@shipfox/api-secrets 2.0.0

package/dist/core/secret-store.js

@@ -0,0 +1,209 @@
+import { countSecretValueRows, db, deleteSecretValueRows, lockWorkspaceEntries, upsertSecretValueRows } from '#db/index.js';
+import { normalizedProjectId } from '#db/scope.js';
+import { classifySecretsOperationError, operationScope, recordSecretsEntriesMutated, recordSecretsOperation } from '#metrics/instance.js';
+import { fingerprintSecretValue } from './fingerprint.js';
+import { assertWorkspaceCap, validateNamespace, validateSecretKeys, validateValueBytes } from './store-validation.js';
+import { encryptSecretValue } from './value-cipher.js';
+export function createSecretStoreApi(params) {
+    return {
+        async getSecret (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const namespace = input.namespace ?? '';
+                validateNamespace(namespace);
+                validateSecretKeys([
+                    input.key
+                ]);
+                const value = await params.resolveSecretStore(input.store).getSecret({
+                    ...input,
+                    namespace
+                });
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'get',
+                    surface: 'internal',
+                    scope,
+                    outcome: value === null ? 'not_found' : 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return value;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'get',
+                    surface: 'internal',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async getSecretsByNamespace (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const namespace = input.namespace ?? '';
+                validateNamespace(namespace);
+                const values = await params.resolveSecretStore(input.store).getSecretsByNamespace({
+                    ...input,
+                    namespace
+                });
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'get_namespace',
+                    surface: 'internal',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return values;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'get_namespace',
+                    surface: 'internal',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async setSecrets (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const namespace = input.namespace ?? '';
+                const entries = Object.entries(input.values);
+                validateNamespace(namespace);
+                validateSecretKeys(entries.map(([key])=>key));
+                validateValueBytes(entries.map(([, value])=>value));
+                if (entries.length === 0) {
+                    recordSecretsOperation({
+                        resource: 'secret',
+                        operation: 'set',
+                        surface: 'internal',
+                        scope,
+                        outcome: 'success',
+                        durationMs: Date.now() - startedAt
+                    });
+                    return;
+                }
+                const dek = await params.dekManager.getPlaintextDek(input.workspaceId);
+                const projectId = normalizedProjectId(input);
+                const rows = entries.map(([key, value])=>({
+                        workspaceId: input.workspaceId,
+                        projectId,
+                        namespace,
+                        key,
+                        ciphertext: encryptSecretValue({
+                            dek,
+                            workspaceId: input.workspaceId,
+                            scope: {
+                                projectId
+                            },
+                            namespace,
+                            key,
+                            value
+                        }),
+                        fingerprint: fingerprintSecretValue(value, dek),
+                        lastEditedBy: input.editedBy ?? null
+                    }));
+                let existingEntries = 0;
+                await db().transaction(async (tx)=>{
+                    await lockWorkspaceEntries(input.workspaceId, tx);
+                    existingEntries = await countSecretValueRows({
+                        workspaceId: input.workspaceId,
+                        projectId,
+                        namespace,
+                        keys: entries.map(([key])=>key)
+                    }, tx);
+                    await assertWorkspaceCap({
+                        workspaceId: input.workspaceId,
+                        namespace,
+                        incomingEntries: entries.length - existingEntries,
+                        tx
+                    });
+                    await upsertSecretValueRows(rows, tx);
+                });
+                recordSecretsEntriesMutated({
+                    resource: 'secret',
+                    operation: 'set',
+                    effect: 'created',
+                    surface: 'internal',
+                    count: entries.length - existingEntries
+                });
+                recordSecretsEntriesMutated({
+                    resource: 'secret',
+                    operation: 'set',
+                    effect: 'updated',
+                    surface: 'internal',
+                    count: existingEntries
+                });
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'set',
+                    surface: 'internal',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'set',
+                    surface: 'internal',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        },
+        async deleteSecrets (input) {
+            const startedAt = Date.now();
+            const scope = operationScope(input);
+            try {
+                const namespace = input.namespace ?? '';
+                validateNamespace(namespace);
+                if (input.keys) validateSecretKeys(input.keys);
+                const deleted = await deleteSecretValueRows({
+                    workspaceId: input.workspaceId,
+                    projectId: normalizedProjectId(input),
+                    namespace,
+                    keys: input.keys
+                });
+                recordSecretsEntriesMutated({
+                    resource: 'secret',
+                    operation: 'delete',
+                    effect: 'deleted',
+                    surface: 'internal',
+                    count: deleted
+                });
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'delete',
+                    surface: 'internal',
+                    scope,
+                    outcome: 'success',
+                    durationMs: Date.now() - startedAt
+                });
+                return deleted;
+            } catch (error) {
+                recordSecretsOperation({
+                    resource: 'secret',
+                    operation: 'delete',
+                    surface: 'internal',
+                    scope,
+                    outcome: classifySecretsOperationError(error),
+                    durationMs: Date.now() - startedAt
+                });
+                throw error;
+            }
+        }
+    };
+}
+
+//# sourceMappingURL=secret-store.js.map

