npm - @skaile/workspaces - Versions diffs - 0.39.0 → 0.40.0 - Mend

@skaile/workspaces 0.39.0 → 0.40.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (94) hide show

package/dist/{chunk-6LW7Q53Z.js → chunk-6BEGKO2Q.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { SecretNotFoundError, SecretAccessDeniedError, SecretsError, ProviderUnavailableError } from './chunk-ZDKJHQY2.js';
+import { SecretNotFoundError, SecretAccessDeniedError, SecretsError, ProviderUnavailableError } from './chunk-JXT46QFC.js';
 import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -531,5 +531,5 @@ var SecretsRouter = class {
 var VERSION = "0.0.0";
 export { CredentialLifecycleService, EnvSecretsProvider, LocalSecretsProvider, SecretsRouter, VERSION };
-//# sourceMappingURL=chunk-6LW7Q53Z.js.map
-//# sourceMappingURL=chunk-6LW7Q53Z.js.map
+//# sourceMappingURL=chunk-6BEGKO2Q.js.map
+//# sourceMappingURL=chunk-6BEGKO2Q.js.map

package/dist/{chunk-6LW7Q53Z.js.map → chunk-6BEGKO2Q.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;ACnDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,aAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,SAAS,CAAA;AAAA,EAC9E;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACtZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-6LW7Q53Z.js","sourcesContent":["/*\n CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n \n Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/\n Configuration for {@link CredentialLifecycleService}.\n \n Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\nexport interface CredentialLifecycleConfig {\n /* How far before expiry to trigger a proactive refresh (seconds). /\n refreshLeadTimeSec: number;\n}\n\n/\n Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n \n The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\nexport interface RefreshResult {\n refreshed: boolean;\n reason: \"not_applicable\" \| \"still_valid\" \| \"refreshed\" \| \"refresh_failed\";\n error?: string;\n}\n\nexport class CredentialLifecycleService {\n private router: SecretsRouter;\n\n // `_config` is accepted for signature stability but not stored yet: Phase 1\n // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n // store and read `refreshLeadTimeSec` when proactive refresh lands.\n constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n this.router = router;\n }\n\n /\n Attempt to refresh a credential if needed.\n * Phase 1: always returns not_applicable (no OAuth support yet).\n /\n async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n // Phase 1: no OAuth refresh implemented.\n // The credential exists and is valid as-is (static secrets, env vars, etc.)\n try {\n await this.router.getMetadata(credentialRef);\n return { refreshed: false, reason: \"not_applicable\" };\n } catch {\n return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n }\n }\n\n /\n Check if a credential is still valid (not expired).\n * Phase 1: always returns true for non-OAuth credentials.\n /\n async isValid(credentialRef: string): Promise<boolean> {\n try {\n await this.router.getSecret(credentialRef);\n return true;\n } catch {\n return false;\n }\n }\n}\n","/\n EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n \n Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n \n @docLink packages/secrets/concepts#env-secrets-provider\n /\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/\n Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n /\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n readonly id = \"env\";\n\n async getSecret(ref: string): Promise<Uint8Array> {\n const value = process.env[ref];\n if (value === undefined) {\n throw new SecretNotFoundError(ref);\n }\n return new TextEncoder().encode(value);\n }\n\n async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n }\n\n async deleteSecret(_ref: string): Promise<void> {\n throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n let keys = Object.keys(process.env);\n if (filter?.prefix) {\n keys = keys.filter((k) => k.startsWith(filter.prefix!));\n }\n if (filter?.limit) {\n keys = keys.slice(0, filter.limit);\n }\n return keys;\n }\n\n async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n return { ok: true, latencyMs: 0 };\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const value = process.env[ref];\n if (value === undefined) {\n throw new SecretNotFoundError(ref);\n }\n // Env vars carry no creation/modification time. `SecretMetadata` requires\n // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n // rather than `new Date()`, which would falsely imply the secret was just\n // created/updated. The read-only scope summary already signals the source.\n return {\n ref,\n createdAt: ENV_UNKNOWN_TIMESTAMP,\n updatedAt: ENV_UNKNOWN_TIMESTAMP,\n scopeSummary: \"environment variable (read-only)\",\n };\n }\n\n getCapabilities(): ProviderCapabilities {\n return {\n supportsRotation: false,\n supportsExpiry: false,\n supportsBatch: false,\n scopeModel: \"flat\",\n };\n }\n}\n","/\n LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n \n Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n \n @docLink packages/secrets/concepts#local-secrets-provider\n /\n\nimport as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n ProviderUnavailableError,\n SecretNotFoundError,\n SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). /\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/\n Master key derivation strategy used by {@link LocalSecretsProvider}.\n \n - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n \n The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n \n @docLink packages/secrets/concepts#local-secrets-provider\n /\nexport type KeyStrategy = \"keychain\" \| \"passphrase\" \| \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n // Deterministic but not secret -- last resort only.\n return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/* Hash a passphrase for verification (stored in .master). /\nfunction hashPassphrase(passphrase: string): string {\n return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n const iv = crypto.randomBytes(IV_LENGTH);\n const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n const authTag = cipher.getAuthTag();\n // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n const iv = blob.subarray(0, IV_LENGTH);\n const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n decipher.setAuthTag(authTag);\n return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n readonly id = \"local\";\n private secretsDir: string;\n private masterKey: Buffer \| null = null;\n private salt: Buffer \| null = null;\n private strategy: KeyStrategy = \"machine\";\n\n constructor(secretsDir?: string) {\n this.secretsDir = secretsDir ?? path.join(os.homedir(), \".skaile\", \"secrets\");\n }\n\n // -- Initialization --------------------------------------------------------\n\n private ensureDir(): void {\n if (!fs.existsSync(this.secretsDir)) {\n fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n }\n }\n\n private loadOrCreateSalt(): Buffer {\n const saltPath = path.join(this.secretsDir, \".salt\");\n if (fs.existsSync(saltPath)) {\n return fs.readFileSync(saltPath);\n }\n const salt = crypto.randomBytes(SALT_LENGTH);\n fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n return salt;\n }\n\n private async ensureKey(): Promise<void> {\n if (this.masterKey) return;\n\n this.ensureDir();\n this.salt = this.loadOrCreateSalt();\n\n // Determine strategy\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n if (fs.existsSync(strategyPath)) {\n this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n } else {\n // Auto-detect: try keychain, fall back to machine\n this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n }\n\n // Derive key from strategy\n const passphrase = await this.getPassphraseForStrategy(this.strategy);\n this.masterKey = deriveMasterKey(passphrase, this.salt);\n }\n\n private async tryKeychainStrategy(): Promise<boolean> {\n try {\n // `keytar` is an optional OS-keychain native module the user installs\n // themselves; the `as string` specifier keeps it out of tsc resolution.