@penclipai/server 2026.508.2 → 2026.511.0-canary.0

package/dist/services/access.d.ts

@@ -19,13 +19,13 @@ export declare function accessService(db: Db): {
     getMembership: (companyId: string, principalType: PrincipalType, principalId: string) => Promise<MembershipRow | null>;
     getMemberById: (companyId: string, memberId: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }>;
     ensureMembership: (companyId: string, principalType: PrincipalType, principalId: string, membershipRole?: string | null, status?: "pending" | "active" | "suspended") => Promise<{
         id: string;
@@ -39,56 +39,56 @@ export declare function accessService(db: Db): {
     }>;
     listMembers: (companyId: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     listActiveUserMemberships: (companyId: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     copyActiveUserMemberships: (sourceCompanyId: string, targetCompanyId: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     archiveMember: (companyId: string, memberId: string, input?: MemberArchiveInput) => Promise<{
         member: {
             id: string;
-            status: string;
-            createdAt: Date;
-            updatedAt: Date;
             companyId: string;
             principalType: string;
             principalId: string;
+            status: string;
             membershipRole: string | null;
+            createdAt: Date;
+            updatedAt: Date;
         };
         reassignedIssueCount: number;
     } | null>;
     setMemberPermissions: (companyId: string, memberId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     } | null>;
     updateMemberAndPermissions: (companyId: string, memberId: string, data: {
         membershipRole?: string | null;
@@ -120,37 +120,37 @@ export declare function accessService(db: Db): {
     }>;
     listUserCompanyAccess: (userId: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     setUserCompanyAccess: (userId: string, companyIds: string[], options?: {
         actorUserId?: string | null;
     }) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         principalType: string;
         principalId: string;
+        status: string;
         membershipRole: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     setPrincipalGrants: (companyId: string, principalType: PrincipalType, principalId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<void>;
     listPrincipalGrants: (companyId: string, principalType: PrincipalType, principalId: string) => Promise<{
         id: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
-        scope: Record<string, unknown> | null;
         principalType: string;
         principalId: string;
         permissionKey: string;
+        scope: Record<string, unknown> | null;
         grantedByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     setPrincipalPermission: (companyId: string, principalType: PrincipalType, principalId: string, permissionKey: PermissionKey, enabled: boolean, grantedByUserId: string | null, scope?: Record<string, unknown> | null) => Promise<void>;
     updateMember: (companyId: string, memberId: string, data: {

package/dist/services/activity.d.ts

@@ -11,16 +11,16 @@ export declare function normalizeActivityLimit(limit: number | undefined): numbe
 export declare function activityService(db: Db): {
     list: (filters: ActivityFilters) => Promise<{
         id: string;
-        createdAt: Date;
         companyId: string;
-        agentId: string | null;
-        runId: string | null;
-        action: string;
         actorType: string;
         actorId: string;
+        action: string;
         entityType: string;
         entityId: string;
+        agentId: string | null;
+        runId: string | null;
         details: Record<string, unknown> | null;
+        createdAt: Date;
     }[]>;
     forIssue: (issueId: string) => Omit<import("drizzle-orm/pg-core").PgSelectBase<"activity_log", {
         id: import("drizzle-orm/pg-core").PgColumn<{
@@ -214,16 +214,16 @@ export declare function activityService(db: Db): {
         }, {}, {}>;
     }, "single", Record<"activity_log", "not-null">, false, "where" | "orderBy", {
         id: string;
-        createdAt: Date;
         companyId: string;
-        agentId: string | null;
-        runId: string | null;
-        action: string;
         actorType: string;
         actorId: string;
+        action: string;
         entityType: string;
         entityId: string;
+        agentId: string | null;
+        runId: string | null;
         details: Record<string, unknown> | null;
+        createdAt: Date;
     }[], {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";

