@proletariat/cli 0.3.93 → 0.3.94

package/dist/lib/clickup/types.d.ts

@@ -0,0 +1,104 @@
+/**
+ * ClickUp Integration Types
+ *
+ * Type definitions for the ClickUp ↔ PMO integration layer.
+ */
+/**
+ * Represents a ClickUp task as fetched from the API.
+ */
+export interface ClickUpTask {
+    id: string;
+    custom_id: string | null;
+    name: string;
+    description: string | null;
+    status: {
+        id: string;
+        status: string;
+        type: string;
+        color: string;
+    };
+    priority: {
+        id: string;
+        priority: string;
+        color: string;
+    } | null;
+    assignees: Array<{
+        id: number;
+        username: string;
+        email: string;
+        profilePicture: string | null;
+    }>;
+    tags: Array<{
+        name: string;
+        tag_fg: string;
+        tag_bg: string;
+    }>;
+    list: {
+        id: string;
+        name: string;
+    };
+    folder: {
+        id: string;
+        name: string;
+    };
+    space: {
+        id: string;
+    };
+    url: string;
+    date_created: string;
+    date_updated: string;
+}
+/**
+ * Represents a ClickUp status in a list/space.
+ */
+export interface ClickUpStatus {
+    id: string;
+    status: string;
+    type: string;
+    color: string;
+    orderindex: number;
+}
+/**
+ * Represents a ClickUp space.
+ */
+export interface ClickUpSpace {
+    id: string;
+    name: string;
+    statuses: ClickUpStatus[];
+}
+/**
+ * Represents a ClickUp list.
+ */
+export interface ClickUpList {
+    id: string;
+    name: string;
+    statuses: ClickUpStatus[];
+    folder: {
+        id: string;
+        name: string;
+    };
+    space: {
+        id: string;
+        name: string;
+    };
+}
+/**
+ * ClickUp connection configuration stored in workspace_settings.
+ */
+export interface ClickUpConfig {
+    apiKey: string;
+    defaultListId?: string;
+    defaultListName?: string;
+    workspaceName?: string;
+}
+/**
+ * Priority mapping between ClickUp and PMO (P0-P3).
+ * ClickUp: 1=Urgent, 2=High, 3=Normal, 4=Low
+ * PMO: P0=Critical, P1=High, P2=Medium, P3=Low
+ */
+export declare const CLICKUP_PRIORITY_TO_PMO: Record<string, string>;
+export declare const PMO_PRIORITY_TO_CLICKUP: Record<string, number>;
+/**
+ * Map ClickUp status type to PMO state category.
+ */
+export declare const CLICKUP_STATUS_TYPE_TO_PMO_CATEGORY: Record<string, string>;

package/dist/lib/clickup/types.js

@@ -0,0 +1,34 @@
+/**
+ * ClickUp Integration Types
+ *
+ * Type definitions for the ClickUp ↔ PMO integration layer.
+ */
+// =============================================================================
+// Mapping Types
+// =============================================================================
+/**
+ * Priority mapping between ClickUp and PMO (P0-P3).
+ * ClickUp: 1=Urgent, 2=High, 3=Normal, 4=Low
+ * PMO: P0=Critical, P1=High, P2=Medium, P3=Low
+ */
+export const CLICKUP_PRIORITY_TO_PMO = {
+    '1': 'P0', // Urgent → Critical
+    '2': 'P1', // High → High
+    '3': 'P2', // Normal → Medium
+    '4': 'P3', // Low → Low
+};
+export const PMO_PRIORITY_TO_CLICKUP = {
+    P0: 1, // Critical → Urgent
+    P1: 2, // High → High
+    P2: 3, // Medium → Normal
+    P3: 4, // Low → Low
+};
+/**
+ * Map ClickUp status type to PMO state category.
+ */
+export const CLICKUP_STATUS_TYPE_TO_PMO_CATEGORY = {
+    open: 'unstarted',
+    custom: 'started',
+    closed: 'completed',
+};
+//# sourceMappingURL=types.js.map