\n const keytar = await import(\"keytar\" as string);\n let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n if (!stored) {\n stored = crypto.randomBytes(32).toString(\"base64\");\n await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n }\n return true;\n } catch {\n return false;\n }\n }\n\n private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n switch (strategy) {\n case \"keychain\": {\n try {\n // `keytar` is an optional OS-keychain native module the user installs\n // themselves; the `as string` specifier keeps it out of tsc resolution.\n const keytar = await import(\"keytar\" as string);\n const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n if (stored) return stored;\n } catch {\n // Keychain failed; fall through to machine\n }\n return getMachinePassphrase();\n }\n case \"passphrase\": {\n const envPassphrase = process.env[PASSPHRASE_ENV];\n if (envPassphrase) {\n // Verify against stored hash if it exists\n const masterPath = path.join(this.secretsDir, \".master\");\n if (fs.existsSync(masterPath)) {\n const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n if (hashPassphrase(envPassphrase) !== storedHash) {\n throw new SecretsError(\n `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n \"Use skaile auth set-key-strategy passphrase to reset.\",\n \"PASSPHRASE_MISMATCH\",\n );\n }\n }\n return envPassphrase;\n }\n // No env var -- hard error. Silent fallback to machine would\n // produce a different key, causing AES-GCM auth-tag failures\n // on secrets encrypted with the real passphrase.\n throw new SecretsError(\n `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n \"PASSPHRASE_REQUIRED\",\n );\n }\n case \"machine\":\n return getMachinePassphrase();\n default:\n return getMachinePassphrase();\n }\n }\n\n // -- Strategy management ---------------------------------------------------\n\n /\n Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n \n When existing secrets are present, they are re-encrypted with the new key\n * to prevent data loss from key mismatch.\n /\n async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n this.ensureDir();\n\n // --- 1. Validate new strategy prerequisites -------------------------\n\n const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n if (strategy === \"passphrase\") {\n if (!effectivePassphrase) {\n throw new SecretsError(\n `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n \"PASSPHRASE_REQUIRED\",\n );\n }\n }\n\n if (strategy === \"keychain\") {\n const success = await this.tryKeychainStrategy();\n if (!success) {\n throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n }\n }\n\n // --- 2. Load the OLD key under the current strategy -----------------\n // ensureKey() reads the current strategy file and derives the key\n // that was used to encrypt existing secrets. This is critical for\n // cross-process scenarios where masterKey starts as null.\n\n const encFiles = this.listEncFiles();\n if (encFiles.length > 0) {\n await this.ensureKey();\n const oldKey = this.masterKey!;\n\n // Derive the new key\n const salt = this.salt!;\n const newPassphrase =\n strategy === \"passphrase\"\n ? effectivePassphrase!\n : strategy === \"keychain\"\n ? await this.getPassphraseForStrategy(\"keychain\")\n : getMachinePassphrase();\n const newKey = deriveMasterKey(newPassphrase, salt);\n\n // Re-encrypt each secret with the new key. A single failure must abort the\n // whole switch: committing the new strategy while a secret is still under\n // the old key orphans that secret (the registry advertises a key that no\n // longer decrypts it). Collect failures and throw before the commit below,\n // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n const failed: string[] = [];\n for (const encFile of encFiles) {\n const filePath = path.join(this.secretsDir, encFile);\n const blob = fs.readFileSync(filePath);\n try {\n const plaintext = decrypt(blob, oldKey);\n const reEncrypted = encrypt(plaintext, newKey);\n fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n } catch {\n failed.push(encFile);\n }\n }\n if (failed.length > 0) {\n throw new Error(\n `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n \"is unchanged; resolve the failing secrets before retrying.\",\n );\n }\n }\n\n // --- 3. Commit the new strategy (last write -- failure above leaves\n // the old strategy intact) ------------------------------------\n\n if (strategy === \"passphrase\") {\n const masterPath = path.join(this.secretsDir, \".master\");\n fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n }\n\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n this.masterKey = null;\n this.strategy = strategy;\n }\n\n getKeyStrategy(): KeyStrategy {\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n if (fs.existsSync(strategyPath)) {\n return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n }\n return \"machine\";\n }\n\n // -- File helpers ----------------------------------------------------------\n\n private encFilename(ref: string): string {\n return `${refToHash(ref)}.enc`;\n }\n\n private metaFilename(ref: string): string {\n return `${refToHash(ref)}.meta.json`;\n }\n\n private metaPath(ref: string): string {\n return path.join(this.secretsDir, this.metaFilename(ref));\n }\n\n private listEncFiles(): string[] {\n if (!fs.existsSync(this.secretsDir)) return [];\n return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n }\n\n // -- ISecretsProvider implementation ----------------------------------------\n\n async getSecret(ref: string): Promise<Uint8Array> {\n await this.ensureKey();\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n const blob = fs.readFileSync(filePath);\n const decrypted = decrypt(blob, this.masterKey!);\n\n // Update lastAccessedAt\n const metaFile = this.metaPath(ref);\n if (fs.existsSync(metaFile)) {\n try {\n const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n meta.lastAccessedAt = new Date().toISOString();\n fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n } catch {\n // Non-fatal\n }\n }\n\n return new Uint8Array(decrypted);\n }\n\n async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n await this.ensureKey();\n this.ensureDir();\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n const encrypted = encrypt(value, this.masterKey!);\n fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n // Write metadata (stores the original ref for reverse lookup)\n const now = new Date().toISOString();\n const metaFile = this.metaPath(ref);\n let existing: Record<string, unknown> = {};\n if (fs.existsSync(metaFile)) {\n try {\n existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n } catch {\n // Overwrite corrupt meta\n }\n }\n const meta = {\n ref,\n createdAt: existing.createdAt ?? now,\n updatedAt: now,\n lastAccessedAt: now,\n ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n ...(opts?.ttlSeconds\n ? { expiresAt: new Date(Date.now() + opts.ttlSeconds 1000).toISOString() }\n : {}),\n };\n fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n }\n\n async deleteSecret(ref: string): Promise<void> {\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n const metaFile = this.metaPath(ref);\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n fs.unlinkSync(filePath);\n if (fs.existsSync(metaFile)) {\n fs.unlinkSync(metaFile);\n }\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n this.ensureDir();\n // Read refs from meta files (the .enc filenames are hashes, not refs)\n const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n let refs: string[] = [];\n for (const mf of metaFiles) {\n try {\n const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n if (meta.ref) refs.push(meta.ref);\n } catch {\n // Skip corrupt meta files\n }\n }\n if (filter?.prefix) {\n refs = refs.filter((r) => r.startsWith(filter.prefix!));\n }\n if (filter?.limit) {\n refs = refs.slice(0, filter.limit);\n }\n return refs;\n }\n\n async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n const start = Date.now();\n try {\n await this.ensureKey();\n // Write + read + delete a test secret\n const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n const testValue = new TextEncoder().encode(\"test\");\n await this.setSecret(testRef, testValue);\n const read = await this.getSecret(testRef);\n await this.deleteSecret(testRef);\n if (new TextDecoder().decode(read) !