package/dist/services/agents.d.ts

@@ -289,29 +289,29 @@ export declare function agentService(db: Db): {
     }) | null>;
     listConfigRevisions: (id: string) => Promise<{
         id: string;
-        createdAt: Date;
         companyId: string;
+        agentId: string;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        agentId: string;
         source: string;
         rolledBackFromRevisionId: string | null;
         changedKeys: string[];
         beforeConfig: Record<string, unknown>;
         afterConfig: Record<string, unknown>;
+        createdAt: Date;
     }[]>;
     getConfigRevision: (id: string, revisionId: string) => Promise<{
         id: string;
-        createdAt: Date;
         companyId: string;
+        agentId: string;
         createdByAgentId: string | null;
         createdByUserId: string | null;
-        agentId: string;
         source: string;
         rolledBackFromRevisionId: string | null;
         changedKeys: string[];
         beforeConfig: Record<string, unknown>;
         afterConfig: Record<string, unknown>;
+        createdAt: Date;
     }>;
     rollbackConfigRevision: (id: string, revisionId: string, actor: {
         agentId?: string | null;
@@ -1342,16 +1342,14 @@ export declare function agentService(db: Db): {
         }, {}, {}>;
     }, "single", Record<"heartbeat_runs", "not-null">, false, "where", {
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         agentId: string;
+        invocationSource: string;
         triggerDetail: string | null;
+        status: string;
+        startedAt: Date | null;
         finishedAt: Date | null;
         error: string | null;
-        invocationSource: string;
-        startedAt: Date | null;
         wakeupRequestId: string | null;
         exitCode: number | null;
         signal: string | null;
@@ -1389,6 +1387,8 @@ export declare function agentService(db: Db): {
         lastUsefulActionAt: Date | null;
         nextAction: string | null;
         contextSnapshot: Record<string, unknown> | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[], {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";

package/dist/services/approvals.d.ts

@@ -210,17 +210,17 @@ export declare function approvalService(db: Db): {
         }, {}, {}>;
     }, "single", Record<"approvals", "not-null">, false, "where", {
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         type: string;
         requestedByAgentId: string | null;
         requestedByUserId: string | null;
+        status: string;
         payload: Record<string, unknown>;
         decisionNote: string | null;
         decidedByUserId: string | null;
         decidedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
     }[], {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
@@ -431,17 +431,17 @@ export declare function approvalService(db: Db): {
     }>, "where">;
     getById: (id: string) => Promise<{
         id: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         type: string;
         requestedByAgentId: string | null;
         requestedByUserId: string | null;
+        status: string;
         payload: Record<string, unknown>;
         decisionNote: string | null;
         decidedByUserId: string | null;
         decidedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
     }>;
     create: (companyId: string, data: Omit<typeof approvals.$inferInsert, "companyId">) => Promise<{
         id: string;
@@ -521,13 +521,13 @@ export declare function approvalService(db: Db): {
     }>;
     listComments: (approvalId: string) => Promise<{
         id: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         approvalId: string;
-        body: string;
-        authorUserId: string | null;
         authorAgentId: string | null;
+        authorUserId: string | null;
+        body: string;
+        createdAt: Date;
+        updatedAt: Date;
     }[]>;
     addComment: (approvalId: string, body: string, actor: {
         agentId?: string;

package/dist/services/assets.d.ts

@@ -16,18 +16,18 @@ export declare function assetService(db: Db): {
         createdByUserId: string | null;
     }>;
     getById: (id: string) => Promise<{
-        sha256: string;
         id: string;
-        createdAt: Date;
-        updatedAt: Date;
         companyId: string;
         provider: string;
         objectKey: string;
         contentType: string;
         byteSize: number;
+        sha256: string;
         originalFilename: string | null;
         createdByAgentId: string | null;
         createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
     }>;
 };
 //# sourceMappingURL=assets.d.ts.map

