@nocobase/app-server 0.11.1-alpha.5 → 2.0.0-beta.2

package/dist/sample-data/token.d.ts

@@ -0,0 +1,64 @@
+import { type ServiceToken } from '@nocobase/service-provider';
+/**
+ * Sample data a service builds rather than a seed: what has to go through other plugins' services, such as projects
+ * with issues and comments. It runs once the application is ready, under the same condition as a seed declared with
+ * `sample: true` — the database was installed by this start and `app.sampleData` is set — and is recorded in the
+ * seed history of the default connection as `sample-data:<name>`, so it never runs twice on its own.
+ */
+export interface SampleDataRegistration {
+    /** Unique within the application, such as `acme/demo`. */
+    readonly name: string;
+    /** The package that registers it, recorded with it. */
+    readonly packageName: string;
+    run(): Promise<void>;
+}
+/** A recorded sample, as the ledger returns it. */
+export interface SampleDataRecord {
+    readonly name: string;
+    readonly status: 'executed' | 'skipped';
+}
+/** Where samples are recorded: the default connection's seed history. The database provider supplies it. */
+export interface SampleDataLedger {
+    history(): Promise<readonly SampleDataRecord[]>;
+    record(entry: {
+        readonly packageName: string;
+        readonly name: string;
+        readonly status: 'executed' | 'skipped';
+        readonly durationMs?: number | null;
+    }): Promise<void>;
+}
+export interface SampleDataRunResult {
+    /** Registration names that ran. */
+    readonly executed: readonly string[];
+    /** Registration names recorded as skipped without running. */
+    readonly skipped: readonly string[];
+    /** Registrations that threw; each is recorded as skipped, so `nocobase db sample` can run it again. */
+    readonly failed: readonly {
+        readonly name: string;
+        readonly error: unknown;
+    }[];
+}
+export interface SampleDataService {
+    /** Adds sample data to build. Call it from a service provider's `register()` or `boot()`. */
+    register(registration: SampleDataRegistration): void;
+    registrations(): readonly SampleDataRegistration[];
+    /**
+     * Called by the database provider once startup tasks ran: where samples are recorded, and whether this start
+     * installed the database with `app.sampleData` set. Without it, a run does nothing.
+     */
+    prepare(state: {
+        readonly ledger: SampleDataLedger;
+        readonly enabled: boolean;
+    }): void;
+    /**
+     * Makes the next run build every registration recorded as skipped, or not recorded at all, whatever `prepare` said.
+     * `nocobase db sample` uses it.
+     */
+    rerunSkipped(): void;
+    /** Builds or skips what is not recorded yet. The application calls it once every provider is ready. */
+    run(): Promise<SampleDataRunResult>;
+}
+export declare const sampleDataToken: ServiceToken<SampleDataService>;
+/** The seed history name a registration is recorded under. */
+export declare function sampleDataRecordName(name: string): string;
+//# sourceMappingURL=token.d.ts.map

package/dist/sample-data/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/sample-data/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED,4GAA4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,OAAO,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uGAAuG;IACvG,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,EAAE,CAAC;CACL;AAED,MAAM,WAAW,iBAAiB;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACrD,aAAa,IAAI,SAAS,sBAAsB,EAAE,CAAC;IACnD;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT;;;OAGG;IACH,YAAY,IAAI,IAAI,CAAC;IACrB,uGAAuG;IACvG,GAAG,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACrC;AAED,eAAO,MAAM,eAAe,EAAE,YAAY,CAAC,iBAAiB,CACe,CAAC;AAE5E,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/sample-data/token.js

@@ -0,0 +1,7 @@
+import { createServiceToken, } from '@nocobase/service-provider';
+export const sampleDataToken = createServiceToken('@nocobase/app-server/sample-data');
+/** The seed history name a registration is recorded under. */
+export function sampleDataRecordName(name) {
+    return `sample-data:${name}`;
+}
+//# sourceMappingURL=token.js.map

package/dist/sample-data/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/sample-data/token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAkEpC,MAAM,CAAC,MAAM,eAAe,GAC1B,kBAAkB,CAAoB,kCAAkC,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,eAAe,IAAI,EAAE,CAAC;AAC/B,CAAC"}