== \"test\") {\n return { ok: false, error: \"Round-trip mismatch\" };\n }\n return { ok: true, latencyMs: Date.now() - start };\n } catch (e) {\n return {\n ok: false,\n latencyMs: Date.now() - start,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const metaFile = this.metaPath(ref);\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n if (fs.existsSync(metaFile)) {\n const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n return {\n ref: raw.ref ?? ref,\n createdAt: new Date(raw.createdAt),\n updatedAt: new Date(raw.updatedAt),\n lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n owner: raw.owner,\n scopeSummary: \"local encrypted file\",\n };\n }\n // Fallback: derive from file stat\n const stat = fs.statSync(filePath);\n return {\n ref,\n createdAt: stat.birthtime,\n updatedAt: stat.mtime,\n scopeSummary: \"local encrypted file\",\n };\n }\n\n getCapabilities(): ProviderCapabilities {\n return {\n supportsRotation: false,\n supportsExpiry: false,\n supportsBatch: false,\n scopeModel: \"flat\",\n };\n }\n}\n","/*\n SecretsRouter — audit chokepoint for all secret operations.\n \n Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n \n @docLink packages/secrets/concepts#secrets-router\n /\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/\n Audit event emitted by {@link SecretsRouter} after every secret operation.\n \n Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface CredentialAccessed {\n credential_ref: string;\n operation: \"get\" \| \"set\" \| \"delete\" \| \"list\" \| \"metadata\";\n provider_id: string;\n caller_session_id?: string;\n caller_tool_call?: string;\n timestamp: Date;\n}\n\n/\n Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n \n Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/\n A single routing rule that maps a credential ref prefix to a provider.\n \n Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface RoutingRule {\n /* Prefix match on credential_ref. First match wins. /\n prefix: string;\n /* Provider id to route to. /\n provider_id: string;\n}\n\n/\n Configuration object for {@link SecretsRouter}.\n \n Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface SecretsRouterConfig {\n /* Default provider id when no routing rule matches. /\n default_provider: string;\n /* Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. /\n rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n private providers = new Map<string, ISecretsProvider>();\n private config: SecretsRouterConfig;\n private sinks: AuditSink[] = [];\n\n /* Caller context for audit events (set per-request by the runner). /\n callerSessionId?: string;\n callerToolCall?: string;\n\n constructor(config: SecretsRouterConfig) {\n this.config = config;\n }\n\n // -- Provider registration ------------------------------------------------\n\n register(provider: ISecretsProvider): void {\n this.providers.set(provider.id, provider);\n }\n\n unregister(id: string): void {\n this.providers.delete(id);\n }\n\n listProviders(): string[] {\n return [...this.providers.keys()];\n }\n\n // -- Audit sinks -----------------------------------------------------------\n\n addSink(sink: AuditSink): void {\n this.sinks.push(sink);\n }\n\n private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n const event: CredentialAccessed = {\n credential_ref: ref,\n operation,\n provider_id: providerId,\n caller_session_id: this.callerSessionId,\n caller_tool_call: this.callerToolCall,\n timestamp: new Date(),\n };\n for (const sink of this.sinks) {\n try {\n sink(event);\n } catch {\n // Audit sink errors must not break the secret operation.\n }\n }\n }\n\n // -- Routing ---------------------------------------------------------------\n\n private resolve(ref: string): ISecretsProvider {\n // Check routing rules first\n if (this.config.rules) {\n for (const rule of this.config.rules) {\n if (ref.startsWith(rule.prefix)) {\n const provider = this.providers.get(rule.provider_id);\n if (provider) return provider;\n }\n }\n }\n\n // Fall back to default\n const provider = this.providers.get(this.config.default_provider);\n if (!provider) {\n throw new ProviderUnavailableError(\n this.config.default_provider,\n `No provider registered for default id \"${this.config.default_provider}\"`,\n );\n }\n return provider;\n }\n\n // -- Delegated operations --------------------------------------------------\n\n async getSecret(ref: string): Promise<Uint8Array> {\n const provider = this.resolve(ref);\n this.emit(ref, \"get\", provider.id);\n return provider.getSecret(ref);\n }\n\n async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n const provider = this.resolve(ref);\n this.emit(ref, \"set\", provider.id);\n return provider.setSecret(ref, value, opts);\n }\n\n async deleteSecret(ref: string): Promise<void> {\n const provider = this.resolve(ref);\n this.emit(ref, \"delete\", provider.id);\n return provider.deleteSecret(ref);\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n // List aggregates from the default provider only (per-provider listing\n // would require iterating all providers; deferred to Phase 3 with\n // federated catalogs).\n const provider = this.providers.get(this.config.default_provider);\n if (!provider) return [];\n this.emit(\"\", \"list\", provider.id);\n return provider.listSecrets(filter);\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const provider = this.resolve(ref);\n this.emit(ref, \"metadata\", provider.id);\n return provider.getMetadata(ref);\n }\n\n getCapabilities(providerId?: string): ProviderCapabilities \| null {\n const id = providerId ?? this.config.default_provider;\n const provider = this.providers.get(id);\n return provider?.getCapabilities() ?? null;\n }\n\n async testConnection(\n providerId?: string,\n ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n const id = providerId ?? this.config.default_provider;\n const provider = this.providers.get(id);\n if (!provider) {\n return { ok: false, error: `Provider \"${id}\" not registered` };\n }\n return provider.testConnection();\n }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n ProviderUnavailableError,\n SecretAccessDeniedError,\n SecretExpiredError,\n SecretNotFoundError,\n SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}
1	+ {"version":3,"sources":["../secrets/src/lifecycle.ts","../secrets/src/providers/env.ts","../secrets/src/providers/local.ts","../secrets/src/router.ts","../secrets/src/index.ts"],"names":["provider"],"mappings":";;;;;;;AAuCO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,MAAA;AAAA;AAAA;AAAA;AAAA,EAKR,WAAA,CAAY,QAAuB,OAAA,EAA8C;AAC/E,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,aAAA,EAA+C;AAGnE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY,aAAa,CAAA;AAC3C,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAkB,OAAO,sBAAA,EAAuB;AAAA,IACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,aAAA,EAAyC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA;AACzC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF;;;ACnDA,IAAM,qBAAA,mBAAwB,IAAI,IAAA,CAAK,CAAC,CAAA;AAEjC,IAAM,qBAAN,MAAqD;AAAA,EACjD,EAAA,GAAK,KAAA;AAAA,EAEd,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,EACvC;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,MAAA,EAAoB,KAAA,EAAyC;AACzF,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,aAAa,IAAA,EAA6B;AAC9C,IAAA,MAAM,IAAI,wBAAwB,iCAAiC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAI,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AAKA,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAA,EAAW,qBAAA;AAAA,MACX,SAAA,EAAW,qBAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;ACnDA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,eAAA,GAAkB,EAAA;AACxB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,aAAA,GAAgB,QAAA;AAEtB,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,cAAA,GAAiB,2BAAA;AAoBvB,SAAS,eAAA,CAAgB,YAAoB,IAAA,EAAsB;AACjE,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,iBAAA,EAAmB,YAAY,aAAa,CAAA;AACzF;AAEA,SAAS,oBAAA,GAA+B;AAEtC,EAAA,OAAO,UAAa,EAAA,CAAA,QAAA,EAAU,CAAA,CAAA,EAAO,EAAA,CAAA,QAAA,GAAW,QAAQ,CAAA,CAAA;AAC1D;AAGA,SAAS,eAAe,UAAA,EAA4B;AAClD,EAAA,OAAc,kBAAW,QAAQ,CAAA,CAAE,OAAO,UAAU,CAAA,CAAE,OAAO,KAAK,CAAA;AACpE;AAMA,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAc,MAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC1E;AAMA,SAAS,OAAA,CAAQ,MAAkB,GAAA,EAAqB;AACtD,EAAA,MAAM,EAAA,GAAY,mBAAY,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAgB,sBAAe,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACrE,EAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,EAAA,OAAO,OAAO,MAAA,CAAO,CAAC,EAAA,EAAI,OAAA,EAAS,SAAS,CAAC,CAAA;AAC/C;AAEA,SAAS,OAAA,CAAQ,MAAc,GAAA,EAAqB;AAClD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,CAAS,CAAA,EAAG,SAAS,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,YAAY,eAAe,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,QAAA,CAAS,SAAA,GAAY,eAAe,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAkB,wBAAiB,SAAA,EAAW,GAAA,EAAK,IAAI,EAAE,aAAA,EAAe,iBAAiB,CAAA;AAC/F,EAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACtE;AAMO,IAAM,uBAAN,MAAuD;AAAA,EACnD,EAAA,GAAK,OAAA;AAAA,EACN,UAAA;AAAA,EACA,SAAA,GAA2B,IAAA;AAAA,EAC3B,IAAA,GAAsB,IAAA;AAAA,EACtB,QAAA,GAAwB,SAAA;AAAA,EAEhC,YAAY,UAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,aAAa,UAAA,IAAmB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,SAAS,CAAA;AAAA,EAC9E;AAAA;AAAA,EAIQ,SAAA,GAAkB;AACxB,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,EAAG;AACnC,MAAG,EAAA,CAAA,SAAA,CAAU,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,IAChE;AAAA,EACF;AAAA,EAEQ,gBAAA,GAA2B;AACjC,IAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,OAAU,gBAAa,QAAQ,CAAA;AAAA,IACjC;AACA,IAAA,MAAM,IAAA,GAAc,mBAAY,WAAW,CAAA;AAC3C,IAAG,iBAAc,QAAA,EAAU,IAAA,EAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAA,GAA2B;AACvC,IAAA,IAAI,KAAK,SAAA,EAAW;AAEpB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,gBAAA,EAAiB;AAGlC,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,IAAA,CAAK,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,EAAE,IAAA,EAAK;AAAA,IAC9D,CAAA,MAAO;AAEL,MAAA,IAAA,CAAK,QAAA,GAAY,MAAM,IAAA,CAAK,mBAAA,KAAyB,UAAA,GAAa,SAAA;AAClE,MAAG,iBAAc,YAAA,EAAc,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,wBAAA,CAAyB,KAAK,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,SAAA,GAAY,eAAA,CAAgB,UAAA,EAAY,IAAA,CAAK,IAAI,CAAA;AAAA,EACxD;AAAA,EAEA,MAAc,mBAAA,GAAwC;AACpD,IAAA,IAAI;AAGF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AACxE,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,GAAgB,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACjD,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAA,EAAkB,gBAAA,EAAkB,MAAM,CAAA;AAAA,MACrE;AACA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,yBAAyB,QAAA,EAAwC;AAC7E,IAAA,QAAQ,QAAA;AAAU,MAChB,KAAK,UAAA,EAAY;AACf,QAAA,IAAI;AAGF,UAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAkB,CAAA;AAC9C,UAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,WAAA,CAAY,kBAAkB,gBAAgB,CAAA;AAC1E,UAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,QACrB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAChD,QAAA,IAAI,aAAA,EAAe;AAEjB,UAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,UAAA,IAAO,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,YAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC7D,YAAA,IAAI,cAAA,CAAe,aAAa,CAAA,KAAM,UAAA,EAAY;AAChD,cAAA,MAAM,IAAI,YAAA;AAAA,gBACR,mBAAmB,cAAc,CAAA,kFAAA,CAAA;AAAA,gBAEjC;AAAA,eACF;AAAA,YACF;AAAA,UACF;AACA,UAAA,OAAO,aAAA;AAAA,QACT;AAIA,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,6BAAA,EAAgC,cAAc,CAAA,8CAAA,EACR,cAAc,CAAA,MAAA,CAAA;AAAA,UACpD;AAAA,SACF;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,OAAO,oBAAA,EAAqB;AAAA,MAC9B;AACE,QAAA,OAAO,oBAAA,EAAqB;AAAA;AAChC,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAA,CAAe,QAAA,EAAuB,UAAA,EAAoC;AAC9E,IAAA,IAAA,CAAK,SAAA,EAAU;AAIf,IAAA,MAAM,mBAAA,GAAsB,UAAA,IAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAEpE,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACxB,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,sDAAsD,cAAc,CAAA,CAAA,CAAA;AAAA,UACpE;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,mBAAA,EAAoB;AAC/C,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,wBAAA,CAAyB,OAAA,EAAS,2BAA2B,CAAA;AAAA,MACzE;AAAA,IACF;AAOA,IAAA,MAAM,QAAA,GAAW,KAAK,YAAA,EAAa;AACnC,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAM,KAAK,SAAA,EAAU;AACrB,MAAA,MAAM,SAAS,IAAA,CAAK,SAAA;AAGpB,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,MAAA,MAAM,aAAA,GACJ,QAAA,KAAa,YAAA,GACT,mBAAA,GACA,QAAA,KAAa,UAAA,GACX,MAAM,IAAA,CAAK,wBAAA,CAAyB,UAAU,CAAA,GAC9C,oBAAA,EAAqB;AAC7B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,aAAA,EAAe,IAAI,CAAA;AAOlD,MAAA,MAAM,SAAmB,EAAC;AAC1B,MAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,QAAA,MAAM,QAAA,GAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AACnD,QAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA;AACtC,UAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,MAAM,CAAA;AAC7C,UAAG,iBAAc,QAAA,EAAU,WAAA,EAAa,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,QACzD,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,QACrB;AAAA,MACF;AACA,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sEACK,MAAA,CAAO,MAAM,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,mFAAA;AAAA,SAEpD;AAAA,MACF;AAAA,IACF;AAKA,IAAA,IAAI,aAAa,YAAA,EAAc;AAC7B,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,SAAS,CAAA;AACvD,MAAG,EAAA,CAAA,aAAA,CAAc,YAAY,cAAA,CAAe,mBAAoB,GAAG,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAG,iBAAc,YAAA,EAAc,QAAA,EAAU,EAAE,IAAA,EAAM,KAAO,CAAA;AACxD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,cAAA,GAA8B;AAC5B,IAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,eAAe,CAAA;AAC/D,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,OAAU,EAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAA,CAAE,IAAA,EAAK;AAAA,IACrD;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAAA;AAAA,EAIQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,IAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,aAAa,GAAA,EAAqB;AACxC,IAAA,OAAO,CAAA,EAAG,SAAA,CAAU,GAAG,CAAC,CAAA,UAAA,CAAA;AAAA,EAC1B;AAAA,EAEQ,SAAS,GAAA,EAAqB;AACpC,IAAA,OAAY,UAAK,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,YAAA,CAAa,GAAG,CAAC,CAAA;AAAA,EAC1D;AAAA,EAEQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,UAAU,CAAA,SAAU,EAAC;AAC7C,IAAA,OAAU,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EACzE;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,IAAA,GAAU,gBAAa,QAAQ,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,IAAA,EAAM,IAAA,CAAK,SAAU,CAAA;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC1D,QAAA,IAAA,CAAK,cAAA,GAAA,iBAAiB,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAC7C,QAAG,EAAA,CAAA,aAAA,CAAc,UAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,WAAW,SAAS,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,SAAU,CAAA;AAChD,IAAG,iBAAc,QAAA,EAAU,SAAA,EAAW,EAAE,IAAA,EAAM,KAAO,CAAA;AAGrD,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,WAAoC,EAAC;AACzC,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAAA,MAC1D,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,GAAA;AAAA,MACA,SAAA,EAAW,SAAS,SAAA,IAAa,GAAA;AAAA,MACjC,SAAA,EAAW,GAAA;AAAA,MACX,cAAA,EAAgB,GAAA;AAAA,MAChB,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,IAAA,CAAK,QAAA,KAAa,EAAC;AAAA,MACpD,GAAI,IAAA,EAAM,UAAA,GACN,EAAE,SAAA,EAAW,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,UAAA,GAAa,GAAI,EAAE,WAAA,EAAY,KACvE;AAAC,KACP;AACA,IAAG,EAAA,CAAA,aAAA,CAAc,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAG,cAAW,QAAQ,CAAA;AACtB,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAG,cAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AACxD,IAAA,IAAA,CAAK,SAAA,EAAU;AAEf,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,YAAY,CAAC,CAAA;AACxF,IAAA,IAAI,OAAiB,EAAC;AACtB,IAAA,KAAA,MAAW,MAAM,SAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAkB,IAAA,CAAA,IAAA,CAAK,KAAK,UAAA,EAAY,EAAE,CAAA,EAAG,OAAO,CAAC,CAAA;AAChF,QAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,IAAA,GAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,MAAA,CAAO,MAAO,CAAC,CAAA;AAAA,IACxD;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,GAA+E;AACnF,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,SAAA,EAAU;AAErB,MAAA,MAAM,UAAU,CAAA,OAAA,EAAiB,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AAC/D,MAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AACjD,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,EAAS,SAAS,CAAA;AACvC,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,aAAa,OAAO,CAAA;AAC/B,MAAA,IAAI,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACnD;AACA,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAW,IAAA,CAAK,GAAA,KAAQ,KAAA,EAAM;AAAA,IACnD,SAAS,CAAA,EAAG;AACV,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,QACxB,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA;AAClC,IAAA,MAAM,WAAgB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,YAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,oBAAoB,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAO,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,GAAA,EAAK,IAAI,GAAA,IAAO,GAAA;AAAA,QAChB,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA;AAAA,QACjC,gBAAgB,GAAA,CAAI,cAAA,GAAiB,IAAI,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,GAAI,MAAA;AAAA,QACpE,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAU,YAAS,QAAQ,CAAA;AACjC,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,KAAA;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,eAAA,GAAwC;AACtC,IAAA,OAAO;AAAA,MACL,gBAAA,EAAkB,KAAA;AAAA,MAClB,cAAA,EAAgB,KAAA;AAAA,MAChB,aAAA,EAAe,KAAA;AAAA,MACf,UAAA,EAAY;AAAA,KACd;AAAA,EACF;AACF;;;ACtZO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAA,uBAAgB,GAAA,EAA8B;AAAA,EAC9C,MAAA;AAAA,EACA,QAAqB,EAAC;AAAA;AAAA,EAG9B,eAAA;AAAA,EACA,cAAA;AAAA,EAEA,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA,EAIA,SAAS,QAAA,EAAkC;AACzC,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC1C;AAAA,EAEA,WAAW,EAAA,EAAkB;AAC3B,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,EAAE,CAAA;AAAA,EAC1B;AAAA,EAEA,aAAA,GAA0B;AACxB,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAA,EAClC;AAAA;AAAA,EAIA,QAAQ,IAAA,EAAuB;AAC7B,IAAA,IAAA,CAAK,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACtB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,SAAA,EAA4C,UAAA,EAA0B;AAC9F,IAAA,MAAM,KAAA,GAA4B;AAAA,MAChC,cAAA,EAAgB,GAAA;AAAA,MAChB,SAAA;AAAA,MACA,WAAA,EAAa,UAAA;AAAA,MACb,mBAAmB,IAAA,CAAK,eAAA;AAAA,MACxB,kBAAkB,IAAA,CAAK,cAAA;AAAA,MACvB,SAAA,sBAAe,IAAA;AAAK,KACtB;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,QAAQ,GAAA,EAA+B;AAE7C,IAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,MAAMA,SAAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,KAAK,WAAW,CAAA;AACpD,UAAA,IAAIA,WAAU,OAAOA,SAAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,KAAK,MAAA,CAAO,gBAAA;AAAA,QACZ,CAAA,uCAAA,EAA0C,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAIA,MAAM,UAAU,GAAA,EAAkC;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,UAAU,GAAG,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,SAAA,CAAU,GAAA,EAAa,KAAA,EAAmB,IAAA,EAAwC;AACtF,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,KAAA,EAAO,QAAA,CAAS,EAAE,CAAA;AACjC,IAAA,OAAO,QAAA,CAAS,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,IAAI,CAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,GAAA,EAA4B;AAC7C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,QAAA,CAAS,EAAE,CAAA;AACpC,IAAA,OAAO,QAAA,CAAS,aAAa,GAAG,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY,MAAA,EAAwC;AAIxD,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,OAAO,gBAAgB,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,CAAS,EAAE,CAAA;AAClC,IAAA,OAAO,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,YAAY,GAAA,EAAsC;AACtD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,UAAA,EAAY,QAAA,CAAS,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,CAAS,YAAY,GAAG,CAAA;AAAA,EACjC;AAAA,EAEA,gBAAgB,UAAA,EAAkD;AAChE,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,OAAO,QAAA,EAAU,iBAAgB,IAAK,IAAA;AAAA,EACxC;AAAA,EAEA,MAAM,eACJ,UAAA,EAC8D;AAC9D,IAAA,MAAM,EAAA,GAAK,UAAA,IAAc,IAAA,CAAK,MAAA,CAAO,gBAAA;AACrC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,EAAE,CAAA;AACtC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,UAAA,EAAa,EAAE,CAAA,gBAAA,CAAA,EAAmB;AAAA,IAC/D;AACA,IAAA,OAAO,SAAS,cAAA,EAAe;AAAA,EACjC;AACF;;;ACvNO,IAAM,OAAA,GAAU","file":"chunk-6BEGKO2Q.js","sourcesContent":["/*\n CredentialLifecycleService — manages OAuth token refresh outside the SecretsRouter.\n \n Works with opaque token blobs stored via the {@link SecretsRouter}; providers remain\n * OAuth-unaware. Phase 1 ships non-OAuth paths (always returns `not_applicable`).\n * Full proactive OAuth refresh with expiry checking ships in Phase 3.4.\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\n\nimport type { SecretsRouter } from \"./router.js\";\n\n/\n Configuration for {@link CredentialLifecycleService}.\n \n Controls how aggressively the service proactively refreshes credentials before they expire.\n * The default lead time is 300 seconds (5 minutes).\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\nexport interface CredentialLifecycleConfig {\n /* How far before expiry to trigger a proactive refresh (seconds). /\n refreshLeadTimeSec: number;\n}\n\n/\n Result returned by {@link CredentialLifecycleService.refreshIfNeeded}.\n \n The `reason` discriminant indicates why a refresh did or did not occur.\n * An `error` string is present only when `reason` is `refresh_failed`.\n \n @docLink packages/secrets/concepts#credential-lifecycle\n /\nexport interface RefreshResult {\n refreshed: boolean;\n reason: \"not_applicable\" \| \"still_valid\" \| \"refreshed\" \| \"refresh_failed\";\n error?: string;\n}\n\nexport class CredentialLifecycleService {\n private router: SecretsRouter;\n\n // `_config` is accepted for signature stability but not stored yet: Phase 1\n // ships no OAuth refresh, so there is nothing to configure. Phase 3.4 will\n // store and read `refreshLeadTimeSec` when proactive refresh lands.\n constructor(router: SecretsRouter, _config?: Partial<CredentialLifecycleConfig>) {\n this.router = router;\n }\n\n /\n Attempt to refresh a credential if needed.\n * Phase 1: always returns not_applicable (no OAuth support yet).\n /\n async refreshIfNeeded(credentialRef: string): Promise<RefreshResult> {\n // Phase 1: no OAuth refresh implemented.\n // The credential exists and is valid as-is (static secrets, env vars, etc.)\n try {\n await this.router.getMetadata(credentialRef);\n return { refreshed: false, reason: \"not_applicable\" };\n } catch {\n return { refreshed: false, reason: \"refresh_failed\", error: \"Credential not found\" };\n }\n }\n\n /\n Check if a credential is still valid (not expired).\n * Phase 1: always returns true for non-OAuth credentials.\n /\n async isValid(credentialRef: string): Promise<boolean> {\n try {\n await this.router.getSecret(credentialRef);\n return true;\n } catch {\n return false;\n }\n }\n}\n","/\n EnvSecretsProvider — read-only provider that resolves secrets from environment variables.\n \n Refs are expected to be plain env var names (e.g. `DATABASE_URL`). The provider is\n * always available with zero configuration and requires no encryption or keychain access.\n * `setSecret` and `deleteSecret` always throw `SecretAccessDeniedError` because\n * environment variables are managed externally to the running process.\n \n @docLink packages/secrets/concepts#env-secrets-provider\n /\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { SecretAccessDeniedError, SecretNotFoundError } from \"@skaile/workspaces/plugins\";\n\n/\n Sentinel timestamp for env secrets, which have no real created/updated time.\n * The Unix epoch is unambiguously not \"now\", so consumers can recognise it as\n * \"unknown\" rather than treating it as a genuine recent timestamp.\n /\nconst ENV_UNKNOWN_TIMESTAMP = new Date(0);\n\nexport class EnvSecretsProvider implements ISecretsProvider {\n readonly id = \"env\";\n\n async getSecret(ref: string): Promise<Uint8Array> {\n const value = process.env[ref];\n if (value === undefined) {\n throw new SecretNotFoundError(ref);\n }\n return new TextEncoder().encode(value);\n }\n\n async setSecret(_ref: string, _value: Uint8Array, _opts?: SetSecretOptions): Promise<void> {\n throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n }\n\n async deleteSecret(_ref: string): Promise<void> {\n throw new SecretAccessDeniedError(\"EnvSecretsProvider is read-only\");\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n let keys = Object.keys(process.env);\n if (filter?.prefix) {\n keys = keys.filter((k) => k.startsWith(filter.prefix!));\n }\n if (filter?.limit) {\n keys = keys.slice(0, filter.limit);\n }\n return keys;\n }\n\n async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n return { ok: true, latencyMs: 0 };\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const value = process.env[ref];\n if (value === undefined) {\n throw new SecretNotFoundError(ref);\n }\n // Env vars carry no creation/modification time. `SecretMetadata` requires\n // both fields, so use the Unix epoch as a documented \"unknown\" sentinel\n // rather than `new Date()`, which would falsely imply the secret was just\n // created/updated. The read-only scope summary already signals the source.