package/dist/lib/clickup/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/clickup/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuGH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,GAAG,EAAE,IAAI,EAAI,oBAAoB;IACjC,GAAG,EAAE,IAAI,EAAI,cAAc;IAC3B,GAAG,EAAE,IAAI,EAAI,kBAAkB;IAC/B,GAAG,EAAE,IAAI,EAAI,YAAY;CAC1B,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,EAAE,EAAE,CAAC,EAAM,oBAAoB;IAC/B,EAAE,EAAE,CAAC,EAAM,cAAc;IACzB,EAAE,EAAE,CAAC,EAAM,kBAAkB;IAC7B,EAAE,EAAE,CAAC,EAAM,YAAY;CACxB,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAA2B;IACzE,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,WAAW;CACpB,CAAA"}

package/dist/lib/database/credential-store.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Credential Store
+ *
+ * Stores API keys and tokens in a separate credentials.db file
+ * that is NOT mounted into agent containers. This prevents agents
+ * from reading or leaking credentials.
+ *
+ * Credentials are stored at {workspacePath}/.proletariat-credentials/credentials.db
+ * while the main workspace.db lives at {workspacePath}/.proletariat/workspace.db.
+ * Only .proletariat/ is mounted into containers, keeping credentials isolated.
+ *
+ * PRLT-1114: Agent secret isolation
+ */
+import Database from 'better-sqlite3';
+/**
+ * Check if a workspace_settings key stores a credential (API key or token).
+ */
+export declare function isCredentialKey(key: string): boolean;
+/**
+ * Get the path to the credentials database for a workspace.
+ */
+export declare function getCredentialDatabasePath(workspacePath: string): string;
+/**
+ * Get a credential value, with automatic migration from workspace.db.
+ *
+ * Resolution order:
+ * 1. Check credentials.db (if available)
+ * 2. Fall back to workspace.db (for backward compatibility)
+ * 3. If found in workspace.db, migrate to credentials.db and delete from workspace.db
+ *
+ * In agent containers, credentials.db won't exist and workspace.db will have
+ * credentials removed — so this returns null, which is the desired behavior.
+ *
+ * For in-memory databases (tests), falls back to workspace_settings directly
+ * since there's no filesystem path to store credentials.db.
+ */
+export declare function getCredential(workspaceDb: Database.Database, key: string): string | null;
+/**
+ * Set a credential value. Always writes to credentials.db.
+ * Also removes from workspace.db if present (migration cleanup).
+ * For in-memory databases (tests), writes to workspace_settings directly.
+ */
+export declare function setCredential(workspaceDb: Database.Database, key: string, value: string): void;
+/**
+ * Delete a credential from both credentials.db and workspace.db.
+ * For in-memory databases (tests), deletes from workspace_settings directly.
+ */
+export declare function deleteCredential(workspaceDb: Database.Database, key: string): void;
+/**
+ * Check if a credential exists in either credentials.db or workspace.db.
+ */
+export declare function hasCredential(workspaceDb: Database.Database, key: string): boolean;
+/**
+ * Close all cached credential database connections.
+ * Call this during cleanup/shutdown.
+ */
+export declare function closeAllCredentialStores(): void;
+/**
+ * Eagerly migrate all known credential keys from workspace.db to credentials.db.
+ * This is safe to call multiple times (idempotent).
+ * Useful during workspace open to proactively move all credentials out.
+ * No-op for in-memory databases (tests).
+ */
+export declare function migrateCredentials(workspaceDb: Database.Database): void;