package/dist/secrets/config.d.ts

@@ -0,0 +1,15 @@
+import { type SecretKeyEntry } from '@nocobase/secrets';
+import type { EnvironmentMapping, EnvironmentMetadata } from '@nocobase/config/providers/env';
+import { type AppConfigDefinition, type AppConfigFactory, type ConfigValidator } from '../config/define-app-config.js';
+export type { SecretKeyEntry } from '@nocobase/secrets';
+/** The `secrets` section: the master keys stored secrets are encrypted with, the current one first. */
+export interface SecretsConfig {
+    readonly keys?: readonly SecretKeyEntry[];
+}
+/** `SECRETS_KEYS=2:<key>,1:<key>`, the current key first. */
+export declare function envSecretKeys(path: string, metadata?: EnvironmentMetadata): EnvironmentMapping;
+/** Rejects weak, placeholder and duplicate keys. A missing list is reported by `config check`, not here. */
+export declare const validateSecretsConfig: ConfigValidator<SecretsConfig>;
+/** Declares the `secrets` section with its validation and the `SECRETS_KEYS` variable. */
+export declare function defineSecretsConfig(definition?: Partial<AppConfigDefinition<SecretsConfig>>): AppConfigFactory<SecretsConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/secrets/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC3C;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,mBAAwB,GACjC,kBAAkB,CAQpB;AAcD,4GAA4G;AAC5G,eAAO,MAAM,qBAAqB,EAAE,eAAe,CAAC,aAAa,CAahE,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAM,GAC3D,gBAAgB,CAAC,aAAa,CAAC,CAajC"}

package/dist/secrets/config.js

@@ -0,0 +1,43 @@
+import { parseSecretKeysEnv, validateSecretKeys, } from '@nocobase/secrets';
+import { defineAppConfig, } from '../config/define-app-config.js';
+import { isPlaceholderSecret } from '../config/placeholder-secret.js';
+/** `SECRETS_KEYS=2:<key>,1:<key>`, the current key first. */
+export function envSecretKeys(path, metadata = {}) {
+    return {
+        ...metadata,
+        path,
+        type: 'secretKeys',
+        parse: (value) => parseSecretKeysEnv(value).map((entry) => ({ ...entry })),
+    };
+}
+const SECRETS_ENVIRONMENT = {
+    SECRETS_KEYS: envSecretKeys('keys', {
+        description: 'The master keys stored secrets are encrypted with, as version:key pairs, the current one first.',
+        secret: true,
+        generate: 'secretKeys',
+    }),
+};
+const KEY_FIX = 'Generate a key with: openssl rand -hex 32, and put it first in secrets.keys with a version above every other.';
+/** Rejects weak, placeholder and duplicate keys. A missing list is reported by `config check`, not here. */
+export const validateSecretsConfig = (secrets, context) => {
+    for (const issue of validateSecretKeys(secrets.keys, {
+        isPlaceholder: isPlaceholderSecret,
+    })) {
+        context.error(issue.index === undefined ? 'keys' : `keys.${issue.index}`, issue.message, { fix: KEY_FIX });
+    }
+};
+/** Declares the `secrets` section with its validation and the `SECRETS_KEYS` variable. */
+export function defineSecretsConfig(definition = {}) {
+    const extra = definition.validate === undefined
+        ? []
+        : Array.isArray(definition.validate)
+            ? definition.validate
+            : [definition.validate];
+    return defineAppConfig({
+        defaults: definition.defaults ?? { keys: [] },
+        validate: [validateSecretsConfig, ...extra],
+        public: definition.public ?? [],
+        env: { ...SECRETS_ENVIRONMENT, ...definition.env },
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/secrets/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EACL,eAAe,GAIhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAStE,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,WAAgC,EAAE;IAElC,OAAO;QACL,GAAG,QAAQ;QACX,IAAI;QACJ,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAiD;IACxE,YAAY,EAAE,aAAa,CAAC,MAAM,EAAE;QAClC,WAAW,EACT,iGAAiG;QACnG,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,YAAY;KACvB,CAAC;CACH,CAAC;AAEF,MAAM,OAAO,GACX,+GAA+G,CAAC;AAElH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,qBAAqB,GAAmC,CACnE,OAAO,EACP,OAAO,EACP,EAAE;IACF,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE;QACnD,aAAa,EAAE,mBAAmB;KACnC,CAAC,EAAE,CAAC;QACH,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,EAC1D,KAAK,CAAC,OAAO,EACb,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CACjC,aAA0D,EAAE;IAE5D,MAAM,KAAK,GACT,UAAU,CAAC,QAAQ,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAClC,CAAC,CAAE,UAAU,CAAC,QAAsD;YACpE,CAAC,CAAC,CAAC,UAAU,CAAC,QAA0C,CAAC,CAAC;IAChE,OAAO,eAAe,CAAgB;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7C,QAAQ,EAAE,CAAC,qBAAqB,EAAE,GAAG,KAAK,CAAC;QAC3C,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;QAC/B,GAAG,EAAE,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE;KACnD,CAAC,CAAC;AACL,CAAC"}

