@wardby/cli 0.1.0

package/dist/providers/llm/pricing.js

@@ -0,0 +1,74 @@
+/**
+ * Static price + tokenizer table for the budget guardrail.
+ *
+ * Sourced from OpenAI's public pricing page at write time. Deliberately
+ * static (no pricing API call) so `priceUsd` stays synchronous and
+ * network-free — the budget math must work offline and in tests. An unknown
+ * model throws rather than silently pricing at zero, so a misconfigured
+ * agent can never bypass the budget guardrail by accident.
+ *
+ * `encoding` is here too (not just price) because it drives which
+ * `gpt-tokenizer` BPE table `countTokens` uses — every gpt-4o-and-later
+ * model uses `o200k_base`, not the older `cl100k_base` gpt-tokenizer
+ * defaults to. Keeping both in one table means a model can't be priced
+ * without also being told which tokenizer estimates its input cost.
+ *
+ * `cachedInputPerMTok` / `cacheWritePerMTok` are optional: not every model's
+ * entry carries verified cache rates. When a model has cached or
+ * cache-write tokens but no rate for them, `priceUsd` falls back to the
+ * full (non-cached) input rate — the same fail-toward-overestimate
+ * direction as the unknown-model error, never fail-toward-underestimate.
+ */
+import { computeCost } from "./pricing-core.js";
+export { computeCost } from "./pricing-core.js";
+/** Bump whenever a rate changes so durable reservations retain their original terms. */
+export const PRICING_VERSION = "2026-09-06";
+const PRICING = {
+    "gpt-4o": { encoding: "o200k_base", inputPerMTok: 2.5, cachedInputPerMTok: 1.25, outputPerMTok: 10.0 },
+    "gpt-4o-mini": { encoding: "o200k_base", inputPerMTok: 0.15, cachedInputPerMTok: 0.075, outputPerMTok: 0.6 },
+    "gpt-4.1": { encoding: "o200k_base", inputPerMTok: 2.0, cachedInputPerMTok: 0.5, outputPerMTok: 8.0 },
+    "gpt-4.1-mini": { encoding: "o200k_base", inputPerMTok: 0.4, cachedInputPerMTok: 0.1, outputPerMTok: 1.6 },
+    "gpt-4.1-nano": { encoding: "o200k_base", inputPerMTok: 0.1, cachedInputPerMTok: 0.025, outputPerMTok: 0.4 },
+    "gpt-6-astra": {
+        encoding: "o200k_base",
+        inputPerMTok: 10.0,
+        cachedInputPerMTok: 1.0,
+        cacheWritePerMTok: 12.5,
+        outputPerMTok: 50.0,
+    },
+    "gpt-5.6-sol": {
+        encoding: "o200k_base",
+        inputPerMTok: 4.0,
+        cachedInputPerMTok: 0.4,
+        cacheWritePerMTok: 5.0,
+        outputPerMTok: 20.0,
+    },
+    "gpt-5.6-terra": {
+        encoding: "o200k_base",
+        inputPerMTok: 2.0,
+        cachedInputPerMTok: 0.2,
+        cacheWritePerMTok: 2.5,
+        outputPerMTok: 12.0,
+    },
+    "gpt-5.6-luna": {
+        encoding: "o200k_base",
+        inputPerMTok: 0.2,
+        cachedInputPerMTok: 0.02,
+        cacheWritePerMTok: 0.25,
+        outputPerMTok: 1.2,
+    },
+};
+/** Looks up a model's pricing/tokenizer entry, or throws (fail closed). */
+export function getModelPricing(model) {
+    const pricing = PRICING[model];
+    if (!pricing) {
+        throw new Error(`No pricing entry for model "${model}" — refusing to price at zero. ` + `Add it to src/providers/llm/pricing.ts.`);
+    }
+    return pricing;
+}
+export function supportedModels() {
+    return Object.keys(PRICING);
+}
+export function priceUsd(model, usage) {
+    return computeCost(getModelPricing(model), usage);
+}

package/dist/providers/llm/registration.d.ts

@@ -0,0 +1,8 @@
+import type { LlmRegistration } from "./routing.js";
+export type LlmRegistrationResult = {
+    kind: "registrations";
+    registrations: LlmRegistration[];
+} | {
+    kind: "no-credentials";
+};
+export declare function resolveLlmRegistrations(env?: NodeJS.ProcessEnv): LlmRegistrationResult;

