})}}async setSecret(e,r){let t=this.parseReference(e),n=this.getClient(t.region),i=l(r);try{let o=await n.send(new O({SecretId:t.secretId,SecretBinary:i})),c=typeof o.VersionId==="string"&&o.VersionId?o.VersionId:"latest";return{reference:this.buildReference(t.region,t.secretId,{version:c}),version:c}}catch(o){if(!_(o))throw g({error:o,provider:this.id,reference:e,operation:"putSecretValue"});if(V(t.secretId))throw new s({message:`Secret not found: ${t.secretId}`,provider:this.id,reference:e,code:"NOT_FOUND",cause:o});try{let c=await n.send(new E({Name:t.secretId,SecretBinary:i})),a=typeof c.VersionId==="string"&&c.VersionId?c.VersionId:"latest";return{reference:this.buildReference(t.region,t.secretId,{version:a}),version:a}}catch(c){throw g({error:c,provider:this.id,reference:e,operation:"createSecret"})}}}async rotateSecret(e,r){return this.setSecret(e,r)}async deleteSecret(e){let r=this.parseReference(e),t=this.getClient(r.region);try{await t.send(new N({SecretId:r.secretId,RecoveryWindowInDays:b}))}catch(n){throw g({error:n,provider:this.id,reference:e,operation:"deleteSecret"})}}getClient(e){if(this.injectedClient)return this.injectedClient;let r=this.clientsByRegion.get(e);if(r)return r;let t=new A({...this.clientConfig??{},region:e});return this.clientsByRegion.set(e,t),t}parseReference(e){let r=d(e);if(r.provider!=="aws")throw new s({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:e,code:"INVALID"});let t=r.path.split("/").filter(Boolean);if(t.length<3||t[0]!=="secretsmanager")throw new s({message:"Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]",provider:this.id,reference:e,code:"INVALID"});let n=t[1],i=this.resolveRegion(n),o=t.slice(2).join("/");if(!o)throw new s({message:`Unable to resolve secret id from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});return{region:i,secretId:o,version:r.extras?.version,stage:r.extras?.stage}}resolveRegion(e){let r=e??this.explicitRegion??process.env.AWS_REGION??process.env.AWS_DEFAULT_REGION;if(!r)throw new s({message:"AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.",provider:this.id,reference:"aws://secretsmanager//",code:"INVALID"});return r}buildVersionSelector(e){if(!e)return{};if(e==="latest"||e==="current")return{VersionStage:"AWSCURRENT"};if(e.startsWith("AWS"))return{VersionStage:e};return{VersionId:e}}buildReference(e,r,t){let n=`aws://secretsmanager/${e}/${r}`,i=t?Object.entries(t).filter(([,o])=>Boolean(o)).map(([o,c])=>`${encodeURIComponent(o)}=${encodeURIComponent(c)}`).join("&"):"";return i?`${n}?${i}`:n}}function U(e,r,t){if(!e||typeof e!=="object")throw new s({message:"Invalid AWS Secrets Manager response",provider:t,reference:r,code:"UNKNOWN",cause:e});let n=e;if(n.SecretBinary instanceof Uint8Array)return n.SecretBinary;if(typeof n.SecretBinary==="string")return y.from(n.SecretBinary,"base64");if(typeof n.SecretString==="string")return y.from(n.SecretString,"utf-8");throw new s({message:"AWS secret value is empty",provider:t,reference:r,code:"NOT_FOUND",cause:e})}function V(e){return e.startsWith("arn:aws:secretsmanager:")}function _(e){if(!e||typeof e!=="object")return!1;let r=e;if(typeof r.$metadata?.httpStatusCode==="number")return r.$metadata.httpStatusCode===404;return r.name==="ResourceNotFoundException"}function g(e){let{error:r,provider:t,reference:n,operation:i}=e;if(r instanceof s)return r;let o=typeof r==="object"&&r!==null&&"$metadata"in r&&typeof r.$metadata==="object"&&r.