package/dist/secrets/index.d.ts

@@ -0,0 +1,6 @@
+export * from './config.js';
+export * from './provider.js';
+export * from './service.js';
+export * from './table-store.js';
+export { secretsServiceToken } from './token.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,6 @@
+export * from './config.js';
+export * from './provider.js';
+export * from './service.js';
+export * from './table-store.js';
+export { secretsServiceToken } from './token.js';
+//# sourceMappingURL=index.js.map

package/dist/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/secrets/provider.d.ts

@@ -0,0 +1,7 @@
+import { ServiceProvider } from '@nocobase/service-provider';
+import type { AppPluginApplication } from '../plugins/index.js';
+export declare class SecretsProvider extends ServiceProvider<AppPluginApplication> {
+    readonly name: string;
+    register(): void;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/secrets/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/secrets/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAKhE,qBAAa,eAAgB,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAkC;IAE9C,QAAQ,IAAI,IAAI;CAOjC"}

package/dist/secrets/provider.js

@@ -0,0 +1,10 @@
+import { ServiceProvider } from '@nocobase/service-provider';
+import { createSecretsService } from './service.js';
+import { secretsServiceToken } from './token.js';
+export class SecretsProvider extends ServiceProvider {
+    name = '@nocobase/app-server/secrets';
+    register() {
+        this.app.container.singleton(secretsServiceToken, () => createSecretsService(this.app.config.get('secrets') ?? { keys: [] }));
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/secrets/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/secrets/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,OAAO,eAAgB,SAAQ,eAAqC;IACxD,IAAI,GAAW,8BAA8B,CAAC;IAE9C,QAAQ;QACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACrD,oBAAoB,CAClB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9D,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/secrets/service.d.ts

@@ -0,0 +1,64 @@
+import { type DerivedSecret, type SecretsEnvelopeInfo, type SecretsSealOptions } from '@nocobase/secrets';
+import type { SecretsConfig } from './config.js';
+export { SecretsError, isSecretsError, type DerivedSecret, type SecretsEnvelopeInfo, type SecretsErrorCode, type SecretsSealOptions, } from '@nocobase/secrets';
+/** What `secrets status` and `secrets rotate` hand a store. */
+export interface SecretsStoreContext {
+    readonly secrets: SecretsService;
+    /** How many rows to read and rewrite at a time. */
+    readonly batchSize: number;
+    /** `rotate --dry-run`: count what would change, write nothing. */
+    readonly dryRun: boolean;
+}
+export interface SecretsStoreStatus {
+    /** Sealed values the store holds. */
+    readonly total: number;
+    /** Count of sealed values by the key version that sealed them. */
+    readonly byVersion: Readonly<Record<string, number>>;
+    /** Values not sealed with the current key, including legacy ones a store still reads. */
+    readonly needsReseal: number;
+    /** Values in a format the store reads only for compatibility. */
+    readonly legacy?: number;
+}
+export interface SecretsResealResult {
+    /** Values rewritten under the current key (or that would be, under `dryRun`). */
+    readonly resealed: number;
+    /** Values that could not be opened, left as they were. */
+    readonly failed: number;
+}
+/**
+ * A place that keeps sealed values: one table, or a few columns of one. `reseal` rewrites every value not sealed with
+ * the current key and must be safe to run again — after an interruption, or alongside a running application.
+ */
+export interface SecretsStore {
+    readonly name: string;
+    status(context: SecretsStoreContext): Promise<SecretsStoreStatus>;
+    reseal(context: SecretsStoreContext): Promise<SecretsResealResult>;
+}
+export interface SecretsService {
+    /** Whether keys are configured, so that `seal`, `open` and `keyring` work. */
+    readonly ready: boolean;
+    /** The version new values are sealed with; `undefined` when not ready. */
+    readonly currentVersion: number | undefined;
+    /** Encrypts `plaintext` for `purpose`. Throws `SECRETS_NOT_CONFIGURED` when not ready. */
+    seal(plaintext: string, options: SecretsSealOptions): string;
+    /** Decrypts what `seal` produced with the same purpose and `aad`. */
+    open(sealed: string, options: SecretsSealOptions): string;
+    /** The key version of a sealed value, without opening it. */
+    inspect(sealed: string): SecretsEnvelopeInfo;
+    /** Whether a sealed value was sealed with a key other than the current one. */
+    needsReseal(sealed: string): boolean;
+    /**
+     * Every configured version's key derived for `purpose`, current first, for a library that encrypts on its own and
+     * takes a rotation list, such as Better Auth's `secrets`.
+     */
+    keyring(purpose: string): DerivedSecret[];
+    registerStore(store: SecretsStore): void;
+    stores(): readonly SecretsStore[];
+}
+export declare const SECRETS_NOT_CONFIGURED_MESSAGE: string;
+/**
+ * The service over the configured keys. Without keys, or with keys that fail validation, it is not ready rather than
+ * failing to construct: a command that never touches a secret still runs, and every use reports what to configure.
+ */
+export declare function createSecretsService(config: SecretsConfig): SecretsService;
+//# sourceMappingURL=service.d.ts.map