package/dist/lib/database/credential-store.js

@@ -0,0 +1,306 @@
+/**
+ * Credential Store
+ *
+ * Stores API keys and tokens in a separate credentials.db file
+ * that is NOT mounted into agent containers. This prevents agents
+ * from reading or leaking credentials.
+ *
+ * Credentials are stored at {workspacePath}/.proletariat-credentials/credentials.db
+ * while the main workspace.db lives at {workspacePath}/.proletariat/workspace.db.
+ * Only .proletariat/ is mounted into containers, keeping credentials isolated.
+ *
+ * PRLT-1114: Agent secret isolation
+ */
+import Database from 'better-sqlite3';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const CREDENTIALS_TABLE = 'credentials';
+/** Known credential setting keys that must be stored in credentials.db */
+const CREDENTIAL_KEYS = new Set([
+    'linear.api_key',
+    'jira.api_token',
+    'asana.access_token',
+    'trello.api_key',
+    'trello.api_token',
+    'shortcut.api_token',
+    'monday.api_token',
+    'clickup.api_key',
+]);
+/**
+ * Check if a workspace_settings key stores a credential (API key or token).
+ */
+export function isCredentialKey(key) {
+    return CREDENTIAL_KEYS.has(key);
+}
+/**
+ * Get the path to the credentials database for a workspace.
+ */
+export function getCredentialDatabasePath(workspacePath) {
+    return path.join(workspacePath, '.proletariat-credentials', 'credentials.db');
+}
+/**
+ * Derive the workspace root path from a workspace.db Database instance.
+ * workspace.db is at {workspacePath}/.proletariat/workspace.db
+ * Returns empty string for in-memory databases (used in tests).
+ */
+function deriveWorkspacePath(db) {
+    const dbName = db.name;
+    // In-memory or unnamed databases don't have a filesystem path
+    if (!dbName || dbName === ':memory:' || dbName === '')
+        return '';
+    return path.dirname(path.dirname(dbName));
+}
+/**
+ * Open or create the credentials database.
+ * Creates the directory and schema if they don't exist.
+ */
+function openCredentialDb(workspacePath) {
+    const dbPath = getCredentialDatabasePath(workspacePath);
+    const dir = path.dirname(dbPath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    const credDb = new Database(dbPath);
+    credDb.pragma('journal_mode = WAL');
+    credDb.pragma('foreign_keys = ON');
+    credDb.pragma('busy_timeout = 5000');
+    credDb.exec(`
+    CREATE TABLE IF NOT EXISTS ${CREDENTIALS_TABLE} (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    )
+  `);
+    return credDb;
+}
+// Cache open credential db connections keyed by workspace path
+const credentialDbCache = new Map();
+/**
+ * Get a cached credential database connection.
+ * Returns null if credentials.db cannot be opened (e.g., in agent containers
+ * where the credentials directory is not mounted).
+ */
+function getCachedCredentialDb(workspacePath, autoCreate) {
+    const cached = credentialDbCache.get(workspacePath);
+    if (cached) {
+        try {
+            cached.pragma('journal_mode');
+            return cached;
+        }
+        catch {
+            credentialDbCache.delete(workspacePath);
+        }
+    }
+    const dbPath = getCredentialDatabasePath(workspacePath);
+    const dir = path.dirname(dbPath);
+    // If the credentials directory doesn't exist and we're not auto-creating,
+    // return null. This is expected in agent containers where only .proletariat/
+    // is mounted, not .proletariat-credentials/.
+    if (!autoCreate && !fs.existsSync(dir)) {
+        return null;
+    }
+    try {
+        const credDb = openCredentialDb(workspacePath);
+        credentialDbCache.set(workspacePath, credDb);
+        return credDb;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get a credential value, with automatic migration from workspace.db.
+ *
+ * Resolution order:
+ * 1. Check credentials.db (if available)
+ * 2. Fall back to workspace.db (for backward compatibility)
+ * 3. If found in workspace.db, migrate to credentials.db and delete from workspace.db
+ *
+ * In agent containers, credentials.db won't exist and workspace.db will have
+ * credentials removed — so this returns null, which is the desired behavior.
+ *
+ * For in-memory databases (tests), falls back to workspace_settings directly
+ * since there's no filesystem path to store credentials.db.
+ */
+export function getCredential(workspaceDb, key) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        try {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            return row?.value ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    // Check credentials.db first (don't auto-create just for reads)
+    const credDb = getCachedCredentialDb(workspacePath, false);
+    if (credDb) {
+        const row = credDb
+            .prepare(`SELECT value FROM ${CREDENTIALS_TABLE} WHERE key = ?`)
+            .get(key);
+        if (row)
+            return row.value;
+    }
+    // Fall back to workspace.db (backward compatibility + auto-migration)
+    let fallbackValue = null;
+    try {
+        const fallbackRow = workspaceDb
+            .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+            .get(key);
+        fallbackValue = fallbackRow?.value ?? null;
+    }
+    catch {
+        // workspace.db may not have the table yet
+    }
+    if (fallbackValue) {
+        // Auto-migrate: move credential to credentials.db (auto-create on write)
+        const writeDb = getCachedCredentialDb(workspacePath, true);
+        if (writeDb) {
+            writeDb
+                .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+                .run(key, fallbackValue);
+        }
+        // Remove from workspace.db so agents can't see it
+        try {
+            workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+        }
+        catch {
+            // workspace.db may be read-only in containers
+        }
+        return fallbackValue;
+    }
+    return null;
+}
+/**
+ * Set a credential value. Always writes to credentials.db.
+ * Also removes from workspace.db if present (migration cleanup).
+ * For in-memory databases (tests), writes to workspace_settings directly.
+ */
+export function setCredential(workspaceDb, key, value) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        workspaceDb.prepare(`
