@nexus-cortex/core 4.130.0 → 4.131.2

package/dist/config/spaSecretTypes.d.ts

@@ -0,0 +1,329 @@
+/**
+ * Nexus Secrets - Type Definitions
+ *
+ * Secure storage for API keys, tokens, and sensitive configuration.
+ */
+/**
+ * Encrypted secret payload stored in database
+ */
+export interface EncryptedSecret {
+    /** Base64 encoded initialization vector (12 bytes for AES-GCM) */
+    iv: string;
+    /** Base64 encoded ciphertext */
+    ciphertext: string;
+    /** Base64 encoded authentication tag (16 bytes for AES-GCM) */
+    tag: string;
+    /** Encryption version for future migrations */
+    version: number;
+}
+/**
+ * Secret types within a provider
+ */
+export type SecretType = 'api-key' | 'api-secret' | 'token' | 'access-token' | 'refresh-token' | 'account-id' | 'username' | 'password' | 'client-id' | 'client-secret' | 'private-key' | 'public-key' | 'webhook-secret' | 'other';
+/**
+ * Known providers with their configurations
+ */
+export type KnownProvider = 'alpaca' | 'huggingface' | 'openai' | 'anthropic' | 'google' | 'github' | 'aws' | 'azure' | 'firebase' | 'supabase' | 'spacetimedb' | 'stripe' | 'twilio' | 'sendgrid' | 'polygon' | 'finnhub' | 'alpha-vantage' | 'iex-cloud' | 'quandl' | 'tradier' | 'interactive-brokers' | 'coinbase' | 'binance' | 'kraken' | 'workos' | 'xai' | 'deepseek' | 'custom';
+/**
+ * Provider configuration with expected secret types
+ */
+export interface ProviderConfig {
+    id: KnownProvider;
+    name: string;
+    description: string;
+    icon?: string;
+    color: string;
+    expectedSecrets: SecretType[];
+    docsUrl?: string;
+    /** Regex patterns to auto-detect this provider from API key format */
+    keyPatterns?: RegExp[];
+}
+/**
+ * Registry of known providers and their configurations
+ */
+export declare const PROVIDER_CONFIGS: Record<KnownProvider, ProviderConfig>;
+/**
+ * Legacy category type (for backwards compatibility)
+ * @deprecated Use provider + secretType instead
+ */
+export type SecretCategory = 'api-keys' | 'database' | 'authentication' | 'services' | 'other';
+/**
+ * Secret scope distinguishes platform (developer) secrets from user secrets:
+ * - platform: Infrastructure-level secrets (SpacetimeDB, Sentry, etc.) - developer only
+ * - user: Personal API keys (Alpaca, OpenAI, etc.) - visible to end users
+ */
+export type SecretScope = 'platform' | 'user';
+/**
+ * System-level user ID for platform secrets.
+ * Platform secrets use this ID instead of individual user IDs so they're
+ * accessible to the platform regardless of which user is logged in.
+ * These are infrastructure secrets (API keys for data feeds, etc.) managed by admins.
