atabey-shared 0.0.36 → 0.1.0-beta.0

package/dist/secrets.js

@@ -0,0 +1,371 @@
+/**
+ * Secret Management & Leak Guard (Phase 1.5)
+ *
+ * Provides:
+ *   1. Encrypted local secret vault (.atabey/secrets.vault.json) using AES-256-GCM
+ *      with per-secret random salt (HKDF-SHA256) and 96-bit IV.
+ *   2. Subprocess environment scrubber (strips sensitive keys before spawning child processes).
+ *   3. Secret leak scanner (detects API keys, cloud credentials, private keys, and vault values).
+ */
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "./storage.js";
+/** Env var names or patterns that must never leak into untrusted subprocesses. */
+const SENSITIVE_ENV_PATTERNS = [
+    /_KEY$/i,
+    /_KEYS$/i,
+    /_SECRET/i,
+    /_TOKEN$/i,
+    /_PASSWORD$/i,
+    /_PASSWD$/i,
+    /(^|_)PWD$/i,
+    /^PGPASSWORD$/i,
+    /_CREDENTIAL/i,
+    /_PRIVATE/i,
+    /_PASSPHRASE$/i,
+    /ACCESS_KEY/i,
+    /_APIKEY$/i,
+    /_DSN$/i,
+    /(^|_)AUTH$/i,
+    /_SALT$/i,
+    /(^|_)SECRETKEY/i,
+    /^ATABEY_AUDIT_HMAC_KEY$/i,
+    /^ATABEY_MASTER_KEY$/i,
+    /^MCP_AUTH_TOKEN$/i,
+    /^MCP_AUTH_USERS$/i,
+    /^DATABASE_URL$/i,
+    /^REDIS_URL$/i,
+    /^OPENAI_API_KEY$/i,
+    /^ANTHROPIC_API_KEY$/i,
+    /^GEMINI_API_KEY$/i,
+    /^GOOGLE_API_KEY$/i,
+    /^AWS_SECRET_ACCESS_KEY$/i,
+    /^AWS_SESSION_TOKEN$/i,
+    /^GITHUB_TOKEN$/i,
+    /^GH_TOKEN$/i,
+    /^GITLAB_TOKEN$/i,
+    /^NPM_TOKEN$/i,
+    /^SLACK_BOT_TOKEN$/i,
+    /^STRIPE_SECRET_KEY$/i,
+];
+const SECRET_LEAK_PATTERNS = [
+    {
+        id: "aws-access-key",
+        description: "AWS Access Key ID",
+        regex: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        id: "github-pat",
+        description: "GitHub Personal Access Token",
+        regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}\b|\bgithub_pat_[A-Za-z0-9_]{80,255}\b/g,
+    },
+    {
+        id: "openai-anthropic-key",
+        description: "OpenAI / Anthropic API Key",
+        regex: /\bsk-(?:proj-|ant-api\d{2}-|live-|test-)?[A-Za-z0-9_-]{20,200}\b/g,
+    },
+    {
+        id: "google-api-key",
+        description: "Google Cloud / Gemini API Key",
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    },
+    {
+        id: "slack-token",
+        description: "Slack API Token",
+        regex: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+    },
+    {
+        id: "private-key-pem",
+        description: "PEM Private Key Block",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,
+    },
+    {
+        id: "stripe-secret",
+        description: "Stripe Live/Test Secret Key",
+        regex: /\b(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99}\b/g,
+    },
+];
+function deriveSubkey(masterKey, salt) {
+    return Buffer.from(crypto.hkdfSync("sha256", masterKey, salt, Buffer.from("atabey-vault-v1", "utf8"), 32));
+}
+function redactPreview(match) {
+    if (match.length <= 8)
+        return "***";
+    return `${match.slice(0, 4)}...${match.slice(-3)}`;
+}
+export class SecretManager {
+    static resolveVaultDir(customDir) {
+        if (customDir)
+            return customDir;
+        const envDir = process.env.ATABEY_TEST_DIR || process.env.ATABEY_FRAMEWORK_DIR;
+        if (envDir && envDir.trim())
+            return envDir.trim();
+        return resolveFrameworkDir();
+    }
+    static resolveMasterKey(vaultDir) {
+        const envKey = process.env.ATABEY_MASTER_KEY?.trim();
+        if (envKey) {
+            return crypto.createHash("sha256").update(envKey, "utf8").digest();
+        }
+        const keyPath = path.join(vaultDir, "master.key");
+        if (fs.existsSync(keyPath)) {
+            const raw = fs.readFileSync(keyPath);
+            if (raw.length === 32)