package/dist/secrets/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/secrets/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,0FAA0F;IAC1F,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAAC;IAC7D,qEAAqE;IACrE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAAC;IAC1D,6DAA6D;IAC7D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC7C,+EAA+E;IAC/E,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IAC1C,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACzC,MAAM,IAAI,SAAS,YAAY,EAAE,CAAC;CACnC;AAED,eAAO,MAAM,8BAA8B,EAAE,MAC2J,CAAC;AAEzM;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAyC1E"}

package/dist/secrets/service.js

@@ -0,0 +1,47 @@
+import { createKeyring, inspectSecret, isSecretsError, SecretsError, } from '@nocobase/secrets';
+export { SecretsError, isSecretsError, } from '@nocobase/secrets';
+export const SECRETS_NOT_CONFIGURED_MESSAGE = 'No secrets key is configured. Run pnpm nocobase config init, or set secrets.keys in the configuration file (SECRETS_KEYS in the environment) to a random key such as one from: openssl rand -hex 32.';
+/**
+ * The service over the configured keys. Without keys, or with keys that fail validation, it is not ready rather than
+ * failing to construct: a command that never touches a secret still runs, and every use reports what to configure.
+ */
+export function createSecretsService(config) {
+    let keyring;
+    let unavailable;
+    if (!config.keys || config.keys.length === 0) {
+        unavailable = new SecretsError('SECRETS_NOT_CONFIGURED', SECRETS_NOT_CONFIGURED_MESSAGE);
+    }
+    else {
+        try {
+            keyring = createKeyring(config.keys);
+        }
+        catch (error) {
+            if (!isSecretsError(error))
+                throw error;
+            unavailable = error;
+        }
+    }
+    const require = () => {
+        if (keyring)
+            return keyring;
+        throw unavailable;
+    };
+    const stores = new Map();
+    return {
+        ready: keyring !== undefined,
+        currentVersion: keyring?.currentVersion,
+        seal: (plaintext, options) => require().seal(plaintext, options),
+        open: (sealed, options) => require().open(sealed, options),
+        inspect: (sealed) => inspectSecret(sealed),
+        needsReseal: (sealed) => inspectSecret(sealed).version !== require().currentVersion,
+        keyring: (purpose) => require().derive(purpose),
+        registerStore(store) {
+            if (stores.has(store.name)) {
+                throw new Error(`A secrets store named ${store.name} is already registered.`);
+            }
+            stores.set(store.name, store);
+        },
+        stores: () => [...stores.values()],
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/secrets/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/secrets/service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,YAAY,GAKb,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,YAAY,EACZ,cAAc,GAKf,MAAM,mBAAmB,CAAC;AA6D3B,MAAM,CAAC,MAAM,8BAA8B,GACzC,sMAAsM,CAAC;AAEzM;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,OAA4B,CAAC;IACjC,IAAI,WAAqC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,WAAW,GAAG,IAAI,YAAY,CAC5B,wBAAwB,EACxB,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxC,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAY,EAAE;QAC5B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,WAAY,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE/C,OAAO;QACL,KAAK,EAAE,OAAO,KAAK,SAAS;QAC5B,cAAc,EAAE,OAAO,EAAE,cAAc;QACvC,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;QAChE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1D,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC,cAAc;QAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,aAAa,CAAC,KAAK;YACjB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,IAAI,yBAAyB,CAC7D,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/secrets/table-store.d.ts

