studiograph 1.3.48-next.13 → 1.3.48-next.131

package/dist/core/secrets/importer.js

@@ -0,0 +1,319 @@
+/**
+ * First-run importer — Phase 6 of the secrets refactor.
+ *
+ * Walks the Key Registry and seeds the encrypted store from whatever
+ * plaintext legacy files exist on disk:
+ *
+ *   ~/.studiograph/user.json                — workspace settings & secrets
+ *   ~/.studiograph/auth.json                — GitHub PAT (bootstrap class, skipped)
+ *   ~/.studiograph/connectors/*.json        — connector secrets
+ *   <workspace>/.studiograph/workspace.json — workspace + r2 fields
+ *
+ * Plus the running process environment for any registry entry whose
+ * `envAliases` matches a set `process.env.*`. Env values are mirrored
+ * into the store but NEVER overwrite an existing row — they remain the
+ * runtime source of truth via the resolver's precedence chain. The
+ * import is purely a "warm the store" pass so the read-flip doesn't
+ * see empty slots on first boot.
+ *
+ * Idempotency: a `meta.imported_legacy_at` row gates the whole pass.
+ * Once set, the importer is a no-op until the row is cleared
+ * (operationally: by deleting it via the SQLite CLI, or by burning the
+ * secrets.db file).
+ *
+ * Conflict rule: never overwrites a key already present in the store.
+ * Importer fills empty slots only. This means the store ALWAYS wins
+ * over a legacy file — the operator may have already used the API to
+ * set a value before the importer ran (race during a redeploy that
+ * brought legacy files along), and we must not regress that write.
+ *
+ * Failure handling: per-source failures (parse errors, missing files)
+ * are logged and continued. The whole pass succeeds even if some
+ * sources are missing — the goal is to copy what's there, not enforce
+ * that everything is there.
+ *
+ * After the scope-collapse refactor, the store is single-tier — the
+ * process IS the workspace. The importer no longer routes writes
+ * through a scope dimension.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { REGISTRY, getKeyDef, resolveConnectorKeyDef } from './registry.js';
+import { getSecretStore, hasSecretStore } from './index.js';
+const IMPORTER_ACTOR = { type: 'system', systemId: 'importer' };
+/**
+ * `$ENV_VAR` placeholder values must not be mirrored — see dual-write.ts
+ * for the rationale (they're a sanitization marker, not a credential).
+ */
+function looksLikeEnvPlaceholder(s) {
+    return typeof s === 'string' && /^\$[A-Z_][A-Z0-9_]*$/.test(s);
+}
+function isNonEmptyString(v) {
+    return typeof v === 'string' && v.length > 0;
+}
+function readPath(obj, path) {
+    if (!obj || typeof obj !== 'object')
+        return undefined;
+    const parts = path.split('.');
+    let cur = obj;
+    for (const p of parts) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[p];
+    }
+    return cur;
+}
+function isStoreManaged(c) {
+    return c === 'workspace-secret' || c === 'workspace-setting';
+}
+/**
+ * Whether the importer has already run against this store. Operationally
+ * checked via the `meta` table — a single row keyed `imported_legacy_at`.
+ */
+function hasRunBefore(store) {
+    const row = store.db
+        .prepare("SELECT value FROM meta WHERE key='imported_legacy_at'")
+        .get();
+    return !!row?.value;
+}
+function markImported(store) {
+    store.db
+        .prepare("INSERT INTO meta (key, value) VALUES ('imported_legacy_at', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value")
+        .run(String(Date.now()));
+}
+/**
+ * Decide whether a slot is already occupied (so we should skip the
+ * importer write). For settings we use `get()` returning undefined as
+ * "empty"; for secrets we use `describe()` returning undefined.
+ *
+ * Note: settings can legally store `null` as a JSON value — if a future
+ * caller chose to model "explicitly unset" with `null`, our "undefined
+ * means empty" rule would incorrectly let the importer overwrite. No
+ * registry entry uses null defaults today, so this is fine; flagged as
+ * a future hazard.
+ */
+function slotEmpty(store, key, isSecret) {
+    if (isSecret) {
+        return store.describe(key) === undefined;
+    }
+    return store.get(key) === undefined;
+}
+async function writeOne(store, def, value, result) {
+    if (value === undefined || value === null || value === '')
+        return;
+    if (looksLikeEnvPlaceholder(value))
+        return;
+    const isSecret = def.classification.endsWith('-secret');
+    if (!slotEmpty(store, def.name, isSecret))
+        return;
+    if (isSecret) {
+        if (!isNonEmptyString(value))
+            return;
+        await store.set({ key: def.name, value }, IMPORTER_ACTOR);
+        result.secrets++;
+        return;
+    }
+    await store.set({ key: def.name, value }, IMPORTER_ACTOR);
+    result.settings++;
+}
+async function importFromUserJson(store, homePath, result) {
+    const path = join(homePath, '.studiograph', 'user.json');
+    if (!existsSync(path))
+        return;
+    result.sources.push(path);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.warn(`[secrets] importer: failed to parse ${path}: ${err instanceof Error ? err.message : err}`);
+        return;
+    }
+    for (const def of REGISTRY) {
+        if (def.migrationSource?.file !== 'user.json')
+            continue;
+        if (!isStoreManaged(def.classification))
+            continue; // bootstrap / user-* — not the store's job.