+ */
+export declare const PLATFORM_SYSTEM_ID = "nexus-platform-system";
+/**
+ * Full secret entry stored in database
+ */
+export interface Secret {
+    /** Unique identifier (UUID) */
+    id: string;
+    /** Secret name/key (e.g., "ALPACA_API_KEY") */
+    key: string;
+    /** Owner user ID */
+    userId: string;
+    /** Encrypted value payload */
+    encrypted: EncryptedSecret;
+    /** Optional encrypted description */
+    encryptedDescription?: EncryptedSecret;
+    /** Provider this secret belongs to (e.g., "alpaca", "openai") */
+    provider: KnownProvider;
+    /** Type of secret (e.g., "api-key", "token", "password") */
+    secretType: SecretType;
+    /** Legacy category for organization (deprecated, use provider instead) */
+    category: SecretCategory;
+    /** Scope: platform (developer infrastructure) or user (personal API keys) */
+    scope: SecretScope;
+    /** Creation timestamp (Unix ms) */
+    createdAt: number;
+    /** Last update timestamp (Unix ms) */
+    updatedAt: number;
+    /** Optional expiration timestamp (Unix ms) */
+    expiresAt?: number;
+    /** Whether synced to cloud (subscriber feature) */
+    synced: boolean;
+}
+/**
+ * Secret metadata (without sensitive encrypted values)
+ */
+export interface SecretMetadata {
+    id: string;
+    key: string;
+    provider: KnownProvider;
+    secretType: SecretType;
+    category: SecretCategory;
+    scope: SecretScope;
+    description?: string;
+    createdAt: number;
+    updatedAt: number;
+    expiresAt?: number;
+    synced: boolean;
+}
+/**
+ * Options when creating/updating a secret
+ */
+export interface SecretOptions {
+    /** Human-readable description */
+    description?: string;
+    /** Provider this secret belongs to */
+    provider?: KnownProvider;
+    /** Type of secret */
+    secretType?: SecretType;
+    /** Legacy category for organization */
+    category?: SecretCategory;
+    /** Secret scope (platform or user) - defaults to 'user' */
+    scope?: SecretScope;
+    /** Optional expiration timestamp */
+    expiresAt?: number;
+}
+/**
+ * Secrets service configuration
+ */
+export interface SecretsServiceConfig {
+    /** User ID for scoping secrets */
+    userId: string;
+    /** Auth token for key derivation */
+    authToken: string;
+    /** User's subscription tier */
+    tier: SecretTier;
+    /** Whether to enable cloud sync (subscriber feature) */
+    enableCloudSync?: boolean;
+}
+/**
+ * Result of a sync operation
+ */
+export interface SyncResult {
+    /** Whether sync was successful */
+    success: boolean;
+    /** Number of secrets uploaded to cloud */
+    uploaded: number;
+    /** Number of secrets downloaded from cloud */
+    downloaded: number;
+    /** Any conflicts encountered */
+    conflicts: SyncConflict[];
+    /** Error message if sync failed */
+    error?: string;
+}
+/**
+ * Conflict during sync
+ */
+export interface SyncConflict {
+    secretKey: string;
+    localUpdatedAt: number;
+    remoteUpdatedAt: number;
+    resolution: 'local' | 'remote' | 'manual';
+}
+/**
+ * Secret access log entry
+ */
+export interface SecretAccessLog {
+    timestamp: number;
+    action: 'read' | 'write' | 'delete' | 'list' | 'export' | 'import';
+    secretKey: string;
+    source: string;
+    success: boolean;
+    error?: string;
+}
+/**
+ * Storage adapter interface for secrets
+ */
+export interface ISecretsStorageAdapter {
+    /** Initialize the adapter */
+    initialize(): Promise<void>;
+    /** Get a secret by ID */
+    get(id: string): Promise<Secret | null>;
+    /** Get a secret by key */
+    getByKey(userId: string, key: string): Promise<Secret | null>;
+    /** Save a secret */
+    set(secret: Secret): Promise<void>;
+    /** Delete a secret by ID */
+    delete(id: string): Promise<void>;
+    /** List all secrets for a user */
+    list(userId: string): Promise<Secret[]>;
+    /** Count secrets for a user */
+    count(userId: string): Promise<number>;
+    /** Get last sync timestamp */
+    getLastSync(): Promise<number>;
+    /** Set last sync timestamp */
+    setLastSync(timestamp: number): Promise<void>;
+    /** Clear all secrets (for logout) */
+    clear(): Promise<void>;
+}
+/**
+ * Main secrets service interface
+ */
+export interface ISecretsService {
+    initialize(config: SecretsServiceConfig): Promise<void>;
+    isInitialized(): boolean;
+    getUserId(): string | null;
+    getUserTier(): SecretTier | null;