package/dist/providers/llm/registration.js

@@ -0,0 +1,39 @@
+/**
+ * Enable-by-credential decision logic for the LLM seam: which adapters to
+ * wire into RoutingLlmProvider, given environment credentials.
+ *
+ * Pure — no `fail()`/`process.exit` — so the CLI's `buildLlmProvider()` can
+ * stay a thin wrapper that translates each outcome to `fail()`, while this
+ * branching (which adapters to register) is unit-testable on its own.
+ *
+ * All three adapters register additively, purely by credential presence —
+ * OpenAI, direct Anthropic, and Bedrock-Claude can all be active in one
+ * deployment at once. An agent's `model` field (routed by RoutingLlmProvider)
+ * picks which one handles its calls; there is no exclusive global mode.
+ */
+import { OpenAiLlmProvider, openaiCredentialsPresent } from "./openai.js";
+import { supportedModels as openaiSupportedModels } from "./pricing.js";
+import { AnthropicLlmProvider, anthropicCredentialsPresent, anthropicSupportedModels } from "./anthropic.js";
+import { BedrockClaudeLlmProvider, bedrockCredentialsPresent, bedrockClaudeSupportedModels } from "./bedrock.js";
+export function resolveLlmRegistrations(env = process.env) {
+    const registrations = [];
+    if (openaiCredentialsPresent(env)) {
+        registrations.push({ provider: new OpenAiLlmProvider(env.OPENAI_API_KEY), models: openaiSupportedModels() });
+    }
+    if (anthropicCredentialsPresent(env)) {
+        registrations.push({
+            provider: new AnthropicLlmProvider(env.ANTHROPIC_API_KEY),
+            models: anthropicSupportedModels(),
+        });
+    }
+    if (bedrockCredentialsPresent(env)) {
+        registrations.push({
+            provider: new BedrockClaudeLlmProvider(env.BEDROCK_REGION ?? env.AWS_REGION),
+            models: bedrockClaudeSupportedModels(),
+        });
+    }
+    if (registrations.length === 0) {
+        return { kind: "no-credentials" };
+    }
+    return { kind: "registrations", registrations };
+}

package/dist/providers/llm/routing.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Model->provider routing. Becomes the single ProviderRegistry.llm and
+ * dispatches each call to the adapter that owns `model`, so per-agent model
+ * selection (Agent.model) selects the provider too — GPT and Claude agents
+ * run in one deployment. Unknown model / duplicate registration fail closed.
+ */
+import type { LlmMessage, LlmProvider, LlmRequest, LlmStreamEvent, LlmToolDef } from "./types.js";
+export interface LlmRegistration {
+    provider: LlmProvider;
+    models: string[];
+}
+export declare class RoutingLlmProvider implements LlmProvider {
+    private readonly byModel;
+    constructor(registrations: LlmRegistration[]);
+    listModels(): string[];
+    private resolve;
+    stream(req: LlmRequest, signal?: AbortSignal): AsyncIterable<LlmStreamEvent>;
+    countTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): Promise<number>;
+    priceUsd(model: string, usage: {
+        inputTokens: number;
+        outputTokens: number;
+        cachedInputTokens?: number;
+        cacheWriteTokens?: number;
+    }): number;
+}

package/dist/providers/llm/routing.js

@@ -0,0 +1,32 @@
+export class RoutingLlmProvider {
+    byModel = new Map();
+    constructor(registrations) {
+        for (const reg of registrations) {
+            for (const model of reg.models) {
+                if (this.byModel.has(model)) {
+                    throw new Error(`Model "${model}" is registered by more than one LLM provider — check the routing configuration.`);
+                }
+                this.byModel.set(model, reg.provider);
+            }
+        }
+    }
+    listModels() {
+        return [...this.byModel.keys()];
+    }
+    resolve(model) {
+        const provider = this.byModel.get(model);
+        if (!provider) {
+            throw new Error(`No LLM provider is registered for model "${model}". Known models: ${[...this.byModel.keys()].join(", ") || "(none)"}.`);
+        }
+        return provider;
+    }
+    stream(req, signal) {
+        return this.resolve(req.model).stream(req, signal);
+    }
+    countTokens(model, messages, tools) {
+        return this.resolve(model).countTokens(model, messages, tools);
+    }
+    priceUsd(model, usage) {
+        return this.resolve(model).priceUsd(model, usage);
+    }
+}

