@objectstack/service-settings 6.7.0 → 6.8.0

package/dist/index.js

@@ -86,6 +86,15 @@ var SettingsService = class {
     if (extras?.secretStore) this.secretStore = extras.secretStore;
     if (extras?.auditWriter) this.auditWriter = extras.auditWriter;
     if (extras?.cryptoProvider) this.cryptoProvider = extras.cryptoProvider;
+    for (const ns of this.registry.keys()) {
+      this.emitChange({
+        namespace: ns,
+        key: "*",
+        scope: "global",
+        action: "set",
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
   }
   /**
    * Cascade priority ranks for lock comparisons (lower = higher
@@ -505,24 +514,31 @@ var SettingsService = class {
     if (row.encrypted) {
       if (!row.value_enc) return null;
       let plain;
-      if (this.cryptoProvider && this.secretStore && typeof row.value_enc === "string" && row.value_enc.startsWith("sec_")) {
-        const secret = await this.secretStore.get(row.value_enc);
-        if (!secret) return null;
-        plain = await this.cryptoProvider.decrypt(
-          {
-            id: secret.id,
-            kmsKeyId: secret.kms_key_id,
-            alg: secret.alg,
-            version: secret.version,
-            ciphertext: secret.ciphertext
-          },
-          { namespace: row.namespace, key: row.key }
+      try {
+        if (this.cryptoProvider && this.secretStore && typeof row.value_enc === "string" && row.value_enc.startsWith("sec_")) {
+          const secret = await this.secretStore.get(row.value_enc);
+          if (!secret) return null;
+          plain = await this.cryptoProvider.decrypt(
+            {
+              id: secret.id,
+              kmsKeyId: secret.kms_key_id,
+              alg: secret.alg,
+              version: secret.version,
+              ciphertext: secret.ciphertext
+            },
+            { namespace: row.namespace, key: row.key }
+          );
+        } else {
+          plain = await this.crypto.decrypt(row.value_enc, {
+            namespace: row.namespace,
+            key: row.key
+          });
+        }
+      } catch (err) {
+        console.warn(
+          `[SettingsService] failed to decrypt ${row.namespace}.${row.key}: ${err?.message ?? err}. Returning null so the namespace remains readable; re-save the field to repair.`
         );
-      } else {
-        plain = await this.crypto.decrypt(row.value_enc, {
-          namespace: row.namespace,
-          key: row.key
-        });
+        return null;
       }
       try {
         return JSON.parse(plain);
@@ -558,6 +574,47 @@ function coerceEnvValue(raw, hint) {
 