package/dist/core/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/secret-store.ts"],"sourcesContent":["import {\n  countSecretValueRows,\n  db,\n  deleteSecretValueRows,\n  lockWorkspaceEntries,\n  type StoreScope,\n  upsertSecretValueRows,\n} from '#db/index.js';\nimport {normalizedProjectId} from '#db/scope.js';\nimport {\n  classifySecretsOperationError,\n  operationScope,\n  recordSecretsEntriesMutated,\n  recordSecretsOperation,\n} from '#metrics/instance.js';\nimport type {DekManager} from './dek-manager.js';\nimport {fingerprintSecretValue} from './fingerprint.js';\nimport type {SecretStoreProvider} from './store-resolver.js';\nimport {\n  assertWorkspaceCap,\n  validateNamespace,\n  validateSecretKeys,\n  validateValueBytes,\n} from './store-validation.js';\nimport {encryptSecretValue} from './value-cipher.js';\n\nexport interface SetSecretsParams extends StoreScope {\n  workspaceId: string;\n  namespace?: string | undefined;\n  values: Record<string, string>;\n  editedBy?: string | null | undefined;\n}\n\nexport interface DeleteSecretsParams extends StoreScope {\n  workspaceId: string;\n  namespace?: string | undefined;\n  keys?: string[] | undefined;\n}\n\nexport function createSecretStoreApi(params: {\n  dekManager: DekManager;\n  resolveSecretStore: (name?: string | undefined) => SecretStoreProvider;\n}) {\n  return {\n    async getSecret(\n      input: StoreScope & {\n        workspaceId: string;\n        namespace?: string | undefined;\n        key: string;\n        store?: string;\n      },\n    ) {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const namespace = input.namespace ?? '';\n        validateNamespace(namespace);\n        validateSecretKeys([input.key]);\n        const value = await params.resolveSecretStore(input.store).getSecret({...input, namespace});\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'get',\n          surface: 'internal',\n          scope,\n          outcome: value === null ? 'not_found' : 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return value;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'get',\n          surface: 'internal',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async getSecretsByNamespace(\n      input: StoreScope & {workspaceId: string; namespace?: string | undefined; store?: string},\n    ) {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const namespace = input.namespace ?? '';\n        validateNamespace(namespace);\n        const values = await params\n          .resolveSecretStore(input.store)\n          .getSecretsByNamespace({...input, namespace});\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'get_namespace',\n          surface: 'internal',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return values;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'get_namespace',\n          surface: 'internal',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async setSecrets(input: SetSecretsParams): Promise<void> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const namespace = input.namespace ?? '';\n        const entries = Object.entries(input.values);\n        validateNamespace(namespace);\n        validateSecretKeys(entries.map(([key]) => key));\n        validateValueBytes(entries.map(([, value]) => value));\n        if (entries.length === 0) {\n          recordSecretsOperation({\n            resource: 'secret',\n            operation: 'set',\n            surface: 'internal',\n            scope,\n            outcome: 'success',\n            durationMs: Date.now() - startedAt,\n          });\n          return;\n        }\n\n        const dek = await params.dekManager.getPlaintextDek(input.workspaceId);\n        const projectId = normalizedProjectId(input);\n        const rows = entries.map(([key, value]) => ({\n          workspaceId: input.workspaceId,\n          projectId,\n          namespace,\n          key,\n          ciphertext: encryptSecretValue({\n            dek,\n            workspaceId: input.workspaceId,\n            scope: {projectId},\n            namespace,\n            key,\n            value,\n          }),\n          fingerprint: fingerprintSecretValue(value, dek),\n          lastEditedBy: input.editedBy ?? null,\n        }));\n\n        let existingEntries = 0;\n        await db().transaction(async (tx) => {\n          await lockWorkspaceEntries(input.workspaceId, tx);\n          existingEntries = await countSecretValueRows(\n            {\n              workspaceId: input.workspaceId,\n              projectId,\n              namespace,\n              keys: entries.map(([key]) => key),\n            },\n            tx,\n          );\n          await assertWorkspaceCap({\n            workspaceId: input.workspaceId,\n            namespace,\n            incomingEntries: entries.length - existingEntries,\n            tx,\n          });\n          await upsertSecretValueRows(rows, tx);\n        });\n\n        recordSecretsEntriesMutated({\n          resource: 'secret',\n          operation: 'set',\n          effect: 'created',\n          surface: 'internal',\n          count: entries.length - existingEntries,\n        });\n        recordSecretsEntriesMutated({\n          resource: 'secret',\n          operation: 'set',\n          effect: 'updated',\n          surface: 'internal',\n          count: existingEntries,\n        });\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'set',\n          surface: 'internal',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'set',\n          surface: 'internal',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n    async deleteSecrets(input: DeleteSecretsParams): Promise<number> {\n      const startedAt = Date.now();\n      const scope = operationScope(input);\n      try {\n        const namespace = input.namespace ?? '';\n        validateNamespace(namespace);\n        if (input.keys) validateSecretKeys(input.keys);\n\n        const