@@ -0,0 +1,34 @@
+import type { DatabaseConnection } from '@nocobase/db';
+import type { SecretsStore } from './service.js';
+type Row = Record<string, unknown>;
+/** A value format a column still reads for compatibility. Such values count as legacy and are resealed. */
+export interface SecretsLegacyFormat {
+    matches(value: string): boolean;
+    open(value: string, row: Row): string;
+}
+export interface SecretsTableColumn {
+    readonly column: string;
+    readonly purpose: string;
+    /** What the column's values are bound to, read from the row, such as its id. */
+    readonly aad?: (row: Row) => readonly string[];
+    readonly legacy?: SecretsLegacyFormat;
+}
+export interface SecretsTableStoreOptions {
+    readonly name: string;
+    readonly table: string;
+    /** The column rows are paged and updated by. Defaults to `id`. */
+    readonly key?: string;
+    readonly columns: readonly SecretsTableColumn[];
+    /** Further columns `aad` or `legacy.open` read. */
+    readonly select?: readonly string[];
+    readonly connection: () => DatabaseConnection;
+}
+/**
+ * A store over columns of one table. Rows are paged by `key`, so a run reads a bounded batch at a time, and each value
+ * is rewritten only if it still holds what was read, so a run racing the application or another run never overwrites
+ * a newer value. Running it again picks up where an interrupted run stopped, because sealed-with-current values are
+ * skipped.
+ */
+export declare function createSecretsTableStore(options: SecretsTableStoreOptions): SecretsStore;
+export {};
+//# sourceMappingURL=table-store.d.ts.map

package/dist/secrets/table-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-store.d.ts","sourceRoot":"","sources":["../../src/secrets/table-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,KAAK,EAEV,YAAY,EAGb,MAAM,cAAc,CAAC;AAEtB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,YAAY,CAqGd"}