package/dist/services/board-auth.d.ts

@@ -25,13 +25,13 @@ export declare function boardAuthService(db: Db): {
     }>;
     findBoardApiKeyByToken: (token: string) => Promise<{
         id: string;
-        name: string;
-        createdAt: Date;
-        expiresAt: Date | null;
         userId: string;
+        name: string;
         keyHash: string;
         lastUsedAt: Date | null;
         revokedAt: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
     } | null>;
     touchBoardApiKey: (id: string) => Promise<void>;
     revokeBoardApiKey: (id: string) => Promise<{
@@ -72,9 +72,6 @@ export declare function boardAuthService(db: Db): {
     }>;
     getCliAuthChallengeBySecret: (id: string, token: string) => Promise<{
         id: string;
-        createdAt: Date;
-        updatedAt: Date;
-        expiresAt: Date;
         secretHash: string;
         command: string;
         clientName: string | null;
@@ -86,6 +83,9 @@ export declare function boardAuthService(db: Db): {
         boardApiKeyId: string | null;
         approvedAt: Date | null;
         cancelledAt: Date | null;
+        expiresAt: Date;
+        createdAt: Date;
+        updatedAt: Date;
     } | null>;
     describeCliAuthChallenge: (id: string, token: string) => Promise<{
         id: string;
@@ -108,9 +108,6 @@ export declare function boardAuthService(db: Db): {
         status: "expired";
         challenge: {
             id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            expiresAt: Date;
             secretHash: string;
             command: string;
             clientName: string | null;
@@ -122,14 +119,14 @@ export declare function boardAuthService(db: Db): {
             boardApiKeyId: string | null;
             approvedAt: Date | null;
             cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
         };
     } | {
         status: "cancelled";
         challenge: {
             id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            expiresAt: Date;
             secretHash: string;
             command: string;
             clientName: string | null;
@@ -141,6 +138,9 @@ export declare function boardAuthService(db: Db): {
             boardApiKeyId: string | null;
             approvedAt: Date | null;
             cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
         };
     } | {
         status: "approved";
@@ -166,9 +166,6 @@ export declare function boardAuthService(db: Db): {
         status: "approved";
         challenge: {
             id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            expiresAt: Date;
             secretHash: string;
             command: string;
             clientName: string | null;
@@ -180,14 +177,14 @@ export declare function boardAuthService(db: Db): {
             boardApiKeyId: string | null;
             approvedAt: Date | null;
             cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
         };
     } | {
         status: "expired";
         challenge: {
             id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            expiresAt: Date;
             secretHash: string;
             command: string;
             clientName: string | null;
@@ -199,14 +196,14 @@ export declare function boardAuthService(db: Db): {
             boardApiKeyId: string | null;
             approvedAt: Date | null;
             cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
         };
     } | {
         status: "cancelled";
         challenge: {
             id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            expiresAt: Date;
             secretHash: string;
             command: string;
             clientName: string | null;
@@ -218,17 +215,20 @@ export declare function boardAuthService(db: Db): {
             boardApiKeyId: string | null;
             approvedAt: Date | null;
             cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
         };
     }>;
     assertCurrentBoardKey: (keyId: string | undefined, userId: string | undefined) => Promise<{
         id: string;
-        name: string;
-        createdAt: Date;
-        expiresAt: Date | null;
         userId: string;
+        name: string;
         keyHash: string;
         lastUsedAt: Date | null;
         revokedAt: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
     }>;
     resolveBoardActivityCompanyIds: (input: {
         userId: string;