package/dist/providers/llm/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * LLM seam — streaming chat with tool-calling and usage accounting.
+ *
+ * The budget guardrail (wardby's differentiator) hangs off `countTokens`
+ * and `priceUsd`: the core estimates cost pre-flight and can stop a run
+ * *before* it incurs spend, not just report spend after the fact.
+ *
+ * Default adapter: OpenAiLlmProvider. Anthropic adapter: AnthropicLlmProvider.
+ * Selected per-agent by RoutingLlmProvider (Agent.model -> provider).
+ * Bedrock-hosted Claude is a reserved future adapter (shared claude-messages.ts core).
+ */
+export interface LlmMessage {
+    role: "system" | "user" | "assistant" | "tool";
+    content: string;
+    /** Set on `role: "tool"` messages to correlate with the originating call. */
+    toolCallId?: string;
+    /** Optional tool/function name (for tool results or named messages). */
+    name?: string;
+    /**
+     * Set on an `role: "assistant"` message that made tool calls. Providers
+     * require the assistant message preceding tool-result messages to
+     * replay the calls it made — omitting this on a follow-up turn breaks
+     * the conversation, since the provider can no longer correlate the
+     * `role: "tool"` results that follow it.
+     */
+    toolCalls?: {
+        id: string;
+        name: string;
+        argsJson: string;
+    }[];
+}
+export interface LlmToolDef {
+    name: string;
+    description: string;
+    /** JSON Schema for the tool's parameters. */
+    parameters: Record<string, unknown>;
+}
+export interface LlmRequest {
+    model: string;
+    messages: LlmMessage[];
+    tools?: LlmToolDef[];
+    maxTokens?: number;
+    temperature?: number;
+    stopSequences?: string[];
+}
+export interface LlmUsage {
+    /** Total input tokens, including any served from cache. */
+    inputTokens: number;
+    outputTokens: number;
+    /** Subset of `inputTokens` served from a provider-side prompt cache, if reported. */
+    cachedInputTokens?: number;
+    /** Tokens billed for writing a new prompt-cache entry, if the provider charges for it. */
+    cacheWriteTokens?: number;
+    costUsd: number;
+}
+export type LlmStreamEvent = {
+    type: "text";
+    delta: string;
+} | {
+    type: "tool_call";
+    id: string;
+    name: string;
+    argsJson: string;
+} | {
+    type: "done";
+    stopReason: string;
+    usage: LlmUsage;
+};
+export interface LlmProvider {
+    stream(req: LlmRequest, signal?: AbortSignal): AsyncIterable<LlmStreamEvent>;
+    /**
+     * Pre-flight token count for budget enforcement. `tools`, when passed,
+     * must be counted too — a provider bills the serialized tool schemas as
+     * input tokens alongside the messages, so an estimate that ignores them
+     * under-counts by however large the attached tool roster is.
+     */
+    countTokens(model: string, messages: LlmMessage[], tools?: LlmToolDef[]): Promise<number>;
+    /** Deterministic price for a given token usage (no network call). */
+    priceUsd(model: string, usage: {
+        inputTokens: number;
+        outputTokens: number;
+        cachedInputTokens?: number;
+        cacheWriteTokens?: number;
+    }): number;
+}

package/dist/providers/llm/types.js

@@ -0,0 +1,12 @@
+/**
+ * LLM seam — streaming chat with tool-calling and usage accounting.
+ *
+ * The budget guardrail (wardby's differentiator) hangs off `countTokens`
+ * and `priceUsd`: the core estimates cost pre-flight and can stop a run
+ * *before* it incurs spend, not just report spend after the fact.
+ *
+ * Default adapter: OpenAiLlmProvider. Anthropic adapter: AnthropicLlmProvider.
+ * Selected per-agent by RoutingLlmProvider (Agent.model -> provider).
+ * Bedrock-hosted Claude is a reserved future adapter (shared claude-messages.ts core).
+ */
+export {};

package/dist/providers/memory/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./postgres.js";

package/dist/providers/memory/index.js

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./postgres.js";