deleted = await deleteSecretValueRows({\n          workspaceId: input.workspaceId,\n          projectId: normalizedProjectId(input),\n          namespace,\n          keys: input.keys,\n        });\n        recordSecretsEntriesMutated({\n          resource: 'secret',\n          operation: 'delete',\n          effect: 'deleted',\n          surface: 'internal',\n          count: deleted,\n        });\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'delete',\n          surface: 'internal',\n          scope,\n          outcome: 'success',\n          durationMs: Date.now() - startedAt,\n        });\n        return deleted;\n      } catch (error) {\n        recordSecretsOperation({\n          resource: 'secret',\n          operation: 'delete',\n          surface: 'internal',\n          scope,\n          outcome: classifySecretsOperationError(error),\n          durationMs: Date.now() - startedAt,\n        });\n        throw error;\n      }\n    },\n  };\n}\n"],"names":["countSecretValueRows","db","deleteSecretValueRows","lockWorkspaceEntries","upsertSecretValueRows","normalizedProjectId","classifySecretsOperationError","operationScope","recordSecretsEntriesMutated","recordSecretsOperation","fingerprintSecretValue","assertWorkspaceCap","validateNamespace","validateSecretKeys","validateValueBytes","encryptSecretValue","createSecretStoreApi","params","getSecret","input","startedAt","Date","now","scope","namespace","key","value","resolveSecretStore","store","resource","operation","surface","outcome","durationMs","error","getSecretsByNamespace","values","setSecrets","entries","Object","map","length","dek","dekManager","getPlaintextDek","workspaceId","projectId","rows","ciphertext","fingerprint","lastEditedBy","editedBy","existingEntries","transaction","tx","keys","incomingEntries","effect","count","deleteSecrets","deleted"],"mappings":"AAAA,SACEA,oBAAoB,EACpBC,EAAE,EACFC,qBAAqB,EACrBC,oBAAoB,EAEpBC,qBAAqB,QAChB,eAAe;AACtB,SAAQC,mBAAmB,QAAO,eAAe;AACjD,SACEC,6BAA6B,EAC7BC,cAAc,EACdC,2BAA2B,EAC3BC,sBAAsB,QACjB,uBAAuB;AAE9B,SAAQC,sBAAsB,QAAO,mBAAmB;AAExD,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,QACb,wBAAwB;AAC/B,SAAQC,kBAAkB,QAAO,oBAAoB;AAerD,OAAO,SAASC,qBAAqBC,MAGpC;IACC,OAAO;QACL,MAAMC,WACJC,KAKC;YAED,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQhB,eAAeY;YAC7B,IAAI;gBACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;gBACrCZ,kBAAkBY;gBAClBX,mBAAmB;oBAACM,MAAMM,GAAG;iBAAC;gBAC9B,MAAMC,QAAQ,MAAMT,OAAOU,kBAAkB,CAACR,MAAMS,KAAK,EAAEV,SAAS,CAAC;oBAAC,GAAGC,KAAK;oBAAEK;gBAAS;gBACzFf,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAASN,UAAU,OAAO,cAAc;oBACxCO,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOM;YACT,EAAE,OAAOQ,OAAO;gBACdzB,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS1B,8BAA8B4B;oBACvCD,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMc;YACR;QACF;QACA,MAAMC,uBACJhB,KAAyF;YAEzF,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQhB,eAAeY;YAC7B,IAAI;gBACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;gBACrCZ,kBAAkBY;gBAClB,MAAMY,SAAS,MAAMnB,OAClBU,kBAAkB,CAACR,MAAMS,KAAK,EAC9BO,qBAAqB,CAAC;oBAAC,GAAGhB,KAAK;oBAAEK;gBAAS;gBAC7Cf,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS;oBACTC,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOgB;YACT,EAAE,OAAOF,OAAO;gBACdzB,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS1B,8BAA8B4B;oBACvCD,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMc;YACR;QACF;QACA,MAAMG,YAAWlB,KAAuB;YACtC,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQhB,eAAeY;YAC7B,IAAI;gBACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;gBACrC,MAAMc,UAAUC,OAAOD,OAAO,CAACnB,MAAMiB,MAAM;gBAC3CxB,kBAAkBY;gBAClBX,mBAAmByB,QAAQE,GAAG,CAAC,CAAC,CAACf,IAAI,GAAKA;gBAC1CX,mBAAmBwB,QAAQE,GAAG,CAAC,CAAC,GAAGd,MAAM,GAAKA;gBAC9C,IAAIY,QAAQG,MAAM,KAAK,GAAG;oBACxBhC,uBAAuB;wBACrBoB,UAAU;wBACVC,WAAW;wBACXC,SAAS;wBACTR;wBACAS,SAAS;wBACTC,YAAYZ,KAAKC,GAAG,KAAKF;oBAC3B;oBACA;gBACF;gBAEA,MAAMsB,MAAM,MAAMzB,OAAO0B,UAAU,CAACC,eAAe,CAACzB,MAAM0B,WAAW;gBACrE,MAAMC,YAAYzC,oBAAoBc;gBACtC,MAAM4B,OAAOT,QAAQE,GAAG,CAAC,CAAC,CAACf,KAAKC,MAAM,GAAM,CAAA;wBAC1CmB,aAAa1B,MAAM0B,WAAW;wBAC9BC;wBACAtB;wBACAC;wBACAuB,YAAYjC,mBAAmB;4BAC7B2B;4BACAG,aAAa1B,MAAM0B,WAAW;4BAC9BtB,OAAO;gCAACuB;4BAAS;4BACjBtB;4BACAC;4BACAC;wBACF;wBACAuB,aAAavC,uBAAuBgB,OAAOgB;wBAC3CQ,cAAc/B,MAAMgC,QAAQ,IAAI;oBAClC,CAAA;gBAEA,IAAIC,kBAAkB;gBACtB,MAAMnD,KAAKoD,WAAW,CAAC,OAAOC;oBAC5B,MAAMnD,qBAAqBgB,MAAM0B,WAAW,EAAES;oBAC9CF,kBAAkB,MAAMpD,qBACtB;wBACE6C,aAAa1B,MAAM0B,WAAW;wBAC9BC;wBACAtB;wBACA+B,MAAMjB,QAAQE,GAAG,CAAC,CAAC,CAACf,IAAI,GAAKA;oBAC/B,GACA6B;oBAEF,MAAM3C,mBAAmB;wBACvBkC,aAAa1B,MAAM0B,WAAW;wBAC9BrB;wBACAgC,iBAAiBlB,QAAQG,MAAM,GAAGW;wBAClCE;oBACF;oBACA,MAAMlD,sBAAsB2C,MAAMO;gBACpC;gBAEA9C,4BAA4B;oBAC1BqB,UAAU;oBACVC,WAAW;oBACX2B,QAAQ;oBACR1B,SAAS;oBACT2B,OAAOpB,QAAQG,MAAM,GAAGW;gBAC1B;gBACA5C,4BAA4B;oBAC1BqB,UAAU;oBACVC,WAAW;oBACX2B,QAAQ;oBACR1B,SAAS;oBACT2B,OAAON;gBACT;gBACA3C,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS;oBACTC,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;YACF,EAAE,OAAOc,OAAO;gBACdzB,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS1B,8BAA8B4B;oBACvCD,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMc;YACR;QACF;QACA,MAAMyB,eAAcxC,KAA0B;YAC5C,MAAMC,YAAYC,KAAKC,GAAG;YAC1B,MAAMC,QAAQhB,eAAeY;YAC7B,IAAI;gBACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;gBACrCZ,kBAAkBY;gBAClB,IAAIL,MAAMoC,IAAI,EAAE1C,mBAAmBM,MAAMoC,IAAI;gBAE7C,MAAMK,UAAU,MAAM1D,sBAAsB;oBAC1C2C,aAAa1B,MAAM0B,WAAW;oBAC9BC,WAAWzC,oBAAoBc;oBAC/BK;oBACA+B,MAAMpC,MAAMoC,IAAI;gBAClB;gBACA/C,4BAA4B;oBAC1BqB,UAAU;oBACVC,WAAW;oBACX2B,QAAQ;oBACR1B,SAAS;oBACT2B,OAAOE;gBACT;gBACAnD,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS;oBACTC,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,OAAOwC;YACT,EAAE,OAAO1B,OAAO;gBACdzB,uBAAuB;oBACrBoB,UAAU;oBACVC,WAAW;oBACXC,SAAS;oBACTR;oBACAS,SAAS1B,8BAA8B4B;oBACvCD,YAAYZ,KAAKC,GAAG,KAAKF;gBAC3B;gBACA,MAAMc;YACR;QACF;IACF;AACF"}