package/dist/services/environment-config.d.ts

@@ -1,5 +1,5 @@
 import type { Db } from "@penclipai/db";
-import type { Environment, EnvironmentDriver, LocalEnvironmentConfig, PluginEnvironmentConfig, SandboxEnvironmentConfig, SshEnvironmentConfig } from "@penclipai/shared";
+import type { Environment, EnvironmentDriver, LocalEnvironmentConfig, PluginEnvironmentConfig, SandboxEnvironmentConfig, SecretProvider, SecretVersionSelector, SshEnvironmentConfig } from "@penclipai/shared";
 import type { PluginWorkerManager } from "./plugin-worker-manager.js";
 export type ParsedEnvironmentConfig = {
     driver: "local";
@@ -14,6 +14,14 @@ export type ParsedEnvironmentConfig = {
     driver: "plugin";
     config: PluginEnvironmentConfig;
 };
+export declare function collectEnvironmentSecretRefs(input: {
+    db: Db;
+    environment: Pick<Environment, "id" | "driver" | "config">;
+}): Promise<Array<{
+    secretId: string;
+    configPath: string;
+    versionSelector?: SecretVersionSelector;
+}>>;
 export declare function stripSandboxProviderEnvelope(config: SandboxEnvironmentConfig): Record<string, unknown>;
 export declare function normalizeEnvironmentConfig(input: {
     driver: EnvironmentDriver;
@@ -30,6 +38,7 @@ export declare function normalizeEnvironmentConfigForPersistence(input: {
     companyId: string;
     environmentName: string;
     driver: EnvironmentDriver;
+    secretProvider: SecretProvider;
     config: Record<string, unknown> | null | undefined;
     actor?: {
         userId?: string | null;
@@ -37,7 +46,10 @@ export declare function normalizeEnvironmentConfigForPersistence(input: {
     };
     pluginWorkerManager?: PluginWorkerManager;
 }): Promise<Record<string, unknown>>;
-export declare function resolveEnvironmentDriverConfigForRuntime(db: Db, companyId: string, environment: Pick<Environment, "driver" | "config">): Promise<ParsedEnvironmentConfig>;
+export declare function resolveEnvironmentDriverConfigForRuntime(db: Db, companyId: string, environment: Pick<Environment, "driver" | "config"> & Partial<Pick<Environment, "id">>, context?: {
+    issueId?: string | null;
+    heartbeatRunId?: string | null;
+}): Promise<ParsedEnvironmentConfig>;
 export declare function readSshEnvironmentPrivateKeySecretId(environment: Pick<Environment, "driver" | "config">): string | null;
 export declare function parseEnvironmentDriverConfig(environment: Pick<Environment, "driver" | "config">): ParsedEnvironmentConfig;
 //# sourceMappingURL=environment-config.d.ts.map

package/dist/services/environment-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-config.d.ts","sourceRoot":"","sources":["../../src/services/environment-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,sBAAsB,EACtB,uBAAuB,EAEvB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AA8EtE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AA8I1D,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGtG;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;CACpD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoC1B;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACnD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuC7D;AAED,wBAAsB,wCAAwC,CAAC,KAAK,EAAE;IACpE,EAAE,EAAE,EAAE,CAAC;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8FnC;AAED,wBAAsB,wCAAwC,CAC5D,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA+BlC;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAClD,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAClD,uBAAuB,CAoCzB"}
+{"version":3,"file":"environment-config.d.ts","sourceRoot":"","sources":["../../src/services/environment-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,sBAAsB,EACtB,uBAAuB,EAEvB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AA8EtE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAiK1D,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,EAAE,EAAE,EAAE,CAAC;IACP,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;CAC5D,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC,CAqBpG;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGtG;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;CACpD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoC1B;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACnD,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuC7D;AAED,wBAAsB,wCAAwC,CAAC,KAAK,EAAE;IACpE,EAAE,EAAE,EAAE,CAAC;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgGnC;AAED,wBAAsB,wCAAwC,CAC5D,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EACtF,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpE,OAAO,CAAC,uBAAuB,CAAC,CAiDlC;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAClD,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAClD,uBAAuB,CAoCzB"}