 // src/in-memory-crypto-provider.ts
 import { createHash, randomBytes, createCipheriv, createDecipheriv } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEV_KEY_ENV = "OBJECTSTACK_DEV_CRYPTO_KEY";
+var devKeyFallbackPath = () => {
+  const proc = globalThis?.process;
+  const home = proc?.env?.OBJECTSTACK_HOME || (proc?.env?.HOME ? join(proc.env.HOME, ".objectstack") : void 0) || join(homedir(), ".objectstack");
+  return join(home, "dev-crypto-key");
+};
+var loadOrCreateDevKey = () => {
+  try {
+    const path = devKeyFallbackPath();
+    if (existsSync(path)) {
+      const raw = readFileSync(path, "utf8").trim();
+      const parsed = parseDevKey(raw);
+      if (parsed) return { key: parsed, path, generated: false };
+    }
+    const key = randomBytes(32);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, key.toString("base64"), { mode: 384 });
+    return { key, path, generated: true };
+  } catch {
+    return void 0;
+  }
+};
+var parseDevKey = (raw) => {
+  if (!raw) return void 0;
+  const trimmed = raw.trim();
+  if (!trimmed) return void 0;
+  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) return Buffer.from(trimmed, "hex");
+  try {
+    const normalised = trimmed.replace(/-/g, "+").replace(/_/g, "/");
+    const buf = Buffer.from(normalised, "base64");
+    if (buf.length === 32) return buf;
+  } catch {
+  }
+  console.warn(
+    `[InMemoryCryptoProvider] ${DEV_KEY_ENV} is set but is not 32 bytes (hex or base64). Ignoring and generating an ephemeral key.`
+  );
+  return void 0;
+};
 var isWebContainerRuntime = () => {
   const g = globalThis;
   return typeof g !== "undefined" && (Boolean(g.process?.versions?.webcontainer) || Boolean(g.process?.env?.SHELL?.includes?.("jsh")) || Boolean(g.process?.env?.STACKBLITZ));
@@ -581,7 +638,37 @@ var loadNobleGcm = () => {
 };
 var InMemoryCryptoProvider = class {
   constructor(opts = {}) {
-    this.key = opts.key ?? randomBytes(32);
+    if (opts.key) {
+      this.key = opts.key;
+    } else {
+      const fromEnv = parseDevKey(
+        globalThis?.process?.env?.[DEV_KEY_ENV]
+      );
+      if (fromEnv) {
+        this.key = fromEnv;
+      } else {
+        const isTest = Boolean(
+          globalThis?.process?.env?.VITEST || globalThis?.process?.env?.NODE_ENV === "test"
+        );
+        const persisted = isTest ? void 0 : loadOrCreateDevKey();
+        if (persisted) {
+          this.key = persisted.key;
+          if (persisted.generated) {
+            console.warn(
+              `[InMemoryCryptoProvider] No ${DEV_KEY_ENV} set \u2014 generated a new AES-256-GCM key and persisted it to ${persisted.path} (mode 0600). Future restarts will reuse it automatically. For shared/CI environments, set ${DEV_KEY_ENV} explicitly in your environment.`
+            );
+          }
+        } else {
+          this.key = randomBytes(32);
+          if (!isTest) {
+            console.warn(
+              `[InMemoryCryptoProvider] No ${DEV_KEY_ENV} set and could not persist a fallback key \u2014 generated an ephemeral AES-256-GCM key. Existing encrypted settings (e.g. AI API keys) will fail to decrypt on next restart. To make the key survive restarts, add this to your .env:
+  ${DEV_KEY_ENV}=${this.key.toString("base64")}`
+            );
+          }
+        }
+      }
+    }
     this.useNoble = isWebContainerRuntime();
   }
   async encrypt(plain, ctx) {
@@ -1449,7 +1536,7 @@ var manifest3 = {
 };
 var aiSettingsManifest = manifest3;
 var aiTestActionHandler = async ({ values, payload }) => {
-  const overrides = payload && typeof payload === "object" && payload !== null && "values" in payload ? payload.values ?? {} : {};
+  const overrides = extractOverrides(payload);
   const merged = { ...values, ...overrides };
   const provider = String(merged.provider ?? "memory");
   values = merged;
@@ -1482,6 +1569,14 @@ var aiTestActionHandler = async ({ values, payload }) => {
     message: `${provider} configured (model=${model}). Mount @objectstack/service-ai to exercise live calls.`
   };
 };
+function extractOverrides(payload) {
+  if (!payload || typeof payload !== "object") return {};
+  const p = payload;
+  if (p.values && typeof p.values === "object" && p.values !== null) {
+    return p.values;
+  }
+  return p;
+}
 
 // src/manifests/knowledge.manifest.ts
 var manifest4 = {
@@ -2394,7 +2489,7 @@ var SettingsServicePlugin = class {
       }
       if (engine) {
         this.service.bindEngine(
-          engine,
+          wrapEngineAsSettingsEngine(engine),
           this.buildAuditSink(ctx, engine),
           {
             secretStore: this.buildSecretStore(engine),
@@ -2470,11 +2565,11 @@ var SettingsServicePlugin = class {
         return row ?? null;
       },
       async update(id, patch) {
-        await eng.update("sys_secret", {
-          where: { id },
-          data: patch,
-          bypassTenantAudit: true
-        });
+        await eng.update(
+          "sys_secret",
+          { id, ...patch },
+          { bypassTenantAudit: true }
+        );
       }
     };
   }
@@ -2509,6 +2604,30 @@ var SettingsServicePlugin = class {
     };
   }
 };
+function wrapEngineAsSettingsEngine(engine) {
+  const eng = engine;
+  return {
+    async find(objectName, opts) {
+      return eng.find(objectName, opts);
+    },
+    async insert(objectName, data, opts) {
+      return eng.insert(objectName, data, opts);
+    },
+    async update(objectName, opts) {
+      const { where, data, bypassTenantAudit } = opts;
+      const driverOpts = bypassTenantAudit ? { bypassTenantAudit: true } : void 0;
+      const id = where?.id;
+      if (id !== void 0 && id !== null) {
+        return eng.update(objectName, { id, ...data }, driverOpts);
+      }
+      return eng.update(objectName, data, {
+        where,
+        multi: true,
+        ...driverOpts ?? {}
+      });
+    }
+  };
+}
 export {
   NoopCryptoAdapter,
   SETTINGS_PLUGIN_ID,