+    lock(): void;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, options?: SecretOptions): Promise<void>;
+    delete(key: string): Promise<void>;
+    has(key: string): Promise<boolean>;
+    list(): Promise<SecretMetadata[]>;
+    getBase64(key: string): Promise<string | null>;
+    getBasicAuth(keyName: string, secretName: string): Promise<string | null>;
+    export(): Promise<Record<string, string>>;
+    import(secrets: Record<string, string>, options?: SecretOptions): Promise<void>;
+    sync(): Promise<SyncResult>;
+    enableCloudSync(): Promise<void>;
+    disableCloudSync(): Promise<void>;
+    isCloudSyncEnabled(): boolean;
+    getUsage(): Promise<{
+        used: number;
+        limit: number;
+    }>;
+}
+/** Maximum secrets for free tier */
+export declare const FREE_TIER_SECRET_LIMIT = 5;
+/** Maximum secrets for pro tier */
+export declare const PRO_TIER_SECRET_LIMIT = 25;
+/** Maximum secrets for creator tier */
+export declare const CREATOR_TIER_SECRET_LIMIT = 100;
+/** Maximum secrets for team tier */
+export declare const TEAM_TIER_SECRET_LIMIT = 1000;
+/** Maximum secrets for admin tier — intentionally 10× team so admins are
+ * never gated by the secret cap during platform setup or debugging. */
+export declare const ADMIN_TIER_SECRET_LIMIT = 10000;
+/** Legacy: Maximum secrets for subscriber tiers (kept for backwards compatibility) */
+export declare const SUBSCRIBER_SECRET_LIMIT = 1000;
+/** All tiers recognised by the secrets service. */
+export type SecretTier = 'free' | 'pro' | 'creator' | 'team' | 'admin';
+/** Get secret limit for a tier */
+export declare function getSecretLimitForTier(tier: SecretTier): number;
+/** PBKDF2 iterations for key derivation */
+export declare const PBKDF2_ITERATIONS = 100000;
+/** Encryption version */
+export declare const ENCRYPTION_VERSION = 1;
+/** IndexedDB database name */
+export declare const SECRETS_DB_NAME = "nexus-secrets";
+/** IndexedDB store name */
+export declare const SECRETS_STORE_NAME = "secrets";
+/** IndexedDB store name for bindings */
+export declare const BINDINGS_STORE_NAME = "secret-bindings";
+/**
+ * Binding scope determines what the secret is available to:
+ * - platform: Available to ALL commands across the entire app
+ * - module: Available to all commands within a specific module
+ * - command: Available only to a specific command
+ */
+export type BindingScope = 'platform' | 'module' | 'command';
+/**
+ * A binding links a secret to a platform, module, or command
+ * When a command runs, secrets are resolved in order: platform → module → command
+ */
+export interface SecretBinding {
+    /** Unique binding ID */
+    id: string;
+    /** User ID for scoping */
+    userId: string;
+    /** Binding scope level */
+    scope: BindingScope;
+    /** The command shortcut (only for scope='command') */
+    command: string | null;
+    /** Module ID (for scope='module' or 'command') */
+    moduleId: string | null;
+    /** Secret key to inject (from secrets store) */
+    secretKey: string;
+    /** Environment variable name to inject as (e.g., "API_KEY") */
+    envVarName: string;
+    /** When binding was created */
+    createdAt: number;
+    /** When binding was last updated */
+    updatedAt: number;
+}
+/**
+ * Metadata for a binding (used in UI)
+ */
+export interface BindingMetadata {
+    id: string;
+    scope: BindingScope;
+    command: string | null;
+    moduleId: string | null;
+    secretKey: string;
+    envVarName: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Options when creating a binding
+ */
+export interface BindingOptions {
+    envVarName?: string;
+}
+/**
+ * Storage adapter interface for secret bindings
+ */
+export interface ISecretBindingsAdapter {
+    /** Initialize the adapter */
+    initialize(): Promise<void>;
+    /** Get all bindings for a user */
+    list(userId: string): Promise<SecretBinding[]>;
+    /** Get bindings for a specific command (scope='command') */
+    getByCommand(userId: string, command: string): Promise<SecretBinding[]>;
+    /** Get bindings for a specific module (scope='module') */
+    getByModule(userId: string, moduleId: string): Promise<SecretBinding[]>;
+    /** Get platform-wide bindings (scope='platform') */
+    getPlatformBindings(userId: string): Promise<SecretBinding[]>;
+    /** Get a binding by ID */
+    get(id: string): Promise<SecretBinding | null>;
+    /** Save a binding */
+    set(binding: SecretBinding): Promise<void>;
+    /** Delete a binding by ID */