package/dist/secrets/table-store.js

@@ -0,0 +1,118 @@
+import { isSealedSecret } from '@nocobase/secrets';
+/**
+ * A store over columns of one table. Rows are paged by `key`, so a run reads a bounded batch at a time, and each value
+ * is rewritten only if it still holds what was read, so a run racing the application or another run never overwrites
+ * a newer value. Running it again picks up where an interrupted run stopped, because sealed-with-current values are
+ * skipped.
+ */
+export function createSecretsTableStore(options) {
+    const key = options.key ?? 'id';
+    const selection = [
+        ...new Set([
+            key,
+            ...options.columns.map((column) => column.column),
+            ...(options.select ?? []),
+        ]),
+    ];
+    async function* batches(batchSize) {
+        let last;
+        for (;;) {
+            let query = options
+                .connection()
+                .query.selectFrom(options.table)
+                .select(selection);
+            if (last !== undefined)
+                query = query.where(key, '>', last);
+            const rows = await query
+                .orderBy(key, 'asc')
+                .limit(batchSize)
+                .execute();
+            if (rows.length === 0)
+                return;
+            yield rows;
+            if (rows.length < batchSize)
+                return;
+            last = rows[rows.length - 1][key];
+        }
+    }
+    return {
+        name: options.name,
+        async status(context) {
+            const byVersion = {};
+            let total = 0;
+            let needsReseal = 0;
+            let legacy = 0;
+            for await (const rows of batches(context.batchSize)) {
+                for (const row of rows) {
+                    for (const column of options.columns) {
+                        const value = row[column.column];
+                        if (typeof value !== 'string' || value === '')
+                            continue;
+                        total += 1;
+                        const version = classify(value, column);
+                        byVersion[version] = (byVersion[version] ?? 0) + 1;
+                        if (version === 'legacy')
+                            legacy += 1;
+                        if (version === 'legacy' ||
+                            (version !== 'malformed' &&
+                                Number(version) !== context.secrets.currentVersion)) {
+                            needsReseal += 1;
+                        }
+                    }
+                }
+            }
+            return { total, byVersion, needsReseal, ...(legacy ? { legacy } : {}) };
+        },
+        async reseal(context) {
+            let resealed = 0;
+            let failed = 0;
+            for await (const rows of batches(context.batchSize)) {
+                for (const row of rows) {
+                    for (const column of options.columns) {
+                        const value = row[column.column];
+                        if (typeof value !== 'string' || value === '')
+                            continue;
+                        const version = classify(value, column);
+                        if (version === 'malformed')
+                            continue;
+                        if (version !== 'legacy' &&
+                            Number(version) === context.secrets.currentVersion)
+                            continue;
+                        const seal = { purpose: column.purpose, aad: column.aad?.(row) };
+                        let plaintext;
+                        try {
+                            plaintext =
+                                version === 'legacy'
+                                    ? column.legacy.open(value, row)
+                                    : context.secrets.open(value, seal);
+                        }
+                        catch {
+                            failed += 1;
+                            continue;
+                        }
+                        if (context.dryRun) {
+                            resealed += 1;
+                            continue;
+                        }
+                        const result = await options
+                            .connection()
+                            .query.updateTable(options.table)
+                            .set({ [column.column]: context.secrets.seal(plaintext, seal) })
+                            .where(key, '=', row[key])
+                            .where(column.column, '=', value)
+                            .execute();
+                        if ((result.updatedCount ?? 1) > 0)
+                            resealed += 1;
+                    }
+                }
+            }
+            return { resealed, failed };
+        },
+    };
+}
+function classify(value, column) {
+    if (isSealedSecret(value))
+        return value.split('.')[1];
+    return column.legacy?.matches(value) ? 'legacy' : 'malformed';
+}
+//# sourceMappingURL=table-store.js.map

package/dist/secrets/table-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-store.js","sourceRoot":"","sources":["../../src/secrets/table-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoCnD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAiC;IAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC;YACT,GAAG;YACH,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SAC1B,CAAC;KACH,CAAC;IAEF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,SAAiB;QACvC,IAAI,IAAa,CAAC;QAClB,SAAS,CAAC;YACR,IAAI,KAAK,GAAG,OAAO;iBAChB,UAAU,EAAE;iBACZ,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;iBAC/B,MAAM,CAAC,SAAS,CAAC,CAAC;YACrB,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,KAAK;iBACrB,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;iBACnB,KAAK,CAAC,SAAS,CAAC;iBAChB,OAAO,EAAO,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC9B,MAAM,IAAI,CAAC;YACX,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;gBAAE,OAAO;YACpC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,CAAC,MAAM,CAAC,OAA4B;YACvC,MAAM,SAAS,GAA2B,EAAE,CAAC;YAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;4BAAE,SAAS;wBACxD,KAAK,IAAI,CAAC,CAAC;wBACX,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBACxC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;wBACnD,IAAI,OAAO,KAAK,QAAQ;4BAAE,MAAM,IAAI,CAAC,CAAC;wBACtC,IACE,OAAO,KAAK,QAAQ;4BACpB,CAAC,OAAO,KAAK,WAAW;gCACtB,MAAM,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EACrD,CAAC;4BACD,WAAW,IAAI,CAAC,CAAC;wBACnB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAA4B;YACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;4BAAE,SAAS;wBACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBACxC,IAAI,OAAO,KAAK,WAAW;4BAAE,SAAS;wBACtC,IACE,OAAO,KAAK,QAAQ;4BACpB,MAAM,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc;4BAElD,SAAS;wBACX,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjE,IAAI,SAAiB,CAAC;wBACtB,IAAI,CAAC;4BACH,SAAS;gCACP,OAAO,KAAK,QAAQ;oCAClB,CAAC,CAAC,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oCACjC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;wBAC1C,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,IAAI,CAAC,CAAC;4BACZ,SAAS;wBACX,CAAC;wBACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;4BACnB,QAAQ,IAAI,CAAC,CAAC;4BACd,SAAS;wBACX,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,OAAO;6BACzB,UAAU,EAAE;6BACZ,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;6BAChC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;6BAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;6BACzB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC;6BAChC,OAAO,EAAE,CAAC;wBACb,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;4BAAE,QAAQ,IAAI,CAAC,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,MAA0B;IACzD,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;AAChE,CAAC"}

