@lssm/lib.contracts 0.0.0-canary-20251217083314 → 0.0.0-canary-20251219202229

package/dist/integrations/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","names":["secretProvider: SecretProvider"],"sources":["../../src/integrations/runtime.ts"],"sourcesContent":["import { performance } from 'node:perf_hooks';\nimport type {\n  ResolvedAppConfig,\n  ResolvedIntegration,\n} from '../app-config/runtime';\nimport type { ConnectionStatus, IntegrationConnection } from './connection';\nimport type { IntegrationSpec } from './spec';\nimport type { SecretProvider, SecretValue } from './secrets/provider';\n\nexport interface IntegrationTraceMetadata {\n  blueprintName: string;\n  blueprintVersion: number;\n  configVersion: number;\n}\n\nexport interface IntegrationTelemetryEvent {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  slotId?: string;\n  integrationKey: string;\n  integrationVersion: number;\n  connectionId: string;\n  status: 'success' | 'error';\n  durationMs?: number;\n  errorCode?: string;\n  errorMessage?: string;\n  occurredAt: Date;\n  metadata?: Record<string, string | number | boolean>;\n}\n\nexport interface IntegrationTelemetryEmitter {\n  record(event: IntegrationTelemetryEvent): Promise<void> | void;\n}\n\nexport type IntegrationInvocationStatus = 'success' | 'error';\n\nexport interface IntegrationContext {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  slotId?: string;\n  spec: IntegrationSpec;\n  connection: IntegrationConnection;\n  secretProvider: SecretProvider;\n  secretReference: string;\n  trace: IntegrationTraceMetadata;\n  config?: Record<string, unknown>;\n}\n\nexport interface IntegrationCallContext {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  blueprintName: string;\n  blueprintVersion: number;\n  configVersion: number;\n  slotId: string;\n  operation: string;\n}\n\nexport interface IntegrationCallError {\n  code: string;\n  message: string;\n  retryable: boolean;\n  cause?: unknown;\n}\n\nexport interface IntegrationCallResult<T> {\n  success: boolean;\n  data?: T;\n  error?: IntegrationCallError;\n  metadata: {\n    latencyMs: number;\n    connectionId: string;\n    ownershipMode: IntegrationConnection['ownershipMode'];\n    attempts: number;\n  };\n}\n\nexport interface IntegrationCallGuardOptions {\n  telemetry?: IntegrationTelemetryEmitter;\n  maxAttempts?: number;\n  backoffMs?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => Date;\n}\n\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_BACKOFF_MS = 250;\n\nexport class IntegrationCallGuard {\n  private readonly telemetry?: IntegrationTelemetryEmitter;\n  private readonly maxAttempts: number;\n  private readonly backoffMs: number;\n  private readonly shouldRetry: (error: unknown, attempt: number) => boolean;\n  private readonly sleep: (ms: number) => Promise<void>;\n  private readonly now: () => Date;\n\n  constructor(\n    private readonly secretProvider: SecretProvider,\n    options: IntegrationCallGuardOptions = {}\n  ) {\n    this.telemetry = options.telemetry;\n    this.maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);\n    this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;\n    this.shouldRetry =\n      options.shouldRetry ??\n      ((error: unknown) =>\n        typeof error === 'object' &&\n        error !== null &&\n        'retryable' in error &&\n        Boolean((error as { retryable?: unknown }).retryable));\n    this.sleep =\n      options.sleep ??\n      ((ms: number) =>\n        ms <= 0\n          ? Promise.resolve()\n          : new Promise((resolve) => setTimeout(resolve, ms)));\n    this.now = options.now ?? (() => new Date());\n  }\n\n  async executeWithGuards<T>(\n    slotId: string,\n    operation: string,\n    input: unknown,\n    resolvedConfig: ResolvedAppConfig,\n    executor: (\n      connection: IntegrationConnection,\n      secrets: Record<string, string>\n    ) => Promise<T>\n  ): Promise<IntegrationCallResult<T>> {\n    const integration = this.findIntegration(slotId, resolvedConfig);\n    if (!integration) {\n      return this.failure(\n        {\n          tenantId: resolvedConfig.tenantId,\n          appId: resolvedConfig.appId,\n          environment: resolvedConfig.environment,\n          blueprintName: resolvedConfig.blueprintName,\n          blueprintVersion: resolvedConfig.blueprintVersion,\n          configVersion: resolvedConfig.configVersion,\n          slotId,\n          operation,\n        },\n        undefined,\n        {\n          code: 'SLOT_NOT_BOUND',\n          message: `Integration slot \"${slotId}\" is not bound for tenant \"${resolvedConfig.tenantId}\".`,\n          retryable: false,\n        },\n        0\n      );\n    }\n\n    const status = integration.connection.status;\n    if (status === 'disconnected' || status === 'error') {\n      return this.failure(\n        this.makeContext(slotId, operation, resolvedConfig),\n        integration,\n        {\n          code: 'CONNECTION_NOT_READY',\n          message: `Integration connection \"${integration.connection.meta.label}\" is in status \"${status}\".`,\n          retryable: false,\n        },\n        0\n      );\n    }\n\n    const secrets = await this.fetchSecrets(integration.connection);\n\n    let attempt = 0;\n    const started = performance.now();\n    while (attempt < this.maxAttempts) {\n      attempt += 1;\n      try {\n        const data = await executor(integration.connection, secrets);\n        const duration = performance.now() - started;\n        this.emitTelemetry(\n          this.makeContext(slotId, operation, resolvedConfig),\n          integration,\n          'success',\n          duration\n        );\n        return {\n          success: true,\n          data,\n          metadata: {\n            latencyMs: duration,\n            connectionId: integration.connection.meta.id,\n            ownershipMode: integration.connection.ownershipMode,\n            attempts: attempt,\n          },\n        };\n      } catch (error) {\n        const duration = performance.now() - started;\n        this.emitTelemetry(\n          this.makeContext(slotId, operation, resolvedConfig),\n          integration,\n          'error',\n          duration,\n          this.errorCodeFor(error),\n          error instanceof Error ? error.message : String(error)\n        );\n        const retryable = this.shouldRetry(error, attempt);\n        if (!retryable || attempt >= this.maxAttempts) {\n          return {\n            success: false,\n            error: {\n              code: this.errorCodeFor(error),\n              message: error instanceof Error ? error.message : String(error),\n              retryable,\n              cause: error,\n            },\n            metadata: {\n              latencyMs: duration,\n              connectionId: integration.connection.meta.id,\n              ownershipMode: integration.connection.ownershipMode,\n              attempts: attempt,\n            },\n          };\n        }\n        await this.sleep(this.backoffMs);\n      }\n    }\n\n    // Should never reach here due to loop logic.\n    return {\n      success: false,\n      error: {\n        code: 'UNKNOWN_ERROR',\n        message: 'Integration call failed after retries.',\n        retryable: false,\n      },\n      metadata: {\n        latencyMs: performance.now() - started,\n        connectionId: integration.connection.meta.id,\n        ownershipMode: integration.connection.ownershipMode,\n        attempts: this.maxAttempts,\n      },\n    };\n  }\n\n  private findIntegration(\n    slotId: string,\n    config: ResolvedAppConfig\n  ): ResolvedIntegration | undefined {\n    return config.integrations.find(\n      (integration) => integration.slot.slotId === slotId\n    );\n  }\n\n  private async fetchSecrets(\n    connection: IntegrationConnection\n  ): Promise<Record<string, string>> {\n    if (!this.secretProvider.canHandle(connection.secretRef)) {\n      throw new Error(\n        `Secret provider \"${this.secretProvider.id}\" cannot handle reference \"${connection.secretRef}\".`\n      );\n    }\n    const secret = await this.secretProvider.getSecret(connection.secretRef);\n    return this.parseSecret(secret);\n  }\n\n  private parseSecret(secret: SecretValue): Record<string, string> {\n    const text = new TextDecoder().decode(secret.data);\n    try {\n      const parsed = JSON.parse(text);\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        const entries = Object.entries(parsed).filter(\n          ([, value]) =>\n            typeof value === 'string' ||\n            typeof value === 'number' ||\n            typeof value === 'boolean'\n        );\n        return Object.fromEntries(\n          entries.map(([key, value]) => [key, String(value)])\n        );\n      }\n    } catch {\n      // Fall through to raw secret.\n    }\n    return { secret: text };\n  }\n\n  private emitTelemetry(\n    context: IntegrationCallContext,\n    integration: ResolvedIntegration | undefined,\n    status: 'success' | 'error',\n    durationMs: number,\n    errorCode?: string,\n    errorMessage?: string\n  ) {\n    if (!this.telemetry || !integration) return;\n    this.telemetry.record({\n      tenantId: context.tenantId,\n      appId: context.appId,\n      environment: context.environment,\n      slotId: context.slotId,\n      integrationKey: integration.connection.meta.integrationKey,\n      integrationVersion: integration.connection.meta.integrationVersion,\n      connectionId: integration.connection.meta.id,\n      status,\n      durationMs,\n      errorCode,\n      errorMessage,\n      occurredAt: this.now(),\n      metadata: {\n        blueprint: `${context.blueprintName}.v${context.blueprintVersion}`,\n        configVersion: context.configVersion,\n        operation: context.operation,\n      },\n    });\n  }\n\n  private failure<T>(\n    context: IntegrationCallContext,\n    integration: ResolvedIntegration | undefined,\n    error: IntegrationCallError,\n    attempts: number\n  ): IntegrationCallResult<T> {\n    if (integration) {\n      this.emitTelemetry(\n        context,\n        integration,\n        'error',\n        0,\n        error.code,\n        error.message\n      );\n    }\n    return {\n      success: false,\n      error,\n      metadata: {\n        latencyMs: 0,\n        connectionId: integration?.connection.meta.id ?? 'unknown',\n        ownershipMode: integration?.connection.ownershipMode ?? 'managed',\n        attempts,\n      },\n    };\n  }\n\n  private makeContext(\n    slotId: string,\n    operation: string,\n    config: ResolvedAppConfig\n  ): IntegrationCallContext {\n    return {\n      tenantId: config.tenantId,\n      appId: config.appId,\n      environment: config.environment,\n      blueprintName: config.blueprintName,\n      blueprintVersion: config.blueprintVersion,\n      configVersion: config.configVersion,\n      slotId,\n      operation,\n    };\n  }\n\n  private errorCodeFor(error: unknown): string {\n    if (\n      typeof error === 'object' &&\n      error !== null &&\n      'code' in error &&\n      typeof (error as { code?: unknown }).code === 'string'\n    ) {\n      return (error as { code: string }).code;\n    }\n    return 'PROVIDER_ERROR';\n  }\n}\n\nexport function ensureConnectionReady(integration: ResolvedIntegration): void {\n  const status = integration.connection.status;\n  if (status === 'disconnected' || status === 'error') {\n    throw new Error(\n      `Integration connection \"${integration.connection.meta.label}\" is in status \"${status}\".`\n    );\n  }\n}\n\nexport function connectionStatusLabel(status: ConnectionStatus): string {\n  switch (status) {\n    case 'connected':\n      return 'connected';\n    case 'disconnected':\n      return 'disconnected';\n    case 'error':\n      return 'error';\n    case 'unknown':\n    default:\n      return 'unknown';\n  }\n}\n"],"mappings":";;;AAyFA,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB;AAE3B,IAAa,uBAAb,MAAkC;CAChC,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YACE,AAAiBA,gBACjB,UAAuC,EAAE,EACzC;EAFiB;AAGjB,OAAK,YAAY,QAAQ;AACzB,OAAK,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,qBAAqB;AAC3E,OAAK,YAAY,QAAQ,aAAa;AACtC,OAAK,cACH,QAAQ,iBACN,UACA,OAAO,UAAU,YACjB,UAAU,QACV,eAAe,SACf,QAAS,MAAkC,UAAU;AACzD,OAAK,QACH,QAAQ,WACN,OACA,MAAM,IACF,QAAQ,SAAS,GACjB,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;AACzD,OAAK,MAAM,QAAQ,8BAAc,IAAI,MAAM;;CAG7C,MAAM,kBACJ,QACA,WACA,OACA,gBACA,UAImC;EACnC,MAAM,cAAc,KAAK,gBAAgB,QAAQ,eAAe;AAChE,MAAI,CAAC,YACH,QAAO,KAAK,QACV;GACE,UAAU,eAAe;GACzB,OAAO,eAAe;GACtB,aAAa,eAAe;GAC5B,eAAe,eAAe;GAC9B,kBAAkB,eAAe;GACjC,eAAe,eAAe;GAC9B;GACA;GACD,EACD,QACA;GACE,MAAM;GACN,SAAS,qBAAqB,OAAO,6BAA6B,eAAe,SAAS;GAC1F,WAAW;GACZ,EACD,EACD;EAGH,MAAM,SAAS,YAAY,WAAW;AACtC,MAAI,WAAW,kBAAkB,WAAW,QAC1C,QAAO,KAAK,QACV,KAAK,YAAY,QAAQ,WAAW,eAAe,EACnD,aACA;GACE,MAAM;GACN,SAAS,2BAA2B,YAAY,WAAW,KAAK,MAAM,kBAAkB,OAAO;GAC/F,WAAW;GACZ,EACD,EACD;EAGH,MAAM,UAAU,MAAM,KAAK,aAAa,YAAY,WAAW;EAE/D,IAAI,UAAU;EACd,MAAM,UAAU,YAAY,KAAK;AACjC,SAAO,UAAU,KAAK,aAAa;AACjC,cAAW;AACX,OAAI;IACF,MAAM,OAAO,MAAM,SAAS,YAAY,YAAY,QAAQ;IAC5D,MAAM,WAAW,YAAY,KAAK,GAAG;AACrC,SAAK,cACH,KAAK,YAAY,QAAQ,WAAW,eAAe,EACnD,aACA,WACA,SACD;AACD,WAAO;KACL,SAAS;KACT;KACA,UAAU;MACR,WAAW;MACX,cAAc,YAAY,WAAW,KAAK;MAC1C,eAAe,YAAY,WAAW;MACtC,UAAU;MACX;KACF;YACM,OAAO;IACd,MAAM,WAAW,YAAY,KAAK,GAAG;AACrC,SAAK,cACH,KAAK,YAAY,QAAQ,WAAW,eAAe,EACnD,aACA,SACA,UACA,KAAK,aAAa,MAAM,EACxB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACvD;IACD,MAAM,YAAY,KAAK,YAAY,OAAO,QAAQ;AAClD,QAAI,CAAC,aAAa,WAAW,KAAK,YAChC,QAAO;KACL,SAAS;KACT,OAAO;MACL,MAAM,KAAK,aAAa,MAAM;MAC9B,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;MAC/D;MACA,OAAO;MACR;KACD,UAAU;MACR,WAAW;MACX,cAAc,YAAY,WAAW,KAAK;MAC1C,eAAe,YAAY,WAAW;MACtC,UAAU;MACX;KACF;AAEH,UAAM,KAAK,MAAM,KAAK,UAAU;;;AAKpC,SAAO;GACL,SAAS;GACT,OAAO;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACZ;GACD,UAAU;IACR,WAAW,YAAY,KAAK,GAAG;IAC/B,cAAc,YAAY,WAAW,KAAK;IAC1C,eAAe,YAAY,WAAW;IACtC,UAAU,KAAK;IAChB;GACF;;CAGH,AAAQ,gBACN,QACA,QACiC;AACjC,SAAO,OAAO,aAAa,MACxB,gBAAgB,YAAY,KAAK,WAAW,OAC9C;;CAGH,MAAc,aACZ,YACiC;AACjC,MAAI,CAAC,KAAK,eAAe,UAAU,WAAW,UAAU,CACtD,OAAM,IAAI,MACR,oBAAoB,KAAK,eAAe,GAAG,6BAA6B,WAAW,UAAU,IAC9F;EAEH,MAAM,SAAS,MAAM,KAAK,eAAe,UAAU,WAAW,UAAU;AACxE,SAAO,KAAK,YAAY,OAAO;;CAGjC,AAAQ,YAAY,QAA6C;EAC/D,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,OAAO,KAAK;AAClD,MAAI;GACF,MAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,OAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,OAAO,EAAE;IAClE,MAAM,UAAU,OAAO,QAAQ,OAAO,CAAC,QACpC,GAAG,WACF,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,UACpB;AACD,WAAO,OAAO,YACZ,QAAQ,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,OAAO,MAAM,CAAC,CAAC,CACpD;;UAEG;AAGR,SAAO,EAAE,QAAQ,MAAM;;CAGzB,AAAQ,cACN,SACA,aACA,QACA,YACA,WACA,cACA;AACA,MAAI,CAAC,KAAK,aAAa,CAAC,YAAa;AACrC,OAAK,UAAU,OAAO;GACpB,UAAU,QAAQ;GAClB,OAAO,QAAQ;GACf,aAAa,QAAQ;GACrB,QAAQ,QAAQ;GAChB,gBAAgB,YAAY,WAAW,KAAK;GAC5C,oBAAoB,YAAY,WAAW,KAAK;GAChD,cAAc,YAAY,WAAW,KAAK;GAC1C;GACA;GACA;GACA;GACA,YAAY,KAAK,KAAK;GACtB,UAAU;IACR,WAAW,GAAG,QAAQ,cAAc,IAAI,QAAQ;IAChD,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACpB;GACF,CAAC;;CAGJ,AAAQ,QACN,SACA,aACA,OACA,UAC0B;AAC1B,MAAI,YACF,MAAK,cACH,SACA,aACA,SACA,GACA,MAAM,MACN,MAAM,QACP;AAEH,SAAO;GACL,SAAS;GACT;GACA,UAAU;IACR,WAAW;IACX,cAAc,aAAa,WAAW,KAAK,MAAM;IACjD,eAAe,aAAa,WAAW,iBAAiB;IACxD;IACD;GACF;;CAGH,AAAQ,YACN,QACA,WACA,QACwB;AACxB,SAAO;GACL,UAAU,OAAO;GACjB,OAAO,OAAO;GACd,aAAa,OAAO;GACpB,eAAe,OAAO;GACtB,kBAAkB,OAAO;GACzB,eAAe,OAAO;GACtB;GACA;GACD;;CAGH,AAAQ,aAAa,OAAwB;AAC3C,MACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAQ,MAA6B,SAAS,SAE9C,QAAQ,MAA2B;AAErC,SAAO;;;AAIX,SAAgB,sBAAsB,aAAwC;CAC5E,MAAM,SAAS,YAAY,WAAW;AACtC,KAAI,WAAW,kBAAkB,WAAW,QAC1C,OAAM,IAAI,MACR,2BAA2B,YAAY,WAAW,KAAK,MAAM,kBAAkB,OAAO,IACvF;;AAIL,SAAgB,sBAAsB,QAAkC;AACtE,SAAQ,QAAR;EACE,KAAK,YACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK;EACL,QACE,QAAO"}