+    delete(id: string): Promise<void>;
+    /** Delete all bindings for a command */
+    deleteByCommand(userId: string, command: string): Promise<void>;
+    /** Clear all bindings */
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=spaSecretTypes.d.ts.map

package/dist/config/spaSecretTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaSecretTypes.d.ts","sourceRoot":"","sources":["../../src/config/spaSecretTypes.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,YAAY,GACZ,OAAO,GACP,cAAc,GACd,eAAe,GACf,YAAY,GACZ,UAAU,GACV,UAAU,GACV,WAAW,GACX,eAAe,GACf,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,OAAO,CAAC;AAEZ;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,OAAO,GACP,UAAU,GACV,UAAU,GACV,aAAa,GACb,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,SAAS,GACT,SAAS,GACT,eAAe,GACf,WAAW,GACX,QAAQ,GACR,SAAS,GACT,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,UAAU,GACV,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,CAwQlE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,UAAU,GACV,OAAO,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,SAAS,EAAE,eAAe,CAAC;IAC3B,qCAAqC;IACrC,oBAAoB,CAAC,EAAE,eAAe,CAAC;IACvC,iEAAiE;IACjE,QAAQ,EAAE,aAAa,CAAC;IACxB,4DAA4D;IAC5D,UAAU,EAAE,UAAU,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,cAAc,CAAC;IACzB,6EAA6E;IAC7E,KAAK,EAAE,WAAW,CAAC;IACnB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,aAAa,CAAC;IACxB,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,qBAAqB;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,wDAAwD;IACxD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,yBAAyB;IACzB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAExC,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE9D,oBAAoB;IACpB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,4BAA4B;IAC5B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC,kCAAkC;IAClC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,+BAA+B;IAC/B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC,8BAA8B;IAC9B,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,8BAA8B;IAC9B,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,qCAAqC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAE9B,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,aAAa,IAAI,OAAO,CAAC;IACzB,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,IAAI,UAAU,GAAG,IAAI,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC;IAGb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAGlC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG1E,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhF,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,kBAAkB,IAAI,OAAO,CAAC;IAG9B,QAAQ,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAMD,oCAAoC;AACpC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,mCAAmC;AACnC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,uCAAuC;AACvC,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,oCAAoC;AACpC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;uEACuE;AACvE,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,mDAAmD;AACnD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEvE,kCAAkC;AAClC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAe9D;AAED,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,yBAAyB;AACzB,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,8BAA8B;AAC9B,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,2BAA2B;AAC3B,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAMrD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,KAAK,EAAE,YAAY,CAAC;IACpB,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,kCAAkC;IAClC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE/C,4DAA4D;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAExE,0DAA0D;IAC1D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAExE,oDAAoD;IACpD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE9D,0BAA0B;IAC1B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB;IACrB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C,6BAA6B;IAC7B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC,wCAAwC;IACxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,yBAAyB;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/config/spaSecretTypes.js

@@ -0,0 +1,326 @@
+// GENERATED by packages/core/scripts/sync-spa-secret-types.mjs from nexus-terminal/services/secrets/types.ts — do not edit.
+/* eslint-disable */
+/**
+ * Nexus Secrets - Type Definitions
+ *
+ * Secure storage for API keys, tokens, and sensitive configuration.
