arcway 0.1.30 → 0.2.1

package/server/plugins/manifest.js

@@ -1,6 +1,4 @@
 const ID_PATTERN = /^[a-z][a-z0-9-]*$/;
-const KINDS = new Set(['core', 'feature']);
-const SCOPES = new Set(['global', 'workspace']);
 
 function assertPlainObject(value, label) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -22,18 +20,6 @@ function normalizeRequires(value) {
   return { ...value };
 }
 
-function normalizeContributes(value) {
-  if (value === undefined) return {};
-  assertPlainObject(value, 'plugin contributes');
-  return {
-    ...value,
-    tools: value.tools ?? [],
-    routes: value.routes ?? [],
-    jobs: value.jobs ?? [],
-    ui: value.ui,
-  };
-}
-
 function normalizeLifecycle(value) {
   if (value === undefined) return {};
   assertPlainObject(value, 'plugin lifecycle');
@@ -52,17 +38,34 @@ function normalizeLifecycle(value) {
 function validateManifest(rawManifest, { packageName } = {}) {
   assertPlainObject(rawManifest, 'plugin manifest');
 
+  if (rawManifest.enabled !== undefined && typeof rawManifest.enabled !== 'boolean') {
+    throw new Error('plugin enabled must be a boolean');
+  }
+
+  const { id, name, version, enabled, provides, requires, lifecycle } = rawManifest;
+  const appMetadata = { ...rawManifest };
+  for (const key of [
+    'id',
+    'name',
+    'version',
+    'defaultEnabled',
+    'enabled',
+    'provides',
+    'requires',
+    'lifecycle',
+  ]) {
+    delete appMetadata[key];
+  }
+
   const manifest = {
-    id: rawManifest.id ?? packageName,
-    name: rawManifest.name ?? rawManifest.id ?? packageName,
-    version: rawManifest.version,
-    kind: rawManifest.kind ?? 'feature',
-    scope: rawManifest.scope ?? 'workspace',
-    defaultEnabled: rawManifest.defaultEnabled === true,
-    provides: normalizeStringArray(rawManifest.provides, 'plugin provides'),
-    requires: normalizeRequires(rawManifest.requires),
-    contributes: normalizeContributes(rawManifest.contributes),
-    lifecycle: normalizeLifecycle(rawManifest.lifecycle),
+    ...appMetadata,
+    id: id ?? packageName,
+    name: name ?? id ?? packageName,
+    version,
+    enabled: enabled !== false,
+    provides: normalizeStringArray(provides, 'plugin provides'),
+    requires: normalizeRequires(requires),
+    lifecycle: normalizeLifecycle(lifecycle),
   };
 
   if (typeof manifest.id !== 'string' || !ID_PATTERN.test(manifest.id)) {
@@ -74,13 +77,6 @@ function validateManifest(rawManifest, { packageName } = {}) {
   if (typeof manifest.version !== 'string' || manifest.version === '') {
     throw new Error(`plugin ${manifest.id} version must be a non-empty string`);
   }
-  if (!KINDS.has(manifest.kind)) {
-    throw new Error(`plugin ${manifest.id} kind must be core or feature`);
-  }
-  if (!SCOPES.has(manifest.scope)) {
-    throw new Error(`plugin ${manifest.id} scope must be global or workspace`);
-  }
-
   return manifest;
 }
 

package/server/router/api-router.js

@@ -347,6 +347,10 @@ class ApiRouter {
     }
   }
 
+  async reload() {
+    return this._reload();
+  }
+
   async close() {
     if (this._mode === 'development' && this._fileWatcher) {
       this._fileWatcher.unsubscribe('routes');

package/server/router/routes.js

@@ -46,8 +46,7 @@ function prefixRoutePattern(pattern, prefix) {
   if (pattern === '/') return normalized;
   return normalized + pattern;
 }
-async function discoverRoutes(apiDir, { prefix = '', plugin } = {}) {
-  const entries = await discoverModules(apiDir, { recursive: true, label: 'route file' });
+function buildRoutesFromModules(entries, { prefix = '', plugin } = {}) {
   const routes = [];
   for (const { filePath, relativePath, module } of entries) {
     const urlPattern = prefixRoutePattern(filePathToPattern(relativePath), prefix);
@@ -84,6 +83,11 @@ async function discoverRoutes(apiDir, { prefix = '', plugin } = {}) {
   sortBySpecificity(routes);
   return routes;
 }
+
+async function discoverRoutes(apiDir, { prefix = '', plugin } = {}) {
+  const entries = await discoverModules(apiDir, { recursive: true, label: 'route file' });
+  return buildRoutesFromModules(entries, { prefix, plugin });
+}
 function matchRoute(routes, method, pathname) {
   const upperMethod = method.toUpperCase();
   const methodRoutes = routes.filter((r) => r.method === upperMethod);
@@ -106,6 +110,7 @@ function matchRoutesByPath(routes, pathname) {
 }
 export {
   compilePattern,
+  buildRoutesFromModules,
   discoverRoutes,
   filePathToPattern,
   matchPattern,