package/dist/providers/memory/postgres.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Postgres-backed default AgentMemory adapter, via the `AgentMemory` table.
+ * `content`/`contentTsv` are always written together in one raw statement
+ * (`contentTsv` is an `Unsupported("tsvector")` column — unreachable through
+ * Prisma Client, and deliberately not a Postgres GENERATED column; see
+ * schema.prisma). Every other operation goes through the normal Prisma
+ * Client since it never touches `contentTsv`.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { AgentMemorySearchHit, AgentMemoryStore } from "./types.js";
+export type AgentMemoryDb = Pick<PrismaClient, "agentMemory" | "$executeRaw" | "$queryRaw">;
+export declare class PostgresAgentMemory implements AgentMemoryStore {
+    private readonly db;
+    constructor(db: AgentMemoryDb);
+    get(agentId: string, key: string): Promise<string | undefined>;
+    set(agentId: string, key: string, content: string): Promise<void>;
+    list(agentId: string): Promise<string[]>;
+    search(agentId: string, query: string, limit?: number): Promise<AgentMemorySearchHit[]>;
+    delete(agentId: string, key: string): Promise<void>;
+}

package/dist/providers/memory/postgres.js

@@ -0,0 +1,72 @@
+/**
+ * Postgres-backed default AgentMemory adapter, via the `AgentMemory` table.
+ * `content`/`contentTsv` are always written together in one raw statement
+ * (`contentTsv` is an `Unsupported("tsvector")` column — unreachable through
+ * Prisma Client, and deliberately not a Postgres GENERATED column; see
+ * schema.prisma). Every other operation goes through the normal Prisma
+ * Client since it never touches `contentTsv`.
+ */
+import { MEMORY_CONTENT_MAX_BYTES, MEMORY_KEY_MAX_BYTES, MEMORY_MAX_KEYS_PER_AGENT, MEMORY_SEARCH_DEFAULT_LIMIT, MEMORY_SEARCH_MAX_LIMIT, } from "./types.js";
+function checkKey(key) {
+    if (typeof key !== "string" || Buffer.byteLength(key) < 1 || Buffer.byteLength(key) > MEMORY_KEY_MAX_BYTES) {
+        throw new Error("memory_key_limit");
+    }
+}
+function checkContent(content) {
+    if (typeof content !== "string" || Buffer.byteLength(content) > MEMORY_CONTENT_MAX_BYTES) {
+        throw new Error("memory_content_limit");
+    }
+}
+export class PostgresAgentMemory {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async get(agentId, key) {
+        checkKey(key);
+        const row = await this.db.agentMemory.findUnique({
+            where: { agentId_key: { agentId, key } },
+            select: { content: true },
+        });
+        return row?.content;
+    }
+    async set(agentId, key, content) {
+        checkKey(key);
+        checkContent(content);
+        // Single atomic statement: the INSERT...SELECT's WHERE only yields a row
+        // (so the INSERT proceeds) when the agent is under its key cap, or the
+        // key already exists (in which case ON CONFLICT overwrites regardless of
+        // the cap) — overwriting an existing key never counts against the cap.
+        const affected = await this.db.$executeRaw `
+      INSERT INTO "AgentMemory" ("agentId", "key", "content", "contentTsv", "updatedAt")
+      SELECT ${agentId}, ${key}, ${content}, to_tsvector('english', ${content}), now()
+      WHERE (SELECT count(*) FROM "AgentMemory" WHERE "agentId" = ${agentId}) < ${MEMORY_MAX_KEYS_PER_AGENT}
+         OR EXISTS (SELECT 1 FROM "AgentMemory" WHERE "agentId" = ${agentId} AND "key" = ${key})
+      ON CONFLICT ("agentId", "key")
+      DO UPDATE SET "content" = EXCLUDED."content", "contentTsv" = EXCLUDED."contentTsv", "updatedAt" = now()
+    `;
+        if (affected === 0)
+            throw new Error("memory_limit_exceeded");
+    }
+    async list(agentId) {
+        const rows = await this.db.agentMemory.findMany({
+            where: { agentId },
+            select: { key: true },
+            orderBy: { key: "asc" },
+        });
+        return rows.map((r) => r.key);
+    }
+    async search(agentId, query, limit) {
+        const cappedLimit = Math.min(Math.max(1, limit ?? MEMORY_SEARCH_DEFAULT_LIMIT), MEMORY_SEARCH_MAX_LIMIT);
+        return this.db.$queryRaw `
+      SELECT "key", "content", ts_rank("contentTsv", plainto_tsquery('english', ${query}))::float8 AS rank
+      FROM "AgentMemory"
+      WHERE "agentId" = ${agentId} AND "contentTsv" @@ plainto_tsquery('english', ${query})
+      ORDER BY rank DESC
+      LIMIT ${cappedLimit}
+    `;
+    }
+    async delete(agentId, key) {
+        await this.db.agentMemory.deleteMany({ where: { agentId, key } });
+    }
+}