+ */
+/**
+ * Registry of known providers and their configurations
+ */
+export const PROVIDER_CONFIGS = {
+    alpaca: {
+        id: 'alpaca',
+        name: 'Alpaca',
+        description: 'Commission-free stock & crypto trading API',
+        icon: '🦙',
+        color: '#FFDC00',
+        expectedSecrets: ['api-key', 'api-secret', 'account-id'],
+        docsUrl: 'https://alpaca.markets/docs/',
+        keyPatterns: [/^PK[A-Z0-9]{18,}$/, /^AK[A-Z0-9]{18,}$/],
+    },
+    huggingface: {
+        id: 'huggingface',
+        name: 'Hugging Face',
+        description: 'AI models and datasets platform',
+        icon: '🤗',
+        color: '#FFD21E',
+        expectedSecrets: ['api-key', 'token'],
+        docsUrl: 'https://huggingface.co/docs',
+        keyPatterns: [/^hf_[a-zA-Z0-9]{20,}$/],
+    },
+    openai: {
+        id: 'openai',
+        name: 'OpenAI',
+        description: 'GPT and AI models API',
+        icon: '🧠',
+        color: '#10A37F',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://platform.openai.com/docs',
+        keyPatterns: [/^sk-[a-zA-Z0-9]{20,}$/],
+    },
+    anthropic: {
+        id: 'anthropic',
+        name: 'Anthropic',
+        description: 'Claude AI models API',
+        icon: '🔮',
+        color: '#D4A574',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://docs.anthropic.com',
+        keyPatterns: [/^sk-ant-[a-zA-Z0-9-]{20,}$/],
+    },
+    google: {
+        id: 'google',
+        name: 'Google Cloud',
+        description: 'Google Cloud Platform services',
+        icon: '☁️',
+        color: '#4285F4',
+        expectedSecrets: ['api-key', 'client-id', 'client-secret', 'private-key'],
+        docsUrl: 'https://cloud.google.com/docs',
+        keyPatterns: [/^AIza[a-zA-Z0-9_-]{35}$/],
+    },
+    github: {
+        id: 'github',
+        name: 'GitHub',
+        description: 'Code hosting and CI/CD platform',
+        icon: '🐙',
+        color: '#333333',
+        expectedSecrets: ['token', 'client-id', 'client-secret', 'webhook-secret'],
+        docsUrl: 'https://docs.github.com',
+        keyPatterns: [/^ghp_[a-zA-Z0-9]{36}$/, /^gho_[a-zA-Z0-9]{36}$/, /^github_pat_[a-zA-Z0-9_]{22,}$/],
+    },
+    aws: {
+        id: 'aws',
+        name: 'Amazon Web Services',
+        description: 'AWS cloud infrastructure',
+        icon: '📦',
+        color: '#FF9900',
+        expectedSecrets: ['api-key', 'api-secret', 'account-id'],
+        docsUrl: 'https://docs.aws.amazon.com',
+        keyPatterns: [/^AKIA[A-Z0-9]{16}$/],
+    },
+    azure: {
+        id: 'azure',
+        name: 'Microsoft Azure',
+        description: 'Azure cloud services',
+        icon: '☁️',
+        color: '#0078D4',
+        expectedSecrets: ['api-key', 'client-id', 'client-secret', 'account-id'],
+        docsUrl: 'https://docs.microsoft.com/azure',
+    },
+    firebase: {
+        id: 'firebase',
+        name: 'Firebase',
+        description: 'Google app development platform',
+        icon: '🔥',
+        color: '#FFCA28',
+        expectedSecrets: ['api-key', 'client-id', 'private-key'],
+        docsUrl: 'https://firebase.google.com/docs',
+    },
+    supabase: {
+        id: 'supabase',
+        name: 'Supabase',
+        description: 'Open source Firebase alternative',
+        icon: '⚡',
+        color: '#3ECF8E',
+        expectedSecrets: ['api-key', 'api-secret', 'account-id'],
+        docsUrl: 'https://supabase.com/docs',
+    },
+    spacetimedb: {
+        id: 'spacetimedb',
+        name: 'SpacetimeDB',
+        description: 'Real-time database platform',
+        icon: '🌌',
+        color: '#6366F1',