package/dist/integrations/secrets/aws-secret-manager.d.ts

@@ -28,4 +28,5 @@ declare class AwsSecretsManagerProvider implements SecretProvider {
   private buildReference;
 }
 //#endregion
-export { AwsSecretsManagerProvider };
+export { AwsSecretsManagerProvider };
+//# sourceMappingURL=aws-secret-manager.d.ts.map

package/dist/integrations/secrets/aws-secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-secret-manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/aws-secret-manager.ts"],"sourcesContent":[],"mappings":";;;;KAwBK,uBAAA,GAA0B,KAAK;KAE/B,6BAAA,GAAgC,6BAC5B;AALW,UAQV,gCAAA,CAN0B;EAE/B,MAAA,CAAA,EAAA,MAAA;EAIK,MAAA,CAAA,EAEC,uBAFD;EAeG,YAAA,CAAA,EAZI,6BAYsB;;AAchB,cAdV,yBAAA,YAAqC,cAc3B,CAAA;EAcR,SAAA,EAAA,GAAA,qBAAA;EACD,iBAAA,cAAA;EACD,iBAAA,cAAA;EAAR,iBAAA,YAAA;EAsCU,iBAAA,eAAA;EACF,WAAA,CAAA,OAAA,CAAA,EA7DU,gCA6DV;EACA,SAAA,CAAA,SAAA,EAxDU,eAwDV,CAAA,EAAA,OAAA;EAAR,SAAA,CAAA,SAAA,EA1CU,eA0CV,EAAA,OAAA,CAAA,EAzCS,kBAyCT,CAAA,EAxCA,OAwCA,CAxCQ,WAwCR,CAAA;EA4EU,SAAA,CAAA,SAAA,EA9EA,eA8EA,EAAA,OAAA,EA7EF,kBA6EE,CAAA,EA5EV,OA4EU,CA5EF,oBA4EE,CAAA;EACF,YAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EAImB,eAJnB,CAAA,EAIqC,OAJrC,CAAA,IAAA,CAAA;EAAR,QAAA,SAAA;EAI2B,QAAA,cAAA;EAAkB,QAAA,aAAA;EAxJA,QAAA,oBAAA;EAAc,QAAA,cAAA"}

package/dist/integrations/secrets/aws-secret-manager.js

@@ -228,4 +228,5 @@ function toAwsSecretProviderError(params) {
 }
 
 //#endregion
-export { AwsSecretsManagerProvider };
+export { AwsSecretsManagerProvider };
+//# sourceMappingURL=aws-secret-manager.js.map

package/dist/integrations/secrets/aws-secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-secret-manager.js","names":["code: SecretProviderError['code']"],"sources":["../../../src/integrations/secrets/aws-secret-manager.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n\nimport {\n  CreateSecretCommand,\n  DeleteSecretCommand,\n  GetSecretValueCommand,\n  PutSecretValueCommand,\n  SecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\n\nimport {\n  normalizeSecretPayload,\n  parseSecretUri,\n  SecretProviderError,\n} from './provider';\nimport type {\n  SecretFetchOptions,\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ntype AwsSecretsManagerClient = Pick<SecretsManagerClient, 'send'>;\n\ntype AwsSecretsManagerClientConfig = ConstructorParameters<\n  typeof SecretsManagerClient\n>[0];\n\ninterface AwsSecretsManagerProviderOptions {\n  region?: string;\n  client?: AwsSecretsManagerClient;\n  clientConfig?: AwsSecretsManagerClientConfig;\n}\n\ninterface AwsSecretLocation {\n  region: string;\n  secretId: string;\n  version?: string;\n  stage?: string;\n}\n\nconst DEFAULT_DELETE_RECOVERY_DAYS = 7;\n\nexport class AwsSecretsManagerProvider implements SecretProvider {\n  readonly id = 'aws-secrets-manager';\n\n  private readonly explicitRegion?: string;\n  private readonly injectedClient?: AwsSecretsManagerClient;\n  private readonly clientConfig?: AwsSecretsManagerClientConfig;\n  private readonly clientsByRegion = new Map<string, AwsSecretsManagerClient>();\n\n  constructor(options: AwsSecretsManagerProviderOptions = {}) {\n    this.explicitRegion = options.region;\n    this.injectedClient = options.client;\n    this.clientConfig = options.clientConfig;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    try {\n      const parsed = parseSecretUri(reference);\n      return (\n        parsed.provider === 'aws' &&\n        (parsed.path === 'secretsmanager' ||\n          parsed.path.startsWith('secretsmanager/'))\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue> {\n    const location = this.parseReference(reference);\n    const client = this.getClient(location.region);\n\n    const requestedVersion =\n      options?.version ?? location.stage ?? location.version;\n    const input = {\n      SecretId: location.secretId,\n      ...this.buildVersionSelector(requestedVersion),\n    };\n\n    try {\n      const result = await client.send(new GetSecretValueCommand(input));\n      const data = extractAwsSecretBytes(result, reference, this.id);\n      return {\n        data,\n        version:\n          typeof result.VersionId === 'string' && result.VersionId\n            ? result.VersionId\n            : requestedVersion,\n        metadata: {\n          region: location.region,\n          secretId: location.secretId,\n          ...(requestedVersion ? { requestedVersion } : {}),\n        },\n        retrievedAt: new Date(),\n      };\n    } catch (error) {\n      throw toAwsSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'getSecret',\n      });\n    }\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    const location = this.parseReference(reference);\n    const client = this.getClient(location.region);\n    const bytes = normalizeSecretPayload(payload);\n\n    try {\n      const result = await client.send(\n        new PutSecretValueCommand({\n          SecretId: location.secretId,\n          SecretBinary: bytes,\n        })\n      );\n\n      const versionId =\n        typeof result.VersionId === 'string' && result.VersionId\n          ? result.VersionId\n          : 'latest';\n\n      return {\n        reference: this.buildReference(location.region, location.secretId, {\n          version: versionId,\n        }),\n        version: versionId,\n      };\n    } catch (error) {\n      if (!isAwsNotFound(error)) {\n        throw toAwsSecretProviderError({\n          error,\n          provider: this.id,\n          reference,\n          operation: 'putSecretValue',\n        });\n      }\n\n      // Secret doesn't exist yet: create it when reference is name-like.\n      if (looksLikeAwsArn(location.secretId)) {\n        throw new SecretProviderError({\n          message: `Secret not found: ${location.secretId}`,\n          provider: this.id,\n          reference,\n          code: 'NOT_FOUND',\n          cause: error,\n        });\n      }\n\n      try {\n        const created = await client.send(\n          new CreateSecretCommand({\n            Name: location.secretId,\n            SecretBinary: bytes,\n          })\n        );\n\n        const versionId =\n          typeof created.VersionId === 'string' && created.VersionId\n            ? created.VersionId\n            : 'latest';\n\n        return {\n          reference: this.buildReference(location.region, location.secretId, {\n            version: versionId,\n          }),\n          version: versionId,\n        };\n      } catch (creationError) {\n        throw toAwsSecretProviderError({\n          error: creationError,\n          provider: this.id,\n          reference,\n          operation: 'createSecret',\n        });\n      }\n    }\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.setSecret(reference, payload);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    const location = this.parseReference(reference);\n    const client = this.getClient(location.region);\n\n    try {\n      await client.send(\n        new DeleteSecretCommand({\n          SecretId: location.secretId,\n          RecoveryWindowInDays: DEFAULT_DELETE_RECOVERY_DAYS,\n        })\n      );\n    } catch (error) {\n      throw toAwsSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'deleteSecret',\n      });\n    }\n  }\n\n  private getClient(region: string): AwsSecretsManagerClient {\n    if (this.injectedClient) {\n      return this.injectedClient;\n    }\n\n    const cached = this.clientsByRegion.get(region);\n    if (cached) {\n      return cached;\n    }\n\n    const client = new SecretsManagerClient({\n      ...(this.clientConfig ?? {}),\n      region,\n    });\n\n    this.clientsByRegion.set(region, client);\n    return client;\n  }\n\n  private parseReference(reference: SecretReference): AwsSecretLocation {\n    const parsed = parseSecretUri(reference);\n    if (parsed.provider !== 'aws') {\n      throw new SecretProviderError({\n        message: `Unsupported secret provider: ${parsed.provider}`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const segments = parsed.path.split('/').filter(Boolean);\n    if (segments.length < 3 || segments[0] !== 'secretsmanager') {\n      throw new SecretProviderError({\n        message:\n          'Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]',\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const regionCandidate = segments[1];\n    const region = this.resolveRegion(regionCandidate);\n\n    const secretId = segments.slice(2).join('/');\n    if (!secretId) {\n      throw new SecretProviderError({\n        message: `Unable to resolve secret id from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    return {\n      region,\n      secretId,\n      version: parsed.extras?.version,\n      stage: parsed.extras?.stage,\n    };\n  }\n\n  private resolveRegion(regionCandidate?: string): string {\n    const region =\n      regionCandidate ??\n      this.explicitRegion ??\n      process.env.AWS_REGION ??\n      process.env.AWS_DEFAULT_REGION;\n\n    if (!region) {\n      throw new SecretProviderError({\n        message:\n          'AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.',\n        provider: this.id,\n        reference: 'aws://secretsmanager//',\n        code: 'INVALID',\n      });\n    }\n\n    return region;\n  }\n\n  private buildVersionSelector(\n    version?: string\n  ): { VersionStage?: string; VersionId?: string } | Record<string, never> {\n    if (!version) return {};\n\n    if (version === 'latest' || version === 'current') {\n      return { VersionStage: 'AWSCURRENT' };\n    }\n\n    if (version.startsWith('AWS')) {\n      return { VersionStage: version };\n    }\n\n    return { VersionId: version };\n  }\n\n  private buildReference(\n    region: string,\n    secretId: string,\n    extras?: Record<string, string>\n  ): string {\n    const base = `aws://secretsmanager/${region}/${secretId}`;\n    const query = extras\n      ? Object.entries(extras)\n          .filter(([, value]) => Boolean(value))\n          .map(\n            ([key, value]) =>\n              `${encodeURIComponent(key)}=${encodeURIComponent(value)}`\n          )\n          .join('&')\n      : '';\n\n    return query ? `${base}?${query}` : base;\n  }\n}\n\nfunction extractAwsSecretBytes(\n  result: unknown,\n  reference: SecretReference,\n  provider: string\n): Uint8Array {\n  if (!result || typeof result !== 'object') {\n    throw new SecretProviderError({\n      message: 'Invalid AWS Secrets Manager response',\n      provider,\n      reference,\n      code: 'UNKNOWN',\n      cause: result,\n    });\n  }\n\n  const record = result as {\n    SecretBinary?: unknown;\n    SecretString?: unknown;\n  };\n\n  if (record.SecretBinary instanceof Uint8Array) {\n    return record.SecretBinary;\n  }\n\n  if (typeof record.SecretBinary === 'string') {\n    // Some runtimes may coerce binary payload to base64 string.\n    return Buffer.from(record.SecretBinary, 'base64');\n  }\n\n  if (typeof record.SecretString === 'string') {\n    return Buffer.from(record.SecretString, 'utf-8');\n  }\n\n  throw new SecretProviderError({\n    message: 'AWS secret value is empty',\n    provider,\n    reference,\n    code: 'NOT_FOUND',\n    cause: result,\n  });\n}\n\nfunction looksLikeAwsArn(secretId: string): boolean {\n  return secretId.startsWith('arn:aws:secretsmanager:');\n}\n\nfunction isAwsNotFound(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false;\n  const err = error as {\n    name?: unknown;\n    $metadata?: { httpStatusCode?: unknown };\n  };\n  if (typeof err.$metadata?.httpStatusCode === 'number') {\n    return err.$metadata.httpStatusCode === 404;\n  }\n  return err.name === 'ResourceNotFoundException';\n}\n\nfunction toAwsSecretProviderError(params: {\n  error: unknown;\n  provider: string;\n  reference: SecretReference;\n  operation: string;\n}): SecretProviderError {\n  const { error, provider, reference, operation } = params;\n\n  if (error instanceof SecretProviderError) {\n    return error;\n  }\n\n  const httpStatusCode =\n    typeof error === 'object' &&\n    error !== null &&\n    '$metadata' in error &&\n    typeof (error as { $metadata?: unknown }).$metadata === 'object' &&\n    (error as { $metadata?: { httpStatusCode?: unknown } }).$metadata\n      ?.httpStatusCode;\n\n  const code: SecretProviderError['code'] =\n    httpStatusCode === 404\n      ? 'NOT_FOUND'\n      : httpStatusCode === 401 || httpStatusCode === 403\n        ? 'FORBIDDEN'\n        : httpStatusCode === 400\n          ? 'INVALID'\n          : 'UNKNOWN';\n\n  const message =\n    error instanceof Error\n      ? error.message\n      : `Unknown error during ${operation}`;\n\n  return new SecretProviderError({\n    message,\n    provider,\n    reference,\n    code,\n    cause: error,\n  });\n}\n"],"mappings":";;;;;AA2CA,MAAM,+BAA+B;AAErC,IAAa,4BAAb,MAAiE;CAC/D,AAAS,KAAK;CAEd,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB,kCAAkB,IAAI,KAAsC;CAE7E,YAAY,UAA4C,EAAE,EAAE;AAC1D,OAAK,iBAAiB,QAAQ;AAC9B,OAAK,iBAAiB,QAAQ;AAC9B,OAAK,eAAe,QAAQ;;CAG9B,UAAU,WAAqC;AAC7C,MAAI;GACF,MAAM,SAAS,eAAe,UAAU;AACxC,UACE,OAAO,aAAa,UACnB,OAAO,SAAS,oBACf,OAAO,KAAK,WAAW,kBAAkB;UAEvC;AACN,UAAO;;;CAIX,MAAM,UACJ,WACA,SACsB;EACtB,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,SAAS,KAAK,UAAU,SAAS,OAAO;EAE9C,MAAM,mBACJ,SAAS,WAAW,SAAS,SAAS,SAAS;EACjD,MAAM,QAAQ;GACZ,UAAU,SAAS;GACnB,GAAG,KAAK,qBAAqB,iBAAiB;GAC/C;AAED,MAAI;GACF,MAAM,SAAS,MAAM,OAAO,KAAK,IAAI,sBAAsB,MAAM,CAAC;AAElE,UAAO;IACL,MAFW,sBAAsB,QAAQ,WAAW,KAAK,GAAG;IAG5D,SACE,OAAO,OAAO,cAAc,YAAY,OAAO,YAC3C,OAAO,YACP;IACN,UAAU;KACR,QAAQ,SAAS;KACjB,UAAU,SAAS;KACnB,GAAI,mBAAmB,EAAE,kBAAkB,GAAG,EAAE;KACjD;IACD,6BAAa,IAAI,MAAM;IACxB;WACM,OAAO;AACd,SAAM,yBAAyB;IAC7B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;;;CAIN,MAAM,UACJ,WACA,SAC+B;EAC/B,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,SAAS,KAAK,UAAU,SAAS,OAAO;EAC9C,MAAM,QAAQ,uBAAuB,QAAQ;AAE7C,MAAI;GACF,MAAM,SAAS,MAAM,OAAO,KAC1B,IAAI,sBAAsB;IACxB,UAAU,SAAS;IACnB,cAAc;IACf,CAAC,CACH;GAED,MAAM,YACJ,OAAO,OAAO,cAAc,YAAY,OAAO,YAC3C,OAAO,YACP;AAEN,UAAO;IACL,WAAW,KAAK,eAAe,SAAS,QAAQ,SAAS,UAAU,EACjE,SAAS,WACV,CAAC;IACF,SAAS;IACV;WACM,OAAO;AACd,OAAI,CAAC,cAAc,MAAM,CACvB,OAAM,yBAAyB;IAC7B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;AAIJ,OAAI,gBAAgB,SAAS,SAAS,CACpC,OAAM,IAAI,oBAAoB;IAC5B,SAAS,qBAAqB,SAAS;IACvC,UAAU,KAAK;IACf;IACA,MAAM;IACN,OAAO;IACR,CAAC;AAGJ,OAAI;IACF,MAAM,UAAU,MAAM,OAAO,KAC3B,IAAI,oBAAoB;KACtB,MAAM,SAAS;KACf,cAAc;KACf,CAAC,CACH;IAED,MAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,YAC7C,QAAQ,YACR;AAEN,WAAO;KACL,WAAW,KAAK,eAAe,SAAS,QAAQ,SAAS,UAAU,EACjE,SAAS,WACV,CAAC;KACF,SAAS;KACV;YACM,eAAe;AACtB,UAAM,yBAAyB;KAC7B,OAAO;KACP,UAAU,KAAK;KACf;KACA,WAAW;KACZ,CAAC;;;;CAKR,MAAM,aACJ,WACA,SAC+B;AAC/B,SAAO,KAAK,UAAU,WAAW,QAAQ;;CAG3C,MAAM,aAAa,WAA2C;EAC5D,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,SAAS,KAAK,UAAU,SAAS,OAAO;AAE9C,MAAI;AACF,SAAM,OAAO,KACX,IAAI,oBAAoB;IACtB,UAAU,SAAS;IACnB,sBAAsB;IACvB,CAAC,CACH;WACM,OAAO;AACd,SAAM,yBAAyB;IAC7B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;;;CAIN,AAAQ,UAAU,QAAyC;AACzD,MAAI,KAAK,eACP,QAAO,KAAK;EAGd,MAAM,SAAS,KAAK,gBAAgB,IAAI,OAAO;AAC/C,MAAI,OACF,QAAO;EAGT,MAAM,SAAS,IAAI,qBAAqB;GACtC,GAAI,KAAK,gBAAgB,EAAE;GAC3B;GACD,CAAC;AAEF,OAAK,gBAAgB,IAAI,QAAQ,OAAO;AACxC,SAAO;;CAGT,AAAQ,eAAe,WAA+C;EACpE,MAAM,SAAS,eAAe,UAAU;AACxC,MAAI,OAAO,aAAa,MACtB,OAAM,IAAI,oBAAoB;GAC5B,SAAS,gCAAgC,OAAO;GAChD,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,WAAW,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ;AACvD,MAAI,SAAS,SAAS,KAAK,SAAS,OAAO,iBACzC,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,kBAAkB,SAAS;EACjC,MAAM,SAAS,KAAK,cAAc,gBAAgB;EAElD,MAAM,WAAW,SAAS,MAAM,EAAE,CAAC,KAAK,IAAI;AAC5C,MAAI,CAAC,SACH,OAAM,IAAI,oBAAoB;GAC5B,SAAS,+CAA+C,OAAO,KAAK;GACpE,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;AAGJ,SAAO;GACL;GACA;GACA,SAAS,OAAO,QAAQ;GACxB,OAAO,OAAO,QAAQ;GACvB;;CAGH,AAAQ,cAAc,iBAAkC;EACtD,MAAM,SACJ,mBACA,KAAK,kBACL,QAAQ,IAAI,cACZ,QAAQ,IAAI;AAEd,MAAI,CAAC,OACH,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf,WAAW;GACX,MAAM;GACP,CAAC;AAGJ,SAAO;;CAGT,AAAQ,qBACN,SACuE;AACvE,MAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,MAAI,YAAY,YAAY,YAAY,UACtC,QAAO,EAAE,cAAc,cAAc;AAGvC,MAAI,QAAQ,WAAW,MAAM,CAC3B,QAAO,EAAE,cAAc,SAAS;AAGlC,SAAO,EAAE,WAAW,SAAS;;CAG/B,AAAQ,eACN,QACA,UACA,QACQ;EACR,MAAM,OAAO,wBAAwB,OAAO,GAAG;EAC/C,MAAM,QAAQ,SACV,OAAO,QAAQ,OAAO,CACnB,QAAQ,GAAG,WAAW,QAAQ,MAAM,CAAC,CACrC,KACE,CAAC,KAAK,WACL,GAAG,mBAAmB,IAAI,CAAC,GAAG,mBAAmB,MAAM,GAC1D,CACA,KAAK,IAAI,GACZ;AAEJ,SAAO,QAAQ,GAAG,KAAK,GAAG,UAAU;;;AAIxC,SAAS,sBACP,QACA,WACA,UACY;AACZ,KAAI,CAAC,UAAU,OAAO,WAAW,SAC/B,OAAM,IAAI,oBAAoB;EAC5B,SAAS;EACT;EACA;EACA,MAAM;EACN,OAAO;EACR,CAAC;CAGJ,MAAM,SAAS;AAKf,KAAI,OAAO,wBAAwB,WACjC,QAAO,OAAO;AAGhB,KAAI,OAAO,OAAO,iBAAiB,SAEjC,QAAO,OAAO,KAAK,OAAO,cAAc,SAAS;AAGnD,KAAI,OAAO,OAAO,iBAAiB,SACjC,QAAO,OAAO,KAAK,OAAO,cAAc,QAAQ;AAGlD,OAAM,IAAI,oBAAoB;EAC5B,SAAS;EACT;EACA;EACA,MAAM;EACN,OAAO;EACR,CAAC;;AAGJ,SAAS,gBAAgB,UAA2B;AAClD,QAAO,SAAS,WAAW,0BAA0B;;AAGvD,SAAS,cAAc,OAAyB;AAC9C,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;CAChD,MAAM,MAAM;AAIZ,KAAI,OAAO,IAAI,WAAW,mBAAmB,SAC3C,QAAO,IAAI,UAAU,mBAAmB;AAE1C,QAAO,IAAI,SAAS;;AAGtB,SAAS,yBAAyB,QAKV;CACtB,MAAM,EAAE,OAAO,UAAU,WAAW,cAAc;AAElD,KAAI,iBAAiB,oBACnB,QAAO;CAGT,MAAM,iBACJ,OAAO,UAAU,YACjB,UAAU,QACV,eAAe,SACf,OAAQ,MAAkC,cAAc,YACvD,MAAuD,WACpD;CAEN,MAAMA,OACJ,mBAAmB,MACf,cACA,mBAAmB,OAAO,mBAAmB,MAC3C,cACA,mBAAmB,MACjB,YACA;AAOV,QAAO,IAAI,oBAAoB;EAC7B,SALA,iBAAiB,QACb,MAAM,UACN,wBAAwB;EAI5B;EACA;EACA;EACA,OAAO;EACR,CAAC"}