package/dist/providers/memory/types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Agent memory seam — persistent, agent-controlled key/content notes,
+ * separate from the Datastore seam (`../datastore/types.ts`). Datastore is
+ * opaque per-tool JSON state a sandboxed tool body reads/writes; memory is
+ * curated free-text an agent reads/writes about itself, with its own
+ * built-in tools (`memory_get`/`memory_set`/`memory_list`/`memory_search`,
+ * see `../../core/memory-tools.ts`) rather than user-authored sandbox code.
+ */
+/** A key must fit a reasonable identifier; content is free text up to MEMORY_CONTENT_MAX_BYTES. */
+export declare const MEMORY_KEY_MAX_BYTES = 200;
+/** Bounds one entry's content — generous for free-text notes, far below the sandbox bridge's 1MiB guard. */
+export declare const MEMORY_CONTENT_MAX_BYTES: number;
+/** Caps rows per agent so a runaway loop writing unique keys every turn can't grow the table unbounded. */
+export declare const MEMORY_MAX_KEYS_PER_AGENT = 500;
+/** Default/maximum result count for `search`. */
+export declare const MEMORY_SEARCH_DEFAULT_LIMIT = 20;
+export declare const MEMORY_SEARCH_MAX_LIMIT = 50;
+export interface AgentMemorySearchHit {
+    key: string;
+    content: string;
+    rank: number;
+}
+export interface AgentMemoryStore {
+    get(agentId: string, key: string): Promise<string | undefined>;
+    /** Upserts `key`. Throws `memory_key_limit`/`memory_content_limit` over the byte bounds, or `memory_limit_exceeded` if a brand-new key would exceed MEMORY_MAX_KEYS_PER_AGENT (overwriting an existing key never counts against the cap). */
+    set(agentId: string, key: string, content: string): Promise<void>;
+    /** Lists keys only (not content), sorted, scoped to the agent. */
+    list(agentId: string): Promise<string[]>;
+    /** Full-text search over content via Postgres `ts_rank`, best matches first. */
+    search(agentId: string, query: string, limit?: number): Promise<AgentMemorySearchHit[]>;
+    delete(agentId: string, key: string): Promise<void>;
+}

package/dist/providers/memory/types.js

@@ -0,0 +1,17 @@
+/**
+ * Agent memory seam — persistent, agent-controlled key/content notes,
+ * separate from the Datastore seam (`../datastore/types.ts`). Datastore is
+ * opaque per-tool JSON state a sandboxed tool body reads/writes; memory is
+ * curated free-text an agent reads/writes about itself, with its own
+ * built-in tools (`memory_get`/`memory_set`/`memory_list`/`memory_search`,
+ * see `../../core/memory-tools.ts`) rather than user-authored sandbox code.
+ */
+/** A key must fit a reasonable identifier; content is free text up to MEMORY_CONTENT_MAX_BYTES. */
+export const MEMORY_KEY_MAX_BYTES = 200;
+/** Bounds one entry's content — generous for free-text notes, far below the sandbox bridge's 1MiB guard. */
+export const MEMORY_CONTENT_MAX_BYTES = 64 * 1024;
+/** Caps rows per agent so a runaway loop writing unique keys every turn can't grow the table unbounded. */
+export const MEMORY_MAX_KEYS_PER_AGENT = 500;
+/** Default/maximum result count for `search`. */
+export const MEMORY_SEARCH_DEFAULT_LIMIT = 20;
+export const MEMORY_SEARCH_MAX_LIMIT = 50;

package/dist/providers/secrets/app-key.d.ts

@@ -0,0 +1,8 @@
+export declare class AppKeySecretCipher {
+    private readonly key;
+    private readonly id;
+    constructor(hexKey: string);
+    keyId(): string;
+    encrypt(plaintext: string): Promise<string>;
+    decrypt(blob: string): Promise<string>;
+}