package/dist/core/store-resolver.d.ts

@@ -0,0 +1,18 @@
+export declare const BUILTIN_LOCAL_STORE = "local";
+export interface GetSecretParams {
+    workspaceId: string;
+    projectId?: string | null | undefined;
+    namespace: string;
+    key: string;
+}
+export interface GetSecretsByNamespaceParams {
+    workspaceId: string;
+    projectId?: string | null | undefined;
+    namespace: string;
+}
+export interface SecretStoreProvider {
+    getSecret(params: GetSecretParams): Promise<string | null>;
+    getSecretsByNamespace(params: GetSecretsByNamespaceParams): Promise<Record<string, string>>;
+}
+export declare function createSecretStoreResolver(localProvider: SecretStoreProvider): (name?: string) => SecretStoreProvider;
+//# sourceMappingURL=store-resolver.d.ts.map

package/dist/core/store-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-resolver.d.ts","sourceRoot":"","sources":["../../src/core/store-resolver.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7F;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,mBAAmB,IACvC,aAA0B,KAAG,mBAAmB,CAIpF"}

package/dist/core/store-resolver.js

@@ -0,0 +1,10 @@
+import { UnknownSecretStoreError } from './errors.js';
+export const BUILTIN_LOCAL_STORE = 'local';
+export function createSecretStoreResolver(localProvider) {
+    return function resolveSecretStore(name = BUILTIN_LOCAL_STORE) {
+        if (name === BUILTIN_LOCAL_STORE) return localProvider;
+        throw new UnknownSecretStoreError(name);
+    };
+}
+
+//# sourceMappingURL=store-resolver.js.map

package/dist/core/store-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/store-resolver.ts"],"sourcesContent":["import {UnknownSecretStoreError} from './errors.js';\n\nexport const BUILTIN_LOCAL_STORE = 'local';\n\nexport interface GetSecretParams {\n  workspaceId: string;\n  projectId?: string | null | undefined;\n  namespace: string;\n  key: string;\n}\n\nexport interface GetSecretsByNamespaceParams {\n  workspaceId: string;\n  projectId?: string | null | undefined;\n  namespace: string;\n}\n\nexport interface SecretStoreProvider {\n  getSecret(params: GetSecretParams): Promise<string | null>;\n  getSecretsByNamespace(params: GetSecretsByNamespaceParams): Promise<Record<string, string>>;\n}\n\nexport function createSecretStoreResolver(localProvider: SecretStoreProvider) {\n  return function resolveSecretStore(name = BUILTIN_LOCAL_STORE): SecretStoreProvider {\n    if (name === BUILTIN_LOCAL_STORE) return localProvider;\n    throw new UnknownSecretStoreError(name);\n  };\n}\n"],"names":["UnknownSecretStoreError","BUILTIN_LOCAL_STORE","createSecretStoreResolver","localProvider","resolveSecretStore","name"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,cAAc;AAEpD,OAAO,MAAMC,sBAAsB,QAAQ;AAoB3C,OAAO,SAASC,0BAA0BC,aAAkC;IAC1E,OAAO,SAASC,mBAAmBC,OAAOJ,mBAAmB;QAC3D,IAAII,SAASJ,qBAAqB,OAAOE;QACzC,MAAM,IAAIH,wBAAwBK;IACpC;AACF"}

package/dist/core/store-validation.d.ts

@@ -0,0 +1,11 @@
+import { type Tx } from '#db/index.js';
+export declare function validateNamespace(namespace: string): void;
+export declare function validateSecretKeys(keys: Iterable<string>): void;
+export declare function validateValueBytes(values: Iterable<string>): void;
+export declare function assertWorkspaceCap(params: {
+    workspaceId: string;
+    namespace: string;
+    incomingEntries: number;
+    tx: Tx;
+}): Promise<void>;
+//# sourceMappingURL=store-validation.d.ts.map

package/dist/core/store-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-validation.d.ts","sourceRoot":"","sources":["../../src/core/store-validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,EAAE,EAAC,MAAM,cAAc,CAAC;AAQ5D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGzD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAI/D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAMjE;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,EAAE,EAAE,CAAC;CACR,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB"}

package/dist/core/store-validation.js

@@ -0,0 +1,30 @@
+import { isSystemNamespace, namespaceSchema, secretKeySchema } from '@shipfox/api-secrets-dto';
+import { config, MAX_VALUE_BYTES } from '#config.js';
+import { countWorkspaceEntries } from '#db/index.js';
+import { NamespaceValidationError, SecretKeyValidationError, SecretValueTooLargeError, WorkspaceSecretCapExceededError } from './errors.js';
+export function validateNamespace(namespace) {
+    if (namespaceSchema.safeParse(namespace).success) return;
+    throw new NamespaceValidationError(namespace);
+}
+export function validateSecretKeys(keys) {
+    for (const key of keys){
+        if (!secretKeySchema.safeParse(key).success) throw new SecretKeyValidationError(key);
+    }
+}
+export function validateValueBytes(values) {
+    for (const value of values){
+        if (Buffer.byteLength(value, 'utf8') > MAX_VALUE_BYTES) {
+            throw new SecretValueTooLargeError(MAX_VALUE_BYTES);
+        }
+    }
+}
+export async function assertWorkspaceCap(params) {
+    // System namespaces are internal-only; public management routes do not accept a namespace.
+    if (isSystemNamespace(params.namespace)) return;
+    const count = await countWorkspaceEntries(params.workspaceId, params.tx);
+    if (count + params.incomingEntries > config.SECRETS_MAX_PER_WORKSPACE) {
+        throw new WorkspaceSecretCapExceededError(params.workspaceId, config.SECRETS_MAX_PER_WORKSPACE);
+    }
+}
+
+//# sourceMappingURL=store-validation.js.map

package/dist/core/store-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/store-validation.ts"],"sourcesContent":["import {isSystemNamespace, namespaceSchema, secretKeySchema} from '@shipfox/api-secrets-dto';\nimport {config, MAX_VALUE_BYTES} from '#config.js';\nimport {countWorkspaceEntries, type Tx} from '#db/index.js';\nimport {\n  NamespaceValidationError,\n  SecretKeyValidationError,\n  SecretValueTooLargeError,\n  WorkspaceSecretCapExceededError,\n} from './errors.js';\n\nexport function validateNamespace(namespace: string): void {\n  if (namespaceSchema.safeParse(namespace).success) return;\n  throw new NamespaceValidationError(namespace);\n}\n\nexport function validateSecretKeys(keys: Iterable<string>): void {\n  for (const key of keys) {\n    if (!secretKeySchema.safeParse(key).success) throw new SecretKeyValidationError(key);\n  }\n}\n\nexport function validateValueBytes(values: Iterable<string>): void {\n  for (const value of values) {\n    if (Buffer.byteLength(value, 'utf8') > MAX_VALUE_BYTES) {\n      throw new SecretValueTooLargeError(MAX_VALUE_BYTES);\n    }\n  }\n}\n\nexport async function assertWorkspaceCap(params: {\n  workspaceId: string;\n  namespace: string;\n  incomingEntries: number;\n  tx: Tx;\n}): Promise<void> {\n  // System namespaces are internal-only; public management routes do not accept a namespace.\n  if (isSystemNamespace(params.namespace)) return;\n\n  const count = await countWorkspaceEntries(params.workspaceId, params.tx);\n  if (count + params.incomingEntries > config.SECRETS_MAX_PER_WORKSPACE) {\n    throw new WorkspaceSecretCapExceededError(params.workspaceId, config.SECRETS_MAX_PER_WORKSPACE);\n  }\n}\n"],"names":["isSystemNamespace","namespaceSchema","secretKeySchema","config","MAX_VALUE_BYTES","countWorkspaceEntries","NamespaceValidationError","SecretKeyValidationError","SecretValueTooLargeError","WorkspaceSecretCapExceededError","validateNamespace","namespace","safeParse","success","validateSecretKeys","keys","key","validateValueBytes","values","value","Buffer","byteLength","assertWorkspaceCap","params","count","workspaceId","tx","incomingEntries","SECRETS_MAX_PER_WORKSPACE"],"mappings":"AAAA,SAAQA,iBAAiB,EAAEC,eAAe,EAAEC,eAAe,QAAO,2BAA2B;AAC7F,SAAQC,MAAM,EAAEC,eAAe,QAAO,aAAa;AACnD,SAAQC,qBAAqB,QAAgB,eAAe;AAC5D,SACEC,wBAAwB,EACxBC,wBAAwB,EACxBC,wBAAwB,EACxBC,+BAA+B,QAC1B,cAAc;AAErB,OAAO,SAASC,kBAAkBC,SAAiB;IACjD,IAAIV,gBAAgBW,SAAS,CAACD,WAAWE,OAAO,EAAE;IAClD,MAAM,IAAIP,yBAAyBK;AACrC;AAEA,OAAO,SAASG,mBAAmBC,IAAsB;IACvD,KAAK,MAAMC,OAAOD,KAAM;QACtB,IAAI,CAACb,gBAAgBU,SAAS,CAACI,KAAKH,OAAO,EAAE,MAAM,IAAIN,yBAAyBS;IAClF;AACF;AAEA,OAAO,SAASC,mBAAmBC,MAAwB;IACzD,KAAK,MAAMC,SAASD,OAAQ;QAC1B,IAAIE,OAAOC,UAAU,CAACF,OAAO,UAAUf,iBAAiB;YACtD,MAAM,IAAII,yBAAyBJ;QACrC;IACF;AACF;AAEA,OAAO,eAAekB,mBAAmBC,MAKxC;IACC,2FAA2F;IAC3F,IAAIvB,kBAAkBuB,OAAOZ,SAAS,GAAG;IAEzC,MAAMa,QAAQ,MAAMnB,sBAAsBkB,OAAOE,WAAW,EAAEF,OAAOG,EAAE;IACvE,IAAIF,QAAQD,OAAOI,eAAe,GAAGxB,OAAOyB,yBAAyB,EAAE;QACrE,MAAM,IAAInB,gCAAgCc,OAAOE,WAAW,EAAEtB,OAAOyB,yBAAyB;IAChG;AACF"}