package/dist/integrations/secrets/env-secret-provider.d.ts

@@ -28,4 +28,5 @@ declare class EnvSecretProvider implements SecretProvider {
   private forbiddenError;
 }
 //#endregion
-export { EnvSecretProvider };
+export { EnvSecretProvider };
+//# sourceMappingURL=env-secret-provider.d.ts.map

package/dist/integrations/secrets/env-secret-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-provider.d.ts","names":[],"sources":["../../../src/integrations/secrets/env-secret-provider.ts"],"sourcesContent":[],"mappings":";;;UASU,wBAAA;;AAFU;AAgBpB;;;EAc6B,OAAA,CAAA,EAtBjB,MAsBiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;;;AAwCd,cAtDF,iBAAA,YAA6B,cAsD3B,CAAA;EACD,SAAA,EAAA,GAAA,KAAA;EACD,iBAAA,OAAA;EAAR,WAAA,CAAA,OAAA,CAAA,EAnDkB,wBAmDlB;EAI2B,SAAA,CAAA,SAAA,EAnDT,eAmDS,CAAA,EAAA,OAAA;EAAkB,SAAA,CAAA,SAAA,EA9CrB,eA8CqB,CAAA,EA9CH,OA8CG,CA9CK,WA8CL,CAAA;EA5DR,SAAA,CAAA,SAAA,EA+C3B,eA/C2B,EAAA,QAAA,EAgD5B,kBAhD4B,CAAA,EAiDrC,OAjDqC,CAiD7B,oBAjD6B,CAAA;EAAc,YAAA,CAAA,SAAA,EAsDzC,eAtDyC,EAAA,QAAA,EAuD1C,kBAvD0C,CAAA,EAwDnD,OAxDmD,CAwD3C,oBAxD2C,CAAA;0BA4DxB,kBAAkB"}

package/dist/integrations/secrets/env-secret-provider.js

@@ -78,4 +78,5 @@ var EnvSecretProvider = class {
 };
 
 //#endregion
-export { EnvSecretProvider };
+export { EnvSecretProvider };
+//# sourceMappingURL=env-secret-provider.js.map

package/dist/integrations/secrets/env-secret-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-provider.js","names":[],"sources":["../../../src/integrations/secrets/env-secret-provider.ts"],"sourcesContent":["import { parseSecretUri, SecretProviderError } from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ninterface EnvSecretProviderOptions {\n  /**\n   * Optional map to alias secret references to environment variable names.\n   * Useful when referencing secrets from other providers (e.g. gcp://...)\n   * while still allowing local overrides.\n   */\n  aliases?: Record<string, string>;\n}\n\n/**\n * Environment-variable backed secret provider. Read-only by design.\n * Allows overriding other secret providers by deriving environment variable\n * names from secret references (or by using explicit aliases).\n */\nexport class EnvSecretProvider implements SecretProvider {\n  readonly id = 'env';\n\n  private readonly aliases: Record<string, string>;\n\n  constructor(options: EnvSecretProviderOptions = {}) {\n    this.aliases = options.aliases ?? {};\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    const envKey = this.resolveEnvKey(reference);\n    return envKey !== undefined && process.env[envKey] !== undefined;\n  }\n\n  async getSecret(reference: SecretReference): Promise<SecretValue> {\n    const envKey = this.resolveEnvKey(reference);\n    if (!envKey) {\n      throw new SecretProviderError({\n        message: `Unable to resolve environment variable for reference \"${reference}\".`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const value = process.env[envKey];\n    if (value === undefined) {\n      throw new SecretProviderError({\n        message: `Environment variable \"${envKey}\" not found for reference \"${reference}\".`,\n        provider: this.id,\n        reference,\n        code: 'NOT_FOUND',\n      });\n    }\n\n    return {\n      data: Buffer.from(value, 'utf-8'),\n      version: 'current',\n      metadata: {\n        source: 'env',\n        envKey,\n      },\n      retrievedAt: new Date(),\n    };\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    _payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    throw this.forbiddenError('setSecret', reference);\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    _payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    throw this.forbiddenError('rotateSecret', reference);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    throw this.forbiddenError('deleteSecret', reference);\n  }\n\n  private resolveEnvKey(reference: SecretReference): string | undefined {\n    if (!reference) {\n      return undefined;\n    }\n\n    if (this.aliases[reference]) {\n      return this.aliases[reference];\n    }\n\n    if (!reference.includes('://')) {\n      return reference;\n    }\n\n    try {\n      const parsed = parseSecretUri(reference);\n      if (parsed.provider === 'env') {\n        return parsed.path;\n      }\n\n      if (parsed.extras?.env) {\n        return parsed.extras.env;\n      }\n\n      return this.deriveEnvKey(parsed.path);\n    } catch {\n      return reference;\n    }\n  }\n\n  private deriveEnvKey(path: string): string | undefined {\n    if (!path) return undefined;\n    return path\n      .split(/[\\/:\\-\\.]/)\n      .filter(Boolean)\n      .map((segment) =>\n        segment\n          .replace(/[^a-zA-Z0-9]/g, '_')\n          .replace(/_{2,}/g, '_')\n          .toUpperCase()\n      )\n      .join('_');\n  }\n\n  private forbiddenError(\n    operation: string,\n    reference: SecretReference\n  ): SecretProviderError {\n    return new SecretProviderError({\n      message: `EnvSecretProvider is read-only. \"${operation}\" is not allowed for ${reference}.`,\n      provider: this.id,\n      reference,\n      code: 'FORBIDDEN',\n    });\n  }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAa,oBAAb,MAAyD;CACvD,AAAS,KAAK;CAEd,AAAiB;CAEjB,YAAY,UAAoC,EAAE,EAAE;AAClD,OAAK,UAAU,QAAQ,WAAW,EAAE;;CAGtC,UAAU,WAAqC;EAC7C,MAAM,SAAS,KAAK,cAAc,UAAU;AAC5C,SAAO,WAAW,UAAa,QAAQ,IAAI,YAAY;;CAGzD,MAAM,UAAU,WAAkD;EAChE,MAAM,SAAS,KAAK,cAAc,UAAU;AAC5C,MAAI,CAAC,OACH,OAAM,IAAI,oBAAoB;GAC5B,SAAS,yDAAyD,UAAU;GAC5E,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,UAAU,OACZ,OAAM,IAAI,oBAAoB;GAC5B,SAAS,yBAAyB,OAAO,6BAA6B,UAAU;GAChF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;AAGJ,SAAO;GACL,MAAM,OAAO,KAAK,OAAO,QAAQ;GACjC,SAAS;GACT,UAAU;IACR,QAAQ;IACR;IACD;GACD,6BAAa,IAAI,MAAM;GACxB;;CAGH,MAAM,UACJ,WACA,UAC+B;AAC/B,QAAM,KAAK,eAAe,aAAa,UAAU;;CAGnD,MAAM,aACJ,WACA,UAC+B;AAC/B,QAAM,KAAK,eAAe,gBAAgB,UAAU;;CAGtD,MAAM,aAAa,WAA2C;AAC5D,QAAM,KAAK,eAAe,gBAAgB,UAAU;;CAGtD,AAAQ,cAAc,WAAgD;AACpE,MAAI,CAAC,UACH;AAGF,MAAI,KAAK,QAAQ,WACf,QAAO,KAAK,QAAQ;AAGtB,MAAI,CAAC,UAAU,SAAS,MAAM,CAC5B,QAAO;AAGT,MAAI;GACF,MAAM,SAAS,eAAe,UAAU;AACxC,OAAI,OAAO,aAAa,MACtB,QAAO,OAAO;AAGhB,OAAI,OAAO,QAAQ,IACjB,QAAO,OAAO,OAAO;AAGvB,UAAO,KAAK,aAAa,OAAO,KAAK;UAC/B;AACN,UAAO;;;CAIX,AAAQ,aAAa,MAAkC;AACrD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KACJ,MAAM,YAAY,CAClB,OAAO,QAAQ,CACf,KAAK,YACJ,QACG,QAAQ,iBAAiB,IAAI,CAC7B,QAAQ,UAAU,IAAI,CACtB,aAAa,CACjB,CACA,KAAK,IAAI;;CAGd,AAAQ,eACN,WACA,WACqB;AACrB,SAAO,IAAI,oBAAoB;GAC7B,SAAS,oCAAoC,UAAU,uBAAuB,UAAU;GACxF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC"}

package/dist/integrations/secrets/gcp-secret-manager.d.ts

@@ -29,4 +29,5 @@ declare class GcpSecretManagerProvider implements SecretProvider {
   private ensureSecretExists;
 }
 //#endregion
-export { GcpSecretManagerProvider };
+export { GcpSecretManagerProvider };
+//# sourceMappingURL=gcp-secret-manager.d.ts.map

package/dist/integrations/secrets/gcp-secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-secret-manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/gcp-secret-manager.ts"],"sourcesContent":[],"mappings":";;;;;KAmBK,mBAAA,GAAsB;UAEjB,+BAAA;EAFL,SAAA,CAAA,EAAA,MAAA;EAEK,MAAA,CAAA,EAEC,mBAFD;EAEC,aAAA,CAAA,EACO,qBADP,CAAA,OACoC,0BADpC,CAAA,CAAA,CAAA,CAAA;EACoC,kBAAA,CAAA,EACxB,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,aAAA,CAAc,EAAA,CAAG,YADb;;AACxB,cAaV,wBAAA,YAAoC,cAbW,CAAA;EAAY,SAAA,EAAA,GAAA,oBAAA;EAa3D,iBAAA,MAAA;EAMU,iBAAA,iBAAA;EAQA,iBAAA,WAAA;EAUR,WAAA,CAAA,OAAA,CAAA,EAlBQ,+BAkBR;EAEG,SAAA,CAAA,SAAA,EAZK,eAYL,CAAA,EAAA,OAAA;EACL,SAAA,CAAA,SAAA,EAHE,eAGF,EAAA,OAyCE,CAzCF,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;EAyCU,CAAA,EAAA,WAAA,CAAA,EA1CG,WA0CH,CAAA,EAzCV,OAyCU,CAzCF,WAyCE,CAAA;EACF,SAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EAsCE,eAtCF,EAAA,OAAA,EAuCA,kBAvCA,CAAA,EAwCR,OAxCQ,CAwCA,oBAxCA,CAAA;EAAR,YAAA,CAAA,SAAA,EA4C2B,eA5C3B,CAAA,EA4C6C,OA5C7C,CAAA,IAAA,CAAA;EAsCU,QAAA,cAAA;EACF,QAAA,UAAA;EACA,QAAA,gBAAA;EAAR,QAAA,kBAAA"}

package/dist/integrations/secrets/gcp-secret-manager.js

@@ -226,4 +226,5 @@ function deriveErrorCode(error) {
 }
 
 //#endregion
-export { GcpSecretManagerProvider };
+export { GcpSecretManagerProvider };
+//# sourceMappingURL=gcp-secret-manager.js.map

