@poncho-ai/harness 0.35.0 → 0.36.0

package/src/secrets-store.ts

@@ -5,9 +5,7 @@ import {
   ensureAgentIdentity,
   getAgentStoreDirectory,
   slugifyStorageComponent,
-  STORAGE_SCHEMA_VERSION,
 } from "./agent-identity.js";
-import { createRawKVStore, type RawKVStore } from "./kv-store.js";
 import type { StateConfig } from "./state.js";
 
 // ---------------------------------------------------------------------------
@@ -131,104 +129,17 @@ class FileSecretsStore implements SecretsStore {
   }
 }
 
-// ---------------------------------------------------------------------------
-// KV-backed implementation
-// ---------------------------------------------------------------------------
-
-class KVSecretsStore implements SecretsStore {
-  private readonly kv: RawKVStore;
-  private readonly baseKey: string;
-  private readonly encKey: Buffer;
-  private readonly ttl?: number;
-
-  constructor(kv: RawKVStore, baseKey: string, signingKey: string, ttl?: number) {
-    this.kv = kv;
-    this.baseKey = baseKey;
-    this.encKey = deriveKey(signingKey);
-    this.ttl = ttl;
-  }
-
-  private kvKey(tenantId: string): string {
-    return `${this.baseKey}:t:${slugifyStorageComponent(tenantId)}:secrets`;
-  }
-
-  private async readAll(tenantId: string): Promise<Record<string, EncryptedBlob>> {
-    try {
-      const raw = await this.kv.get(this.kvKey(tenantId));
-      if (!raw) return {};
-      return JSON.parse(raw) as Record<string, EncryptedBlob>;
-    } catch {
-      return {};
-    }
-  }
-
-  private async writeAll(
-    tenantId: string,
-    data: Record<string, EncryptedBlob>,
-  ): Promise<void> {
-    const key = this.kvKey(tenantId);
-    const value = JSON.stringify(data);
-    if (this.ttl) {
-      await this.kv.setWithTtl(key, value, this.ttl);
-    } else {
-      await this.kv.set(key, value);
-    }
-  }
-
-  async get(tenantId: string): Promise<Record<string, string>> {
-    const data = await this.readAll(tenantId);
-    const result: Record<string, string> = {};
-    for (const [k, blob] of Object.entries(data)) {
-      try {
-        result[k] = decrypt(blob, this.encKey);
-      } catch {
-        // Skip entries that can't be decrypted
-      }
-    }
-    return result;
-  }
-
-  async set(tenantId: string, key: string, value: string): Promise<void> {
-    const data = await this.readAll(tenantId);
-    data[key] = encrypt(value, this.encKey);
-    await this.writeAll(tenantId, data);
-  }
-
-  async delete(tenantId: string, key: string): Promise<void> {
-    const data = await this.readAll(tenantId);
-    delete data[key];
-    await this.writeAll(tenantId, data);
-  }
-
-  async list(tenantId: string): Promise<string[]> {
-    const data = await this.readAll(tenantId);
-    return Object.keys(data);
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
 
 export const createSecretsStore = (
-  agentId: string,
+  _agentId: string,
   signingKey: string,
-  config?: StateConfig,
+  _config?: StateConfig,
   options?: { workingDir?: string },
 ): SecretsStore => {
-  const provider = config?.provider ?? "local";
-  const ttl = typeof config?.ttl === "number" ? config.ttl : undefined;
   const workingDir = options?.workingDir ?? process.cwd();
-
-  if (provider === "local" || provider === "memory") {
-    return new FileSecretsStore(workingDir, signingKey);
-  }
-
-  const kv = createRawKVStore(config);
-  if (kv) {
-    const baseKey = `poncho:${STORAGE_SCHEMA_VERSION}:${slugifyStorageComponent(agentId)}`;
-    return new KVSecretsStore(kv, baseKey, signingKey, ttl);
-  }
   return new FileSecretsStore(workingDir, signingKey);
 };