+                return raw;
+            return crypto.createHash("sha256").update(raw).digest();
+        }
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const generated = crypto.randomBytes(32);
+        fs.writeFileSync(keyPath, generated, { mode: 0o600 });
+        return generated;
+    }
+    static vaultFilePath(vaultDir) {
+        return path.join(vaultDir, "secrets.vault.json");
+    }
+    static readVault(vaultDir) {
+        const filePath = this.vaultFilePath(vaultDir);
+        if (!fs.existsSync(filePath)) {
+            return { version: 1, entries: {} };
+        }
+        const raw = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        if (!raw || raw.version !== 1 || typeof raw.entries !== "object" || raw.entries === null) {
+            throw new Error("Invalid or unsupported secrets.vault.json format.");
+        }
+        return raw;
+    }
+    static writeVault(vaultDir, vault) {
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const filePath = this.vaultFilePath(vaultDir);
+        const tmpPath = `${filePath}.tmp.${process.pid}`;
+        fs.writeFileSync(tmpPath, JSON.stringify(vault, null, 2), { mode: 0o600 });
+        fs.renameSync(tmpPath, filePath);
+    }
+    /**
+     * Encrypt and store a secret in the local AES-256-GCM vault.
+     */
+    static setSecret(name, value, options = {}) {
+        const keyName = name.trim();
+        if (!keyName || !/^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/.test(keyName)) {
+            throw new Error(`Invalid secret name "${name}". Use alphanumeric, '_', '.', or '-' characters.`);
+        }
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const masterKey = this.resolveMasterKey(vaultDir);
+        const salt = crypto.randomBytes(16);
+        const iv = crypto.randomBytes(12);
+        const subkey = deriveSubkey(masterKey, salt);
+        const cipher = crypto.createCipheriv("aes-256-gcm", subkey, iv);
+        cipher.setAAD(Buffer.from(keyName, "utf8"));
+        const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        const vault = this.readVault(vaultDir);
+        const now = new Date().toISOString();
+        const existing = vault.entries[keyName];
+        vault.entries[keyName] = {
+            salt: salt.toString("base64"),
+            iv: iv.toString("base64"),
+            tag: tag.toString("base64"),
+            ciphertext: encrypted.toString("base64"),
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+            description: options.description ?? existing?.description,
+        };
+        this.writeVault(vaultDir, vault);
+    }
+    /**
+     * Retrieve and decrypt a secret by name.
+     * Checks process.env[name] fallback only when allowEnvFallback is true.
+     */
+    static getSecret(name, options = {}) {
+        const keyName = name.trim();
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        const entry = vault.entries[keyName];
+        if (!entry) {
+            if (options.allowEnvFallback && process.env[keyName] !== undefined) {
+                return process.env[keyName] ?? null;
+            }
+            return null;
+        }
+        const masterKey = this.resolveMasterKey(vaultDir);
+        const salt = Buffer.from(entry.salt, "base64");
+        const iv = Buffer.from(entry.iv, "base64");
+        const tag = Buffer.from(entry.tag, "base64");
+        const ciphertext = Buffer.from(entry.ciphertext, "base64");
+        const subkey = deriveSubkey(masterKey, salt);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", subkey, iv);
+        decipher.setAAD(Buffer.from(keyName, "utf8"));
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString("utf8");
+    }
+    /**
+     * Delete a secret from the vault.