package/dist/integrations/secrets/gcp-secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-secret-manager.js","names":["DEFAULT_REPLICATION: protos.google.cloud.secretmanager.v1.IReplication"],"sources":["../../../src/integrations/secrets/gcp-secret-manager.ts"],"sourcesContent":["import {\n  protos,\n  SecretManagerServiceClient,\n} from '@google-cloud/secret-manager';\nimport type { CallOptions } from 'google-gax';\n\nimport {\n  normalizeSecretPayload,\n  parseSecretUri,\n  SecretProviderError,\n} from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ntype SecretManagerClient = SecretManagerServiceClient;\n\ninterface GcpSecretManagerProviderOptions {\n  projectId?: string;\n  client?: SecretManagerClient;\n  clientOptions?: ConstructorParameters<typeof SecretManagerServiceClient>[0];\n  defaultReplication?: protos.google.cloud.secretmanager.v1.IReplication;\n}\n\ninterface GcpSecretLocation {\n  projectId: string;\n  secretId: string;\n  version?: string;\n}\n\nconst DEFAULT_REPLICATION: protos.google.cloud.secretmanager.v1.IReplication = {\n  automatic: {},\n};\n\nexport class GcpSecretManagerProvider implements SecretProvider {\n  readonly id = 'gcp-secret-manager';\n  private readonly client: SecretManagerClient;\n  private readonly explicitProjectId?: string;\n  private readonly replication: protos.google.cloud.secretmanager.v1.IReplication;\n\n  constructor(options: GcpSecretManagerProviderOptions = {}) {\n    this.client =\n      options.client ??\n      new SecretManagerServiceClient(options.clientOptions ?? {});\n    this.explicitProjectId = options.projectId;\n    this.replication = options.defaultReplication ?? DEFAULT_REPLICATION;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    try {\n      const parsed = parseSecretUri(reference);\n      return parsed.provider === 'gcp';\n    } catch {\n      return false;\n    }\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: { version?: string },\n    callOptions?: CallOptions\n  ): Promise<SecretValue> {\n    const location = this.parseReference(reference);\n    const secretVersionName = this.buildVersionName(location, options?.version);\n    try {\n      const response = await this.client.accessSecretVersion(\n        {\n          name: secretVersionName,\n        },\n        callOptions ?? {}\n      );\n      const [result] = response;\n      const payload = result.payload;\n      if (!payload?.data) {\n        throw new SecretProviderError({\n          message: `Secret payload empty for ${secretVersionName}`,\n          provider: this.id,\n          reference,\n          code: 'UNKNOWN',\n        });\n      }\n\n      const version = extractVersionFromName(result.name ?? secretVersionName);\n      return {\n        data: payload.data as Uint8Array,\n        version,\n        metadata: payload.dataCrc32c\n          ? { crc32c: payload.dataCrc32c.toString() }\n          : undefined,\n        retrievedAt: new Date(),\n      };\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'access',\n      });\n    }\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    const location = this.parseReference(reference);\n    const { secretName } = this.buildNames(location);\n    const data = normalizeSecretPayload(payload);\n    await this.ensureSecretExists(location, payload);\n\n    try {\n      const response = await this.client.addSecretVersion({\n        parent: secretName,\n        payload: {\n          data,\n        },\n      });\n      if (!response) {\n        throw new SecretProviderError({\n          message: `No version returned when adding secret version for ${secretName}`,\n          provider: this.id,\n          reference,\n          code: 'UNKNOWN',\n        });\n      }\n      const [version] = response;\n      const versionName = version?.name ?? `${secretName}/versions/latest`;\n      return {\n        reference: `gcp://${versionName}`,\n        version: extractVersionFromName(versionName) ?? 'latest',\n      };\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'addSecretVersion',\n      });\n    }\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.setSecret(reference, payload);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    const location = this.parseReference(reference);\n    const { secretName } = this.buildNames(location);\n    try {\n      await this.client.deleteSecret({\n        name: secretName,\n      });\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'delete',\n      });\n    }\n  }\n\n  private parseReference(reference: SecretReference): GcpSecretLocation {\n    const parsed = parseSecretUri(reference);\n    if (parsed.provider !== 'gcp') {\n      throw new SecretProviderError({\n        message: `Unsupported secret provider: ${parsed.provider}`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const segments = parsed.path.split('/').filter(Boolean);\n    if (segments.length < 4 || segments[0] !== 'projects') {\n      throw new SecretProviderError({\n        message: `Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const projectIdCandidate = segments[1] ?? this.explicitProjectId;\n    if (!projectIdCandidate) {\n      throw new SecretProviderError({\n        message: `Unable to resolve project or secret from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const indexOfSecrets = segments.indexOf('secrets');\n    if (indexOfSecrets === -1 || indexOfSecrets + 1 >= segments.length) {\n      throw new SecretProviderError({\n        message: `Unable to resolve project or secret from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const resolvedProjectId = projectIdCandidate;\n    const secretIdCandidate = segments[indexOfSecrets + 1];\n    if (!secretIdCandidate) {\n      throw new SecretProviderError({\n        message: `Unable to resolve secret ID from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n    const secretId = secretIdCandidate;\n    const indexOfVersions = segments.indexOf('versions');\n    const version =\n      parsed.extras?.version ??\n      (indexOfVersions !== -1 && indexOfVersions + 1 < segments.length\n        ? segments[indexOfVersions + 1]\n        : undefined);\n\n    return {\n      projectId: resolvedProjectId,\n      secretId,\n      version,\n    };\n  }\n\n  private buildNames(location: GcpSecretLocation): {\n    secretName: string;\n    projectParent: string;\n  } {\n    const projectId = location.projectId ?? this.explicitProjectId;\n    if (!projectId) {\n      throw new SecretProviderError({\n        message:\n          'Project ID must be provided either in reference or provider configuration',\n        provider: this.id,\n        reference: `gcp://projects//secrets/${location.secretId}`,\n        code: 'INVALID',\n      });\n    }\n\n    const projectParent = `projects/${projectId}`;\n    const secretName = `${projectParent}/secrets/${location.secretId}`;\n    return {\n      projectParent,\n      secretName,\n    };\n  }\n\n  private buildVersionName(\n    location: GcpSecretLocation,\n    explicitVersion?: string\n  ): string {\n    const { secretName } = this.buildNames(location);\n    const version = explicitVersion ?? location.version ?? 'latest';\n    return `${secretName}/versions/${version}`;\n  }\n\n  private async ensureSecretExists(\n    location: GcpSecretLocation,\n    payload: SecretWritePayload\n  ): Promise<void> {\n    const { secretName, projectParent } = this.buildNames(location);\n    try {\n      await this.client.getSecret({ name: secretName });\n    } catch (error) {\n      const providerError = toSecretProviderError({\n        error,\n        provider: this.id,\n        reference: `gcp://${secretName}`,\n        operation: 'getSecret',\n        suppressThrow: true,\n      });\n      if (!providerError || providerError.code !== 'NOT_FOUND') {\n        if (providerError) {\n          throw providerError;\n        }\n        throw error;\n      }\n      try {\n        await this.client.createSecret({\n          parent: projectParent,\n          secretId: location.secretId,\n          secret: {\n            replication: this.replication,\n            labels: payload.labels,\n          },\n        });\n      } catch (creationError) {\n        const creationProviderError = toSecretProviderError({\n          error: creationError,\n          provider: this.id,\n          reference: `gcp://${secretName}`,\n          operation: 'createSecret',\n        });\n        throw creationProviderError;\n      }\n    }\n  }\n}\n\nfunction extractVersionFromName(name: string): string | undefined {\n  const segments = name.split('/').filter(Boolean);\n  const index = segments.indexOf('versions');\n  if (index === -1 || index + 1 >= segments.length) {\n    return undefined;\n  }\n  return segments[index + 1];\n}\n\nfunction toSecretProviderError(params: {\n  error: unknown;\n  provider: string;\n  reference: SecretReference;\n  operation: string;\n  suppressThrow?: boolean;\n}): SecretProviderError {\n  const { error, provider, reference, operation, suppressThrow } = params;\n  if (error instanceof SecretProviderError) {\n    return error;\n  }\n\n  const code = deriveErrorCode(error);\n  const message =\n    error instanceof Error\n      ? error.message\n      : `Unknown error during ${operation}`;\n\n  const providerError = new SecretProviderError({\n    message,\n    provider,\n    reference,\n    code,\n    cause: error,\n  });\n\n  if (suppressThrow) {\n    return providerError;\n  }\n\n  throw providerError;\n}\n\nfunction deriveErrorCode(error: unknown): SecretProviderError['code'] {\n  if (typeof error !== 'object' || error === null) {\n    return 'UNKNOWN';\n  }\n\n  const errorAny = error as { code?: number | string };\n  const code = errorAny.code;\n  if (code === 5 || code === 'NOT_FOUND') return 'NOT_FOUND';\n  if (code === 6 || code === 'ALREADY_EXISTS') return 'INVALID';\n  if (code === 7 || code === 'PERMISSION_DENIED' || code === 403) {\n    return 'FORBIDDEN';\n  }\n  if (code === 3 || code === 'INVALID_ARGUMENT') return 'INVALID';\n  return 'UNKNOWN';\n}\n"],"mappings":";;;;AAkCA,MAAMA,sBAAyE,EAC7E,WAAW,EAAE,EACd;AAED,IAAa,2BAAb,MAAgE;CAC9D,AAAS,KAAK;CACd,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,UAA2C,EAAE,EAAE;AACzD,OAAK,SACH,QAAQ,UACR,IAAI,2BAA2B,QAAQ,iBAAiB,EAAE,CAAC;AAC7D,OAAK,oBAAoB,QAAQ;AACjC,OAAK,cAAc,QAAQ,sBAAsB;;CAGnD,UAAU,WAAqC;AAC7C,MAAI;AAEF,UADe,eAAe,UAAU,CAC1B,aAAa;UACrB;AACN,UAAO;;;CAIX,MAAM,UACJ,WACA,SACA,aACsB;EACtB,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,oBAAoB,KAAK,iBAAiB,UAAU,SAAS,QAAQ;AAC3E,MAAI;GAOF,MAAM,CAAC,UANU,MAAM,KAAK,OAAO,oBACjC,EACE,MAAM,mBACP,EACD,eAAe,EAAE,CAClB;GAED,MAAM,UAAU,OAAO;AACvB,OAAI,CAAC,SAAS,KACZ,OAAM,IAAI,oBAAoB;IAC5B,SAAS,4BAA4B;IACrC,UAAU,KAAK;IACf;IACA,MAAM;IACP,CAAC;GAGJ,MAAM,UAAU,uBAAuB,OAAO,QAAQ,kBAAkB;AACxE,UAAO;IACL,MAAM,QAAQ;IACd;IACA,UAAU,QAAQ,aACd,EAAE,QAAQ,QAAQ,WAAW,UAAU,EAAE,GACzC;IACJ,6BAAa,IAAI,MAAM;IACxB;WACM,OAAO;AACd,SAAM,sBAAsB;IAC1B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;;;CAIN,MAAM,UACJ,WACA,SAC+B;EAC/B,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,EAAE,eAAe,KAAK,WAAW,SAAS;EAChD,MAAM,OAAO,uBAAuB,QAAQ;AAC5C,QAAM,KAAK,mBAAmB,UAAU,QAAQ;AAEhD,MAAI;GACF,MAAM,WAAW,MAAM,KAAK,OAAO,iBAAiB;IAClD,QAAQ;IACR,SAAS,EACP,MACD;IACF,CAAC;AACF,OAAI,CAAC,SACH,OAAM,IAAI,oBAAoB;IAC5B,SAAS,sDAAsD;IAC/D,UAAU,KAAK;IACf;IACA,MAAM;IACP,CAAC;GAEJ,MAAM,CAAC,WAAW;GAClB,MAAM,cAAc,SAAS,QAAQ,GAAG,WAAW;AACnD,UAAO;IACL,WAAW,SAAS;IACpB,SAAS,uBAAuB,YAAY,IAAI;IACjD;WACM,OAAO;AACd,SAAM,sBAAsB;IAC1B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;;;CAIN,MAAM,aACJ,WACA,SAC+B;AAC/B,SAAO,KAAK,UAAU,WAAW,QAAQ;;CAG3C,MAAM,aAAa,WAA2C;EAC5D,MAAM,WAAW,KAAK,eAAe,UAAU;EAC/C,MAAM,EAAE,eAAe,KAAK,WAAW,SAAS;AAChD,MAAI;AACF,SAAM,KAAK,OAAO,aAAa,EAC7B,MAAM,YACP,CAAC;WACK,OAAO;AACd,SAAM,sBAAsB;IAC1B;IACA,UAAU,KAAK;IACf;IACA,WAAW;IACZ,CAAC;;;CAIN,AAAQ,eAAe,WAA+C;EACpE,MAAM,SAAS,eAAe,UAAU;AACxC,MAAI,OAAO,aAAa,MACtB,OAAM,IAAI,oBAAoB;GAC5B,SAAS,gCAAgC,OAAO;GAChD,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,WAAW,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ;AACvD,MAAI,SAAS,SAAS,KAAK,SAAS,OAAO,WACzC,OAAM,IAAI,oBAAoB;GAC5B,SAAS,mHAAmH,OAAO,KAAK;GACxI,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,qBAAqB,SAAS,MAAM,KAAK;AAC/C,MAAI,CAAC,mBACH,OAAM,IAAI,oBAAoB;GAC5B,SAAS,uDAAuD,OAAO,KAAK;GAC5E,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,iBAAiB,SAAS,QAAQ,UAAU;AAClD,MAAI,mBAAmB,MAAM,iBAAiB,KAAK,SAAS,OAC1D,OAAM,IAAI,oBAAoB;GAC5B,SAAS,uDAAuD,OAAO,KAAK;GAC5E,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,oBAAoB;EAC1B,MAAM,oBAAoB,SAAS,iBAAiB;AACpD,MAAI,CAAC,kBACH,OAAM,IAAI,oBAAoB;GAC5B,SAAS,+CAA+C,OAAO,KAAK;GACpE,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAEJ,MAAM,WAAW;EACjB,MAAM,kBAAkB,SAAS,QAAQ,WAAW;AAOpD,SAAO;GACL,WAAW;GACX;GACA,SARA,OAAO,QAAQ,YACd,oBAAoB,MAAM,kBAAkB,IAAI,SAAS,SACtD,SAAS,kBAAkB,KAC3B;GAML;;CAGH,AAAQ,WAAW,UAGjB;EACA,MAAM,YAAY,SAAS,aAAa,KAAK;AAC7C,MAAI,CAAC,UACH,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf,WAAW,2BAA2B,SAAS;GAC/C,MAAM;GACP,CAAC;EAGJ,MAAM,gBAAgB,YAAY;AAElC,SAAO;GACL;GACA,YAHiB,GAAG,cAAc,WAAW,SAAS;GAIvD;;CAGH,AAAQ,iBACN,UACA,iBACQ;EACR,MAAM,EAAE,eAAe,KAAK,WAAW,SAAS;AAEhD,SAAO,GAAG,WAAW,YADL,mBAAmB,SAAS,WAAW;;CAIzD,MAAc,mBACZ,UACA,SACe;EACf,MAAM,EAAE,YAAY,kBAAkB,KAAK,WAAW,SAAS;AAC/D,MAAI;AACF,SAAM,KAAK,OAAO,UAAU,EAAE,MAAM,YAAY,CAAC;WAC1C,OAAO;GACd,MAAM,gBAAgB,sBAAsB;IAC1C;IACA,UAAU,KAAK;IACf,WAAW,SAAS;IACpB,WAAW;IACX,eAAe;IAChB,CAAC;AACF,OAAI,CAAC,iBAAiB,cAAc,SAAS,aAAa;AACxD,QAAI,cACF,OAAM;AAER,UAAM;;AAER,OAAI;AACF,UAAM,KAAK,OAAO,aAAa;KAC7B,QAAQ;KACR,UAAU,SAAS;KACnB,QAAQ;MACN,aAAa,KAAK;MAClB,QAAQ,QAAQ;MACjB;KACF,CAAC;YACK,eAAe;AAOtB,UAN8B,sBAAsB;KAClD,OAAO;KACP,UAAU,KAAK;KACf,WAAW,SAAS;KACpB,WAAW;KACZ,CAAC;;;;;AAOV,SAAS,uBAAuB,MAAkC;CAChE,MAAM,WAAW,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ;CAChD,MAAM,QAAQ,SAAS,QAAQ,WAAW;AAC1C,KAAI,UAAU,MAAM,QAAQ,KAAK,SAAS,OACxC;AAEF,QAAO,SAAS,QAAQ;;AAG1B,SAAS,sBAAsB,QAMP;CACtB,MAAM,EAAE,OAAO,UAAU,WAAW,WAAW,kBAAkB;AACjE,KAAI,iBAAiB,oBACnB,QAAO;CAGT,MAAM,OAAO,gBAAgB,MAAM;CAMnC,MAAM,gBAAgB,IAAI,oBAAoB;EAC5C,SALA,iBAAiB,QACb,MAAM,UACN,wBAAwB;EAI5B;EACA;EACA;EACA,OAAO;EACR,CAAC;AAEF,KAAI,cACF,QAAO;AAGT,OAAM;;AAGR,SAAS,gBAAgB,OAA6C;AACpE,KAAI,OAAO,UAAU,YAAY,UAAU,KACzC,QAAO;CAIT,MAAM,OADW,MACK;AACtB,KAAI,SAAS,KAAK,SAAS,YAAa,QAAO;AAC/C,KAAI,SAAS,KAAK,SAAS,iBAAkB,QAAO;AACpD,KAAI,SAAS,KAAK,SAAS,uBAAuB,SAAS,IACzD,QAAO;AAET,KAAI,SAAS,KAAK,SAAS,mBAAoB,QAAO;AACtD,QAAO"}

package/dist/integrations/secrets/manager.d.ts

@@ -44,4 +44,5 @@ declare class SecretProviderManager implements SecretProvider {
 }
 type SecretFetchOptions = Parameters<SecretProvider['getSecret']>[1];
 //#endregion
-export { SecretProviderManager, SecretProviderManagerOptions };
+export { SecretProviderManager, SecretProviderManagerOptions };
+//# sourceMappingURL=manager.d.ts.map

package/dist/integrations/secrets/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/manager.ts"],"sourcesContent":[],"mappings":";;;UAeU,eAAA;;AARU;AAepB;EAmBa,QAAA,CAAA,EAAA,MAAA;;AAaQ,UAhCJ,4BAAA,CAgCI;EAAyB;;;EAuBhC,EAAA,CAAA,EAAA,MAAA;EACD;;;;EA2BA,SAAA,CAAA,EAAA;IAAR,QAAA,EA1EqB,cA0ErB;IAOU,QAAA,CAAA,EAAA,MAAA;EACF,CAAA,EAAA;;;;;;;AA0EZ;;cAlJY,qBAAA,YAAiC;;;;wBAKvB;qBAQF,0BAAyB;uBAevB;uBAOR,2BACD,qBACT,QAAQ;uBAyBE,0BACF,qBACR,QAAQ;0BAOE,0BACF,qBACR,QAAQ;0BAMmB,kBAAkB;;;;KAgF7C,kBAAA,GAAqB,WAAW"}

package/dist/integrations/secrets/manager.js

@@ -100,4 +100,5 @@ function safeCanHandle(provider, reference) {
 }
 
 //#endregion
-export { SecretProviderManager };
+export { SecretProviderManager };
+//# sourceMappingURL=manager.js.map