+      INSERT INTO workspace_settings (key, value)
+      VALUES (?, ?)
+      ON CONFLICT(key) DO UPDATE SET value = excluded.value
+    `).run(key, value);
+        return;
+    }
+    const credDb = getCachedCredentialDb(workspacePath, true);
+    if (!credDb) {
+        throw new Error(`Cannot open credential store at ${getCredentialDatabasePath(workspacePath)}`);
+    }
+    credDb
+        .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+        .run(key, value);
+    // Clean up from workspace.db if it was there
+    try {
+        workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+    }
+    catch {
+        // workspace.db may be read-only in containers
+    }
+}
+/**
+ * Delete a credential from both credentials.db and workspace.db.
+ * For in-memory databases (tests), deletes from workspace_settings directly.
+ */
+export function deleteCredential(workspaceDb, key) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        try {
+            workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+        }
+        catch {
+            // Table may not exist
+        }
+        return;
+    }
+    const credDb = getCachedCredentialDb(workspacePath, false);
+    if (credDb) {
+        credDb.prepare(`DELETE FROM ${CREDENTIALS_TABLE} WHERE key = ?`).run(key);
+    }
+    // Also delete from workspace.db in case it's still there
+    try {
+        workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+    }
+    catch {
+        // workspace.db may be read-only
+    }
+}
+/**
+ * Check if a credential exists in either credentials.db or workspace.db.
+ */
+export function hasCredential(workspaceDb, key) {
+    return getCredential(workspaceDb, key) !== null;
+}
+/**
+ * Close all cached credential database connections.
+ * Call this during cleanup/shutdown.
+ */
+export function closeAllCredentialStores() {
+    for (const [, db] of credentialDbCache) {
+        try {
+            db.close();
+        }
+        catch {
+            // Ignore close errors
+        }
+    }
+    credentialDbCache.clear();
+}
+/**
+ * Eagerly migrate all known credential keys from workspace.db to credentials.db.
+ * This is safe to call multiple times (idempotent).
+ * Useful during workspace open to proactively move all credentials out.
+ * No-op for in-memory databases (tests).
+ */
+export function migrateCredentials(workspaceDb) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    if (!workspacePath)
+        return; // In-memory databases (tests)
+    // Check if any credentials exist in workspace.db
+    let hasAny = false;
+    try {
+        for (const key of CREDENTIAL_KEYS) {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            if (row) {
+                hasAny = true;
+                break;
+            }
+        }
+    }
+    catch {
+        return; // workspace_settings table may not exist
+    }
+    if (!hasAny)
+        return;
+    // Open/create credentials.db and migrate
+    const credDb = getCachedCredentialDb(workspacePath, true);
+    if (!credDb)
+        return;
+    for (const key of CREDENTIAL_KEYS) {
+        try {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            if (row) {
+                credDb
+                    .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+                    .run(key, row.value);
+                workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+            }
+        }
+        catch {
+            // Skip individual key failures
+        }
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/lib/database/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/lib/database/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAEvC,0EAA0E;AAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,0BAA0B,EAAE,gBAAgB,CAAC,CAAA;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,EAAqB;IAChD,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAA;IACtB,8DAA8D;IAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAEpC,MAAM,CAAC,IAAI,CAAC;iCACmB,iBAAiB;;;;GAI/C,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6B,CAAA;AAE9D;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,aAAqB,EAAE,UAAmB;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YAC7B,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhC,0EAA0E;IAC1E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAC9C,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW;IACvE,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM;aACf,OAAO,CAAC,qBAAqB,iBAAiB,gBAAgB,CAAC;aAC/D,GAAG,CAAC,GAAG,CAAkC,CAAA;QAC5C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,CAAA;IAC3B,CAAC;IAED,sEAAsE;IACtE,IAAI,aAAa,GAAkB,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,WAAW;aAC5B,OAAO,CAAC,oDAAoD,CAAC;aAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;QAC5C,aAAa,GAAG,WAAW,EAAE,KAAK,IAAI,IAAI,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,yEAAyE;QACzE,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;iBACJ,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;iBACjF,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAC5B,CAAC;QACD,kDAAkD;QAClD,IAAI,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW,EAAE,KAAa;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,WAAW,CAAC,OAAO,CAAC;;;;KAInB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,MAAM;SACH,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;SACjF,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAElB,6CAA6C;IAC7C,IAAI,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA8B,EAAE,GAAW;IAC1E,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,eAAe,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW;IACvE,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,aAAa;QAAE,OAAM,CAAC,8BAA8B;IAEzD,iDAAiD;IACjD,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,IAAI,CAAA;gBACb,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAM,CAAC,yCAAyC;IAClD,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,yCAAyC;IACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM;qBACH,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;qBACjF,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACtB,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/database/index.d.ts