$metadata?.httpStatusCode,c=o===404?"NOT_FOUND":o===401||o===403?"FORBIDDEN":o===400?"INVALID":"UNKNOWN",a=r instanceof Error?r.message:`Unknown error during ${i}`;return new s({message:a,provider:t,reference:n,code:c,cause:r})}class x{id="env";aliases;constructor(e={}){this.aliases=e.aliases??{}}canHandle(e){let r=this.resolveEnvKey(e);return r!==void 0&&process.env[r]!==void 0}async getSecret(e){let r=this.resolveEnvKey(e);if(!r)throw new s({message:`Unable to resolve environment variable for reference "${e}".`,provider:this.id,reference:e,code:"INVALID"});let t=process.env[r];if(t===void 0)throw new s({message:`Environment variable "${r}" not found for reference "${e}".`,provider:this.id,reference:e,code:"NOT_FOUND"});return{data:Buffer.from(t,"utf-8"),version:"current",metadata:{source:"env",envKey:r},retrievedAt:new Date}}async setSecret(e,r){throw this.forbiddenError("setSecret",e)}async rotateSecret(e,r){throw this.forbiddenError("rotateSecret",e)}async deleteSecret(e){throw this.forbiddenError("deleteSecret",e)}resolveEnvKey(e){if(!e)return;if(this.aliases[e])return this.aliases[e];if(!e.includes("://"))return e;try{let r=d(e);if(r.provider==="env")return r.path;if(r.extras?.env)return r.extras.env;return this.deriveEnvKey(r.path)}catch{return e}}deriveEnvKey(e){if(!e)return;return e.split(/[\/:\-\.]/).filter(Boolean).map((r)=>r.replace(/[^a-zA-Z0-9]/g,"_").replace(/_{2,}/g,"_").toUpperCase()).join("_")}forbiddenError(e,r){return new s({message:`EnvSecretProvider is read-only. "${e}" is not allowed for ${r}.`,provider:this.id,reference:r,code:"FORBIDDEN"})}}import{SecretManagerServiceClient as W}from"@google-cloud/secret-manager";var j={automatic:{}};class T{id="gcp-secret-manager";client;explicitProjectId;replication;constructor(e={}){this.client=e.client??new W(e.clientOptions??{}),this.explicitProjectId=e.projectId,this.replication=e.defaultReplication??j}canHandle(e){try{return d(e).provider==="gcp"}catch{return!1}}async getSecret(e,r,t){let n=this.parseReference(e),i=this.buildVersionName(n,r?.version);try{let o=await this.client.accessSecretVersion({name:i},t??{}),[c]=o,a=c.payload;if(!a?.data)throw new s({message:`Secret payload empty for ${i}`,provider:this.id,reference:e,code:"UNKNOWN"});let p=w(c.name??i);return{data:a.data,version:p,metadata:a.dataCrc32c?{crc32c:a.dataCrc32c.toString()}:void 0,retrievedAt:new Date}}catch(o){throw S({error:o,provider:this.id,reference:e,operation:"access"})}}async setSecret(e,r){let t=this.parseReference(e),{secretName:n}=this.buildNames(t),i=l(r);await this.ensureSecretExists(t,r);try{let o=await this.client.addSecretVersion({parent:n,payload:{data:i}});if(!o)throw new s({message:`No version returned when adding secret version for ${n}`,provider:this.id,reference:e,code:"UNKNOWN"});let[c]=o,a=c?.name??`${n}/versions/latest`;return{reference:`gcp://${a}`,version:w(a)??"latest"}}catch(o){throw S({error:o,provider:this.id,reference:e,operation:"addSecretVersion"})}}async rotateSecret(e,r){return this.setSecret(e,r)}async deleteSecret(e){let r=this.parseReference(e),{secretName:t}=this.buildNames(r);try{await this.client.deleteSecret({name:t})}catch(n){throw S({error:n,provider:this.id,reference:e,operation:"delete"})}}parseReference(e){let r=d(e);if(r.provider!=="gcp")throw new s({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:e,code:"INVALID"});let t=r.path.split("/").filter(Boolean);if(t.length<4||t[0]!