package/dist/integrations/secrets/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","names":["errors: SecretProviderError[]"],"sources":["../../../src/integrations/secrets/manager.ts"],"sourcesContent":["import { SecretProviderError } from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ninterface ProviderRegistration {\n  readonly provider: SecretProvider;\n  readonly priority: number;\n  readonly order: number;\n}\n\ninterface RegisterOptions {\n  /**\n   * Larger priority values are attempted first. Defaults to 0.\n   */\n  priority?: number;\n}\n\nexport interface SecretProviderManagerOptions {\n  /**\n   * Override manager identifier. Defaults to \"secret-provider-manager\".\n   */\n  id?: string;\n  /**\n   * Providers to pre-register. They are registered in array order with\n   * descending priority (first entry wins ties).\n   */\n  providers?: { provider: SecretProvider; priority?: number }[];\n}\n\n/**\n * Composite secret provider that delegates to registered providers.\n * Providers are attempted in order of descending priority, respecting the\n * registration order for ties. This enables privileged overrides (e.g.\n * environment variables) while still supporting durable backends like GCP\n * Secret Manager.\n */\nexport class SecretProviderManager implements SecretProvider {\n  readonly id: string;\n  private readonly providers: ProviderRegistration[] = [];\n  private registrationCounter = 0;\n\n  constructor(options: SecretProviderManagerOptions = {}) {\n    this.id = options.id ?? 'secret-provider-manager';\n    const initialProviders = options.providers ?? [];\n    for (const entry of initialProviders) {\n      this.register(entry.provider, { priority: entry.priority });\n    }\n  }\n\n  register(provider: SecretProvider, options: RegisterOptions = {}): this {\n    this.providers.push({\n      provider,\n      priority: options.priority ?? 0,\n      order: this.registrationCounter++,\n    });\n    this.providers.sort((a, b) => {\n      if (a.priority !== b.priority) {\n        return b.priority - a.priority;\n      }\n      return a.order - b.order;\n    });\n    return this;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    return this.providers.some(({ provider }) =>\n      safeCanHandle(provider, reference)\n    );\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue> {\n    const errors: SecretProviderError[] = [];\n\n    for (const { provider } of this.providers) {\n      if (!safeCanHandle(provider, reference)) {\n        continue;\n      }\n      try {\n        return await provider.getSecret(reference, options);\n      } catch (error) {\n        if (error instanceof SecretProviderError) {\n          errors.push(error);\n          if (error.code !== 'NOT_FOUND') {\n            break;\n          }\n          continue;\n        }\n        throw error;\n      }\n    }\n\n    throw this.composeError('getSecret', reference, errors, options?.version);\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.delegateToFirst('setSecret', reference, (provider) =>\n      provider.setSecret(reference, payload)\n    );\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.delegateToFirst('rotateSecret', reference, (provider) =>\n      provider.rotateSecret(reference, payload)\n    );\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    await this.delegateToFirst('deleteSecret', reference, (provider) =>\n      provider.deleteSecret(reference)\n    );\n  }\n\n  private async delegateToFirst<T>(\n    operation: 'setSecret' | 'rotateSecret' | 'deleteSecret',\n    reference: SecretReference,\n    invoker: (provider: SecretProvider) => Promise<T>\n  ): Promise<T> {\n    const errors: SecretProviderError[] = [];\n\n    for (const { provider } of this.providers) {\n      if (!safeCanHandle(provider, reference)) {\n        continue;\n      }\n      try {\n        return await invoker(provider);\n      } catch (error) {\n        if (error instanceof SecretProviderError) {\n          errors.push(error);\n          continue;\n        }\n        throw error;\n      }\n    }\n\n    throw this.composeError(operation, reference, errors);\n  }\n\n  private composeError(\n    operation: string,\n    reference: SecretReference,\n    errors: SecretProviderError[],\n    version?: string\n  ): SecretProviderError {\n    if (errors.length === 1) {\n      const [singleError] = errors;\n      if (singleError) {\n        return singleError;\n      }\n    }\n\n    const messageParts = [\n      `No registered secret provider could ${operation}`,\n      `reference \"${reference}\"`,\n    ];\n    if (version) {\n      messageParts.push(`(version: ${version})`);\n    }\n    if (errors.length > 1) {\n      messageParts.push(\n        `Attempts: ${errors\n          .map((error) => `${error.provider}:${error.code}`)\n          .join(', ')}`\n      );\n    }\n\n    return new SecretProviderError({\n      message: messageParts.join(' '),\n      provider: this.id,\n      reference,\n      code: errors.length > 0 ? errors[errors.length - 1]!.code : 'UNKNOWN',\n      cause: errors,\n    });\n  }\n}\n\nfunction safeCanHandle(\n  provider: SecretProvider,\n  reference: SecretReference\n): boolean {\n  try {\n    return provider.canHandle(reference);\n  } catch {\n    return false;\n  }\n}\n\ntype SecretFetchOptions = Parameters<SecretProvider['getSecret']>[1];\n"],"mappings":";;;;;;;;;;AAyCA,IAAa,wBAAb,MAA6D;CAC3D,AAAS;CACT,AAAiB,YAAoC,EAAE;CACvD,AAAQ,sBAAsB;CAE9B,YAAY,UAAwC,EAAE,EAAE;AACtD,OAAK,KAAK,QAAQ,MAAM;EACxB,MAAM,mBAAmB,QAAQ,aAAa,EAAE;AAChD,OAAK,MAAM,SAAS,iBAClB,MAAK,SAAS,MAAM,UAAU,EAAE,UAAU,MAAM,UAAU,CAAC;;CAI/D,SAAS,UAA0B,UAA2B,EAAE,EAAQ;AACtE,OAAK,UAAU,KAAK;GAClB;GACA,UAAU,QAAQ,YAAY;GAC9B,OAAO,KAAK;GACb,CAAC;AACF,OAAK,UAAU,MAAM,GAAG,MAAM;AAC5B,OAAI,EAAE,aAAa,EAAE,SACnB,QAAO,EAAE,WAAW,EAAE;AAExB,UAAO,EAAE,QAAQ,EAAE;IACnB;AACF,SAAO;;CAGT,UAAU,WAAqC;AAC7C,SAAO,KAAK,UAAU,MAAM,EAAE,eAC5B,cAAc,UAAU,UAAU,CACnC;;CAGH,MAAM,UACJ,WACA,SACsB;EACtB,MAAMA,SAAgC,EAAE;AAExC,OAAK,MAAM,EAAE,cAAc,KAAK,WAAW;AACzC,OAAI,CAAC,cAAc,UAAU,UAAU,CACrC;AAEF,OAAI;AACF,WAAO,MAAM,SAAS,UAAU,WAAW,QAAQ;YAC5C,OAAO;AACd,QAAI,iBAAiB,qBAAqB;AACxC,YAAO,KAAK,MAAM;AAClB,SAAI,MAAM,SAAS,YACjB;AAEF;;AAEF,UAAM;;;AAIV,QAAM,KAAK,aAAa,aAAa,WAAW,QAAQ,SAAS,QAAQ;;CAG3E,MAAM,UACJ,WACA,SAC+B;AAC/B,SAAO,KAAK,gBAAgB,aAAa,YAAY,aACnD,SAAS,UAAU,WAAW,QAAQ,CACvC;;CAGH,MAAM,aACJ,WACA,SAC+B;AAC/B,SAAO,KAAK,gBAAgB,gBAAgB,YAAY,aACtD,SAAS,aAAa,WAAW,QAAQ,CAC1C;;CAGH,MAAM,aAAa,WAA2C;AAC5D,QAAM,KAAK,gBAAgB,gBAAgB,YAAY,aACrD,SAAS,aAAa,UAAU,CACjC;;CAGH,MAAc,gBACZ,WACA,WACA,SACY;EACZ,MAAMA,SAAgC,EAAE;AAExC,OAAK,MAAM,EAAE,cAAc,KAAK,WAAW;AACzC,OAAI,CAAC,cAAc,UAAU,UAAU,CACrC;AAEF,OAAI;AACF,WAAO,MAAM,QAAQ,SAAS;YACvB,OAAO;AACd,QAAI,iBAAiB,qBAAqB;AACxC,YAAO,KAAK,MAAM;AAClB;;AAEF,UAAM;;;AAIV,QAAM,KAAK,aAAa,WAAW,WAAW,OAAO;;CAGvD,AAAQ,aACN,WACA,WACA,QACA,SACqB;AACrB,MAAI,OAAO,WAAW,GAAG;GACvB,MAAM,CAAC,eAAe;AACtB,OAAI,YACF,QAAO;;EAIX,MAAM,eAAe,CACnB,uCAAuC,aACvC,cAAc,UAAU,GACzB;AACD,MAAI,QACF,cAAa,KAAK,aAAa,QAAQ,GAAG;AAE5C,MAAI,OAAO,SAAS,EAClB,cAAa,KACX,aAAa,OACV,KAAK,UAAU,GAAG,MAAM,SAAS,GAAG,MAAM,OAAO,CACjD,KAAK,KAAK,GACd;AAGH,SAAO,IAAI,oBAAoB;GAC7B,SAAS,aAAa,KAAK,IAAI;GAC/B,UAAU,KAAK;GACf;GACA,MAAM,OAAO,SAAS,IAAI,OAAO,OAAO,SAAS,GAAI,OAAO;GAC5D,OAAO;GACR,CAAC;;;AAIN,SAAS,cACP,UACA,WACS;AACT,KAAI;AACF,SAAO,SAAS,UAAU,UAAU;SAC9B;AACN,SAAO"}

package/dist/integrations/secrets/provider.d.ts

@@ -49,4 +49,5 @@ declare class SecretProviderError extends Error {
 declare function parseSecretUri(reference: SecretReference): ParsedSecretUri;
 declare function normalizeSecretPayload(payload: SecretWritePayload): Uint8Array;
 //#endregion
-export { ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri };
+export { ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri };
+//# sourceMappingURL=provider.d.ts.map

package/dist/integrations/secrets/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","names":[],"sources":["../../../src/integrations/secrets/provider.ts"],"sourcesContent":[],"mappings":";KAEY,eAAA;AAAA,UAEK,WAAA,CAFU;EAEV,IAAA,EACT,UADoB;EACpB,OAAA,CAAA,EAAA,MAAA;EAEK,QAAA,CAAA,EAAA,MAAA,CAAA,MAAA,EAAA,MAAA,CAAA;EACE,WAAA,EAAA,IAAA;;AAGE,UAAA,kBAAA,CAAkB;EAIvB,OAAA,CAAA,EAAA,MAAA;AAEZ;AACiB,KAHL,qBAAA,GAGK,OAAA,GAAA,QAAA,GAAA,QAAA;AACJ,UAFI,kBAAA,CAEJ;EAEF,IAAA,EAAA,MAAA,GAHM,UAGN;EAAM,QAAA,CAAA,EAFJ,qBAEI;EAGA,WAAA,CAAA,EAAA,MAAA;EAKA,MAAA,CAAA,EARN,MAQM,CAAA,MAAc,EAAA,MAAA,CAAA;;AAIhB,UATE,oBAAA,CASF;EACD,SAAA,EATD,eASC;EACD,OAAA,EAAA,MAAA;;AAEE,UARE,cAAA,CAQF;EACF,SAAA,EAAA,EAAA,MAAA;EACA,SAAA,CAAA,SAAA,EARU,eAQV,CAAA,EAAA,OAAA;EAAR,SAAA,CAAA,SAAA,EANU,eAMV,EAAA,OAAA,CAAA,EALS,kBAKT,CAAA,EAJA,OAIA,CAJQ,WAIR,CAAA;EAEU,SAAA,CAAA,SAAA,EAJA,eAIA,EAAA,OAAA,EAHF,kBAGE,CAAA,EAFV,OAEU,CAFF,oBAEE,CAAA;EACF,YAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EACa,eADb,CAAA,EAC+B,OAD/B,CAAA,IAAA,CAAA;;AACa,UAGT,eAAA,CAHS;EAAkB,QAAA,EAAA,MAAA;EAAO,IAAA,EAAA,MAAA;EAGlC,MAAA,CAAA,EAGN,MAHM,CAAA,MAAe,EAAA,MAAA,CAGrB;AAGX;AAEsB,cAFT,mBAAA,SAA4B,KAAA,CAEnB;EAOP,SAAA,QAAA,EAAA,MAAA;EACJ,SAAA,SAAA,EARW,eAQX;EAV8B,SAAA,IAAA,EAAA,WAAA,GAAA,WAAA,GAAA,SAAA,GAAA,SAAA;EAAK,SAAA,KAAA,CAAA,EAAA,OAAA;EAsB9B,WAAA,CAAA,MAAc,EAAA;IAiDd,OAAA,EAAA,MAAA;;eA9DD;WACJ;;;;iBAYK,cAAA,YAA0B,kBAAkB;iBAiD5C,sBAAA,UACL,qBACR"}

package/dist/integrations/secrets/provider.js

@@ -55,4 +55,5 @@ function normalizeSecretPayload(payload) {
 }
 
 //#endregion
-export { SecretProviderError, normalizeSecretPayload, parseSecretUri };
+export { SecretProviderError, normalizeSecretPayload, parseSecretUri };
+//# sourceMappingURL=provider.js.map

package/dist/integrations/secrets/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","names":[],"sources":["../../../src/integrations/secrets/provider.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n\nexport type SecretReference = string;\n\nexport interface SecretValue {\n  data: Uint8Array;\n  version?: string;\n  metadata?: Record<string, string>;\n  retrievedAt: Date;\n}\n\nexport interface SecretFetchOptions {\n  version?: string;\n}\n\nexport type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';\n\nexport interface SecretWritePayload {\n  data: string | Uint8Array;\n  encoding?: SecretPayloadEncoding;\n  contentType?: string;\n  labels?: Record<string, string>;\n}\n\nexport interface SecretRotationResult {\n  reference: SecretReference;\n  version: string;\n}\n\nexport interface SecretProvider {\n  readonly id: string;\n  canHandle(reference: SecretReference): boolean;\n  getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue>;\n  setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult>;\n  rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult>;\n  deleteSecret(reference: SecretReference): Promise<void>;\n}\n\nexport interface ParsedSecretUri {\n  provider: string;\n  path: string;\n  extras?: Record<string, string>;\n}\n\nexport class SecretProviderError extends Error {\n  readonly provider: string;\n  readonly reference: SecretReference;\n  readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';\n  readonly cause?: unknown;\n\n  constructor(params: {\n    message: string;\n    provider: string;\n    reference: SecretReference;\n    code?: SecretProviderError['code'];\n    cause?: unknown;\n  }) {\n    super(params.message);\n    this.name = 'SecretProviderError';\n    this.provider = params.provider;\n    this.reference = params.reference;\n    this.code = params.code ?? 'UNKNOWN';\n    this.cause = params.cause;\n  }\n}\n\nexport function parseSecretUri(reference: SecretReference): ParsedSecretUri {\n  if (!reference) {\n    throw new SecretProviderError({\n      message: 'Secret reference cannot be empty',\n      provider: 'unknown',\n      reference,\n      code: 'INVALID',\n    });\n  }\n\n  const [scheme, rest] = reference.split('://');\n  if (!scheme || !rest) {\n    throw new SecretProviderError({\n      message: `Invalid secret reference: ${reference}`,\n      provider: 'unknown',\n      reference,\n      code: 'INVALID',\n    });\n  }\n\n  const queryIndex = rest.indexOf('?');\n  if (queryIndex === -1) {\n    return {\n      provider: scheme,\n      path: rest,\n    };\n  }\n\n  const path = rest.slice(0, queryIndex);\n  const query = rest.slice(queryIndex + 1);\n  const extras = Object.fromEntries(\n    query\n      .split('&')\n      .filter(Boolean)\n      .map((pair) => {\n        const [keyRaw, valueRaw] = pair.split('=');\n        const key = keyRaw ?? '';\n        const value = valueRaw ?? '';\n        return [decodeURIComponent(key), decodeURIComponent(value)];\n      })\n  );\n\n  return {\n    provider: scheme,\n    path,\n    extras,\n  };\n}\n\nexport function normalizeSecretPayload(\n  payload: SecretWritePayload\n): Uint8Array {\n  if (payload.data instanceof Uint8Array) {\n    return payload.data;\n  }\n\n  if (payload.encoding === 'base64') {\n    return Buffer.from(payload.data, 'base64');\n  }\n\n  if (payload.encoding === 'binary') {\n    return Buffer.from(payload.data, 'binary');\n  }\n\n  return Buffer.from(payload.data, 'utf-8');\n}\n"],"mappings":";;;AAqDA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,AAAS;CACT,AAAS;CACT,AAAS;CACT,AAAS;CAET,YAAY,QAMT;AACD,QAAM,OAAO,QAAQ;AACrB,OAAK,OAAO;AACZ,OAAK,WAAW,OAAO;AACvB,OAAK,YAAY,OAAO;AACxB,OAAK,OAAO,OAAO,QAAQ;AAC3B,OAAK,QAAQ,OAAO;;;AAIxB,SAAgB,eAAe,WAA6C;AAC1E,KAAI,CAAC,UACH,OAAM,IAAI,oBAAoB;EAC5B,SAAS;EACT,UAAU;EACV;EACA,MAAM;EACP,CAAC;CAGJ,MAAM,CAAC,QAAQ,QAAQ,UAAU,MAAM,MAAM;AAC7C,KAAI,CAAC,UAAU,CAAC,KACd,OAAM,IAAI,oBAAoB;EAC5B,SAAS,6BAA6B;EACtC,UAAU;EACV;EACA,MAAM;EACP,CAAC;CAGJ,MAAM,aAAa,KAAK,QAAQ,IAAI;AACpC,KAAI,eAAe,GACjB,QAAO;EACL,UAAU;EACV,MAAM;EACP;CAGH,MAAM,OAAO,KAAK,MAAM,GAAG,WAAW;CACtC,MAAM,QAAQ,KAAK,MAAM,aAAa,EAAE;AAaxC,QAAO;EACL,UAAU;EACV;EACA,QAfa,OAAO,YACpB,MACG,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,KAAK,SAAS;GACb,MAAM,CAAC,QAAQ,YAAY,KAAK,MAAM,IAAI;GAC1C,MAAM,MAAM,UAAU;GACtB,MAAM,QAAQ,YAAY;AAC1B,UAAO,CAAC,mBAAmB,IAAI,EAAE,mBAAmB,MAAM,CAAC;IAC3D,CACL;EAMA;;AAGH,SAAgB,uBACd,SACY;AACZ,KAAI,QAAQ,gBAAgB,WAC1B,QAAO,QAAQ;AAGjB,KAAI,QAAQ,aAAa,SACvB,QAAO,OAAO,KAAK,QAAQ,MAAM,SAAS;AAG5C,KAAI,QAAQ,aAAa,SACvB,QAAO,OAAO,KAAK,QAAQ,MAAM,SAAS;AAG5C,QAAO,OAAO,KAAK,QAAQ,MAAM,QAAQ"}

package/dist/integrations/secrets/scaleway-secret-manager.d.ts

@@ -35,4 +35,5 @@ declare class ScalewaySecretManagerProvider implements SecretProvider {
   private buildReference;
 }
 //#endregion
-export { ScalewaySecretManagerProvider };
+export { ScalewaySecretManagerProvider };
+//# sourceMappingURL=scaleway-secret-manager.d.ts.map

package/dist/integrations/secrets/scaleway-secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaleway-secret-manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/scaleway-secret-manager.ts"],"sourcesContent":[],"mappings":";;;UAgBU,oCAAA;;AAFU;AA2BpB;;EA2BuB,KAAA,CAAA,EAAA,MAAA;EAcR;EACD,aAAA,CAAA,EAAA,MAAA;EACD;EAAR,gBAAA,CAAA,EAAA,MAAA;EA0DU;EACF,OAAA,CAAA,EAAA,MAAA;EACA;EAAR,KAAA,CAAA,EAAA,OAnHY,KAmHZ;;AAyCQ,cAhJA,6BAAA,YAAyC,cAgJzC,CAAA;EACA,SAAA,EAAA,GAAA,yBAAA;EAAR,iBAAA,KAAA;EAI2B,iBAAA,aAAA;EAAkB,iBAAA,gBAAA;EArJI,iBAAA,OAAA;EAAc,iBAAA,OAAA;wBAS7C;uBAkBA;uBAcR,2BACD,qBACT,QAAQ;uBA0DE,0BACF,qBACR,QAAQ;0BAwCE,0BACF,qBACR,QAAQ;0BAImB,kBAAkB"}

package/dist/integrations/secrets/scaleway-secret-manager.js

@@ -244,4 +244,5 @@ async function safeReadBody(response) {
 }
 
 //#endregion
-export { ScalewaySecretManagerProvider };
+export { ScalewaySecretManagerProvider };
+//# sourceMappingURL=scaleway-secret-manager.js.map