\n return {\n ref,\n createdAt: ENV_UNKNOWN_TIMESTAMP,\n updatedAt: ENV_UNKNOWN_TIMESTAMP,\n scopeSummary: \"environment variable (read-only)\",\n };\n }\n\n getCapabilities(): ProviderCapabilities {\n return {\n supportsRotation: false,\n supportsExpiry: false,\n supportsBatch: false,\n scopeModel: \"flat\",\n };\n }\n}\n","/\n LocalSecretsProvider — AES-256-GCM encrypted file-blob storage at `~/.skaile/secrets/`.\n \n Each secret is stored as a separate `.enc` file named by the SHA-256 hash of the ref\n * (collision-free, filesystem-safe). A companion `.meta.json` stores the original ref,\n * timestamps, and optional user metadata. The master key is derived via PBKDF2-SHA-512\n * from one of three {@link KeyStrategy} sources: OS keychain (keytar), a passphrase from\n * `SKAILE_SECRETS_PASSPHRASE`, or a machine-derived passphrase as last resort.\n * Switching strategies re-encrypts all existing secrets with the new key.\n \n @docLink packages/secrets/concepts#local-secrets-provider\n /\n\nimport as crypto from \"node:crypto\";\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport {\n ProviderUnavailableError,\n SecretNotFoundError,\n SecretsError,\n} from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\nconst KEY_LENGTH = 32;\nconst PBKDF2_ITERATIONS = 100_000;\nconst PBKDF2_DIGEST = \"sha512\";\n\nconst KEYCHAIN_SERVICE = \"skaile-secrets\";\nconst KEYCHAIN_ACCOUNT = \"master-key\";\n\n/** Env var that provides the passphrase at runtime (never stored on disk). /\nconst PASSPHRASE_ENV = \"SKAILE_SECRETS_PASSPHRASE\";\n\n/\n Master key derivation strategy used by {@link LocalSecretsProvider}.\n \n - `keychain` — OS keychain (via keytar); most secure, requires keytar to be installed.\n * - `passphrase` — PBKDF2 from `SKAILE_SECRETS_PASSPHRASE` env var; portable across machines.\n * - `machine` — deterministic from hostname + username; least secure, last-resort fallback.\n \n The active strategy is persisted in `~/.skaile/secrets/.key-strategy`. Switching strategies\n * re-encrypts all existing secrets with the new key.\n \n @docLink packages/secrets/concepts#local-secrets-provider\n /\nexport type KeyStrategy = \"keychain\" \| \"passphrase\" \| \"machine\";\n\n// ---------------------------------------------------------------------------\n// Key derivation\n// ---------------------------------------------------------------------------\n\nfunction deriveMasterKey(passphrase: string, salt: Buffer): Buffer {\n return crypto.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);\n}\n\nfunction getMachinePassphrase(): string {\n // Deterministic but not secret -- last resort only.\n return `skaile:${os.hostname()}:${os.userInfo().username}`;\n}\n\n/* Hash a passphrase for verification (stored in .master). /\nfunction hashPassphrase(passphrase: string): string {\n return crypto.createHash(\"sha256\").update(passphrase).digest(\"hex\");\n}\n\n// ---------------------------------------------------------------------------\n// Filename hashing (injective: sha256 of ref)\n// ---------------------------------------------------------------------------\n\nfunction refToHash(ref: string): string {\n return crypto.createHash(\"sha256\").update(ref).digest(\"hex\").slice(0, 40);\n}\n\n// ---------------------------------------------------------------------------\n// Encryption / decryption\n// ---------------------------------------------------------------------------\n\nfunction encrypt(data: Uint8Array, key: Buffer): Buffer {\n const iv = crypto.randomBytes(IV_LENGTH);\n const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);\n const authTag = cipher.getAuthTag();\n // Format: [iv (12)] [authTag (16)] [ciphertext (...)]\n return Buffer.concat([iv, authTag, encrypted]);\n}\n\nfunction decrypt(blob: Buffer, key: Buffer): Buffer {\n const iv = blob.subarray(0, IV_LENGTH);\n const authTag = blob.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);\n const ciphertext = blob.subarray(IV_LENGTH + AUTH_TAG_LENGTH);\n const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });\n decipher.setAuthTag(authTag);\n return Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n}\n\n// ---------------------------------------------------------------------------\n// Provider\n// ---------------------------------------------------------------------------\n\nexport class LocalSecretsProvider implements ISecretsProvider {\n readonly id = \"local\";\n private secretsDir: string;\n private masterKey: Buffer \| null = null;\n private salt: Buffer \| null = null;\n private strategy: KeyStrategy = \"machine\";\n\n constructor(secretsDir?: string) {\n this.secretsDir = secretsDir ?? path.join(os.homedir(), \".skaile\", \"secrets\");\n }\n\n // -- Initialization --------------------------------------------------------\n\n private ensureDir(): void {\n if (!fs.existsSync(this.secretsDir)) {\n fs.mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });\n }\n }\n\n private loadOrCreateSalt(): Buffer {\n const saltPath = path.join(this.secretsDir, \".salt\");\n if (fs.existsSync(saltPath)) {\n return fs.readFileSync(saltPath);\n }\n const salt = crypto.randomBytes(SALT_LENGTH);\n fs.writeFileSync(saltPath, salt, { mode: 0o600 });\n return salt;\n }\n\n private async ensureKey(): Promise<void> {\n if (this.masterKey) return;\n\n this.ensureDir();\n this.salt = this.loadOrCreateSalt();\n\n // Determine strategy\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n if (fs.existsSync(strategyPath)) {\n this.strategy = fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n } else {\n // Auto-detect: try keychain, fall back to machine\n this.strategy = (await this.tryKeychainStrategy()) ? \"keychain\" : \"machine\";\n fs.writeFileSync(strategyPath, this.strategy, { mode: 0o600 });\n }\n\n // Derive key from strategy\n const passphrase = await this.getPassphraseForStrategy(this.strategy);\n this.masterKey = deriveMasterKey(passphrase, this.salt);\n }\n\n private async tryKeychainStrategy(): Promise<boolean> {\n try {\n // `keytar` is an optional OS-keychain native module the user installs\n // themselves; the `as string` specifier keeps it out of tsc resolution.\n const keytar = await import(\"keytar\" as string);\n let stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n if (!stored) {\n stored = crypto.randomBytes(32).toString(\"base64\");\n await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, stored);\n }\n return true;\n } catch {\n return false;\n }\n }\n\n private async getPassphraseForStrategy(strategy: KeyStrategy): Promise<string> {\n switch (strategy) {\n case \"keychain\": {\n try {\n // `keytar` is an optional OS-keychain native module the user installs\n // themselves; the `as string` specifier keeps it out of tsc resolution.\n const keytar = await import(\"keytar\" as string);\n const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);\n if (stored) return stored;\n } catch {\n // Keychain failed; fall through to machine\n }\n return getMachinePassphrase();\n }\n case \"passphrase\": {\n const envPassphrase = process.env[PASSPHRASE_ENV];\n if (envPassphrase) {\n // Verify against stored hash if it exists\n const masterPath = path.join(this.secretsDir, \".master\");\n if (fs.existsSync(masterPath)) {\n const storedHash = fs.readFileSync(masterPath, \"utf-8\").trim();\n if (hashPassphrase(envPassphrase) !== storedHash) {\n throw new SecretsError(\n `Passphrase from ${PASSPHRASE_ENV} does not match stored hash. ` +\n \"Use skaile auth set-key-strategy passphrase to reset.\",\n \"PASSPHRASE_MISMATCH\",\n );\n }\n }\n return envPassphrase;\n }\n // No env var -- hard error. Silent fallback to machine would\n // produce a different key, causing AES-GCM auth-tag failures\n // on secrets encrypted with the real passphrase.\n throw new SecretsError(\n `Strategy is \"passphrase\" but ${PASSPHRASE_ENV} is not set. ` +\n `Export it before running: export ${PASSPHRASE_ENV}='...'