@@ -25,4 +25,5 @@ export { type MediaItem, addMediaItemToDatabase, updateMediaItemStatus, getWorks
 export { checkPMOExists, getPMOSetting, dropPMOTables, upsertWorkspaceSetting, } from './pmo-bootstrap.js';
 export { type DatabaseDriver, type PreparedStatement, type RunResult, BetterSqlite3Driver, wrapDatabase, openDriver, getRawDatabase, } from './driver.js';
 export { SettingsStore, createSettingsStore, } from './settings-store.js';
+export { isCredentialKey, getCredentialDatabasePath, getCredential, setCredential, deleteCredential, hasCredential, closeAllCredentialStores, migrateCredentials, } from './credential-store.js';
 export { enableWALMode, createRotatingBackup, checkIntegrity, quickCheckIntegrity, repairDatabase, getBackupPath, type IntegrityCheckResult, type RepairResult, } from './db-safety.js';

package/dist/lib/database/index.js

@@ -35,6 +35,8 @@ export { checkPMOExists, getPMOSetting, dropPMOTables, upsertWorkspaceSetting, }
 export { BetterSqlite3Driver, wrapDatabase, openDriver, getRawDatabase, } from './driver.js';
 // Settings store
 export { SettingsStore, createSettingsStore, } from './settings-store.js';
+// Credential store (PRLT-1114: agent secret isolation)
+export { isCredentialKey, getCredentialDatabasePath, getCredential, setCredential, deleteCredential, hasCredential, closeAllCredentialStores, migrateCredentials, } from './credential-store.js';
 // Database safety (WAL, backup, integrity, repair)
 export { enableWALMode, createRotatingBackup, checkIntegrity, quickCheckIntegrity, repairDatabase, getBackupPath, } from './db-safety.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/database/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/database/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,0DAA0D;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,sBAAsB;AACtB,OAAO,EAEL,WAAW,EACX,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AAEvB,mBAAmB;AACnB,OAAO,EAQL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,aAAa,CAAA;AAEpB,wBAAwB;AACxB,OAAO,EAEL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA;AAE1B,mBAAmB;AACnB,OAAO,EAGL,cAAc,EACd,cAAc,EACd,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAA;AAEpB,sBAAsB;AACtB,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AAEvB,wBAAwB;AACxB,OAAO,EAEL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,YAAY,CAAA;AAEnB,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAE3B,8BAA8B;AAC9B,OAAO,EAIL,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,iBAAiB;AACjB,OAAO,EACL,aAAa,EACb,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,aAAa,GAGd,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/database/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,0DAA0D;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD,sBAAsB;AACtB,OAAO,EAEL,WAAW,EACX,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AAEvB,mBAAmB;AACnB,OAAO,EAQL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,aAAa,CAAA;AAEpB,wBAAwB;AACxB,OAAO,EAEL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA;AAE1B,mBAAmB;AACnB,OAAO,EAGL,cAAc,EACd,cAAc,EACd,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAA;AAEpB,sBAAsB;AACtB,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AAEvB,wBAAwB;AACxB,OAAO,EAEL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,YAAY,CAAA;AAEnB,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAE3B,8BAA8B;AAC9B,OAAO,EAIL,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,iBAAiB;AACjB,OAAO,EACL,aAAa,EACb,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAE5B,uDAAuD;AACvD,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,mDAAmD;AACnD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,aAAa,GAGd,MAAM,gBAAgB,CAAA"}