package/dist/core/value-cipher.d.ts

@@ -0,0 +1,10 @@
+import { type SecretValueAadParams } from './crypto.js';
+export declare function encryptSecretValue(params: SecretValueAadParams & {
+    dek: Buffer;
+    value: string;
+}): string;
+export declare function decryptSecretValue(params: SecretValueAadParams & {
+    dek: Buffer;
+    ciphertext: string;
+}): string;
+//# sourceMappingURL=value-cipher.d.ts.map

package/dist/core/value-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-cipher.d.ts","sourceRoot":"","sources":["../../src/core/value-cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,oBAAoB,EAAC,MAAM,aAAa,CAAC;AAG3F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,oBAAoB,GAAG;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAC1D,MAAM,CAMR;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,oBAAoB,GAAG;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,GAC/D,MAAM,CAUR"}

package/dist/core/value-cipher.js

@@ -0,0 +1,22 @@
+import { aadForValue, aesGcmOpen, aesGcmSeal } from './crypto.js';
+import { SecretDecryptionError } from './errors.js';
+export function encryptSecretValue(params) {
+    return aesGcmSeal({
+        key: params.dek,
+        plaintext: Buffer.from(params.value, 'utf8'),
+        aad: aadForValue(params)
+    });
+}
+export function decryptSecretValue(params) {
+    try {
+        return aesGcmOpen({
+            key: params.dek,
+            encoded: params.ciphertext,
+            aad: aadForValue(params)
+        }).toString('utf8');
+    } catch  {
+        throw new SecretDecryptionError();
+    }
+}
+
+//# sourceMappingURL=value-cipher.js.map

package/dist/core/value-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/value-cipher.ts"],"sourcesContent":["import {aadForValue, aesGcmOpen, aesGcmSeal, type SecretValueAadParams} from './crypto.js';\nimport {SecretDecryptionError} from './errors.js';\n\nexport function encryptSecretValue(\n  params: SecretValueAadParams & {dek: Buffer; value: string},\n): string {\n  return aesGcmSeal({\n    key: params.dek,\n    plaintext: Buffer.from(params.value, 'utf8'),\n    aad: aadForValue(params),\n  });\n}\n\nexport function decryptSecretValue(\n  params: SecretValueAadParams & {dek: Buffer; ciphertext: string},\n): string {\n  try {\n    return aesGcmOpen({\n      key: params.dek,\n      encoded: params.ciphertext,\n      aad: aadForValue(params),\n    }).toString('utf8');\n  } catch {\n    throw new SecretDecryptionError();\n  }\n}\n"],"names":["aadForValue","aesGcmOpen","aesGcmSeal","SecretDecryptionError","encryptSecretValue","params","key","dek","plaintext","Buffer","from","value","aad","decryptSecretValue","encoded","ciphertext","toString"],"mappings":"AAAA,SAAQA,WAAW,EAAEC,UAAU,EAAEC,UAAU,QAAkC,cAAc;AAC3F,SAAQC,qBAAqB,QAAO,cAAc;AAElD,OAAO,SAASC,mBACdC,MAA2D;IAE3D,OAAOH,WAAW;QAChBI,KAAKD,OAAOE,GAAG;QACfC,WAAWC,OAAOC,IAAI,CAACL,OAAOM,KAAK,EAAE;QACrCC,KAAKZ,YAAYK;IACnB;AACF;AAEA,OAAO,SAASQ,mBACdR,MAAgE;IAEhE,IAAI;QACF,OAAOJ,WAAW;YAChBK,KAAKD,OAAOE,GAAG;YACfO,SAAST,OAAOU,UAAU;YAC1BH,KAAKZ,YAAYK;QACnB,GAAGW,QAAQ,CAAC;IACd,EAAE,OAAM;QACN,MAAM,IAAIb;IACZ;AACF"}

package/dist/core/variable-store.d.ts

@@ -0,0 +1,24 @@
+import { type StoreScope } from '#db/index.js';
+export interface SetVariablesParams extends StoreScope {
+    workspaceId: string;
+    namespace?: string | undefined;
+    values: Record<string, string>;
+    editedBy?: string | null | undefined;
+}
+export interface DeleteVariablesParams extends StoreScope {
+    workspaceId: string;
+    namespace?: string | undefined;
+    keys?: string[] | undefined;
+}
+export declare function getVariable(input: StoreScope & {
+    workspaceId: string;
+    namespace?: string | undefined;
+    key: string;
+}): Promise<string | null>;
+export declare function getVariablesByNamespace(input: StoreScope & {
+    workspaceId: string;
+    namespace?: string | undefined;
+}): Promise<Record<string, string>>;
+export declare function setVariables(input: SetVariablesParams): Promise<void>;
+export declare function deleteVariables(input: DeleteVariablesParams): Promise<number>;
+//# sourceMappingURL=variable-store.d.ts.map