`,\n \"PASSPHRASE_REQUIRED\",\n );\n }\n case \"machine\":\n return getMachinePassphrase();\n default:\n return getMachinePassphrase();\n }\n }\n\n // -- Strategy management ---------------------------------------------------\n\n /\n Set the key strategy explicitly. Called by `skaile auth set-key-strategy`.\n \n When existing secrets are present, they are re-encrypted with the new key\n * to prevent data loss from key mismatch.\n /\n async setKeyStrategy(strategy: KeyStrategy, passphrase?: string): Promise<void> {\n this.ensureDir();\n\n // --- 1. Validate new strategy prerequisites -------------------------\n\n const effectivePassphrase = passphrase ?? process.env[PASSPHRASE_ENV];\n\n if (strategy === \"passphrase\") {\n if (!effectivePassphrase) {\n throw new SecretsError(\n `Passphrase required. Pass it as an argument or set ${PASSPHRASE_ENV}.`,\n \"PASSPHRASE_REQUIRED\",\n );\n }\n }\n\n if (strategy === \"keychain\") {\n const success = await this.tryKeychainStrategy();\n if (!success) {\n throw new ProviderUnavailableError(\"local\", \"OS keychain not available\");\n }\n }\n\n // --- 2. Load the OLD key under the current strategy -----------------\n // ensureKey() reads the current strategy file and derives the key\n // that was used to encrypt existing secrets. This is critical for\n // cross-process scenarios where masterKey starts as null.\n\n const encFiles = this.listEncFiles();\n if (encFiles.length > 0) {\n await this.ensureKey();\n const oldKey = this.masterKey!;\n\n // Derive the new key\n const salt = this.salt!;\n const newPassphrase =\n strategy === \"passphrase\"\n ? effectivePassphrase!\n : strategy === \"keychain\"\n ? await this.getPassphraseForStrategy(\"keychain\")\n : getMachinePassphrase();\n const newKey = deriveMasterKey(newPassphrase, salt);\n\n // Re-encrypt each secret with the new key. A single failure must abort the\n // whole switch: committing the new strategy while a secret is still under\n // the old key orphans that secret (the registry advertises a key that no\n // longer decrypts it). Collect failures and throw before the commit below,\n // leaving `.key-strategy`/`.master` — and every secret — on the old key.\n const failed: string[] = [];\n for (const encFile of encFiles) {\n const filePath = path.join(this.secretsDir, encFile);\n const blob = fs.readFileSync(filePath);\n try {\n const plaintext = decrypt(blob, oldKey);\n const reEncrypted = encrypt(plaintext, newKey);\n fs.writeFileSync(filePath, reEncrypted, { mode: 0o600 });\n } catch {\n failed.push(encFile);\n }\n }\n if (failed.length > 0) {\n throw new Error(\n `[skaile/secrets] Key-strategy switch aborted: could not re-encrypt ` +\n `${failed.length} secret(s) (${failed.join(\", \")}). The previous strategy ` +\n \"is unchanged; resolve the failing secrets before retrying.\",\n );\n }\n }\n\n // --- 3. Commit the new strategy (last write -- failure above leaves\n // the old strategy intact) ------------------------------------\n\n if (strategy === \"passphrase\") {\n const masterPath = path.join(this.secretsDir, \".master\");\n fs.writeFileSync(masterPath, hashPassphrase(effectivePassphrase!), { mode: 0o600 });\n }\n\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n fs.writeFileSync(strategyPath, strategy, { mode: 0o600 });\n this.masterKey = null;\n this.strategy = strategy;\n }\n\n getKeyStrategy(): KeyStrategy {\n const strategyPath = path.join(this.secretsDir, \".key-strategy\");\n if (fs.existsSync(strategyPath)) {\n return fs.readFileSync(strategyPath, \"utf-8\").trim() as KeyStrategy;\n }\n return \"machine\";\n }\n\n // -- File helpers ----------------------------------------------------------\n\n private encFilename(ref: string): string {\n return `${refToHash(ref)}.enc`;\n }\n\n private metaFilename(ref: string): string {\n return `${refToHash(ref)}.meta.json`;\n }\n\n private metaPath(ref: string): string {\n return path.join(this.secretsDir, this.metaFilename(ref));\n }\n\n private listEncFiles(): string[] {\n if (!fs.existsSync(this.secretsDir)) return [];\n return fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".enc\"));\n }\n\n // -- ISecretsProvider implementation ----------------------------------------\n\n async getSecret(ref: string): Promise<Uint8Array> {\n await this.ensureKey();\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n const blob = fs.readFileSync(filePath);\n const decrypted = decrypt(blob, this.masterKey!);\n\n // Update lastAccessedAt\n const metaFile = this.metaPath(ref);\n if (fs.existsSync(metaFile)) {\n try {\n const meta = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n meta.lastAccessedAt = new Date().toISOString();\n fs.writeFileSync(metaFile, JSON.stringify(meta), { mode: 0o600 });\n } catch {\n // Non-fatal\n }\n }\n\n return new Uint8Array(decrypted);\n }\n\n async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n await this.ensureKey();\n this.ensureDir();\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n const encrypted = encrypt(value, this.masterKey!);\n fs.writeFileSync(filePath, encrypted, { mode: 0o600 });\n\n // Write metadata (stores the original ref for reverse lookup)\n const now = new Date().toISOString();\n const metaFile = this.metaPath(ref);\n let existing: Record<string, unknown> = {};\n if (fs.existsSync(metaFile)) {\n try {\n existing = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n } catch {\n // Overwrite corrupt meta\n }\n }\n const meta = {\n ref,\n createdAt: existing.createdAt ?? now,\n updatedAt: now,\n lastAccessedAt: now,\n ...(opts?.metadata ? { userMeta: opts.metadata } : {}),\n ...(opts?.ttlSeconds\n ? { expiresAt: new Date(Date.now() + opts.ttlSeconds 1000).toISOString() }\n : {}),\n };\n fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });\n }\n\n async deleteSecret(ref: string): Promise<void> {\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n const metaFile = this.metaPath(ref);\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n fs.unlinkSync(filePath);\n if (fs.existsSync(metaFile)) {\n fs.unlinkSync(metaFile);\n }\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n this.ensureDir();\n // Read refs from meta files (the .enc filenames are hashes, not refs)\n const metaFiles = fs.readdirSync(this.secretsDir).filter((f) => f.endsWith(\".meta.json\"));\n let refs: string[] = [];\n for (const mf of metaFiles) {\n try {\n const meta = JSON.parse(fs.readFileSync(path.join(this.secretsDir, mf), \"utf-8\"));\n if (meta.ref) refs.push(meta.ref);\n } catch {\n // Skip corrupt meta files\n }\n }\n if (filter?.prefix) {\n refs = refs.filter((r) => r.startsWith(filter.prefix!));\n }\n if (filter?.limit) {\n refs = refs.slice(0, filter.limit);\n }\n return refs;\n }\n\n async testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n const start = Date.now();\n try {\n await this.ensureKey();\n // Write + read + delete a test secret\n const testRef = `__test_${crypto.randomBytes(4).toString(\"hex\")}`;\n const testValue = new TextEncoder().encode(\"test\");\n await this.setSecret(testRef, testValue);\n const read = await this.getSecret(testRef);\n await this.deleteSecret(testRef);\n if (new TextDecoder().decode(read) !== \"test\") {\n return { ok: false, error: \"Round-trip mismatch\" };\n }\n return { ok: true, latencyMs: Date.now() - start };\n } catch (e) {\n return {\n ok: false,\n latencyMs: Date.now() - start,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const metaFile = this.metaPath(ref);\n const filePath = path.join(this.secretsDir, this.encFilename(ref));\n if (!fs.existsSync(filePath)) {\n throw new SecretNotFoundError(ref);\n }\n if (fs.existsSync(metaFile)) {\n const raw = JSON.parse(fs.readFileSync(metaFile, \"utf-8\"));\n return {\n ref: raw.ref ?? ref,\n createdAt: new Date(raw.createdAt),\n updatedAt: new Date(raw.updatedAt),\n lastAccessedAt: raw.lastAccessedAt ? new Date(raw.lastAccessedAt) : undefined,\n owner: raw.owner,\n scopeSummary: \"local encrypted file\",\n };\n }\n // Fallback: derive from file stat\n const stat = fs.statSync(filePath);\n return {\n ref,\n createdAt: stat.birthtime,\n updatedAt: stat.mtime,\n scopeSummary: \"local encrypted file\",\n };\n }\n\n getCapabilities(): ProviderCapabilities {\n return {\n supportsRotation: false,\n supportsExpiry: false,\n supportsBatch: false,\n scopeModel: \"flat\",\n };\n }\n}\n","/*\n SecretsRouter — audit chokepoint for all secret operations.