package/dist/integrations/secrets/scaleway-secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaleway-secret-manager.js","names":["code: SecretProviderError['code']"],"sources":["../../../src/integrations/secrets/scaleway-secret-manager.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n\nimport {\n  normalizeSecretPayload,\n  parseSecretUri,\n  SecretProviderError,\n} from './provider';\nimport type {\n  SecretFetchOptions,\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ninterface ScalewaySecretManagerProviderOptions {\n  /**\n   * Scaleway API token (SCW secret key). If omitted, uses env vars.\n   * Header: X-Auth-Token\n   */\n  token?: string;\n  /** Default region when not present in reference (e.g. fr-par). */\n  defaultRegion?: string;\n  /** Default project id used when creating secrets by name. */\n  defaultProjectId?: string;\n  /** Override API base url (defaults to https://api.scaleway.com). */\n  baseUrl?: string;\n  /** Inject fetch for tests. */\n  fetch?: typeof fetch;\n}\n\ninterface ScalewaySecretLocation {\n  region: string;\n  secretIdOrName: string;\n  revision?: string;\n}\n\nconst UUID_V4_LIKE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport class ScalewaySecretManagerProvider implements SecretProvider {\n  readonly id = 'scaleway-secret-manager';\n\n  private readonly token: string;\n  private readonly defaultRegion?: string;\n  private readonly defaultProjectId?: string;\n  private readonly baseUrl: string;\n  private readonly fetchFn: typeof fetch;\n\n  constructor(options: ScalewaySecretManagerProviderOptions = {}) {\n    this.token =\n      options.token ??\n      process.env.SCW_SECRET_KEY ??\n      process.env.SCALEWAY_SECRET_KEY ??\n      '';\n    this.defaultRegion =\n      options.defaultRegion ??\n      process.env.SCW_DEFAULT_REGION ??\n      process.env.SCW_REGION;\n    this.defaultProjectId =\n      options.defaultProjectId ??\n      process.env.SCW_DEFAULT_PROJECT_ID ??\n      process.env.SCW_PROJECT_ID;\n    this.baseUrl = options.baseUrl ?? 'https://api.scaleway.com';\n    this.fetchFn = options.fetch ?? fetch;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    try {\n      const parsed = parseSecretUri(reference);\n      return (\n        parsed.provider === 'scw' &&\n        (parsed.path === 'secret-manager' ||\n          parsed.path.startsWith('secret-manager/'))\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue> {\n    const location = this.parseReference(reference);\n\n    if (!this.token) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).',\n        provider: this.id,\n        reference,\n        code: 'FORBIDDEN',\n      });\n    }\n\n    if (!UUID_V4_LIKE.test(location.secretIdOrName)) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway getSecret requires a secretId (uuid) reference, not a secret name.',\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const revision = options?.version ?? location.revision ?? 'latest';\n\n    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(location.region)}/secrets/${encodeURIComponent(location.secretIdOrName)}/versions/${encodeURIComponent(revision)}/access`;\n\n    const response = await this.fetchFn(url, {\n      method: 'GET',\n      headers: {\n        'X-Auth-Token': this.token,\n      },\n    });\n\n    if (!response.ok) {\n      throw await toScalewayError({\n        response,\n        provider: this.id,\n        reference,\n        operation: 'getSecret',\n      });\n    }\n\n    const payload = (await response.json()) as unknown;\n    const dataB64 = extractScalewayData(payload);\n\n    return {\n      data: Buffer.from(dataB64, 'base64'),\n      version: revision,\n      metadata: {\n        region: location.region,\n        secretId: location.secretIdOrName,\n      },\n      retrievedAt: new Date(),\n    };\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    const location = this.parseReference(reference);\n\n    if (!this.token) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).',\n        provider: this.id,\n        reference,\n        code: 'FORBIDDEN',\n      });\n    }\n\n    const bytes = normalizeSecretPayload(payload);\n    const encoded = Buffer.from(bytes).toString('base64');\n\n    const secretId = UUID_V4_LIKE.test(location.secretIdOrName)\n      ? location.secretIdOrName\n      : await this.createSecret({\n          region: location.region,\n          name: location.secretIdOrName,\n          reference,\n        });\n\n    const version = await this.createSecretVersion({\n      region: location.region,\n      secretId,\n      dataB64: encoded,\n      reference,\n    });\n\n    return {\n      reference: this.buildReference(location.region, secretId, {\n        version,\n      }),\n      version,\n    };\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.setSecret(reference, payload);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    const location = this.parseReference(reference);\n\n    if (!this.token) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).',\n        provider: this.id,\n        reference,\n        code: 'FORBIDDEN',\n      });\n    }\n\n    if (!UUID_V4_LIKE.test(location.secretIdOrName)) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway deleteSecret requires a secretId (uuid) reference, not a secret name.',\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(location.region)}/secrets/${encodeURIComponent(location.secretIdOrName)}`;\n\n    const response = await this.fetchFn(url, {\n      method: 'DELETE',\n      headers: {\n        'X-Auth-Token': this.token,\n      },\n    });\n\n    if (!response.ok) {\n      throw await toScalewayError({\n        response,\n        provider: this.id,\n        reference,\n        operation: 'deleteSecret',\n      });\n    }\n  }\n\n  private parseReference(reference: SecretReference): ScalewaySecretLocation {\n    const parsed = parseSecretUri(reference);\n    if (parsed.provider !== 'scw') {\n      throw new SecretProviderError({\n        message: `Unsupported secret provider: ${parsed.provider}`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const segments = parsed.path.split('/').filter(Boolean);\n    if (segments.length < 2 || segments[0] !== 'secret-manager') {\n      throw new SecretProviderError({\n        message:\n          'Expected secret reference format scw://secret-manager/{region}/{secretIdOrName}[?version=...]',\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const region = segments[1] ?? this.defaultRegion;\n    if (!region) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway region must be provided either in reference (scw://secret-manager/{region}/...) or via SCW_DEFAULT_REGION/SCW_REGION.',\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const secretIdOrName = segments.slice(2).join('/');\n    if (!secretIdOrName) {\n      throw new SecretProviderError({\n        message: `Unable to resolve secret id/name from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    return {\n      region,\n      secretIdOrName,\n      revision: parsed.extras?.version,\n    };\n  }\n\n  private async createSecret(params: {\n    region: string;\n    name: string;\n    reference: SecretReference;\n  }): Promise<string> {\n    const projectId = this.defaultProjectId;\n    if (!projectId) {\n      throw new SecretProviderError({\n        message:\n          'Scaleway project id is required to create secrets by name (set SCW_DEFAULT_PROJECT_ID/SCW_PROJECT_ID).',\n        provider: this.id,\n        reference: params.reference,\n        code: 'INVALID',\n      });\n    }\n\n    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(params.region)}/secrets`;\n\n    const response = await this.fetchFn(url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'X-Auth-Token': this.token,\n      },\n      body: JSON.stringify({\n        name: params.name,\n        project_id: projectId,\n      }),\n    });\n\n    if (!response.ok) {\n      throw await toScalewayError({\n        response,\n        provider: this.id,\n        reference: params.reference,\n        operation: 'createSecret',\n      });\n    }\n\n    const payload = (await response.json()) as unknown;\n    const secretId = extractScalewaySecretId(payload);\n    return secretId;\n  }\n\n  private async createSecretVersion(params: {\n    region: string;\n    secretId: string;\n    dataB64: string;\n    reference: SecretReference;\n  }): Promise<string> {\n    const url = `${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(params.region)}/secrets/${encodeURIComponent(params.secretId)}/versions`;\n\n    const response = await this.fetchFn(url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'X-Auth-Token': this.token,\n      },\n      body: JSON.stringify({\n        data: params.dataB64,\n      }),\n    });\n\n    if (!response.ok) {\n      throw await toScalewayError({\n        response,\n        provider: this.id,\n        reference: params.reference,\n        operation: 'createSecretVersion',\n      });\n    }\n\n    const payload = (await response.json()) as unknown;\n    return extractScalewayRevision(payload) ?? 'latest';\n  }\n\n  private buildReference(\n    region: string,\n    secretId: string,\n    extras?: Record<string, string>\n  ): string {\n    const base = `scw://secret-manager/${region}/${secretId}`;\n    const query = extras\n      ? Object.entries(extras)\n          .filter(([, value]) => Boolean(value))\n          .map(\n            ([key, value]) =>\n              `${encodeURIComponent(key)}=${encodeURIComponent(value)}`\n          )\n          .join('&')\n      : '';\n\n    return query ? `${base}?${query}` : base;\n  }\n}\n\nfunction extractScalewayData(payload: unknown): string {\n  if (!payload || typeof payload !== 'object') {\n    throw new Error('Invalid scaleway secret payload');\n  }\n\n  const record = payload as { data?: unknown };\n  if (typeof record.data === 'string' && record.data) {\n    return record.data;\n  }\n\n  throw new Error('Scaleway secret payload is missing data');\n}\n\nfunction extractScalewaySecretId(payload: unknown): string {\n  if (!payload || typeof payload !== 'object') {\n    throw new Error('Invalid scaleway createSecret payload');\n  }\n\n  const record = payload as { id?: unknown };\n  if (typeof record.id === 'string' && record.id) {\n    return record.id;\n  }\n\n  throw new Error('Scaleway createSecret response is missing id');\n}\n\nfunction extractScalewayRevision(payload: unknown): string | undefined {\n  if (!payload || typeof payload !== 'object') {\n    return undefined;\n  }\n\n  const record = payload as { revision?: unknown; id?: unknown };\n  if (typeof record.revision === 'number') {\n    return String(record.revision);\n  }\n  if (typeof record.revision === 'string' && record.revision) {\n    return record.revision;\n  }\n  if (typeof record.id === 'string' && record.id) {\n    // Some API shapes may return \"id\" for the version.\n    return record.id;\n  }\n\n  return undefined;\n}\n\nasync function toScalewayError(params: {\n  response: Response;\n  provider: string;\n  reference: SecretReference;\n  operation: string;\n}): Promise<SecretProviderError> {\n  const { response, provider, reference, operation } = params;\n\n  const code: SecretProviderError['code'] =\n    response.status === 404\n      ? 'NOT_FOUND'\n      : response.status === 401 || response.status === 403\n        ? 'FORBIDDEN'\n        : response.status >= 400 && response.status < 500\n          ? 'INVALID'\n          : 'UNKNOWN';\n\n  const bodyText = await safeReadBody(response);\n  const message = bodyText\n    ? `Scaleway Secret Manager ${operation} failed (${response.status}): ${bodyText}`\n    : `Scaleway Secret Manager ${operation} failed (${response.status})`;\n\n  return new SecretProviderError({\n    message,\n    provider,\n    reference,\n    code,\n  });\n}\n\nasync function safeReadBody(response: Response): Promise<string | undefined> {\n  try {\n    const text = await response.text();\n    const trimmed = text.trim();\n    return trimmed.length ? trimmed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;AAsCA,MAAM,eACJ;AAEF,IAAa,gCAAb,MAAqE;CACnE,AAAS,KAAK;CAEd,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,UAAgD,EAAE,EAAE;AAC9D,OAAK,QACH,QAAQ,SACR,QAAQ,IAAI,kBACZ,QAAQ,IAAI,uBACZ;AACF,OAAK,gBACH,QAAQ,iBACR,QAAQ,IAAI,sBACZ,QAAQ,IAAI;AACd,OAAK,mBACH,QAAQ,oBACR,QAAQ,IAAI,0BACZ,QAAQ,IAAI;AACd,OAAK,UAAU,QAAQ,WAAW;AAClC,OAAK,UAAU,QAAQ,SAAS;;CAGlC,UAAU,WAAqC;AAC7C,MAAI;GACF,MAAM,SAAS,eAAe,UAAU;AACxC,UACE,OAAO,aAAa,UACnB,OAAO,SAAS,oBACf,OAAO,KAAK,WAAW,kBAAkB;UAEvC;AACN,UAAO;;;CAIX,MAAM,UACJ,WACA,SACsB;EACtB,MAAM,WAAW,KAAK,eAAe,UAAU;AAE/C,MAAI,CAAC,KAAK,MACR,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;AAGJ,MAAI,CAAC,aAAa,KAAK,SAAS,eAAe,CAC7C,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,WAAW,SAAS,WAAW,SAAS,YAAY;EAE1D,MAAM,MAAM,GAAG,KAAK,QAAQ,kCAAkC,mBAAmB,SAAS,OAAO,CAAC,WAAW,mBAAmB,SAAS,eAAe,CAAC,YAAY,mBAAmB,SAAS,CAAC;EAElM,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK;GACvC,QAAQ;GACR,SAAS,EACP,gBAAgB,KAAK,OACtB;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,OAAM,MAAM,gBAAgB;GAC1B;GACA,UAAU,KAAK;GACf;GACA,WAAW;GACZ,CAAC;EAIJ,MAAM,UAAU,oBADC,MAAM,SAAS,MAAM,CACM;AAE5C,SAAO;GACL,MAAM,OAAO,KAAK,SAAS,SAAS;GACpC,SAAS;GACT,UAAU;IACR,QAAQ,SAAS;IACjB,UAAU,SAAS;IACpB;GACD,6BAAa,IAAI,MAAM;GACxB;;CAGH,MAAM,UACJ,WACA,SAC+B;EAC/B,MAAM,WAAW,KAAK,eAAe,UAAU;AAE/C,MAAI,CAAC,KAAK,MACR,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,QAAQ,uBAAuB,QAAQ;EAC7C,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,SAAS,SAAS;EAErD,MAAM,WAAW,aAAa,KAAK,SAAS,eAAe,GACvD,SAAS,iBACT,MAAM,KAAK,aAAa;GACtB,QAAQ,SAAS;GACjB,MAAM,SAAS;GACf;GACD,CAAC;EAEN,MAAM,UAAU,MAAM,KAAK,oBAAoB;GAC7C,QAAQ,SAAS;GACjB;GACA,SAAS;GACT;GACD,CAAC;AAEF,SAAO;GACL,WAAW,KAAK,eAAe,SAAS,QAAQ,UAAU,EACxD,SACD,CAAC;GACF;GACD;;CAGH,MAAM,aACJ,WACA,SAC+B;AAC/B,SAAO,KAAK,UAAU,WAAW,QAAQ;;CAG3C,MAAM,aAAa,WAA2C;EAC5D,MAAM,WAAW,KAAK,eAAe,UAAU;AAE/C,MAAI,CAAC,KAAK,MACR,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;AAGJ,MAAI,CAAC,aAAa,KAAK,SAAS,eAAe,CAC7C,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,MAAM,GAAG,KAAK,QAAQ,kCAAkC,mBAAmB,SAAS,OAAO,CAAC,WAAW,mBAAmB,SAAS,eAAe;EAExJ,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK;GACvC,QAAQ;GACR,SAAS,EACP,gBAAgB,KAAK,OACtB;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,OAAM,MAAM,gBAAgB;GAC1B;GACA,UAAU,KAAK;GACf;GACA,WAAW;GACZ,CAAC;;CAIN,AAAQ,eAAe,WAAoD;EACzE,MAAM,SAAS,eAAe,UAAU;AACxC,MAAI,OAAO,aAAa,MACtB,OAAM,IAAI,oBAAoB;GAC5B,SAAS,gCAAgC,OAAO;GAChD,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,WAAW,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ;AACvD,MAAI,SAAS,SAAS,KAAK,SAAS,OAAO,iBACzC,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,SAAS,SAAS,MAAM,KAAK;AACnC,MAAI,CAAC,OACH,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;EAGJ,MAAM,iBAAiB,SAAS,MAAM,EAAE,CAAC,KAAK,IAAI;AAClD,MAAI,CAAC,eACH,OAAM,IAAI,oBAAoB;GAC5B,SAAS,oDAAoD,OAAO,KAAK;GACzE,UAAU,KAAK;GACf;GACA,MAAM;GACP,CAAC;AAGJ,SAAO;GACL;GACA;GACA,UAAU,OAAO,QAAQ;GAC1B;;CAGH,MAAc,aAAa,QAIP;EAClB,MAAM,YAAY,KAAK;AACvB,MAAI,CAAC,UACH,OAAM,IAAI,oBAAoB;GAC5B,SACE;GACF,UAAU,KAAK;GACf,WAAW,OAAO;GAClB,MAAM;GACP,CAAC;EAGJ,MAAM,MAAM,GAAG,KAAK,QAAQ,kCAAkC,mBAAmB,OAAO,OAAO,CAAC;EAEhG,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK;GACvC,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,gBAAgB,KAAK;IACtB;GACD,MAAM,KAAK,UAAU;IACnB,MAAM,OAAO;IACb,YAAY;IACb,CAAC;GACH,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,OAAM,MAAM,gBAAgB;GAC1B;GACA,UAAU,KAAK;GACf,WAAW,OAAO;GAClB,WAAW;GACZ,CAAC;AAKJ,SADiB,wBADA,MAAM,SAAS,MAAM,CACW;;CAInD,MAAc,oBAAoB,QAKd;EAClB,MAAM,MAAM,GAAG,KAAK,QAAQ,kCAAkC,mBAAmB,OAAO,OAAO,CAAC,WAAW,mBAAmB,OAAO,SAAS,CAAC;EAE/I,MAAM,WAAW,MAAM,KAAK,QAAQ,KAAK;GACvC,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,gBAAgB,KAAK;IACtB;GACD,MAAM,KAAK,UAAU,EACnB,MAAM,OAAO,SACd,CAAC;GACH,CAAC;AAEF,MAAI,CAAC,SAAS,GACZ,OAAM,MAAM,gBAAgB;GAC1B;GACA,UAAU,KAAK;GACf,WAAW,OAAO;GAClB,WAAW;GACZ,CAAC;AAIJ,SAAO,wBADU,MAAM,SAAS,MAAM,CACC,IAAI;;CAG7C,AAAQ,eACN,QACA,UACA,QACQ;EACR,MAAM,OAAO,wBAAwB,OAAO,GAAG;EAC/C,MAAM,QAAQ,SACV,OAAO,QAAQ,OAAO,CACnB,QAAQ,GAAG,WAAW,QAAQ,MAAM,CAAC,CACrC,KACE,CAAC,KAAK,WACL,GAAG,mBAAmB,IAAI,CAAC,GAAG,mBAAmB,MAAM,GAC1D,CACA,KAAK,IAAI,GACZ;AAEJ,SAAO,QAAQ,GAAG,KAAK,GAAG,UAAU;;;AAIxC,SAAS,oBAAoB,SAA0B;AACrD,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,OAAM,IAAI,MAAM,kCAAkC;CAGpD,MAAM,SAAS;AACf,KAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAC5C,QAAO,OAAO;AAGhB,OAAM,IAAI,MAAM,0CAA0C;;AAG5D,SAAS,wBAAwB,SAA0B;AACzD,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,OAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,SAAS;AACf,KAAI,OAAO,OAAO,OAAO,YAAY,OAAO,GAC1C,QAAO,OAAO;AAGhB,OAAM,IAAI,MAAM,+CAA+C;;AAGjE,SAAS,wBAAwB,SAAsC;AACrE,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC;CAGF,MAAM,SAAS;AACf,KAAI,OAAO,OAAO,aAAa,SAC7B,QAAO,OAAO,OAAO,SAAS;AAEhC,KAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAChD,QAAO,OAAO;AAEhB,KAAI,OAAO,OAAO,OAAO,YAAY,OAAO,GAE1C,QAAO,OAAO;;AAMlB,eAAe,gBAAgB,QAKE;CAC/B,MAAM,EAAE,UAAU,UAAU,WAAW,cAAc;CAErD,MAAMA,OACJ,SAAS,WAAW,MAChB,cACA,SAAS,WAAW,OAAO,SAAS,WAAW,MAC7C,cACA,SAAS,UAAU,OAAO,SAAS,SAAS,MAC1C,YACA;CAEV,MAAM,WAAW,MAAM,aAAa,SAAS;AAK7C,QAAO,IAAI,oBAAoB;EAC7B,SALc,WACZ,2BAA2B,UAAU,WAAW,SAAS,OAAO,KAAK,aACrE,2BAA2B,UAAU,WAAW,SAAS,OAAO;EAIlE;EACA;EACA;EACD,CAAC;;AAGJ,eAAe,aAAa,UAAiD;AAC3E,KAAI;EAEF,MAAM,WADO,MAAM,SAAS,MAAM,EACb,MAAM;AAC3B,SAAO,QAAQ,SAAS,UAAU;SAC5B;AACN"}