+        expectedSecrets: ['token', 'account-id'],
+        docsUrl: 'https://spacetimedb.com/docs',
+    },
+    stripe: {
+        id: 'stripe',
+        name: 'Stripe',
+        description: 'Payment processing platform',
+        icon: '💳',
+        color: '#635BFF',
+        expectedSecrets: ['api-key', 'api-secret', 'webhook-secret'],
+        docsUrl: 'https://stripe.com/docs',
+        keyPatterns: [/^sk_live_[a-zA-Z0-9]{24,}$/, /^sk_test_[a-zA-Z0-9]{24,}$/, /^pk_live_[a-zA-Z0-9]{24,}$/, /^pk_test_[a-zA-Z0-9]{24,}$/, /^whsec_[a-zA-Z0-9]{24,}$/],
+    },
+    twilio: {
+        id: 'twilio',
+        name: 'Twilio',
+        description: 'Communication APIs (SMS, Voice)',
+        icon: '📱',
+        color: '#F22F46',
+        expectedSecrets: ['account-id', 'api-key', 'api-secret'],
+        docsUrl: 'https://www.twilio.com/docs',
+        keyPatterns: [/^AC[a-f0-9]{32}$/, /^SK[a-f0-9]{32}$/],
+    },
+    sendgrid: {
+        id: 'sendgrid',
+        name: 'SendGrid',
+        description: 'Email delivery service',
+        icon: '📧',
+        color: '#1A82E2',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://docs.sendgrid.com',
+        keyPatterns: [/^SG\.[a-zA-Z0-9_-]{22,}\.[a-zA-Z0-9_-]{22,}$/],
+    },
+    polygon: {
+        id: 'polygon',
+        name: 'Polygon.io',
+        description: 'Stock market data API',
+        icon: '📈',
+        color: '#8B5CF6',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://polygon.io/docs',
+        keyPatterns: [/^[a-zA-Z0-9_]{32}$/],
+    },
+    finnhub: {
+        id: 'finnhub',
+        name: 'Finnhub',
+        description: 'Real-time stock API',
+        icon: '📊',
+        color: '#00C853',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://finnhub.io/docs/api',
+    },
+    'alpha-vantage': {
+        id: 'alpha-vantage',
+        name: 'Alpha Vantage',
+        description: 'Free stock API',
+        icon: '📉',
+        color: '#1E88E5',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://www.alphavantage.co/documentation/',
+    },
+    'iex-cloud': {
+        id: 'iex-cloud',
+        name: 'IEX Cloud',
+        description: 'Financial data platform',
+        icon: '💹',
+        color: '#6C5CE7',
+        expectedSecrets: ['api-key', 'api-secret'],
+        docsUrl: 'https://iexcloud.io/docs/',
+    },
+    quandl: {
+        id: 'quandl',
+        name: 'Quandl/Nasdaq',
+        description: 'Financial and economic data',
+        icon: '📋',
+        color: '#0091EA',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://docs.data.nasdaq.com/',
+    },
+    tradier: {
+        id: 'tradier',
+        name: 'Tradier',
+        description: 'Brokerage API',
+        icon: '🏦',
+        color: '#00BCD4',
+        expectedSecrets: ['api-key', 'access-token', 'account-id'],
+        docsUrl: 'https://documentation.tradier.com/',
+    },
+    'interactive-brokers': {
+        id: 'interactive-brokers',
+        name: 'Interactive Brokers',
+        description: 'Professional trading platform',
+        icon: '🏛️',
+        color: '#D32F2F',
+        expectedSecrets: ['username', 'password', 'account-id'],
+        docsUrl: 'https://interactivebrokers.github.io/',
+    },
+    coinbase: {
+        id: 'coinbase',
+        name: 'Coinbase',
+        description: 'Cryptocurrency exchange',
+        icon: '🪙',
+        color: '#0052FF',
+        expectedSecrets: ['api-key', 'api-secret'],
+        docsUrl: 'https://docs.cloud.coinbase.com/',
+    },
+    binance: {
+        id: 'binance',
+        name: 'Binance',
+        description: 'Cryptocurrency exchange',