package/dist/lib/database/pmo-bootstrap.d.ts

@@ -3,6 +3,13 @@
  *
  * Raw SQL operations required for PMO initialization and teardown.
  * These run before the storage layer is available.
+ *
+ * All database opens go through openSafeDatabase() which provides:
+ * - Rotating backup before open
+ * - Quick integrity check on startup
+ * - Auto-repair on corruption (dump/reimport or backup restore)
+ *
+ * See: PRLT-1152
  */
 import Database from 'better-sqlite3';
 /**

package/dist/lib/database/pmo-bootstrap.js

@@ -3,24 +3,63 @@
  *
  * Raw SQL operations required for PMO initialization and teardown.
  * These run before the storage layer is available.
+ *
+ * All database opens go through openSafeDatabase() which provides:
+ * - Rotating backup before open
+ * - Quick integrity check on startup
+ * - Auto-repair on corruption (dump/reimport or backup restore)
+ *
+ * See: PRLT-1152
  */
 import Database from 'better-sqlite3';
 import { throwIfNativeBindingError } from './native-validation.js';
 import { createDrizzleConnection } from './drizzle.js';
 import { workspaceSettings as workspaceSettingsTable, } from './drizzle-schema.js';
+import { createRotatingBackup, quickCheckIntegrity, repairDatabase, } from './db-safety.js';
 /**
- * Check if PMO tables exist and get basic stats.
- * Raw SQL: uses sqlite_master introspection (pre-migration bootstrap).
+ * Open a database connection with safety features (backup, integrity check, auto-repair).
+ * Used by PMO bootstrap functions that need raw SQL access before the full workspace
+ * database lifecycle is available.
  */
-export function checkPMOExists(dbPath) {
+function openSafeDatabase(dbPath, caller) {
+    // Create backup before opening (cheap insurance against corruption)
+    createRotatingBackup(dbPath);
     let db;
     try {
         db = new Database(dbPath);
     }
     catch (error) {
-        throwIfNativeBindingError(error, 'checkPMOExists');
+        throwIfNativeBindingError(error, caller);
         throw error;
     }
+    // Quick integrity check — auto-repair if corrupt
+    const integrity = quickCheckIntegrity(db);
+    if (!integrity.ok) {
+        db.close();
+        const repair = repairDatabase(dbPath);
+        if (!repair.success) {
+            throw new Error(`Database corruption detected in ${dbPath}.\n` +
+                `Integrity errors: ${integrity.errors.join('; ')}\n` +
+                `Auto-repair failed: ${repair.message}\n` +
+                `Run 'prlt db repair' for manual recovery options.`);
+        }
+        // Re-open the repaired database
+        try {
+            db = new Database(dbPath);
+        }
+        catch (error) {
+            throwIfNativeBindingError(error, `${caller} (post-repair)`);
+            throw error;
+        }
+    }
+    return db;
+}
+/**
+ * Check if PMO tables exist and get basic stats.
+ * Raw SQL: uses sqlite_master introspection (pre-migration bootstrap).
+ */
+export function checkPMOExists(dbPath) {
+    const db = openSafeDatabase(dbPath, 'checkPMOExists');
     try {
         const result = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='pmo_projects'").get();
         if (result === undefined) {
@@ -43,14 +82,7 @@ export function checkPMOExists(dbPath) {
  * Raw SQL: pre-migration bootstrap query.
  */
 export function getPMOSetting(dbPath, key) {
-    let db;
-    try {
-        db = new Database(dbPath);
-    }
-    catch (error) {
-        throwIfNativeBindingError(error, 'getPMOSetting');
-        throw error;
-    }
+    const db = openSafeDatabase(dbPath, 'getPMOSetting');
     try {
         const result = db.prepare('SELECT value FROM pmo_settings WHERE key = ?').get(key);
         return result?.value ?? null;
@@ -67,14 +99,7 @@ export function getPMOSetting(dbPath, key) {
  * Raw SQL: DDL operations (DROP TABLE) are not supported by Drizzle.
  */
 export function dropPMOTables(dbPath, tables) {
-    let db;
-    try {
-        db = new Database(dbPath);
-    }
-    catch (error) {
-        throwIfNativeBindingError(error, 'dropPMOTables');
-        throw error;
-    }
+    const db = openSafeDatabase(dbPath, 'dropPMOTables');
     try {
         for (const table of tables) {
             try {