package/dist/core/variable-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable-store.d.ts","sourceRoot":"","sources":["../../src/core/variable-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,UAAU,EAEhB,MAAM,cAAc,CAAC;AAetB,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAC,GACrF,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BxB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,UAAU,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GACxE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA4BjC;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsF3E;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCnF"}

package/dist/core/variable-store.js

@@ -0,0 +1,194 @@
+import { countSecretVariableRows, db, deleteSecretVariableRows, getSecretVariableRowWithPrecedence, listSecretVariableRowsByNamespace, lockWorkspaceEntries, upsertSecretVariableRows } from '#db/index.js';
+import { normalizedProjectId } from '#db/scope.js';
+import { classifySecretsOperationError, operationScope, recordSecretsEntriesMutated, recordSecretsOperation } from '#metrics/instance.js';
+import { assertWorkspaceCap, validateNamespace, validateSecretKeys, validateValueBytes } from './store-validation.js';
+export async function getVariable(input) {
+    const startedAt = Date.now();
+    const scope = operationScope(input);
+    try {
+        const namespace = input.namespace ?? '';
+        validateNamespace(namespace);
+        validateSecretKeys([
+            input.key
+        ]);
+        const row = await getSecretVariableRowWithPrecedence({
+            ...input,
+            namespace
+        });
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'get',
+            surface: 'internal',
+            scope,
+            outcome: row ? 'success' : 'not_found',
+            durationMs: Date.now() - startedAt
+        });
+        return row?.value ?? null;
+    } catch (error) {
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'get',
+            surface: 'internal',
+            scope,
+            outcome: classifySecretsOperationError(error),
+            durationMs: Date.now() - startedAt
+        });
+        throw error;
+    }
+}
+export async function getVariablesByNamespace(input) {
+    const startedAt = Date.now();
+    const scope = operationScope(input);
+    try {
+        const namespace = input.namespace ?? '';
+        validateNamespace(namespace);
+        const rows = await listSecretVariableRowsByNamespace({
+            ...input,
+            namespace
+        });
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'get_namespace',
+            surface: 'internal',
+            scope,
+            outcome: 'success',
+            durationMs: Date.now() - startedAt
+        });
+        return Object.fromEntries(rows.map((row)=>[
+                row.key,
+                row.value
+            ]));
+    } catch (error) {
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'get_namespace',
+            surface: 'internal',
+            scope,
+            outcome: classifySecretsOperationError(error),
+            durationMs: Date.now() - startedAt
+        });
+        throw error;
+    }
+}
+export async function setVariables(input) {
+    const startedAt = Date.now();
+    const scope = operationScope(input);
+    try {
+        const namespace = input.namespace ?? '';
+        const entries = Object.entries(input.values);
+        validateNamespace(namespace);
+        validateSecretKeys(entries.map(([key])=>key));
+        validateValueBytes(entries.map(([, value])=>value));
+        if (entries.length === 0) {
+            recordSecretsOperation({
+                resource: 'variable',
+                operation: 'set',
+                surface: 'internal',
+                scope,
+                outcome: 'success',
+                durationMs: Date.now() - startedAt
+            });
+            return;
+        }
+        const projectId = normalizedProjectId(input);
+        let existingEntries = 0;
+        await db().transaction(async (tx)=>{
+            await lockWorkspaceEntries(input.workspaceId, tx);
+            existingEntries = await countSecretVariableRows({
+                workspaceId: input.workspaceId,
+                projectId,
+                namespace,
+                keys: entries.map(([key])=>key)
+            }, tx);
+            await assertWorkspaceCap({
+                workspaceId: input.workspaceId,
+                namespace,
+                incomingEntries: entries.length - existingEntries,
+                tx
+            });
+            await upsertSecretVariableRows(entries.map(([key, value])=>({
+                    workspaceId: input.workspaceId,
+                    projectId,
+                    namespace,
+                    key,
+                    value,
+                    lastEditedBy: input.editedBy ?? null
+                })), tx);
+        });
+        recordSecretsEntriesMutated({
+            resource: 'variable',
+            operation: 'set',
+            effect: 'created',
+            surface: 'internal',
+            count: entries.length - existingEntries
+        });
+        recordSecretsEntriesMutated({
+            resource: 'variable',
+            operation: 'set',
+            effect: 'updated',
+            surface: 'internal',
+            count: existingEntries
+        });
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'set',
+            surface: 'internal',
+            scope,
+            outcome: 'success',
+            durationMs: Date.now() - startedAt
+        });
+    } catch (error) {
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'set',
+            surface: 'internal',
+            scope,
+            outcome: classifySecretsOperationError(error),
+            durationMs: Date.now() - startedAt
+        });
+        throw error;
+    }
+}
+export async function deleteVariables(input) {
+    const startedAt = Date.now();
+    const scope = operationScope(input);
+    try {
+        const namespace = input.namespace ?? '';
+        validateNamespace(namespace);
+        if (input.keys) validateSecretKeys(input.keys);
+        const deleted = await deleteSecretVariableRows({
+            workspaceId: input.workspaceId,
+            projectId: normalizedProjectId(input),
+            namespace,
+            keys: input.keys
+        });
+        recordSecretsEntriesMutated({
+            resource: 'variable',
+            operation: 'delete',
+            effect: 'deleted',
+            surface: 'internal',
+            count: deleted
+        });
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'delete',
+            surface: 'internal',
+            scope,
+            outcome: 'success',
+            durationMs: Date.now() - startedAt
+        });
+        return deleted;
+    } catch (error) {
+        recordSecretsOperation({
+            resource: 'variable',
+            operation: 'delete',
+            surface: 'internal',
+            scope,
+            outcome: classifySecretsOperationError(error),
+            durationMs: Date.now() - startedAt
+        });
+        throw error;
+    }
+}
+
+//# sourceMappingURL=variable-store.js.map