package/server/session/index.js

@@ -4,29 +4,71 @@ import { SESSION_COOKIE_MAX_AGE_SKEW } from '../constants.js';
 import { toErrorMessage } from '../helpers.js';
 import { normalizeDurationSeconds } from '../config/duration.js';
 const MIN_PASSWORD_LENGTH = 32;
-function resolveSessionConfig(config, mode) {
+
+function assertPasswordLength(password, label) {
+  if (typeof password !== 'string') return;
+  if (password.length < MIN_PASSWORD_LENGTH) {
+    throw new Error(
+      `${label} must be at least ${MIN_PASSWORD_LENGTH} characters (got ${password.length}). Short passwords produce weak encryption.`,
+    );
+  }
+}
+
+function normalizePasswordConfig(config) {
+  if (Array.isArray(config.keyring) && config.keyring.length > 0) {
+    const password = {};
+    for (const entry of config.keyring) {
+      const id = String(entry.id ?? '');
+      if (!id) throw new Error('Session keyring entries require stable ids');
+      if (!/^\d+$/.test(id)) throw new Error(`Session keyring id=${id} must be numeric`);
+      assertPasswordLength(entry.password, `Session password id=${id}`);
+      password[id] = entry.password;
+    }
+
+    const active = config.keyring.at(-1);
+    const activeId = String(active.id);
+    return {
+      password,
+      sealPassword: { [activeId]: active.password },
+      activePasswordId: activeId,
+    };
+  }
+
   if (!config.password) {
     throw new Error(
-      `Session "password" is required but was not provided (got ${config.password === void 0 ? 'undefined' : String(config.password)}). Set a password of at least 32 characters, e.g. via SESSION_SECRET env variable.`,
+      `Session "password" is required but was not provided (got ${config.password === void 0 ? 'undefined' : String(config.password)}). Set vault.masterSecret to provide a session key.`,
     );
   }
+
   if (typeof config.password === 'string') {
-    if (config.password.length < MIN_PASSWORD_LENGTH) {
-      throw new Error(
-        `Session password must be at least ${MIN_PASSWORD_LENGTH} characters (got ${config.password.length}). Short passwords produce weak encryption.`,
-      );
-    }
-  } else if (typeof config.password === 'object') {
+    assertPasswordLength(config.password, 'Session password');
+    return {
+      password: config.password,
+      sealPassword: config.password,
+      activePasswordId: null,
+    };
+  }
+
+  if (typeof config.password === 'object') {
     for (const [id, pw] of Object.entries(config.password)) {
-      if (typeof pw === 'string' && pw.length < MIN_PASSWORD_LENGTH) {
-        throw new Error(
-          `Session password id=${id} must be at least ${MIN_PASSWORD_LENGTH} characters (got ${pw.length}). Short passwords produce weak encryption.`,
-        );
-      }
+      assertPasswordLength(pw, `Session password id=${id}`);
     }
+    return {
+      password: config.password,
+      sealPassword: config.password,
+      activePasswordId: String(Math.max(...Object.keys(config.password).map(Number))),
+    };
   }
+
+  throw new Error('Session password must be a string or password map');
+}
+
+function resolveSessionConfig(config, mode) {
+  const { password, sealPassword, activePasswordId } = normalizePasswordConfig(config);
   return {
-    password: config.password,
+    password,
+    sealPassword,
+    activePasswordId,
     cookieName: config.cookieName ?? 'arcway.session',
     ttl:
       config.ttl === undefined
@@ -60,7 +102,7 @@ async function unsealSession(cookieValue, config) {
 }
 async function sealSession(data, config) {
   return sealData(data, {
-    password: config.password,
+    password: config.sealPassword ?? config.password,
     ttl: config.ttl,
   });
 }

package/server/testing/index.js

@@ -188,6 +188,7 @@ async function testBoot(options) {
     },
     mail: { send: async () => ({ accepted: [], rejected: [] }), queue: async () => {} },
     log: { debug() {}, info() {}, warn() {}, error() {} },
+    vault: app.config?.vault,
   };
   async function request(method, urlPath, opts) {
     const url = new URL(urlPath, baseUrl);