=="projects")throw new s({message:`Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});let n=t[1]??this.explicitProjectId;if(!n)throw new s({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});let i=t.indexOf("secrets");if(i===-1||i+1>=t.length)throw new s({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});let o=n,c=t[i+1];if(!c)throw new s({message:`Unable to resolve secret ID from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});let a=c,p=t.indexOf("versions"),u=r.extras?.version??(p!==-1&&p+1<t.length?t[p+1]:void 0);return{projectId:o,secretId:a,version:u}}buildNames(e){let r=e.projectId??this.explicitProjectId;if(!r)throw new s({message:"Project ID must be provided either in reference or provider configuration",provider:this.id,reference:`gcp://projects//secrets/${e.secretId}`,code:"INVALID"});let t=`projects/${r}`,n=`${t}/secrets/${e.secretId}`;return{projectParent:t,secretName:n}}buildVersionName(e,r){let{secretName:t}=this.buildNames(e),n=r??e.version??"latest";return`${t}/versions/${n}`}async ensureSecretExists(e,r){let{secretName:t,projectParent:n}=this.buildNames(e);try{await this.client.getSecret({name:t})}catch(i){let o=S({error:i,provider:this.id,reference:`gcp://${t}`,operation:"getSecret",suppressThrow:!0});if(!o||o.code!=="NOT_FOUND"){if(o)throw o;throw i}try{await this.client.createSecret({parent:n,secretId:e.secretId,secret:{replication:this.replication,labels:r.labels}})}catch(c){throw S({error:c,provider:this.id,reference:`gcp://${t}`,operation:"createSecret"})}}}}function w(e){let r=e.split("/").filter(Boolean),t=r.indexOf("versions");if(t===-1||t+1>=r.length)return;return r[t+1]}function S(e){let{error:r,provider:t,reference:n,operation:i,suppressThrow:o}=e;if(r instanceof s)return r;let c=k(r),a=r instanceof Error?r.message:`Unknown error during ${i}`,p=new s({message:a,provider:t,reference:n,code:c,cause:r});if(o)return p;throw p}function k(e){if(typeof e!=="object"||e===null)return"UNKNOWN";let t=e.code;if(t===5||t==="NOT_FOUND")return"NOT_FOUND";if(t===6||t==="ALREADY_EXISTS")return"INVALID";if(t===7||t==="PERMISSION_DENIED"||t===403)return"FORBIDDEN";if(t===3||t==="INVALID_ARGUMENT")return"INVALID";return"UNKNOWN"}class L{id;providers=[];registrationCounter=0;constructor(e={}){this.id=e.id??"secret-provider-manager";let r=e.providers??[];for(let t of r)this.register(t.provider,{priority:t.priority})}register(e,r={}){return this.providers.push({provider:e,priority:r.priority??0,order:this.registrationCounter++}),this.providers.sort((t,n)=>{if(t.priority!==n.priority)return n.priority-t.priority;return t.order-n.order}),this}canHandle(e){return this.providers.some(({provider:r})=>h(r,e))}async getSecret(e,r){let t=[];for(let{provider:n}of this.providers){if(!h(n,e))continue;try{return await n.getSecret(e,r)}catch(i){if(i instanceof s){if(t.push(i),i.code!=="NOT_FOUND")break;continue}throw i}}throw this.composeError("getSecret",e,t,r?.version)}async setSecret(e,r){return this.delegateToFirst("setSecret",e,(t)=>t.setSecret(e,r))}async rotateSecret(e,r){return this.delegateToFirst("rotateSecret",e,(t)=>t.rotateSecret(e,r))}async deleteSecret(e){await this.delegateToFirst("deleteSecret",e,(r)=>r.deleteSecret(e))}async delegateToFirst(e,r,t){let n=[];for(let{provider:i}of this.providers){if(!h(i,r))continue;try{return await t(i)}catch(o){if(o instanceof s){n.push(o);continue}throw o}}throw this.composeError(e,r,n)}composeError(e,r,t,n){if(t.length===1){let[o]=t;if(o)return o}let i=[`No registered secret provider could ${e}`,`reference "${r}"`];if(n)i.push(`(version: ${n})`);if(t.length>1)i.push(`Attempts: ${t.map((o)=>`${o.provider}:${o.code}`).join(", ")}`);return new s({message:i.join(" "),provider:this.id,reference:r,code:t.length>0?t[t.length-1]?.code??"UNKNOWN":"UNKNOWN",cause:t})}}function h(e,r){try{return e.canHandle(r)}catch{return!1}}import{Buffer as R}from"buffer";var m=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;class F{id="scaleway-secret-manager";token;defaultRegion;defaultProjectId;baseUrl;fetchFn;constructor(e={}){this.token=e.token??process.env.SCW_SECRET_KEY??process.env.SCALEWAY_SECRET_KEY??"",this.defaultRegion=e.defaultRegion??process.env.SCW_DEFAULT_REGION??process.env.SCW_REGION,this.defaultProjectId=e.defaultProjectId??process.env.SCW_DEFAULT_PROJECT_ID??process.env.SCW_PROJECT_ID,this.baseUrl=e.baseUrl??"https://api.scaleway.com",this.fetchFn=e.fetch??fetch}canHandle(e){try{let r=d(e);return r.provider==="scw"&&(r.path==="secret-manager"||r.path.startsWith("secret-manager/"))}catch{return!1}}async getSecret(e,r){let t=this.parseReference(e);if(!this.token)throw new s({message:"Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",provider:this.id,reference:e,code:"FORBIDDEN"});if(!m.test(t.secretIdOrName))throw new s({message:"Scaleway getSecret requires a secretId (uuid) reference, not a secret name.",provider:this.id,reference:e,code:"INVALID"});let n=r?.version??t.revision??"latest",i=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(t.region)}/secrets/${encodeURIComponent(t.secretIdOrName)}/versions/${encodeURIComponent(n)}/access`,o=await this.fetchFn(i,{method:"GET",headers:{"X-Auth-Token":this.token}});if(!o.ok)throw await f({response:o,provider:this.id,reference:e,operation:"getSecret"});let c=await o.json(),a=B(c);return{data:R.from(a,"base64"),version:n,metadata:{region:t.region,secretId:t.secretIdOrName},retrievedAt:new Date}}async setSecret(e,r){let t=this.parseReference(e);if(!this.token)throw new s({message:"Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",provider:this.id,reference:e,code:"FORBIDDEN"});let n=l(r),i=R.from(n).toString("base64"),o=m.test(t.secretIdOrName)?t.secretIdOrName:await this.createSecret({region:t.region,name:t.secretIdOrName,reference:e}),c=await this.createSecretVersion({region:t.region,secretId:o,dataB64:i,reference:e});return{reference:this.buildReference(t.region,o,{version:c}),version:c}}async rotateSecret(e,r){return this.setSecret(e,r)}async deleteSecret(e){let r=this.parseReference(e);if(!this.token)throw new s({message:"Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).",provider:this.id,reference:e,code:"FORBIDDEN"});if(!m.test(r.secretIdOrName))throw new s({message:"Scaleway deleteSecret requires a secretId (uuid) reference, not a secret name.",provider:this.id,reference:e,code:"INVALID"});let t=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(r.region)}/secrets/${encodeURIComponent(r.secretIdOrName)}`,n=await this.fetchFn(t,{method:"DELETE",headers:{"X-Auth-Token":this.token}});if(!n.ok)throw await f({response:n,provider:this.id,reference:e,operation:"deleteSecret"})}parseReference(e){let r=d(e);if(r.provider!=="scw")throw new s({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:e,code:"INVALID"});let t=r.path.split("/").filter(Boolean);if(t.length<2||t[0]!