+        icon: '🔶',
+        color: '#F0B90B',
+        expectedSecrets: ['api-key', 'api-secret'],
+        docsUrl: 'https://binance-docs.github.io/apidocs/',
+    },
+    kraken: {
+        id: 'kraken',
+        name: 'Kraken',
+        description: 'Cryptocurrency exchange',
+        icon: '🐙',
+        color: '#5741D9',
+        expectedSecrets: ['api-key', 'private-key'],
+        docsUrl: 'https://docs.kraken.com/',
+    },
+    workos: {
+        id: 'workos',
+        name: 'WorkOS',
+        description: 'Enterprise SSO and directory sync',
+        color: '#6363F1',
+        expectedSecrets: ['api-key', 'client-id', 'client-secret', 'webhook-secret'],
+        docsUrl: 'https://workos.com/docs',
+    },
+    xai: {
+        id: 'xai',
+        name: 'xAI',
+        description: 'Grok AI models API',
+        icon: '𝕏',
+        color: '#000000',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://docs.x.ai/',
+        keyPatterns: [/^xai-[a-zA-Z0-9]{20,}$/],
+    },
+    deepseek: {
+        id: 'deepseek',
+        name: 'DeepSeek',
+        description: 'DeepSeek AI models API',
+        icon: '🔬',
+        color: '#4D6BFE',
+        expectedSecrets: ['api-key'],
+        docsUrl: 'https://api-docs.deepseek.com/',
+        keyPatterns: [/^sk-[a-f0-9]{32,}$/],
+    },
+    custom: {
+        id: 'custom',
+        name: 'Custom',
+        description: 'Custom provider',
+        icon: '⚙️',
+        color: '#94a3b8',
+        expectedSecrets: ['api-key', 'api-secret', 'token', 'username', 'password', 'account-id', 'other'],
+    },
+};
+/**
+ * System-level user ID for platform secrets.
+ * Platform secrets use this ID instead of individual user IDs so they're
+ * accessible to the platform regardless of which user is logged in.
+ * These are infrastructure secrets (API keys for data feeds, etc.) managed by admins.
+ */
+export const PLATFORM_SYSTEM_ID = 'nexus-platform-system';
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+/** Maximum secrets for free tier */
+export const FREE_TIER_SECRET_LIMIT = 5;
+/** Maximum secrets for pro tier */
+export const PRO_TIER_SECRET_LIMIT = 25;
+/** Maximum secrets for creator tier */
+export const CREATOR_TIER_SECRET_LIMIT = 100;
+/** Maximum secrets for team tier */
+export const TEAM_TIER_SECRET_LIMIT = 1000;
+/** Maximum secrets for admin tier — intentionally 10× team so admins are
+ * never gated by the secret cap during platform setup or debugging. */
+export const ADMIN_TIER_SECRET_LIMIT = 10000;
+/** Legacy: Maximum secrets for subscriber tiers (kept for backwards compatibility) */
+export const SUBSCRIBER_SECRET_LIMIT = 1000;
+/** Get secret limit for a tier */
+export function getSecretLimitForTier(tier) {
+    switch (tier) {
+        case 'free':
+            return FREE_TIER_SECRET_LIMIT;
+        case 'pro':
+            return PRO_TIER_SECRET_LIMIT;
+        case 'creator':
+            return CREATOR_TIER_SECRET_LIMIT;
+        case 'team':
+            return TEAM_TIER_SECRET_LIMIT;
+        case 'admin':
+            return ADMIN_TIER_SECRET_LIMIT;
+        default:
+            return FREE_TIER_SECRET_LIMIT;
+    }
+}
+/** PBKDF2 iterations for key derivation */
+export const PBKDF2_ITERATIONS = 100000;
+/** Encryption version */
+export const ENCRYPTION_VERSION = 1;
+/** IndexedDB database name */
+export const SECRETS_DB_NAME = 'nexus-secrets';
+/** IndexedDB store name */
+export const SECRETS_STORE_NAME = 'secrets';
+/** IndexedDB store name for bindings */
+export const BINDINGS_STORE_NAME = 'secret-bindings';
+//# sourceMappingURL=spaSecretTypes.js.map