+     */
+    static deleteSecret(name, options = {}) {
+        const keyName = name.trim();
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        if (!(keyName in vault.entries))
+            return false;
+        delete vault.entries[keyName];
+        this.writeVault(vaultDir, vault);
+        return true;
+    }
+    /**
+     * List stored secret metadata without exposing plaintext values.
+     */
+    static listSecrets(options = {}) {
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        const vault = this.readVault(vaultDir);
+        return Object.entries(vault.entries).map(([name, entry]) => ({
+            name,
+            createdAt: entry.createdAt,
+            updatedAt: entry.updatedAt,
+            description: entry.description,
+        }));
+    }
+    /**
+     * Re-encrypt all vault entries under a new 32-byte master key.
+     *
+     * Safe ordering: decrypt everything first, build the new vault in memory,
+     * then atomically swap. The previous key is kept as `master.key.bak` for
+     * the duration of the swap and restored on failure, so a mid-rotation error
+     * cannot make the vault permanently undecryptable.
+     */
+    static rotateMasterKey(newKeyMaterial, options = {}) {
+        const vaultDir = this.resolveVaultDir(options.vaultDir);
+        if (process.env.ATABEY_MASTER_KEY?.trim()) {
+            throw new Error("[VAULT] ATABEY_MASTER_KEY is authoritative; file-based rotation is disabled while it is set. " +
+                "Rotate by changing ATABEY_MASTER_KEY and re-running `atabey secrets set` for each secret.");
+        }
+        const vault = this.readVault(vaultDir);
+        const names = Object.keys(vault.entries);
+        if (names.length === 0)
+            return 0;
+        // 1. Decrypt everything with the CURRENT key (no writes yet).
+        const decrypted = names.map((name) => {
+            const value = this.getSecret(name, { vaultDir });
+            if (value === null) {
+                throw new Error(`Failed to decrypt secret "${name}" during key rotation.`);
+            }
+            return {
+                name,
+                value,
+                description: vault.entries[name].description,
+                createdAt: vault.entries[name].createdAt,
+            };
+        });
+        const newMasterKey = typeof newKeyMaterial === "string"
+            ? crypto.createHash("sha256").update(newKeyMaterial, "utf8").digest()
+            : newKeyMaterial.length === 32
+                ? Buffer.from(newKeyMaterial)
+                : crypto.createHash("sha256").update(newKeyMaterial).digest();
+        // 2. Build the new vault in memory, encrypted with the new key.
+        const newEntries = {};
+        const now = new Date().toISOString();
+        for (const item of decrypted) {
+            const salt = crypto.randomBytes(16);
+            const iv = crypto.randomBytes(12);
+            const subkey = deriveSubkey(newMasterKey, salt);
+            const cipher = crypto.createCipheriv("aes-256-gcm", subkey, iv);
+            cipher.setAAD(Buffer.from(item.name, "utf8"));
+            const encrypted = Buffer.concat([cipher.update(item.value, "utf8"), cipher.final()]);
+            newEntries[item.name] = {
+                salt: salt.toString("base64"),
+                iv: iv.toString("base64"),
+                tag: cipher.getAuthTag().toString("base64"),
+                ciphertext: encrypted.toString("base64"),
+                createdAt: item.createdAt,
+                updatedAt: now,
+                description: item.description,
+            };
+        }
+        // 3. Atomically swap key + vault with rollback protection.
+        fs.mkdirSync(vaultDir, { recursive: true });
+        const keyPath = path.join(vaultDir, "master.key");
+        const backupPath = `${keyPath}.bak`;
+        const hadKey = fs.existsSync(keyPath);
+        const oldKey = hadKey ? fs.readFileSync(keyPath) : null;
+        try {
+            if (oldKey)
+                fs.writeFileSync(backupPath, oldKey, { mode: 0o600 });
+            fs.writeFileSync(keyPath, newMasterKey, { mode: 0o600 });
+            this.writeVault(vaultDir, { version: 1, entries: newEntries });
+            if (fs.existsSync(backupPath))
+                fs.unlinkSync(backupPath);
+        }
+        catch (err) {
+            // Restore the previous key so the (unchanged) old vault stays readable.