package/dist/providers/secrets/app-key.js

@@ -0,0 +1,50 @@
+/**
+ * AES-256-GCM SecretCipher adapter, keyed by a single app-wide master key
+ * (SECRET_APP_KEY, 32 bytes hex). Ciphertext is a self-describing
+ * `iv:tag:ciphertext` base64url blob — random per-call IV (never reused),
+ * auth tag verified on decrypt so a tampered ciphertext throws rather than
+ * silently returning corrupted plaintext.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+const ALGORITHM = "aes-256-gcm";
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+function b64url(buf) {
+    return buf.toString("base64url");
+}
+export class AppKeySecretCipher {
+    key;
+    id;
+    constructor(hexKey) {
+        const key = Buffer.from(hexKey, "hex");
+        if (key.length !== KEY_BYTES) {
+            throw new Error(`SECRET_APP_KEY must be ${KEY_BYTES} bytes of hex (${KEY_BYTES * 2} hex chars); got ${key.length} bytes.`);
+        }
+        this.key = key;
+        this.id = `appkey:${createHash("sha256").update(key).digest("hex").slice(0, 8)}`;
+    }
+    keyId() {
+        return this.id;
+    }
+    async encrypt(plaintext) {
+        const iv = randomBytes(IV_BYTES);
+        const cipher = createCipheriv(ALGORITHM, this.key, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return `${b64url(iv)}:${b64url(tag)}:${b64url(ciphertext)}`;
+    }
+    async decrypt(blob) {
+        const parts = blob.split(":");
+        if (parts.length !== 3) {
+            throw new Error("Malformed ciphertext blob — expected iv:tag:ciphertext.");
+        }
+        const [ivPart, tagPart, ciphertextPart] = parts;
+        const iv = Buffer.from(ivPart, "base64url");
+        const tag = Buffer.from(tagPart, "base64url");
+        const ciphertext = Buffer.from(ciphertextPart, "base64url");
+        const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+        decipher.setAuthTag(tag);
+        const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return plaintext.toString("utf8");
+    }
+}

package/dist/providers/secrets/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Secret-cipher selector — builds the adapter for the configured
+ * SECRET_CIPHER kind. `kms` is reserved (no adapter yet); selecting it
+ * fails closed with a clear error, mirroring how the config seam handles
+ * other not-yet-built kinds (e.g. bedrock in the LLM router).
+ */
+import type { ProviderConfig } from "../../config/providers.js";
+import type { SecretCipher } from "./types.js";
+export { AppKeySecretCipher } from "./app-key.js";
+export declare function buildSecretCipher(config: Pick<ProviderConfig, "secrets">, env?: NodeJS.ProcessEnv): SecretCipher;

package/dist/providers/secrets/index.js

@@ -0,0 +1,13 @@
+import { loadSecretConfig } from "../../config/providers.js";
+import { AppKeySecretCipher } from "./app-key.js";
+export { AppKeySecretCipher } from "./app-key.js";
+export function buildSecretCipher(config, env = process.env) {
+    if (config.secrets === "kms") {
+        throw new Error("SECRET_CIPHER=kms not implemented (reserved).");
+    }
+    const { appKey } = loadSecretConfig(env);
+    if (!appKey) {
+        throw new Error("SECRET_APP_KEY is not set — required by the app-key SecretCipher adapter.");
+    }
+    return new AppKeySecretCipher(appKey);
+}

package/dist/providers/secrets/transfer-envelope.d.ts

@@ -0,0 +1,12 @@
+import { type KeyObject } from "node:crypto";
+export interface TransferEnvelope {
+    v: number;
+    alg: string;
+    epk: string;
+    nonce: string;
+    ct: string;
+    tag: string;
+}
+export declare function loadTransferPrivateKey(pem: string): KeyObject;
+export declare function transferKeyIdOf(privateKey: KeyObject): string;
+export declare function decryptTransferEnvelope(env: TransferEnvelope, secretName: string, privateKey: KeyObject): string;