=="secret-manager")throw new s({message:"Expected secret reference format scw://secret-manager/{region}/{secretIdOrName}[?version=...]",provider:this.id,reference:e,code:"INVALID"});let n=t[1]??this.defaultRegion;if(!n)throw new s({message:"Scaleway region must be provided either in reference (scw://secret-manager/{region}/...) or via SCW_DEFAULT_REGION/SCW_REGION.",provider:this.id,reference:e,code:"INVALID"});let i=t.slice(2).join("/");if(!i)throw new s({message:`Unable to resolve secret id/name from reference "${r.path}"`,provider:this.id,reference:e,code:"INVALID"});return{region:n,secretIdOrName:i,revision:r.extras?.version}}async createSecret(e){let r=this.defaultProjectId;if(!r)throw new s({message:"Scaleway project id is required to create secrets by name (set SCW_DEFAULT_PROJECT_ID/SCW_PROJECT_ID).",provider:this.id,reference:e.reference,code:"INVALID"});let t=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(e.region)}/secrets`,n=await this.fetchFn(t,{method:"POST",headers:{"Content-Type":"application/json","X-Auth-Token":this.token},body:JSON.stringify({name:e.name,project_id:r})});if(!n.ok)throw await f({response:n,provider:this.id,reference:e.reference,operation:"createSecret"});let i=await n.json();return M(i)}async createSecretVersion(e){let r=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(e.region)}/secrets/${encodeURIComponent(e.secretId)}/versions`,t=await this.fetchFn(r,{method:"POST",headers:{"Content-Type":"application/json","X-Auth-Token":this.token},body:JSON.stringify({data:e.dataB64})});if(!t.ok)throw await f({response:t,provider:this.id,reference:e.reference,operation:"createSecretVersion"});let n=await t.json();return K(n)??"latest"}buildReference(e,r,t){let n=`scw://secret-manager/${e}/${r}`,i=t?Object.entries(t).filter(([,o])=>Boolean(o)).map(([o,c])=>`${encodeURIComponent(o)}=${encodeURIComponent(c)}`).join("&"):"";return i?`${n}?${i}`:n}}function B(e){if(!e||typeof e!=="object")throw Error("Invalid scaleway secret payload");let r=e;if(typeof r.data==="string"&&r.data)return r.data;throw Error("Scaleway secret payload is missing data")}function M(e){if(!e||typeof e!=="object")throw Error("Invalid scaleway createSecret payload");let r=e;if(typeof r.id==="string"&&r.id)return r.id;throw Error("Scaleway createSecret response is missing id")}function K(e){if(!e||typeof e!=="object")return;let r=e;if(typeof r.revision==="number")return String(r.revision);if(typeof r.revision==="string"&&r.revision)return r.revision;if(typeof r.id==="string"&&r.id)return r.id;return}async function f(e){let{response:r,provider:t,reference:n,operation:i}=e,o=r.status===404?"NOT_FOUND":r.status===401||r.status===403?"FORBIDDEN":r.status>=400&&r.status<500?"INVALID":"UNKNOWN",c=await G(r),a=c?`Scaleway Secret Manager ${i} failed (${r.status}): ${c}`:`Scaleway Secret Manager ${i} failed (${r.status})`;return new s({message:a,provider:t,reference:n,code:o})}async function G(e){try{let t=(await e.text()).trim();return t.length?t:void 0}catch{return}}export{D as AwsSecretsManagerProvider,x as EnvSecretProvider,T as GcpSecretManagerProvider,F as ScalewaySecretManagerProvider,s as SecretProviderError,L as SecretProviderManager,l as normalizeSecretPayload,d as parseSecretUri};

package/dist/integrations/secrets/manager.d.ts

@@ -0,0 +1,44 @@
+import type { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from './provider.js';
+interface RegisterOptions {
+    /**
+     * Larger priority values are attempted first. Defaults to 0.
+     */
+    priority?: number;
+}
+export interface SecretProviderManagerOptions {
+    /**
+     * Override manager identifier. Defaults to "secret-provider-manager".