+            try {
+                if (oldKey)
+                    fs.writeFileSync(keyPath, oldKey, { mode: 0o600 });
+                else if (fs.existsSync(keyPath))
+                    fs.unlinkSync(keyPath);
+                if (fs.existsSync(backupPath))
+                    fs.unlinkSync(backupPath);
+            }
+            catch {
+                /* best-effort rollback */
+            }
+            throw err;
+        }
+        return decrypted.length;
+    }
+}
+/**
+ * Scrub sensitive credentials from an environment object before passing to a child process.
+ */
+export function scrubEnvForSubprocess(env = process.env, extraAllowedKeys = []) {
+    const allowed = new Set(extraAllowedKeys.map((k) => k.toUpperCase()));
+    const clean = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (allowed.has(key.toUpperCase())) {
+            clean[key] = value;
+            continue;
+        }
+        const isSensitive = SENSITIVE_ENV_PATTERNS.some((re) => re.test(key));
+        if (!isSensitive) {
+            clean[key] = value;
+        }
+    }
+    return clean;
+}
+/**
+ * Scan arbitrary text (command output, file content, tool arguments) for leaked secrets.
+ */
+export function scanForSecrets(text) {
+    if (!text)
+        return [];
+    const findings = [];
+    for (const pattern of SECRET_LEAK_PATTERNS) {
+        pattern.regex.lastIndex = 0;
+        let match;
+        while ((match = pattern.regex.exec(text)) !== null) {
+            findings.push({
+                ruleId: pattern.id,
+                description: pattern.description,
+                matchPreview: redactPreview(match[0]),
+                index: match.index,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Redact leaked secrets from text before it is returned to an AI/LLM.
+ * Complements PII masking with cloud-credential/private-key patterns.
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const pattern of SECRET_LEAK_PATTERNS) {
+        const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
+        out = out.replace(new RegExp(pattern.regex.source, flags), `[REDACTED:${pattern.id}]`);
+    }
+    return out;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAsCnD,kFAAkF;AAClF,MAAM,sBAAsB,GAAa;IACrC,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,aAAa;IACb,WAAW;IACX,YAAY;IACZ,eAAe;IACf,cAAc;IACd,WAAW;IACX,eAAe;IACf,aAAa;IACb,WAAW;IACX,QAAQ;IACR,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,sBAAsB;IACtB,iBAAiB;IACjB,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,sBAAsB;CACzB,CAAC;AAQF,MAAM,oBAAoB,GAAwB;IAC9C;QACI,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,mBAAmB;QAChC,KAAK,EAAE,0CAA0C;KACpD;IACD;QACI,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,8BAA8B;QAC3C,KAAK,EAAE,sFAAsF;KAChG;IACD;QACI,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,4BAA4B;QACzC,KAAK,EAAE,mEAAmE;KAC7E;IACD;QACI,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,+BAA+B;QAC5C,KAAK,EAAE,4BAA4B;KACtC;IACD;QACI,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,iBAAiB;QAC9B,KAAK,EAAE,wDAAwD;KAClE;IACD;QACI,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,oEAAoE;KAC9E;IACD;QACI,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,6BAA6B;QAC1C,KAAK,EAAE,iDAAiD;KAC3D;CACJ,CAAC;AAEF,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,IAAI,CACd,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CACzF,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,aAAa;IACd,MAAM,CAAC,eAAe,CAAC,SAAkB;QAC7C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC/E,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,mBAAmB,EAAE,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,QAAgB;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,QAAgB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACrD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAc,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,QAAgB,EAAE,KAAgB;QACxD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CACnB,IAAY,EACZ,KAAa,EACb,UAAuD,EAAE;QAEzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,mDAAmD,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YACrB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;SAC5D,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,SAAS,CACnB,IAAY,EACZ,UAA6D,EAAE;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,UAAiC,EAAE;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,UAAiC,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SACjC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,eAAe,CAAC,cAA+B,EAAE,UAAiC,EAAE;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACX,+FAA+F;gBAC/F,2FAA2F,CAC9F,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEjC,8DAA8D;QAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,wBAAwB,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO;gBACH,IAAI;gBACJ,KAAK;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW;gBAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS;aAC3C,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GACd,OAAO,cAAc,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE;YACrE,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,EAAE;gBAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC7B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;QAExE,gEAAgE;QAChE,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrF,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACpB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,GAAG;gBACd,WAAW,EAAE,IAAI,CAAC,WAAW;aAChC,CAAC;QACN,CAAC;QAED,2DAA2D;QAC3D,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,IAAI,CAAC;YACD,IAAI,MAAM;gBAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,IAAI,CAAC;gBACD,IAAI,MAAM;oBAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACL,0BAA0B;YAC9B,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC;IAC5B,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAAyB,OAAO,CAAC,GAAG,EACpC,mBAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAsB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,SAAS;QACb,CAAC;QACD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,OAAO,CAAC,EAAE;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;aACrB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAClG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,aAAa,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/storage.d.ts

@@ -1,4 +1,6 @@
 import Database from "better-sqlite3";
+import type { ApiEndpoint } from "./api-catalog.js";
+import { type BackupResult, type IntegrityCheckResult } from "./migrations.js";
 import { AgentID, LogID, MessageID, TaskID, TraceID } from "./types.js";
 export interface AgentRow {
     name: AgentID;
@@ -264,10 +266,75 @@ export declare class AtabeyStorage {
         cooldownUntil: number;
     }>;
     static clearAllDiscipline(): void;
+    static recordDisciplineCall(agent: string, tool: string, timestamp: number, argsSize: number): void;
+    static getRecentDisciplineCalls(agent: string, sinceTs: number): Array<{
+        tool: string;
+        timestamp: number;
+        argsSize: number;
+    }>;
+    static pruneDisciplineCalls(beforeTs: number): void;
+    static clearDisciplineCalls(agent?: string): void;
+    static getCodeFileHash(filePath: string): string | null;
+    static upsertCodeFile(filePath: string, hash: string): void;
+    static replaceCodeSymbols(filePath: string, symbols: Array<{
+        name: string;
+        kind: string;
+        startLine: number;
+        endLine: number;
+        signature: string;
+        exported: boolean;
+    }>): void;
+    static replaceCodeImports(filePath: string, specifiers: string[]): void;
+    static deleteCodeFile(filePath: string): void;
+    static getAllCodeFilePaths(): string[];
+    static searchCodeSymbols(query: string, limit?: number): Array<{
+        file: string;
+        name: string;
+        kind: string;
+        startLine: number;
+        endLine: number;
+        signature: string;
+        exported: boolean;
+    }>;
+    static getCodeGraphStats(): {
+        files: number;
+        symbols: number;
+        imports: number;
+    };
+    static clearCodeGraph(): void;
     static checkIntegrity(): {
         ok: boolean;
         message: string;
     };
+    static verifyDatabaseIntegrity(mode?: "quick" | "full"): IntegrityCheckResult;
+    static getMigrationStatus(): {
+        currentVersion: number;
+        applied: import("./migrations.js").AppliedMigration[];
+        pending: Array<{
+            version: number;
+            name: string;
+        }>;
+    };
+    static backup(destinationPath?: string): BackupResult;
+    static restore(backupPath: string, targetDbPath?: string): {
+        restoredPath: string;
+        sha256: string;
+        schemaVersion: number;
+    };
+    static saveApiEndpoint(endpoint: ApiEndpoint): void;
+    static getApiEndpoints(filter?: {
+        tag?: string;
+        method?: string;
+        search?: string;
+    }): ApiEndpoint[];
+    static findApiEndpoint(pathQuery: string, method?: string): ApiEndpoint[];
+    static deleteApiEndpoint(method: string, path: string): boolean;
+    /** Replace the whole catalog with a fresh scan; returns upserted/deleted counts. */
+    static replaceApiCatalog(endpoints: ApiEndpoint[]): {
+        upserted: number;
+        deleted: number;
+    };
+    private static rowToApiEndpoint;
     static reset(): void;
 }
 /** Canonical alias */