package/dist/secrets/token.d.ts

@@ -0,0 +1,4 @@
+import { type ServiceToken } from '@nocobase/service-provider';
+import type { SecretsService } from './service.js';
+export declare const secretsServiceToken: ServiceToken<SecretsService>;
+//# sourceMappingURL=token.d.ts.map

package/dist/secrets/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/secrets/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,eAAO,MAAM,mBAAmB,EAAE,YAAY,CAAC,cAAc,CACO,CAAC"}

package/dist/secrets/token.js

@@ -0,0 +1,3 @@
+import { createServiceToken, } from '@nocobase/service-provider';
+export const secretsServiceToken = createServiceToken('@nocobase/app-server/secrets');
+//# sourceMappingURL=token.js.map

package/dist/secrets/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/secrets/token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,CAAC,MAAM,mBAAmB,GAC9B,kBAAkB,CAAiB,8BAA8B,CAAC,CAAC"}

package/dist/session/config.d.ts

@@ -0,0 +1,10 @@
+import { type AppSessionConfig } from '@nocobase/session';
+export interface AppSessionGcLotteryConfig {
+    readonly hits: number;
+    readonly total: number;
+}
+export interface AppSessionConfigInput extends Omit<AppSessionConfig, 'gcLottery' | 'secret'> {
+    readonly gcLottery: AppSessionGcLotteryConfig;
+    readonly secret?: string;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/session/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CACjD,gBAAgB,EAChB,WAAW,GAAG,QAAQ,CACvB;IACC,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/session/config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.js.map

package/dist/session/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/session/config.ts"],"names":[],"mappings":""}

package/dist/session/index.d.ts

@@ -0,0 +1,4 @@
+export * from './config.js';
+export * from './provider.js';
+export * from './token.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,4 @@
+export * from './config.js';
+export * from './provider.js';
+export * from './token.js';
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/session/provider.d.ts

@@ -0,0 +1,26 @@
+import { type AppSessionConfig } from '@nocobase/session';
+import { ServiceProvider } from '@nocobase/service-provider';
+import type { AppPluginApplication } from '../plugins/index.js';
+import { type AppHttpMiddleware } from '../router/index.js';
+import { type AppSessionConfigInput } from './config.js';
+export declare class SessionProvider extends ServiceProvider<AppPluginApplication> {
+    readonly name: string;
+    private readonly ephemeralSecret;
+    register(): void;
+    shutdown(): Promise<void>;
+    /**
+     * The cookie keys used when `session.secret` is not set: derived from the secrets keys, current first, so adding a
+     * key keeps existing cookies readable. Without secrets keys, a key made up for this process.
+     */
+    private fallbackSecrets;
+}
+/** The purpose session cookie keys are derived for from the secrets keys. */
+export declare const SESSION_COOKIE_PURPOSE = "@nocobase/session/cookie";
+/** The keys a session cookie is encrypted with when `session.secret` is not set. */
+export interface AppSessionSecrets {
+    readonly secret: string;
+    readonly previousSecrets: readonly string[];
+}
+export declare function resolveAppSessionConfig(configured: AppSessionConfigInput, fallback: string | AppSessionSecrets): AppSessionConfig;
+export declare const sessionHttpMiddleware: AppHttpMiddleware<AppPluginApplication>;
+//# sourceMappingURL=provider.d.ts.map

package/dist/session/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/session/provider.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EAEhB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGzD,qBAAa,eAAgB,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CACQ;IAExB,QAAQ,IAAI,IAAI;IAWV,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/C;;;OAGG;IACH,OAAO,CAAC,eAAe;CAaxB;AAED,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GACnC,gBAAgB,CA4BlB;AAED,eAAO,MAAM,qBAAqB,EAAE,iBAAiB,CAAC,oBAAoB,CAStE,CAAC"}