\n \n Registers {@link ISecretsProvider} implementations by id, routes credential refs by\n * prefix or via routing config, and emits {@link CredentialAccessed} events for every\n * get, set, delete, list, and metadata operation. Routing rules are evaluated top-to-bottom;\n * the first matching prefix wins and falls back to the configured default provider.\n \n @docLink packages/secrets/concepts#secrets-router\n /\n\nimport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nimport { ProviderUnavailableError } from \"@skaile/workspaces/plugins\";\n\n// ---------------------------------------------------------------------------\n// Audit event\n// ---------------------------------------------------------------------------\n\n/\n Audit event emitted by {@link SecretsRouter} after every secret operation.\n \n Delivered synchronously to all registered {@link AuditSink} functions. Errors thrown\n * by sinks are swallowed to ensure they never break the underlying secret operation.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface CredentialAccessed {\n credential_ref: string;\n operation: \"get\" \| \"set\" \| \"delete\" \| \"list\" \| \"metadata\";\n provider_id: string;\n caller_session_id?: string;\n caller_tool_call?: string;\n timestamp: Date;\n}\n\n/\n Callback function that receives {@link CredentialAccessed} audit events from {@link SecretsRouter}.\n \n Register sinks via `SecretsRouter.addSink()`. Sinks run synchronously after each operation;\n * exceptions are caught and suppressed so they cannot interrupt credential resolution.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport type AuditSink = (event: CredentialAccessed) => void;\n\n// ---------------------------------------------------------------------------\n// Routing config\n// ---------------------------------------------------------------------------\n\n/\n A single routing rule that maps a credential ref prefix to a provider.\n \n Rules in {@link SecretsRouterConfig.rules} are evaluated top-to-bottom;\n * the first rule whose `prefix` matches the start of the credential ref wins.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface RoutingRule {\n /* Prefix match on credential_ref. First match wins. /\n prefix: string;\n /* Provider id to route to. /\n provider_id: string;\n}\n\n/\n Configuration object for {@link SecretsRouter}.\n \n Specifies the default provider id used when no routing rule matches, and an optional\n * ordered list of {@link RoutingRule} entries for prefix-based routing.\n \n @docLink packages/secrets/concepts#secrets-router\n /\nexport interface SecretsRouterConfig {\n /* Default provider id when no routing rule matches. /\n default_provider: string;\n /* Ordered routing rules. Evaluated top-to-bottom; first prefix match wins. /\n rules?: RoutingRule[];\n}\n\n// ---------------------------------------------------------------------------\n// Router\n// ---------------------------------------------------------------------------\n\nexport class SecretsRouter {\n private providers = new Map<string, ISecretsProvider>();\n private config: SecretsRouterConfig;\n private sinks: AuditSink[] = [];\n\n /* Caller context for audit events (set per-request by the runner). /\n callerSessionId?: string;\n callerToolCall?: string;\n\n constructor(config: SecretsRouterConfig) {\n this.config = config;\n }\n\n // -- Provider registration ------------------------------------------------\n\n register(provider: ISecretsProvider): void {\n this.providers.set(provider.id, provider);\n }\n\n unregister(id: string): void {\n this.providers.delete(id);\n }\n\n listProviders(): string[] {\n return [...this.providers.keys()];\n }\n\n // -- Audit sinks -----------------------------------------------------------\n\n addSink(sink: AuditSink): void {\n this.sinks.push(sink);\n }\n\n private emit(ref: string, operation: CredentialAccessed[\"operation\"], providerId: string): void {\n const event: CredentialAccessed = {\n credential_ref: ref,\n operation,\n provider_id: providerId,\n caller_session_id: this.callerSessionId,\n caller_tool_call: this.callerToolCall,\n timestamp: new Date(),\n };\n for (const sink of this.sinks) {\n try {\n sink(event);\n } catch {\n // Audit sink errors must not break the secret operation.\n }\n }\n }\n\n // -- Routing ---------------------------------------------------------------\n\n private resolve(ref: string): ISecretsProvider {\n // Check routing rules first\n if (this.config.rules) {\n for (const rule of this.config.rules) {\n if (ref.startsWith(rule.prefix)) {\n const provider = this.providers.get(rule.provider_id);\n if (provider) return provider;\n }\n }\n }\n\n // Fall back to default\n const provider = this.providers.get(this.config.default_provider);\n if (!provider) {\n throw new ProviderUnavailableError(\n this.config.default_provider,\n `No provider registered for default id \"${this.config.default_provider}\"`,\n );\n }\n return provider;\n }\n\n // -- Delegated operations --------------------------------------------------\n\n async getSecret(ref: string): Promise<Uint8Array> {\n const provider = this.resolve(ref);\n this.emit(ref, \"get\", provider.id);\n return provider.getSecret(ref);\n }\n\n async setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void> {\n const provider = this.resolve(ref);\n this.emit(ref, \"set\", provider.id);\n return provider.setSecret(ref, value, opts);\n }\n\n async deleteSecret(ref: string): Promise<void> {\n const provider = this.resolve(ref);\n this.emit(ref, \"delete\", provider.id);\n return provider.deleteSecret(ref);\n }\n\n async listSecrets(filter?: ListFilter): Promise<string[]> {\n // List aggregates from the default provider only (per-provider listing\n // would require iterating all providers; deferred to Phase 3 with\n // federated catalogs).\n const provider = this.providers.get(this.config.default_provider);\n if (!provider) return [];\n this.emit(\"\", \"list\", provider.id);\n return provider.listSecrets(filter);\n }\n\n async getMetadata(ref: string): Promise<SecretMetadata> {\n const provider = this.resolve(ref);\n this.emit(ref, \"metadata\", provider.id);\n return provider.getMetadata(ref);\n }\n\n getCapabilities(providerId?: string): ProviderCapabilities \| null {\n const id = providerId ?? this.config.default_provider;\n const provider = this.providers.get(id);\n return provider?.getCapabilities() ?? null;\n }\n\n async testConnection(\n providerId?: string,\n ): Promise<{ ok: boolean; latencyMs?: number; error?: string }> {\n const id = providerId ?? this.config.default_provider;\n const provider = this.providers.get(id);\n if (!provider) {\n return { ok: false, error: `Provider \"${id}\" not registered` };\n }\n return provider.testConnection();\n }\n}\n","/** Package version of `@skaile/secrets`. */\nexport const VERSION = \"0.0.0\";\n\n// Re-export interface + errors from plugins (convenience for consumers)\nexport type {\n ISecretsProvider,\n ListFilter,\n ProviderCapabilities,\n SecretMetadata,\n SetSecretOptions,\n} from \"@skaile/workspaces/plugins\";\nexport {\n ProviderUnavailableError,\n SecretAccessDeniedError,\n SecretExpiredError,\n SecretNotFoundError,\n SecretsError,\n} from \"@skaile/workspaces/plugins\";\nexport type { CredentialLifecycleConfig, RefreshResult } from \"./lifecycle.js\";\n// Lifecycle\nexport { CredentialLifecycleService } from \"./lifecycle.js\";\nexport { EnvSecretsProvider } from \"./providers/env.js\";\nexport type { KeyStrategy } from \"./providers/local.js\";\n// Built-in providers\nexport { LocalSecretsProvider } from \"./providers/local.js\";\nexport type { AuditSink, CredentialAccessed, RoutingRule, SecretsRouterConfig } from \"./router.js\";\n// Router\nexport { SecretsRouter } from \"./router.js\";\n"]}

package/dist/{chunk-WVWX76IB.js → chunk-B5LHVPE2.js} RENAMED Viewed

@@ -1040,5 +1040,5 @@ var AssetManager = class {
 };
 export { AssetManager, parseCanonicalLockKey };
-//# sourceMappingURL=chunk-WVWX76IB.js.map
-//# sourceMappingURL=chunk-WVWX76IB.js.map
+//# sourceMappingURL=chunk-B5LHVPE2.js.map
+//# sourceMappingURL=chunk-B5LHVPE2.js.map