package/dist/providers/secrets/transfer-envelope.js

@@ -0,0 +1,35 @@
+import { createPrivateKey, createPublicKey, diffieHellman, hkdfSync, createDecipheriv, createHash, } from "node:crypto";
+const ALG = "x25519-hkdf-sha256-chacha20poly1305-v1";
+const INFO = Buffer.from("wardby-secret-transfer-v1");
+const SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex"); // X25519 SPKI DER header
+function rawFromSpki(key) {
+    return key.export({ type: "spki", format: "der" }).subarray(-32);
+}
+export function loadTransferPrivateKey(pem) {
+    const key = createPrivateKey(pem.trim());
+    if (key.asymmetricKeyType !== "x25519") {
+        throw new Error("transfer private key must be an X25519 PKCS8 private key");
+    }
+    return key;
+}
+export function transferKeyIdOf(privateKey) {
+    const pubRaw = rawFromSpki(createPublicKey(privateKey));
+    return createHash("sha256").update(pubRaw).digest("hex").slice(0, 16);
+}
+function publicFromRaw(raw) {
+    return createPublicKey({ key: Buffer.concat([SPKI_PREFIX, raw]), format: "der", type: "spki" });
+}
+export function decryptTransferEnvelope(env, secretName, privateKey) {
+    if (env.alg !== ALG)
+        throw new Error(`unsupported envelope alg: ${env.alg}`);
+    const epkRaw = Buffer.from(env.epk, "hex");
+    const shared = diffieHellman({ privateKey, publicKey: publicFromRaw(epkRaw) });
+    const recipientRaw = rawFromSpki(createPublicKey(privateKey));
+    const okm = Buffer.from(hkdfSync("sha256", shared, Buffer.concat([epkRaw, recipientRaw]), INFO, 32));
+    // Supplying the plaintext length satisfies Node's generic AEAD typing and
+    // keeps the authenticated-data call explicit for chacha20-poly1305.
+    const d = createDecipheriv("chacha20-poly1305", okm, Buffer.from(env.nonce, "hex"), { authTagLength: 16 });
+    d.setAAD(Buffer.from(secretName, "utf8"), { plaintextLength: Buffer.byteLength(env.ct, "hex") });
+    d.setAuthTag(Buffer.from(env.tag, "hex"));
+    return Buffer.concat([d.update(Buffer.from(env.ct, "hex")), d.final()]).toString("utf8");
+}

package/dist/providers/secrets/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Secrets seam — encryption of secret values at rest.
+ *
+ * wardby uses its own key and its own ciphertext format, independent of any
+ * other system. `encrypt` returns a self-describing blob (algorithm + key id +
+ * IV + ciphertext) so values can be rotated and re-encrypted without ambiguity
+ * — this is what makes a one-time migration onto wardby clean.
+ *
+ * Default adapter: AppKeySecretCipher (AES-GCM with an app master key).
+ * Native adapter:  KmsSecretCipher (envelope encryption via a KMS key).
+ */
+export interface SecretCipher {
+    /** Identifier of the active key/version, for rotation and envelope reference. */
+    keyId(): string;
+    /** Encrypt to a self-describing blob (algorithm + keyId + IV + ciphertext). */
+    encrypt(plaintext: string): Promise<string>;
+    decrypt(ciphertext: string): Promise<string>;
+}

package/dist/providers/secrets/types.js

@@ -0,0 +1,12 @@
+/**
+ * Secrets seam — encryption of secret values at rest.
+ *
+ * wardby uses its own key and its own ciphertext format, independent of any
+ * other system. `encrypt` returns a self-describing blob (algorithm + key id +
+ * IV + ciphertext) so values can be rotated and re-encrypted without ambiguity
+ * — this is what makes a one-time migration onto wardby clean.
+ *
+ * Default adapter: AppKeySecretCipher (AES-GCM with an app master key).
+ * Native adapter:  KmsSecretCipher (envelope encryption via a KMS key).
+ */
+export {};

package/dist/providers/storage/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Storage seam — object/blob storage (email attachments, run artifacts).
+ *
+ * Default adapter: LocalBlobStore (filesystem).
+ * Native adapter:  S3BlobStore (S3 or S3-compatible object storage).
+ */
+export interface BlobStore {
+    put(key: string, body: Buffer, opts?: {
+        contentType?: string;
+    }): Promise<void>;
+    get(key: string): Promise<Buffer>;
+    delete(key: string): Promise<void>;
+    /** Pre-signed URL for direct client GET/PUT without proxying through the app. */
+    signedUrl(key: string, opts: {
+        expiresSec: number;
+        method: "GET" | "PUT";
+    }): Promise<string>;
+}

package/dist/providers/storage/types.js

@@ -0,0 +1,7 @@
+/**
+ * Storage seam — object/blob storage (email attachments, run artifacts).
+ *
+ * Default adapter: LocalBlobStore (filesystem).
+ * Native adapter:  S3BlobStore (S3 or S3-compatible object storage).
+ */
+export {};