+     */
+    id?: string;
+    /**
+     * Providers to pre-register. They are registered in array order with
+     * descending priority (first entry wins ties).
+     */
+    providers?: {
+        provider: SecretProvider;
+        priority?: number;
+    }[];
+}
+/**
+ * Composite secret provider that delegates to registered providers.
+ * Providers are attempted in order of descending priority, respecting the
+ * registration order for ties. This enables privileged overrides (e.g.
+ * environment variables) while still supporting durable backends like GCP
+ * Secret Manager.
+ */
+export declare class SecretProviderManager implements SecretProvider {
+    readonly id: string;
+    private readonly providers;
+    private registrationCounter;
+    constructor(options?: SecretProviderManagerOptions);
+    register(provider: SecretProvider, options?: RegisterOptions): this;
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+    private delegateToFirst;
+    private composeError;
+}
+type SecretFetchOptions = Parameters<SecretProvider['getSecret']>[1];
+export {};

package/dist/integrations/secrets/manager.js

@@ -0,0 +1,2 @@
+// @bun
+import{Buffer as s}from"buffer";class c extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function y(e){if(!e)throw new c({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[t,r]=e.split("://");if(!t||!r)throw new c({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let o=r.indexOf("?");if(o===-1)return{provider:t,path:r};let i=r.slice(0,o),n=r.slice(o+1),d=Object.fromEntries(n.split("&").filter(Boolean).map((p)=>{let[S,f]=p.split("="),u=S??"",l=f??"";return[decodeURIComponent(u),decodeURIComponent(l)]}));return{provider:t,path:i,extras:d}}function h(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return s.from(e.data,"base64");if(e.encoding==="binary")return s.from(e.data,"binary");return s.from(e.data,"utf-8")}class v{id;providers=[];registrationCounter=0;constructor(e={}){this.id=e.id??"secret-provider-manager";let t=e.providers??[];for(let r of t)this.register(r.provider,{priority:r.priority})}register(e,t={}){return this.providers.push({provider:e,priority:t.priority??0,order:this.registrationCounter++}),this.providers.sort((r,o)=>{if(r.priority!==o.priority)return o.priority-r.priority;return r.order-o.order}),this}canHandle(e){return this.providers.some(({provider:t})=>a(t,e))}async getSecret(e,t){let r=[];for(let{provider:o}of this.providers){if(!a(o,e))continue;try{return await o.getSecret(e,t)}catch(i){if(i instanceof c){if(r.push(i),i.code!=="NOT_FOUND")break;continue}throw i}}throw this.composeError("getSecret",e,r,t?.version)}async setSecret(e,t){return this.delegateToFirst("setSecret",e,(r)=>r.setSecret(e,t))}async rotateSecret(e,t){return this.delegateToFirst("rotateSecret",e,(r)=>r.rotateSecret(e,t))}async deleteSecret(e){await this.delegateToFirst("deleteSecret",e,(t)=>t.deleteSecret(e))}async delegateToFirst(e,t,r){let o=[];for(let{provider:i}of this.providers){if(!a(i,t))continue;try{return await r(i)}catch(n){if(n instanceof c){o.push(n);continue}throw n}}throw this.composeError(e,t,o)}composeError(e,t,r,o){if(r.length===1){let[n]=r;if(n)return n}let i=[`No registered secret provider could ${e}`,`reference "${t}"`];if(o)i.push(`(version: ${o})`);if(r.length>1)i.push(`Attempts: ${r.map((n)=>`${n.provider}:${n.code}`).join(", ")}`);return new c({message:i.join(" "),provider:this.id,reference:t,code:r.length>0?r[r.length-1]?.code??"UNKNOWN":"UNKNOWN",cause:r})}}function a(e,t){try{return e.canHandle(t)}catch{return!1}}export{v as SecretProviderManager};

package/dist/integrations/secrets/provider.d.ts

@@ -0,0 +1,49 @@
+export type SecretReference = string;
+export interface SecretValue {
+    data: Uint8Array;
+    version?: string;
+    metadata?: Record<string, string>;
+    retrievedAt: Date;
+}
+export interface SecretFetchOptions {