package/server/config/modules/secrets.js

@@ -1,145 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import {
-  deriveInfraSecrets,
-  encodeMasterSecret,
-  normalizeMasterSecret,
-  validateVaultKey,
-} from '../../lib/vault/secrets.js';
-
-const DEFAULT_KEY_FILE = '.build/arcway-master-secret.key';
-
-const EXPLICIT_ENV = Object.freeze({
-  session: 'SESSION_SECRET',
-  'plugin-vault': 'PLUGIN_VAULT_KEY',
-  'mcp-api': 'MCP_API_KEY',
-  'pty-api': 'PTY_API_KEY',
-  'pty-server-api': 'PTY_SERVER_API_KEY',
-});
-
-function isProduction(mode) {
-  return mode === 'production';
-}
-
-function readKeyFile(filePath) {
-  try {
-    const stat = fs.statSync(filePath);
-    if ((stat.mode & 0o077) !== 0) {
-      throw new Error('Arcway master secret keyfile permissions must be 0600');
-    }
-    return fs.readFileSync(filePath, 'utf8').trim();
-  } catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
-  }
-}
-
-function createDevKeyFile(filePath) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const encoded = encodeMasterSecret();
-
-  try {
-    const fd = fs.openSync(
-      filePath,
-      fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY,
-      0o600,
-    );
-    try {
-      fs.writeFileSync(fd, `${encoded}\n`, 'utf8');
-    } finally {
-      fs.closeSync(fd);
-    }
-    return encoded;
-  } catch (error) {
-    if (error.code === 'EEXIST') return readKeyFile(filePath);
-    throw error;
-  }
-}
-
-function loadMasterSecret(rawSecrets, { rootDir, mode, env }) {
-  const configured = rawSecrets.master ?? env.ARCWAY_MASTER_SECRET;
-  if (configured) return { value: configured, source: 'config' };
-
-  if (isProduction(mode)) {
-    throw new Error(
-      'ARCWAY_MASTER_SECRET is required when arcway.config secrets are enabled in production',
-    );
-  }
-
-  const keyFile = path.resolve(rootDir, rawSecrets.keyFile ?? DEFAULT_KEY_FILE);
-  const existing = readKeyFile(keyFile);
-  if (existing) return { value: existing, source: 'keyfile', keyFile };
-
-  return { value: createDevKeyFile(keyFile), source: 'generated-keyfile', keyFile };
-}
-
-function explicitValue(name, rawSecrets, env) {
-  const explicit = rawSecrets.explicit?.[name];
-  if (explicit !== undefined && explicit !== null && explicit !== '') return explicit;
-
-  const envName = EXPLICIT_ENV[name];
-  const fromEnv = envName ? env[envName] : undefined;
-  return fromEnv || undefined;
-}
-
-function validateExplicit(name, value) {
-  if (name === 'plugin-vault') return validateVaultKey(value);
-  return String(value);
-}
-
-function resolve(config, { rootDir, mode } = {}) {
-  if (!config.secrets) return config;
-
-  const env = config.secrets.env ?? process.env;
-  const rawSecrets = config.secrets;
-  const master = loadMasterSecret(rawSecrets, { rootDir, mode, env });
-  normalizeMasterSecret(master.value);
-
-  const derived = deriveInfraSecrets(master.value);
-  const values = { ...derived };
-  const explicit = {};
-  const previousValues = {};
-
-  const previousMaster = rawSecrets.previous ?? env.ARCWAY_MASTER_SECRET_PREVIOUS;
-  if (previousMaster) {
-    normalizeMasterSecret(previousMaster, 'Previous Arcway master secret');
-    Object.assign(previousValues, deriveInfraSecrets(previousMaster));
-  }
-
-  for (const name of Object.keys(EXPLICIT_ENV)) {
-    const value = explicitValue(name, rawSecrets, env);
-    if (!value) continue;
-
-    explicit[name] = validateExplicit(name, value);
-    values[name] = explicit[name];
-    if (derived[name] !== explicit[name]) {
-      previousValues[name] = explicit[name];
-    }
-  }
-
-  const vapidPublic = rawSecrets.explicit?.vapidPublic ?? env.VAPID_PUBLIC_KEY;
-  const vapidPrivate = rawSecrets.explicit?.vapidPrivate ?? env.VAPID_PRIVATE_KEY;
-  if (vapidPublic || vapidPrivate) {
-    if (!vapidPublic || !vapidPrivate) {
-      throw new Error('VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY must be provided together');
-    }
-    explicit.vapid = { publicKey: String(vapidPublic), privateKey: String(vapidPrivate) };
-    values.vapid = explicit.vapid;
-    previousValues.vapid = explicit.vapid;
-  }
-
-  return {
-    ...config,
-    secrets: {
-      enabled: true,
-      keyFile: master.keyFile,
-      source: master.source,
-      values,
-      derived,
-      explicit,
-      previousValues,
-    },
-  };
-}
-
-export default resolve;