package/dist/services/environment-config.js

@@ -105,7 +105,7 @@ function secretName(input) {
 async function createEnvironmentSecret(input) {
     const created = await secretService(input.db).create(input.companyId, {
         name: secretName(input),
-        provider: "local_encrypted",
+        provider: input.provider,
         value: input.value,
         description: `Secret for ${input.environmentName} ${input.field}.`,
     }, input.actor);
@@ -136,6 +136,7 @@ async function persistConfigSecretRefs(input) {
             environmentName: input.environmentName,
             driver: input.driver,
             field: path.replace(/[^a-z0-9]+/gi, "-").toLowerCase(),
+            provider: input.secretProvider,
             value: trimmed,
             actor: input.actor,
         });
@@ -153,10 +154,43 @@ async function resolveConfigSecretRefsForRuntime(input) {
         const trimmed = current.trim();
         if (!isUuidSecretRef(trimmed))
             continue;
-        nextConfig = writeConfigValueAtPath(nextConfig, path, await secrets.resolveSecretValue(input.companyId, trimmed, "latest"));
+        if (!input.context.consumerId) {
+            throw unprocessable("Runtime secret resolution requires an environment id");
+        }
+        nextConfig = writeConfigValueAtPath(nextConfig, path, await secrets.resolveSecretValue(input.companyId, trimmed, "latest", {
+            consumerType: "environment",
+            consumerId: input.context.consumerId,
+            actorType: "system",
+            actorId: null,
+            issueId: input.context.issueId ?? null,
+            heartbeatRunId: input.context.heartbeatRunId ?? null,
+            configPath: path,
+        }));
     }
     return nextConfig;
 }
+export async function collectEnvironmentSecretRefs(input) {
+    const parsed = parseEnvironmentDriverConfig(input.environment);
+    if (parsed.driver === "ssh" && parsed.config.privateKeySecretRef) {
+        return [{
+                secretId: parsed.config.privateKeySecretRef.secretId,
+                configPath: "privateKeySecretRef",
+                versionSelector: parsed.config.privateKeySecretRef.version ?? "latest",
+            }];
+    }
+    if (parsed.driver === "sandbox" && parsed.config.provider !== "fake") {
+        const schema = await getSandboxProviderConfigSchema(input.db, parsed.config.provider);
+        const refs = [];
+        for (const path of collectSecretRefPaths(schema)) {
+            const current = readConfigValueAtPath(parsed.config, path);
+            if (typeof current === "string" && isUuidSecretRef(current.trim())) {
+                refs.push({ secretId: current.trim(), configPath: path, versionSelector: "latest" });
+            }
+        }
+        return refs;
+    }
+    return [];
+}
 export function stripSandboxProviderEnvelope(config) {
     const { provider: _provider, ...driverConfig } = config;
     return driverConfig;
@@ -250,6 +284,7 @@ export async function normalizeEnvironmentConfigForPersistence(input) {
                 environmentName: input.environmentName,
                 driver: input.driver,
                 field: "private-key",
+                provider: input.secretProvider,
                 value: privateKey,
                 actor: input.actor,
             });
@@ -288,6 +323,7 @@ export async function normalizeEnvironmentConfigForPersistence(input) {
             companyId: input.companyId,
             environmentName: input.environmentName,
             driver: input.driver,
+            secretProvider: input.secretProvider,
             config: {
                 provider: parsed.data.provider,
                 ...validated.normalizedConfig,
@@ -319,15 +355,27 @@ export async function normalizeEnvironmentConfigForPersistence(input) {
         config: input.config,
     });
 }
-export async function resolveEnvironmentDriverConfigForRuntime(db, companyId, environment) {
+export async function resolveEnvironmentDriverConfigForRuntime(db, companyId, environment, context) {
     const parsed = parseEnvironmentDriverConfig(environment);
     const secrets = secretService(db);
+    const environmentId = environment.id;
+    if (parsed.driver === "ssh" && parsed.config.privateKeySecretRef && !environmentId) {
+        throw unprocessable("Runtime secret resolution requires an environment id");
+    }
     if (parsed.driver === "ssh" && parsed.config.privateKeySecretRef) {
         return {
             driver: "ssh",
             config: {
                 ...parsed.config,
-                privateKey: await secrets.resolveSecretValue(companyId, parsed.config.privateKeySecretRef.secretId, parsed.config.privateKeySecretRef.version ?? "latest"),
+                privateKey: await secrets.resolveSecretValue(companyId, parsed.config.privateKeySecretRef.secretId, parsed.config.privateKeySecretRef.version ?? "latest", {
+                    consumerType: "environment",
+                    consumerId: environmentId,
+                    actorType: "system",
+                    actorId: null,
+                    issueId: context?.issueId ?? null,
+                    heartbeatRunId: context?.heartbeatRunId ?? null,
+                    configPath: "privateKeySecretRef",
+                }),
             },
         };
     }
@@ -339,6 +387,11 @@ export async function resolveEnvironmentDriverConfigForRuntime(db, companyId, en
                 companyId,
                 config: parsed.config,
                 schema: await getSandboxProviderConfigSchema(db, parsed.config.provider),
+                context: {
+                    consumerId: environmentId,
+                    issueId: context?.issueId ?? null,
+                    heartbeatRunId: context?.heartbeatRunId ?? null,
+                },
             }),
         };
     }