package/dist/integrations/spec.d.ts

@@ -76,4 +76,5 @@ declare class IntegrationSpecRegistry {
 }
 declare function makeIntegrationSpecKey(meta: IntegrationMeta): string;
 //#endregion
-export { IntegrationByokSetup, IntegrationCapabilityMapping, IntegrationCategory, IntegrationConfigSchema, IntegrationHealthCheck, IntegrationMeta, IntegrationOwnershipMode, IntegrationSecretSchema, IntegrationSpec, IntegrationSpecRegistry, makeIntegrationSpecKey };
+export { IntegrationByokSetup, IntegrationCapabilityMapping, IntegrationCategory, IntegrationConfigSchema, IntegrationHealthCheck, IntegrationMeta, IntegrationOwnershipMode, IntegrationSecretSchema, IntegrationSpec, IntegrationSpecRegistry, makeIntegrationSpecKey };
+//# sourceMappingURL=spec.d.ts.map

package/dist/integrations/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","names":[],"sources":["../../src/integrations/spec.ts"],"sourcesContent":[],"mappings":";;;;KAGY,mBAAA;KAgBA,wBAAA;AAhBA,UAkBK,eAAA,SAAwB,aAlBV,CAAA;EAgBnB;EAEK,GAAA,EAAA,MAAA;EASA;EAOA,OAAA,EAAA,MAAA;EAOA,QAAA,EAlBL,mBAkB4B;EAOvB,WAAA,EAAA,MAAA;AAOjB;AAOiB,UAnCA,4BAAA,CAmCe;EACxB;EAEU,QAAA,EApCN,aAoCM,EAAA;EAEF;EAEA,QAAA,CAAA,EAtCH,qBAsCG,EAAA;;AAIA,UAvCC,uBAAA,CAuCD;EAMH;EAGC,MAAA,EAAA,OAAA;EAAoB;EAMrB,OAAA,CAAA,EAlDD,MAkDC,CAAA,MAAA,EAAA,OAAuB,CAAA;;AAY1B,UA3DO,uBAAA,CA2DP;EAI4B;EAgBZ,MAAA,EAAA,OAAA;EAAsB;EAAe,OAAA,CAAA,EA3EnD,MA2EmD,CAAA,MAAA,EAAA,MAAA,CAAA;AAK/D;UA7EiB,oBAAA;;;;;;UAOA,sBAAA;;;;;;UAOA,eAAA;QACT;;kBAEU;;gBAEF;;gBAEA;;gBAEA;;gBAEA;;;;;;;;;aAMH;;;cAGC;;cAMD,uBAAA;;iBAGI;UASP;sCAI4B;0BAgBZ,sBAAsB;;iBAKhC,sBAAA,OAA6B"}

package/dist/integrations/spec.js

@@ -36,4 +36,5 @@ function makeIntegrationSpecKey(meta) {
 }
 
 //#endregion
-export { IntegrationSpecRegistry, makeIntegrationSpecKey };
+export { IntegrationSpecRegistry, makeIntegrationSpecKey };
+//# sourceMappingURL=spec.js.map

package/dist/integrations/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","names":["latest: IntegrationSpec | undefined"],"sources":["../../src/integrations/spec.ts"],"sourcesContent":["import type { OwnerShipMeta } from '../ownership';\nimport type { CapabilityRef, CapabilityRequirement } from '../capabilities';\n\nexport type IntegrationCategory =\n  | 'payments'\n  | 'email'\n  | 'calendar'\n  | 'sms'\n  | 'ai-llm'\n  | 'ai-voice'\n  | 'speech-to-text'\n  | 'vector-db'\n  | 'storage'\n  | 'accounting'\n  | 'crm'\n  | 'helpdesk'\n  | 'open-banking'\n  | 'custom';\n\nexport type IntegrationOwnershipMode = 'managed' | 'byok';\n\nexport interface IntegrationMeta extends OwnerShipMeta {\n  /** Stable provider slug (e.g., \"stripe\", \"openai\"). */\n  key: string;\n  /** Provider version (increment on breaking API changes). */\n  version: number;\n  category: IntegrationCategory;\n  displayName: string;\n}\n\nexport interface IntegrationCapabilityMapping {\n  /** Which CapabilitySpec this integration provides. */\n  provides: CapabilityRef[];\n  /** Optional: which capabilities it requires (e.g., storage for caching). */\n  requires?: CapabilityRequirement[];\n}\n\nexport interface IntegrationConfigSchema {\n  /** JSON Schema or SchemaModel defining required config fields. */\n  schema: unknown;\n  /** Example configuration (for docs/UI). */\n  example?: Record<string, unknown>;\n}\n\nexport interface IntegrationSecretSchema {\n  /** JSON Schema or SchemaModel describing secret fields. */\n  schema: unknown;\n  /** Redacted example for documentation/UI. */\n  example?: Record<string, string>;\n}\n\nexport interface IntegrationByokSetup {\n  /** Human-readable instructions for tenants configuring BYOK accounts. */\n  setupInstructions?: string;\n  /** Required scopes/permissions for BYOK accounts. */\n  requiredScopes?: string[];\n}\n\nexport interface IntegrationHealthCheck {\n  /** Endpoint or method to validate connection health. */\n  method?: 'ping' | 'list' | 'custom';\n  /** Timeout in ms for health check. */\n  timeoutMs?: number;\n}\n\nexport interface IntegrationSpec {\n  meta: IntegrationMeta;\n  /** Supported ownership modes for this provider. */\n  supportedModes: IntegrationOwnershipMode[];\n  /** Which capabilities this integration provides/requires. */\n  capabilities: IntegrationCapabilityMapping;\n  /** Configuration schema (API keys, endpoints, etc.). */\n  configSchema: IntegrationConfigSchema;\n  /** Secret schema (API/key material stored via secretRef). */\n  secretSchema: IntegrationSecretSchema;\n  /** Optional health check configuration. */\n  healthCheck?: IntegrationHealthCheck;\n  /** Documentation URL. */\n  docsUrl?: string;\n  /** Rate limits or usage constraints. */\n  constraints?: {\n    rateLimit?: { rpm?: number; rph?: number };\n    quotas?: Record<string, number>;\n  };\n  /** Provider-specific metadata for BYOK setup flows. */\n  byokSetup?: IntegrationByokSetup;\n}\n\nconst integrationKey = (meta: Pick<IntegrationMeta, 'key' | 'version'>) =>\n  `${meta.key}.v${meta.version}`;\n\nexport class IntegrationSpecRegistry {\n  private readonly items = new Map<string, IntegrationSpec>();\n\n  register(spec: IntegrationSpec): this {\n    const key = integrationKey(spec.meta);\n    if (this.items.has(key)) {\n      throw new Error(`Duplicate IntegrationSpec ${key}`);\n    }\n    this.items.set(key, spec);\n    return this;\n  }\n\n  list(): IntegrationSpec[] {\n    return [...this.items.values()];\n  }\n\n  get(key: string, version?: number): IntegrationSpec | undefined {\n    if (version != null) {\n      return this.items.get(integrationKey({ key, version }));\n    }\n    let latest: IntegrationSpec | undefined;\n    let maxVersion = -Infinity;\n    for (const spec of this.items.values()) {\n      if (spec.meta.key !== key) continue;\n      if (spec.meta.version > maxVersion) {\n        maxVersion = spec.meta.version;\n        latest = spec;\n      }\n    }\n    return latest;\n  }\n\n  getByCategory(category: IntegrationCategory): IntegrationSpec[] {\n    return this.list().filter((spec) => spec.meta.category === category);\n  }\n}\n\nexport function makeIntegrationSpecKey(meta: IntegrationMeta) {\n  return integrationKey(meta);\n}\n"],"mappings":";AAwFA,MAAM,kBAAkB,SACtB,GAAG,KAAK,IAAI,IAAI,KAAK;AAEvB,IAAa,0BAAb,MAAqC;CACnC,AAAiB,wBAAQ,IAAI,KAA8B;CAE3D,SAAS,MAA6B;EACpC,MAAM,MAAM,eAAe,KAAK,KAAK;AACrC,MAAI,KAAK,MAAM,IAAI,IAAI,CACrB,OAAM,IAAI,MAAM,6BAA6B,MAAM;AAErD,OAAK,MAAM,IAAI,KAAK,KAAK;AACzB,SAAO;;CAGT,OAA0B;AACxB,SAAO,CAAC,GAAG,KAAK,MAAM,QAAQ,CAAC;;CAGjC,IAAI,KAAa,SAA+C;AAC9D,MAAI,WAAW,KACb,QAAO,KAAK,MAAM,IAAI,eAAe;GAAE;GAAK;GAAS,CAAC,CAAC;EAEzD,IAAIA;EACJ,IAAI,aAAa;AACjB,OAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,EAAE;AACtC,OAAI,KAAK,KAAK,QAAQ,IAAK;AAC3B,OAAI,KAAK,KAAK,UAAU,YAAY;AAClC,iBAAa,KAAK,KAAK;AACvB,aAAS;;;AAGb,SAAO;;CAGT,cAAc,UAAkD;AAC9D,SAAO,KAAK,MAAM,CAAC,QAAQ,SAAS,KAAK,KAAK,aAAa,SAAS;;;AAIxE,SAAgB,uBAAuB,MAAuB;AAC5D,QAAO,eAAe,KAAK"}

package/dist/jobs/define-job.d.ts

@@ -15,4 +15,5 @@ interface DefinedJob<TPayload> {
  */
 declare function registerDefinedJob<TPayload>(queue: JobQueue, job: DefinedJob<TPayload>): void;
 //#endregion
-export { DefinedJob, registerDefinedJob };
+export { DefinedJob, registerDefinedJob };
+//# sourceMappingURL=define-job.d.ts.map

package/dist/jobs/define-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-job.d.ts","names":[],"sources":["../../src/jobs/define-job.ts"],"sourcesContent":[],"mappings":";;;;UAIiB;EAAA,IAAA,EAAA,MAAA;EAEG,MAAA,EAAV,SAAU,CAAA,QAAA,CAAA;EAAV,OAAA,EAAA,CAAA,OAAA,EACW,QADX,EAAA,GAAA,EAC0B,GAD1B,CAC8B,QAD9B,CAAA,EAAA,GAC4C,OAD5C,CAAA,IAAA,CAAA;;;;;;AAUV;;AAEkB,iBAFF,kBAEE,CAAA,QAAA,CAAA,CAAA,KAAA,EADT,QACS,EAAA,GAAA,EAAX,UAAW,CAAA,QAAA,CAAA,CAAA,EAAA,IAAA"}

package/dist/jobs/define-job.js

@@ -13,4 +13,5 @@ function registerDefinedJob(queue, job) {
 }
 
 //#endregion
-export { registerDefinedJob };
+export { registerDefinedJob };
+//# sourceMappingURL=define-job.js.map

package/dist/jobs/define-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-job.js","names":[],"sources":["../../src/jobs/define-job.ts"],"sourcesContent":["import type { ZodSchema } from 'zod';\nimport type { Job } from './queue';\nimport type { JobQueue } from './queue';\n\nexport interface DefinedJob<TPayload> {\n  type: string;\n  schema: ZodSchema<TPayload>;\n  handler: (payload: TPayload, job: Job<TPayload>) => Promise<void>;\n}\n\n/**\n * Register a `DefinedJob` on a queue with payload validation.\n *\n * - Parses and validates payload via the job's Zod schema\n * - Invokes the defined handler with the validated payload\n */\nexport function registerDefinedJob<TPayload>(\n  queue: JobQueue,\n  job: DefinedJob<TPayload>\n): void {\n  queue.register<TPayload>(job.type, async (queuedJob) => {\n    const parsed = job.schema.parse(queuedJob.payload);\n    await job.handler(parsed, queuedJob as Job<TPayload>);\n  });\n}\n"],"mappings":";;;;;;;AAgBA,SAAgB,mBACd,OACA,KACM;AACN,OAAM,SAAmB,IAAI,MAAM,OAAO,cAAc;EACtD,MAAM,SAAS,IAAI,OAAO,MAAM,UAAU,QAAQ;AAClD,QAAM,IAAI,QAAQ,QAAQ,UAA2B;GACrD"}

package/dist/jobs/gcp-cloud-tasks.d.ts

@@ -38,4 +38,5 @@ declare class GcpCloudTasksQueue implements JobQueue {
   stop(): Promise<void>;
 }
 //#endregion
-export { GcpCloudTasksQueue, GcpCloudTasksQueueOptions };
+export { GcpCloudTasksQueue, GcpCloudTasksQueueOptions };
+//# sourceMappingURL=gcp-cloud-tasks.d.ts.map

package/dist/jobs/gcp-cloud-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-cloud-tasks.d.ts","names":[],"sources":["../../src/jobs/gcp-cloud-tasks.ts"],"sourcesContent":[],"mappings":";;;UAUU,oBAAA;;IAAA,MAAA,EAAA,MAAA;IAOI,IAAA,EAAA;MACI,WAAA,EAAA;QAKZ,UAAA,EAAA,MAAA,GAAA,MAAA;QAAO,GAAA,EAAA,MAAA;QAGI,IAAA,EATH,MASG;QASJ,OAAA,CAAA,EAjBK,MAiBc,CAAA,MAAA,EAAA,MAAA,CAAA;QAGQ,SAAA,CAAA,EAAA;UAI3B,mBAAA,EAAA,MAAA;QACA,CAAA;MACI,CAAA;MAAJ,YAAA,CAAA,EAAA;QAAR,OAAA,EAAA,MAAA;MA6CmB,CAAA;IAAU,CAAA;EAArB,CAAA,CAAA,EAlEP,OAkEO,CAAA,OAAA,CAAA;;AAtD8B,UAT1B,yBAAA,CAS0B;EAAQ,MAAA,EARzC,oBAQyC;;;;;;;cAAtC,kBAAA,YAA8B;;;uBAGH;8CAI3B,oBACA,iBACR,QAAQ,IAAI;+DA6CJ,WAAW,UAAU;;UASlB"}

package/dist/jobs/gcp-cloud-tasks.js

@@ -50,4 +50,5 @@ var GcpCloudTasksQueue = class {
 };
 