+    version?: string;
+}
+export type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';
+export interface SecretWritePayload {
+    data: string | Uint8Array;
+    encoding?: SecretPayloadEncoding;
+    contentType?: string;
+    labels?: Record<string, string>;
+}
+export interface SecretRotationResult {
+    reference: SecretReference;
+    version: string;
+}
+export interface SecretProvider {
+    readonly id: string;
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+}
+export interface ParsedSecretUri {
+    provider: string;
+    path: string;
+    extras?: Record<string, string>;
+}
+export declare class SecretProviderError extends Error {
+    readonly provider: string;
+    readonly reference: SecretReference;
+    readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';
+    readonly cause?: unknown;
+    constructor(params: {
+        message: string;
+        provider: string;
+        reference: SecretReference;
+        code?: SecretProviderError['code'];
+        cause?: unknown;
+    });
+}
+export declare function parseSecretUri(reference: SecretReference): ParsedSecretUri;
+export declare function normalizeSecretPayload(payload: SecretWritePayload): Uint8Array;

package/dist/integrations/secrets/provider.js

@@ -0,0 +1,2 @@
+// @bun
+import{Buffer as o}from"buffer";class c extends Error{provider;reference;code;cause;constructor(e){super(e.message);this.name="SecretProviderError",this.provider=e.provider,this.reference=e.reference,this.code=e.code??"UNKNOWN",this.cause=e.cause}}function g(e){if(!e)throw new c({message:"Secret reference cannot be empty",provider:"unknown",reference:e,code:"INVALID"});let[t,r]=e.split("://");if(!t||!r)throw new c({message:`Invalid secret reference: ${e}`,provider:"unknown",reference:e,code:"INVALID"});let n=r.indexOf("?");if(n===-1)return{provider:t,path:r};let i=r.slice(0,n),s=r.slice(n+1),a=Object.fromEntries(s.split("&").filter(Boolean).map((d)=>{let[f,S]=d.split("="),p=f??"",u=S??"";return[decodeURIComponent(p),decodeURIComponent(u)]}));return{provider:t,path:i,extras:a}}function R(e){if(e.data instanceof Uint8Array)return e.data;if(e.encoding==="base64")return o.from(e.data,"base64");if(e.encoding==="binary")return o.from(e.data,"binary");return o.from(e.data,"utf-8")}export{c as SecretProviderError,R as normalizeSecretPayload,g as parseSecretUri};

package/dist/integrations/secrets/provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/secrets/scaleway-secret-manager.d.ts

@@ -0,0 +1,35 @@
+import type { SecretFetchOptions, SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from './provider.js';
+interface ScalewaySecretManagerProviderOptions {
+    /**
+     * Scaleway API token (SCW secret key). If omitted, uses env vars.
+     * Header: X-Auth-Token
+     */
+    token?: string;
+    /** Default region when not present in reference (e.g. fr-par). */
+    defaultRegion?: string;
+    /** Default project id used when creating secrets by name. */
+    defaultProjectId?: string;
+    /** Override API base url (defaults to https://api.scaleway.com). */
+    baseUrl?: string;
+    /** Inject fetch for tests. */
+    fetch?: typeof fetch;
+}
+export declare class ScalewaySecretManagerProvider implements SecretProvider {
+    readonly id = "scaleway-secret-manager";
+    private readonly token;
+    private readonly defaultRegion?;
+    private readonly defaultProjectId?;
+    private readonly baseUrl;
+    private readonly fetchFn;
+    constructor(options?: ScalewaySecretManagerProviderOptions);
+    canHandle(reference: SecretReference): boolean;
+    getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+    setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+    deleteSecret(reference: SecretReference): Promise<void>;
+    private parseReference;
+    private createSecret;
+    private createSecretVersion;
+    private buildReference;
+}
+export {};