package/dist/core/variable-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/variable-store.ts"],"sourcesContent":["import {\n  countSecretVariableRows,\n  db,\n  deleteSecretVariableRows,\n  getSecretVariableRowWithPrecedence,\n  listSecretVariableRowsByNamespace,\n  lockWorkspaceEntries,\n  type StoreScope,\n  upsertSecretVariableRows,\n} from '#db/index.js';\nimport {normalizedProjectId} from '#db/scope.js';\nimport {\n  classifySecretsOperationError,\n  operationScope,\n  recordSecretsEntriesMutated,\n  recordSecretsOperation,\n} from '#metrics/instance.js';\nimport {\n  assertWorkspaceCap,\n  validateNamespace,\n  validateSecretKeys,\n  validateValueBytes,\n} from './store-validation.js';\n\nexport interface SetVariablesParams extends StoreScope {\n  workspaceId: string;\n  namespace?: string | undefined;\n  values: Record<string, string>;\n  editedBy?: string | null | undefined;\n}\n\nexport interface DeleteVariablesParams extends StoreScope {\n  workspaceId: string;\n  namespace?: string | undefined;\n  keys?: string[] | undefined;\n}\n\nexport async function getVariable(\n  input: StoreScope & {workspaceId: string; namespace?: string | undefined; key: string},\n): Promise<string | null> {\n  const startedAt = Date.now();\n  const scope = operationScope(input);\n  try {\n    const namespace = input.namespace ?? '';\n    validateNamespace(namespace);\n    validateSecretKeys([input.key]);\n\n    const row = await getSecretVariableRowWithPrecedence({...input, namespace});\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'get',\n      surface: 'internal',\n      scope,\n      outcome: row ? 'success' : 'not_found',\n      durationMs: Date.now() - startedAt,\n    });\n    return row?.value ?? null;\n  } catch (error) {\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'get',\n      surface: 'internal',\n      scope,\n      outcome: classifySecretsOperationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n\nexport async function getVariablesByNamespace(\n  input: StoreScope & {workspaceId: string; namespace?: string | undefined},\n): Promise<Record<string, string>> {\n  const startedAt = Date.now();\n  const scope = operationScope(input);\n  try {\n    const namespace = input.namespace ?? '';\n    validateNamespace(namespace);\n\n    const rows = await listSecretVariableRowsByNamespace({...input, namespace});\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'get_namespace',\n      surface: 'internal',\n      scope,\n      outcome: 'success',\n      durationMs: Date.now() - startedAt,\n    });\n    return Object.fromEntries(rows.map((row) => [row.key, row.value]));\n  } catch (error) {\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'get_namespace',\n      surface: 'internal',\n      scope,\n      outcome: classifySecretsOperationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n\nexport async function setVariables(input: SetVariablesParams): Promise<void> {\n  const startedAt = Date.now();\n  const scope = operationScope(input);\n  try {\n    const namespace = input.namespace ?? '';\n    const entries = Object.entries(input.values);\n    validateNamespace(namespace);\n    validateSecretKeys(entries.map(([key]) => key));\n    validateValueBytes(entries.map(([, value]) => value));\n    if (entries.length === 0) {\n      recordSecretsOperation({\n        resource: 'variable',\n        operation: 'set',\n        surface: 'internal',\n        scope,\n        outcome: 'success',\n        durationMs: Date.now() - startedAt,\n      });\n      return;\n    }\n\n    const projectId = normalizedProjectId(input);\n    let existingEntries = 0;\n    await db().transaction(async (tx) => {\n      await lockWorkspaceEntries(input.workspaceId, tx);\n      existingEntries = await countSecretVariableRows(\n        {\n          workspaceId: input.workspaceId,\n          projectId,\n          namespace,\n          keys: entries.map(([key]) => key),\n        },\n        tx,\n      );\n      await assertWorkspaceCap({\n        workspaceId: input.workspaceId,\n        namespace,\n        incomingEntries: entries.length - existingEntries,\n        tx,\n      });\n      await upsertSecretVariableRows(\n        entries.map(([key, value]) => ({\n          workspaceId: input.workspaceId,\n          projectId,\n          namespace,\n          key,\n          value,\n          lastEditedBy: input.editedBy ?? null,\n        })),\n        tx,\n      );\n    });\n\n    recordSecretsEntriesMutated({\n      resource: 'variable',\n      operation: 'set',\n      effect: 'created',\n      surface: 'internal',\n      count: entries.length - existingEntries,\n    });\n    recordSecretsEntriesMutated({\n      resource: 'variable',\n      operation: 'set',\n      effect: 'updated',\n      surface: 'internal',\n      count: existingEntries,\n    });\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'set',\n      surface: 'internal',\n      scope,\n      outcome: 'success',\n      durationMs: Date.now() - startedAt,\n    });\n  } catch (error) {\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'set',\n      surface: 'internal',\n      scope,\n      outcome: classifySecretsOperationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n\nexport async function deleteVariables(input: DeleteVariablesParams): Promise<number> {\n  const startedAt = Date.now();\n  const scope = operationScope(input);\n  try {\n    const namespace = input.namespace ?? '';\n    validateNamespace(namespace);\n    if (input.keys) validateSecretKeys(input.keys);\n\n    const deleted = await deleteSecretVariableRows({\n      workspaceId: input.workspaceId,\n      projectId: normalizedProjectId(input),\n      namespace,\n      keys: input.keys,\n    });\n    recordSecretsEntriesMutated({\n      resource: 'variable',\n      operation: 'delete',\n      effect: 'deleted',\n      surface: 'internal',\n      count: deleted,\n    });\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'delete',\n      surface: 'internal',\n      scope,\n      outcome: 'success',\n      durationMs: Date.now() - startedAt,\n    });\n    return deleted;\n  } catch (error) {\n    recordSecretsOperation({\n      resource: 'variable',\n      operation: 'delete',\n      surface: 'internal',\n      scope,\n      outcome: classifySecretsOperationError(error),\n      durationMs: Date.now() - startedAt,\n    });\n    throw error;\n  }\n}\n"],"names":["countSecretVariableRows","db","deleteSecretVariableRows","getSecretVariableRowWithPrecedence","listSecretVariableRowsByNamespace","lockWorkspaceEntries","upsertSecretVariableRows","normalizedProjectId","classifySecretsOperationError","operationScope","recordSecretsEntriesMutated","recordSecretsOperation","assertWorkspaceCap","validateNamespace","validateSecretKeys","validateValueBytes","getVariable","input","startedAt","Date","now","scope","namespace","key","row","resource","operation","surface","outcome","durationMs","value","error","getVariablesByNamespace","rows","Object","fromEntries","map","setVariables","entries","values","length","projectId","existingEntries","transaction","tx","workspaceId","keys","incomingEntries","lastEditedBy","editedBy","effect","count","deleteVariables","deleted"],"mappings":"AAAA,SACEA,uBAAuB,EACvBC,EAAE,EACFC,wBAAwB,EACxBC,kCAAkC,EAClCC,iCAAiC,EACjCC,oBAAoB,EAEpBC,wBAAwB,QACnB,eAAe;AACtB,SAAQC,mBAAmB,QAAO,eAAe;AACjD,SACEC,6BAA6B,EAC7BC,cAAc,EACdC,2BAA2B,EAC3BC,sBAAsB,QACjB,uBAAuB;AAC9B,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,QACb,wBAAwB;AAe/B,OAAO,eAAeC,YACpBC,KAAsF;IAEtF,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,QAAQZ,eAAeQ;IAC7B,IAAI;QACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;QACrCT,kBAAkBS;QAClBR,mBAAmB;YAACG,MAAMM,GAAG;SAAC;QAE9B,MAAMC,MAAM,MAAMrB,mCAAmC;YAAC,GAAGc,KAAK;YAAEK;QAAS;QACzEX,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAASJ,MAAM,YAAY;YAC3BK,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,OAAOM,KAAKM,SAAS;IACvB,EAAE,OAAOC,OAAO;QACdpB,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAASpB,8BAA8BuB;YACvCF,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMa;IACR;AACF;AAEA,OAAO,eAAeC,wBACpBf,KAAyE;IAEzE,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,QAAQZ,eAAeQ;IAC7B,IAAI;QACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;QACrCT,kBAAkBS;QAElB,MAAMW,OAAO,MAAM7B,kCAAkC;YAAC,GAAGa,KAAK;YAAEK;QAAS;QACzEX,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAAS;YACTC,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,OAAOgB,OAAOC,WAAW,CAACF,KAAKG,GAAG,CAAC,CAACZ,MAAQ;gBAACA,IAAID,GAAG;gBAAEC,IAAIM,KAAK;aAAC;IAClE,EAAE,OAAOC,OAAO;QACdpB,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAASpB,8BAA8BuB;YACvCF,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMa;IACR;AACF;AAEA,OAAO,eAAeM,aAAapB,KAAyB;IAC1D,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,QAAQZ,eAAeQ;IAC7B,IAAI;QACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;QACrC,MAAMgB,UAAUJ,OAAOI,OAAO,CAACrB,MAAMsB,MAAM;QAC3C1B,kBAAkBS;QAClBR,mBAAmBwB,QAAQF,GAAG,CAAC,CAAC,CAACb,IAAI,GAAKA;QAC1CR,mBAAmBuB,QAAQF,GAAG,CAAC,CAAC,GAAGN,MAAM,GAAKA;QAC9C,IAAIQ,QAAQE,MAAM,KAAK,GAAG;YACxB7B,uBAAuB;gBACrBc,UAAU;gBACVC,WAAW;gBACXC,SAAS;gBACTN;gBACAO,SAAS;gBACTC,YAAYV,KAAKC,GAAG,KAAKF;YAC3B;YACA;QACF;QAEA,MAAMuB,YAAYlC,oBAAoBU;QACtC,IAAIyB,kBAAkB;QACtB,MAAMzC,KAAK0C,WAAW,CAAC,OAAOC;YAC5B,MAAMvC,qBAAqBY,MAAM4B,WAAW,EAAED;YAC9CF,kBAAkB,MAAM1C,wBACtB;gBACE6C,aAAa5B,MAAM4B,WAAW;gBAC9BJ;gBACAnB;gBACAwB,MAAMR,QAAQF,GAAG,CAAC,CAAC,CAACb,IAAI,GAAKA;YAC/B,GACAqB;YAEF,MAAMhC,mBAAmB;gBACvBiC,aAAa5B,MAAM4B,WAAW;gBAC9BvB;gBACAyB,iBAAiBT,QAAQE,MAAM,GAAGE;gBAClCE;YACF;YACA,MAAMtC,yBACJgC,QAAQF,GAAG,CAAC,CAAC,CAACb,KAAKO,MAAM,GAAM,CAAA;oBAC7Be,aAAa5B,MAAM4B,WAAW;oBAC9BJ;oBACAnB;oBACAC;oBACAO;oBACAkB,cAAc/B,MAAMgC,QAAQ,IAAI;gBAClC,CAAA,IACAL;QAEJ;QAEAlC,4BAA4B;YAC1Be,UAAU;YACVC,WAAW;YACXwB,QAAQ;YACRvB,SAAS;YACTwB,OAAOb,QAAQE,MAAM,GAAGE;QAC1B;QACAhC,4BAA4B;YAC1Be,UAAU;YACVC,WAAW;YACXwB,QAAQ;YACRvB,SAAS;YACTwB,OAAOT;QACT;QACA/B,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAAS;YACTC,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;IACF,EAAE,OAAOa,OAAO;QACdpB,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAASpB,8BAA8BuB;YACvCF,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMa;IACR;AACF;AAEA,OAAO,eAAeqB,gBAAgBnC,KAA4B;IAChE,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,QAAQZ,eAAeQ;IAC7B,IAAI;QACF,MAAMK,YAAYL,MAAMK,SAAS,IAAI;QACrCT,kBAAkBS;QAClB,IAAIL,MAAM6B,IAAI,EAAEhC,mBAAmBG,MAAM6B,IAAI;QAE7C,MAAMO,UAAU,MAAMnD,yBAAyB;YAC7C2C,aAAa5B,MAAM4B,WAAW;YAC9BJ,WAAWlC,oBAAoBU;YAC/BK;YACAwB,MAAM7B,MAAM6B,IAAI;QAClB;QACApC,4BAA4B;YAC1Be,UAAU;YACVC,WAAW;YACXwB,QAAQ;YACRvB,SAAS;YACTwB,OAAOE;QACT;QACA1C,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAAS;YACTC,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,OAAOmC;IACT,EAAE,OAAOtB,OAAO;QACdpB,uBAAuB;YACrBc,UAAU;YACVC,WAAW;YACXC,SAAS;YACTN;YACAO,SAASpB,8BAA8BuB;YACvCF,YAAYV,KAAKC,GAAG,KAAKF;QAC3B;QACA,MAAMa;IACR;AACF"}

package/dist/db/cap.d.ts

@@ -0,0 +1,8 @@
+import { type Tx } from './db.js';
+export declare function countWorkspaceEntries(workspaceId: string, tx?: Tx): Promise<number>;
+export declare function countPublicEntriesByResource(tx?: Tx): Promise<{
+    secrets: number;
+    variables: number;
+}>;
+export declare function lockWorkspaceEntries(workspaceId: string, tx: Tx): Promise<void>;
+//# sourceMappingURL=cap.d.ts.map

package/dist/db/cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cap.d.ts","sourceRoot":"","sources":["../../src/db/cap.ts"],"names":[],"mappings":"AACA,OAAO,EAAK,KAAK,EAAE,EAAC,MAAM,SAAS,CAAC;AAIpC,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBzF;AAED,wBAAsB,4BAA4B,CAChD,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAC,CAAC,CAiB/C;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrF"}