 //#endregion
-export { GcpCloudTasksQueue };
+export { GcpCloudTasksQueue };
+//# sourceMappingURL=gcp-cloud-tasks.js.map

package/dist/jobs/gcp-cloud-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-cloud-tasks.js","names":["options: GcpCloudTasksQueueOptions"],"sources":["../../src/jobs/gcp-cloud-tasks.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport {\n  DEFAULT_RETRY_POLICY,\n  type EnqueueOptions,\n  type Job,\n  type JobHandler,\n  type JobQueue,\n} from './queue';\n\ninterface CloudTasksClientLike {\n  createTask(request: {\n    parent: string;\n    task: {\n      httpRequest: {\n        httpMethod: number | string;\n        url: string;\n        body: Buffer;\n        headers?: Record<string, string>;\n        oidcToken?: { serviceAccountEmail: string };\n      };\n      scheduleTime?: { seconds: number };\n    };\n  }): Promise<unknown>;\n}\n\nexport interface GcpCloudTasksQueueOptions {\n  client: CloudTasksClientLike;\n  projectId: string;\n  location: string;\n  queue: string;\n  resolveUrl(jobType: string): string;\n  serviceAccountEmail?: string;\n}\n\nexport class GcpCloudTasksQueue implements JobQueue {\n  private readonly handlers = new Map<string, JobHandler>();\n\n  constructor(private readonly options: GcpCloudTasksQueueOptions) {}\n\n  async enqueue<TPayload>(\n    jobType: string,\n    payload: TPayload,\n    options: EnqueueOptions = {}\n  ): Promise<Job<TPayload>> {\n    const enqueueTime =\n      options.delaySeconds != null\n        ? { seconds: Math.floor(Date.now() / 1000) + options.delaySeconds }\n        : undefined;\n    const body = Buffer.from(\n      JSON.stringify({\n        id: randomUUID(),\n        type: jobType,\n        payload,\n      }),\n      'utf-8'\n    );\n    await this.options.client.createTask({\n      parent: `projects/${this.options.projectId}/locations/${this.options.location}/queues/${this.options.queue}`,\n      task: {\n        httpRequest: {\n          httpMethod: 'POST',\n          url: this.options.resolveUrl(jobType),\n          body,\n          headers: { 'Content-Type': 'application/json' },\n          oidcToken: this.options.serviceAccountEmail\n            ? { serviceAccountEmail: this.options.serviceAccountEmail }\n            : undefined,\n        },\n        scheduleTime: enqueueTime,\n      },\n    });\n\n    return {\n      id: randomUUID(),\n      type: jobType,\n      version: 1,\n      payload,\n      status: 'pending',\n      priority: options.priority ?? 0,\n      attempts: 0,\n      maxRetries: options.maxRetries ?? DEFAULT_RETRY_POLICY.maxRetries,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    };\n  }\n\n  register<TPayload, TResult = void>(\n    jobType: string,\n    handler: JobHandler<TPayload, TResult>\n  ): void {\n    this.handlers.set(jobType, handler as JobHandler);\n  }\n\n  start(): void {\n    // Execution is handled by Cloud Tasks via HTTP callbacks.\n  }\n\n  async stop(): Promise<void> {\n    this.handlers.clear();\n  }\n}\n"],"mappings":";;;;AAmCA,IAAa,qBAAb,MAAoD;CAClD,AAAiB,2BAAW,IAAI,KAAyB;CAEzD,YAAY,AAAiBA,SAAoC;EAApC;;CAE7B,MAAM,QACJ,SACA,SACA,UAA0B,EAAE,EACJ;EACxB,MAAM,cACJ,QAAQ,gBAAgB,OACpB,EAAE,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,QAAQ,cAAc,GACjE;EACN,MAAM,OAAO,OAAO,KAClB,KAAK,UAAU;GACb,IAAI,YAAY;GAChB,MAAM;GACN;GACD,CAAC,EACF,QACD;AACD,QAAM,KAAK,QAAQ,OAAO,WAAW;GACnC,QAAQ,YAAY,KAAK,QAAQ,UAAU,aAAa,KAAK,QAAQ,SAAS,UAAU,KAAK,QAAQ;GACrG,MAAM;IACJ,aAAa;KACX,YAAY;KACZ,KAAK,KAAK,QAAQ,WAAW,QAAQ;KACrC;KACA,SAAS,EAAE,gBAAgB,oBAAoB;KAC/C,WAAW,KAAK,QAAQ,sBACpB,EAAE,qBAAqB,KAAK,QAAQ,qBAAqB,GACzD;KACL;IACD,cAAc;IACf;GACF,CAAC;AAEF,SAAO;GACL,IAAI,YAAY;GAChB,MAAM;GACN,SAAS;GACT;GACA,QAAQ;GACR,UAAU,QAAQ,YAAY;GAC9B,UAAU;GACV,YAAY,QAAQ,cAAc,qBAAqB;GACvD,2BAAW,IAAI,MAAM;GACrB,2BAAW,IAAI,MAAM;GACtB;;CAGH,SACE,SACA,SACM;AACN,OAAK,SAAS,IAAI,SAAS,QAAsB;;CAGnD,QAAc;CAId,MAAM,OAAsB;AAC1B,OAAK,SAAS,OAAO"}

package/dist/jobs/gcp-pubsub.d.ts

@@ -22,4 +22,5 @@ declare class GcpPubSubQueue implements JobQueue {
   stop(): Promise<void>;
 }
 //#endregion
-export { GcpPubSubQueue, GcpPubSubQueueOptions };
+export { GcpPubSubQueue, GcpPubSubQueueOptions };
+//# sourceMappingURL=gcp-pubsub.d.ts.map

package/dist/jobs/gcp-pubsub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-pubsub.d.ts","names":[],"sources":["../../src/jobs/gcp-pubsub.ts"],"sourcesContent":[],"mappings":";;;UAUU,gBAAA;;IAAA,cAAA,CAAgB,OAAA,EAAA;MAMT,IAAA,EAJmB,MAInB;IAKJ,CAAA,CAAA,EATkC,OASlC,CAAA,MAAe,CAAA;EAGY,CAAA;;AAK3B,UAbI,qBAAA,CAaJ;EACI,MAAA,EAbP,gBAaO;EAAJ,SAAA,EAAA,MAAA;;AA4BW,cArCX,cAAA,YAA0B,QAqCf,CAAA;EAAU,iBAAA,OAAA;EAArB,iBAAA,QAAA;EASG,WAAA,CAAA,OAAA,EA3CwB,qBA2CxB;EA9CuB,OAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAO1B,QAP0B,EAAA,OAAA,CAAA,EAQ1B,cAR0B,CAAA,EASlC,OATkC,CAS1B,GAT0B,CAStB,QATsB,CAAA,CAAA;EAAQ,QAAA,CAAA,QAAA,EAAA,UAAA,IAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAqClC,UArCkC,CAqCvB,QArCuB,EAqCb,OArCa,CAAA,CAAA,EAAA,IAAA;;UA8C/B"}

package/dist/jobs/gcp-pubsub.js

@@ -36,4 +36,5 @@ var GcpPubSubQueue = class {
 };
 
 //#endregion
-export { GcpPubSubQueue };
+export { GcpPubSubQueue };
+//# sourceMappingURL=gcp-pubsub.js.map

package/dist/jobs/gcp-pubsub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-pubsub.js","names":["options: GcpPubSubQueueOptions"],"sources":["../../src/jobs/gcp-pubsub.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport {\n  DEFAULT_RETRY_POLICY,\n  type EnqueueOptions,\n  type Job,\n  type JobHandler,\n  type JobQueue,\n} from './queue';\n\ninterface PubSubClientLike {\n  topic(name: string): {\n    publishMessage(message: { data: Buffer }): Promise<string>;\n  };\n}\n\nexport interface GcpPubSubQueueOptions {\n  client: PubSubClientLike;\n  topicName: string;\n}\n\nexport class GcpPubSubQueue implements JobQueue {\n  private readonly handlers = new Map<string, JobHandler>();\n\n  constructor(private readonly options: GcpPubSubQueueOptions) {}\n\n  async enqueue<TPayload>(\n    jobType: string,\n    payload: TPayload,\n    options: EnqueueOptions = {}\n  ): Promise<Job<TPayload>> {\n    await this.options.client.topic(this.options.topicName).publishMessage({\n      data: Buffer.from(\n        JSON.stringify({\n          id: randomUUID(),\n          type: jobType,\n          payload,\n        }),\n        'utf-8'\n      ),\n    });\n\n    return {\n      id: randomUUID(),\n      type: jobType,\n      version: 1,\n      payload,\n      status: 'pending',\n      priority: options.priority ?? 0,\n      attempts: 0,\n      maxRetries: options.maxRetries ?? DEFAULT_RETRY_POLICY.maxRetries,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    };\n  }\n\n  register<TPayload, TResult = void>(\n    jobType: string,\n    handler: JobHandler<TPayload, TResult>\n  ): void {\n    this.handlers.set(jobType, handler as JobHandler);\n  }\n\n  start(): void {\n    // Message consumption handled externally via Pub/Sub subscription.\n  }\n\n  async stop(): Promise<void> {\n    this.handlers.clear();\n  }\n}\n"],"mappings":";;;;AAqBA,IAAa,iBAAb,MAAgD;CAC9C,AAAiB,2BAAW,IAAI,KAAyB;CAEzD,YAAY,AAAiBA,SAAgC;EAAhC;;CAE7B,MAAM,QACJ,SACA,SACA,UAA0B,EAAE,EACJ;AACxB,QAAM,KAAK,QAAQ,OAAO,MAAM,KAAK,QAAQ,UAAU,CAAC,eAAe,EACrE,MAAM,OAAO,KACX,KAAK,UAAU;GACb,IAAI,YAAY;GAChB,MAAM;GACN;GACD,CAAC,EACF,QACD,EACF,CAAC;AAEF,SAAO;GACL,IAAI,YAAY;GAChB,MAAM;GACN,SAAS;GACT;GACA,QAAQ;GACR,UAAU,QAAQ,YAAY;GAC9B,UAAU;GACV,YAAY,QAAQ,cAAc,qBAAqB;GACvD,2BAAW,IAAI,MAAM;GACrB,2BAAW,IAAI,MAAM;GACtB;;CAGH,SACE,SACA,SACM;AACN,OAAK,SAAS,IAAI,SAAS,QAAsB;;CAGnD,QAAc;CAId,MAAM,OAAsB;AAC1B,OAAK,SAAS,OAAO"}

package/dist/jobs/handlers/gmail-sync-handler.d.ts

@@ -6,4 +6,5 @@ import { GmailIngestionAdapter } from "../../knowledge/ingestion/gmail-adapter.j
 interface GmailSyncJobPayload extends EmailThreadListQuery {}
 declare function createGmailSyncHandler(adapter: GmailIngestionAdapter): JobHandler<GmailSyncJobPayload>;
 //#endregion
-export { GmailSyncJobPayload, createGmailSyncHandler };
+export { GmailSyncJobPayload, createGmailSyncHandler };
+//# sourceMappingURL=gmail-sync-handler.d.ts.map

package/dist/jobs/handlers/gmail-sync-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail-sync-handler.d.ts","names":[],"sources":["../../../src/jobs/handlers/gmail-sync-handler.ts"],"sourcesContent":[],"mappings":";;;;;UAIiB,mBAAA,SAA4B;AAA5B,iBAED,sBAAA,CAF6B,OAAA,EAGlC,qBAHsD,CAAA,EAI9D,UAJ8D,CAInD,mBAJmD,CAAA"}

package/dist/jobs/handlers/gmail-sync-handler.js

@@ -6,4 +6,5 @@ function createGmailSyncHandler(adapter) {
 }
 
 //#endregion
-export { createGmailSyncHandler };
+export { createGmailSyncHandler };
+//# sourceMappingURL=gmail-sync-handler.js.map

package/dist/jobs/handlers/gmail-sync-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail-sync-handler.js","names":[],"sources":["../../../src/jobs/handlers/gmail-sync-handler.ts"],"sourcesContent":["import type { JobHandler } from '../queue';\nimport type { GmailIngestionAdapter } from '../../knowledge/ingestion/gmail-adapter';\nimport type { EmailThreadListQuery } from '../../integrations/providers/email';\n\nexport interface GmailSyncJobPayload extends EmailThreadListQuery {}\n\nexport function createGmailSyncHandler(\n  adapter: GmailIngestionAdapter\n): JobHandler<GmailSyncJobPayload> {\n  return async (job) => {\n    await adapter.syncThreads(job.payload);\n  };\n}\n"],"mappings":";AAMA,SAAgB,uBACd,SACiC;AACjC,QAAO,OAAO,QAAQ;AACpB,QAAM,QAAQ,YAAY,IAAI,QAAQ"}

package/dist/jobs/handlers/index.d.ts

@@ -6,4 +6,5 @@ import { StorageDocumentJobPayload, createStorageDocumentHandler } from "./stora
 //#region src/jobs/handlers/index.d.ts
 declare function registerAllJobs(queue: JobQueue): void;
 //#endregion
-export { GmailSyncJobPayload, PING_JOB_TYPE, PingPayload, PingPayloadSchema, StorageDocumentJobPayload, createGmailSyncHandler, createStorageDocumentHandler, pingJob, registerAllJobs };
+export { GmailSyncJobPayload, PING_JOB_TYPE, PingPayload, PingPayloadSchema, StorageDocumentJobPayload, createGmailSyncHandler, createStorageDocumentHandler, pingJob, registerAllJobs };
+//# sourceMappingURL=index.d.ts.map

package/dist/jobs/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/jobs/handlers/index.ts"],"sourcesContent":[],"mappings":";;;;;;iBAUgB,eAAA,QAAuB"}

package/dist/jobs/handlers/index.js

@@ -9,4 +9,5 @@ function registerAllJobs(queue) {
 }
 
 //#endregion
-export { PING_JOB_TYPE, PingPayloadSchema, createGmailSyncHandler, createStorageDocumentHandler, pingJob, registerAllJobs };
+export { PING_JOB_TYPE, PingPayloadSchema, createGmailSyncHandler, createStorageDocumentHandler, pingJob, registerAllJobs };
+//# sourceMappingURL=index.js.map

package/dist/jobs/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/jobs/handlers/index.ts"],"sourcesContent":["export * from './ping-handler';\nexport * from './gmail-sync-handler';\nexport * from './storage-document-handler';\nimport type { JobQueue } from '../queue';\nimport { registerDefinedJob } from '../define-job';\n\nimport { pingJob } from './ping-handler';\n// import { equityaRecomputePlanJob } from './types/equitya.recompute-plan';\n// import { artisanosGenerateQuoteJob } from './types/artisanos.generate-quote';\n\nexport function registerAllJobs(queue: JobQueue): void {\n  registerDefinedJob(queue, pingJob);\n  // registerDefinedJob(queue, equityaRecomputePlanJob);\n  // registerDefinedJob(queue, artisanosGenerateQuoteJob);\n}\n"],"mappings":";;;;;;AAUA,SAAgB,gBAAgB,OAAuB;AACrD,oBAAmB,OAAO,QAAQ"}

package/dist/jobs/handlers/ping-handler.d.ts

@@ -7,4 +7,5 @@ declare const PingPayloadSchema: z$1.ZodObject<{}, z$1.core.$strip>;
 type PingPayload = z$1.infer<typeof PingPayloadSchema>;
 declare const pingJob: DefinedJob<PingPayload>;
 //#endregion
-export { PING_JOB_TYPE, PingPayload, PingPayloadSchema, pingJob };
+export { PING_JOB_TYPE, PingPayload, PingPayloadSchema, pingJob };
+//# sourceMappingURL=ping-handler.d.ts.map

package/dist/jobs/handlers/ping-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping-handler.d.ts","names":[],"sources":["../../../src/jobs/handlers/ping-handler.ts"],"sourcesContent":[],"mappings":";;;;cAKa;cAEA,mBAAiB,GAAA,CAAA,cAAA,GAAA,CAAA,IAAA,CAAA;AAFjB,KAID,WAAA,GAAc,GAAA,CAAE,KAJqB,CAAA,OAIR,iBAJQ,CAAA;AAEpC,cAIA,OAJgC,EAIvB,UAJQ,CAIG,WAJH,CAAA"}

package/dist/jobs/handlers/ping-handler.js

@@ -12,4 +12,5 @@ const pingJob = {
 };
 
 //#endregion
-export { PING_JOB_TYPE, PingPayloadSchema, pingJob };
+export { PING_JOB_TYPE, PingPayloadSchema, pingJob };
+//# sourceMappingURL=ping-handler.js.map

package/dist/jobs/handlers/ping-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ping-handler.js","names":["z","pingJob: DefinedJob<PingPayload>"],"sources":["../../../src/jobs/handlers/ping-handler.ts"],"sourcesContent":["// jobs/types/ping.ts\nimport * as z from 'zod';\nimport type { Job } from '../queue';\nimport type { DefinedJob } from '../define-job';\n\nexport const PING_JOB_TYPE = 'core.ping' as const;\n\nexport const PingPayloadSchema = z.object({});\n\nexport type PingPayload = z.infer<typeof PingPayloadSchema>;\n\nexport const pingJob: DefinedJob<PingPayload> = {\n  type: PING_JOB_TYPE,\n  schema: PingPayloadSchema,\n  handler: async (_payload: PingPayload, job: Job<PingPayload>) => {\n    console.log('[ping] job id=%s attempts=%d', job.id, job.attempts);\n  },\n};\n"],"mappings":";;;AAKA,MAAa,gBAAgB;AAE7B,MAAa,oBAAoBA,IAAE,OAAO,EAAE,CAAC;AAI7C,MAAaC,UAAmC;CAC9C,MAAM;CACN,QAAQ;CACR,SAAS,OAAO,UAAuB,QAA0B;AAC/D,UAAQ,IAAI,gCAAgC,IAAI,IAAI,IAAI,SAAS;;CAEpE"}

package/dist/jobs/handlers/storage-document-handler.d.ts

@@ -9,4 +9,5 @@ interface StorageDocumentJobPayload {
 }
 declare function createStorageDocumentHandler(storage: ObjectStorageProvider, adapter: StorageIngestionAdapter): JobHandler<StorageDocumentJobPayload>;
 //#endregion
-export { StorageDocumentJobPayload, createStorageDocumentHandler };
+export { StorageDocumentJobPayload, createStorageDocumentHandler };
+//# sourceMappingURL=storage-document-handler.d.ts.map

package/dist/jobs/handlers/storage-document-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-document-handler.d.ts","names":[],"sources":["../../../src/jobs/handlers/storage-document-handler.ts"],"sourcesContent":[],"mappings":";;;;;UAIiB,yBAAA;;EAAA,GAAA,EAAA,MAAA;AAKjB;AACW,iBADK,4BAAA,CACL,OAAA,EAAA,qBAAA,EAAA,OAAA,EACA,uBADA,CAAA,EAER,UAFQ,CAEG,yBAFH,CAAA"}

package/dist/jobs/handlers/storage-document-handler.js

@@ -11,4 +11,5 @@ function createStorageDocumentHandler(storage, adapter) {
 }
 
 //#endregion
-export { createStorageDocumentHandler };
+export { createStorageDocumentHandler };
+//# sourceMappingURL=storage-document-handler.js.map

package/dist/jobs/handlers/storage-document-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-document-handler.js","names":[],"sources":["../../../src/jobs/handlers/storage-document-handler.ts"],"sourcesContent":["import type { ObjectStorageProvider } from '../../integrations/providers/storage';\nimport type { StorageIngestionAdapter } from '../../knowledge/ingestion/storage-adapter';\nimport type { JobHandler } from '../queue';\n\nexport interface StorageDocumentJobPayload {\n  bucket: string;\n  key: string;\n}\n\nexport function createStorageDocumentHandler(\n  storage: ObjectStorageProvider,\n  adapter: StorageIngestionAdapter\n): JobHandler<StorageDocumentJobPayload> {\n  return async (job) => {\n    const object = await storage.getObject({\n      bucket: job.payload.bucket,\n      key: job.payload.key,\n    });\n    if (!object) {\n      throw new Error(\n        `Object ${job.payload.bucket}/${job.payload.key} not found`\n      );\n    }\n    await adapter.ingestObject(object);\n  };\n}\n"],"mappings":";AASA,SAAgB,6BACd,SACA,SACuC;AACvC,QAAO,OAAO,QAAQ;EACpB,MAAM,SAAS,MAAM,QAAQ,UAAU;GACrC,QAAQ,IAAI,QAAQ;GACpB,KAAK,IAAI,QAAQ;GAClB,CAAC;AACF,MAAI,CAAC,OACH,OAAM,IAAI,MACR,UAAU,IAAI,QAAQ,OAAO,GAAG,IAAI,QAAQ,IAAI,YACjD;AAEH,QAAM,QAAQ,aAAa,OAAO"}