@vantageos/agent-engine 0.1.0-alpha.8 → 0.3.0-alpha.1

package/dist/component/lib/auth.js

@@ -1,37 +1,11 @@
-// Trust model (CORRECTIF BLOQUANT, VP k1741evjzm72rj91tkcbdhpskx8ah35a):
-// Convex does NOT propagate the calling app's `ctx.auth` identity across a
-// component boundary -- this is a platform isolation guarantee, not a
-// choice this component makes (convex-test: "Auth doesn't propagate across
-// component boundaries"). A handler inside this component can therefore
-// NEVER read `ctx.auth.getUserIdentity()` and expect it to reflect the
-// consumer app's end user -- there is no such identity to read here.
-//
-// The consumer app has ALREADY authenticated its user and resolved their
-// orgId on ITS OWN side (e.g. Clerk org claim, read in the consumer's own
-// `ctx.auth`) before ever calling into this component. `orgId` is passed
-// as an explicit argument on every public function in this component.
-//
-// What does NOT change: this component still derives NOTHING from the
-// client beyond what the consumer's public API surface exposes, still
-// denies by default, and `orgId` is still the first field of every index
-// and is still enforced on every document read via `assertSameOrg` below
-// -- a caller-supplied `orgId` can never see another org's rows. The
-// isolation boundary moved from "component reads ctx.auth" (impossible
-// across a component boundary) to "component enforces the orgId the
-// consumer already vouches for"; the boundary itself -- deny by default,
-// orgId first, no cross-org reads -- is unchanged.
 export function requireOrgId(orgId) {
     if (!orgId || typeof orgId !== "string" || orgId.trim().length === 0) {
         throw new Error("Unauthenticated: caller did not supply a non-empty orgId");
     }
     return orgId;
 }
-// Throws unless the document's orgId matches the caller-supplied orgId.
-// Use on every read/write of a document fetched by _id, since db.get()
-// does not filter by index.
 export function assertSameOrg(callerOrgId, doc, notFoundMessage) {
     if (!doc || doc.orgId !== callerOrgId) {
-        // Same error for "not found" and "cross-org" -- do not leak existence.
         throw new Error(notFoundMessage);
     }
 }

package/dist/component/lib/connectionSecret.d.ts

@@ -0,0 +1,5 @@
+export interface EncryptedSecret {
+    ciphertextBase64: string;
+    ivBase64: string;
+}
+export declare function encryptSecret(plaintext: string, encryptionKeyBase64: string): Promise<EncryptedSecret>;

package/dist/component/lib/connectionSecret.js

@@ -0,0 +1,32 @@
+function bytesToBase64(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+export async function encryptSecret(plaintext, encryptionKeyBase64) {
+    if (plaintext.length === 0) {
+        throw new Error("Validation: secret plaintext must not be empty");
+    }
+    if (!encryptionKeyBase64 || encryptionKeyBase64.trim().length === 0) {
+        throw new Error("Validation: encryptionKeyBase64 must not be empty -- caller must supply a key, this component never reads one from process.env");
+    }
+    const keyBytes = base64ToBytes(encryptionKeyBase64);
+    if (keyBytes.length !== 32) {
+        throw new Error(`Validation: encryptionKeyBase64 must decode to exactly 32 bytes (AES-256), got ${keyBytes.length}`);
+    }
+    const key = await crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["encrypt"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
+    return {
+        ciphertextBase64: bytesToBase64(new Uint8Array(ciphertext)),
+        ivBase64: bytesToBase64(iv),
+    };
+}