+        const value = readPath(parsed, def.migrationSource.path);
+        await writeOne(store, def, value, result);
+    }
+}
+async function importFromConnectors(store, homePath, result) {
+    // Connector configs live in TWO locations:
+    //   ~/.studiograph/connectors/*.json    — full configs with literal secrets
+    //   <workspace>/.studiograph/connectors/*.json — sanitized configs ($ENV_VAR)
+    // We only mine the homedir layer — workspace files carry placeholders, not
+    // values, and the dual-write layer (Phase 5) already kept them empty.
+    const dir = join(homePath, '.studiograph', 'connectors');
+    if (!existsSync(dir))
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const file of entries) {
+        if (!file.endsWith('.json'))
+            continue;
+        const filePath = join(dir, file);
+        result.sources.push(filePath);
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        }
+        catch (err) {
+            // eslint-disable-next-line no-console
+            console.warn(`[secrets] importer: failed to parse ${filePath}: ${err instanceof Error ? err.message : err}`);
+            continue;
+        }
+        if (!parsed || typeof parsed.name !== 'string')
+            continue;
+        const name = String(parsed.name).toLowerCase();
+        const auth = parsed.headers?.['Authorization'] ?? parsed.headers?.['authorization'];
+        if (isNonEmptyString(auth) && !looksLikeEnvPlaceholder(auth)) {
+            const key = `connector.${name}.auth`;
+            const def = resolveConnectorKeyDef(key);
+            if (def)
+                await writeOne(store, def, auth, result);
+        }
+        const oauthSecret = parsed.oauth?.client_secret;
+        if (isNonEmptyString(oauthSecret) && !looksLikeEnvPlaceholder(oauthSecret)) {
+            const key = `connector.${name}.oauth_secret`;
+            const def = resolveConnectorKeyDef(key);
+            if (def)
+                await writeOne(store, def, oauthSecret, result);
+        }
+    }
+}
+async function importFromWorkspaceJson(store, workspacePath, result) {
+    if (!workspacePath)
+        return;
+    const path = join(workspacePath, '.studiograph', 'workspace.json');
+    if (!existsSync(path))
+        return;
+    result.sources.push(path);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.warn(`[secrets] importer: failed to parse ${path}: ${err instanceof Error ? err.message : err}`);
+        return;
+    }
+    // R2 credentials (workspace.json has its own nested shape that doesn't
+    // match the registry's flat paths — translate explicitly).
+    const accessKey = readPath(parsed, 'r2_config.access_key_id');
+    const secretKey = readPath(parsed, 'r2_config.secret_access_key');
+    const accessDef = getKeyDef('r2.access_key_id');
+    const secretDef = getKeyDef('r2.secret_access_key');
+    if (accessDef)
+        await writeOne(store, accessDef, accessKey, result);
+    if (secretDef)
+        await writeOne(store, secretDef, secretKey, result);
+    // Search api_key — provider-keyed.
+    const searchApiKey = readPath(parsed, 'search.api_key');
+    const searchProvider = readPath(parsed, 'search.provider');
+    if (isNonEmptyString(searchApiKey) && !looksLikeEnvPlaceholder(searchApiKey)) {
+        const providerKey = searchProviderKey(typeof searchProvider === 'string' ? searchProvider : undefined);
+        if (providerKey) {
+            const def = getKeyDef(providerKey);
+            if (def)
+                await writeOne(store, def, searchApiKey, result);
+        }
+    }
+    const googleCx = readPath(parsed, 'search.google_cx');
+    const cxDef = getKeyDef('search.google.cx');
+    if (cxDef)
+        await writeOne(store, cxDef, googleCx, result);
+}
+async function importFromEnv(store, result) {
+    result.sources.push('env');
+    for (const def of REGISTRY) {
+        // Bootstrap, user-secret, user-setting all skip the store entirely.
+        if (!isStoreManaged(def.classification))
+            continue;
+        for (const alias of def.envAliases) {
+            const raw = process.env[alias];
+            if (!isNonEmptyString(raw))
+                continue;
+            if (looksLikeEnvPlaceholder(raw))
+                continue;
+            await writeOne(store, def, raw, result);
+            break; // first non-empty env alias wins, matching resolver order
+        }
+    }
+}
+function searchProviderKey(provider) {
+    switch (provider) {
+        case 'brave': return 'search.brave.api_key';
+        case 'google': return 'search.google.api_key';
+        case 'tavily': return 'search.tavily.api_key';
+        default: return undefined;
+    }
+}
+/**
+ * Touch every legacy source once and copy registry-mapped values into
+ * the encrypted store. Safe to call repeatedly — guarded by
+ * `meta.imported_legacy_at`. Caller (serve.ts) decides whether to log
+ * the result; the importer itself is silent on success and
+ * `console.warn`s on per-source parse failures.
+ *
+ * Returns counts so the caller can produce the boot one-liner the plan
+ * specifies (`[secrets] Imported N settings, M secrets from legacy files`).
+ */
+export async function runFirstRunImporter(ctx = {}) {
+    if (!hasSecretStore()) {
+        return { skipped: true, settings: 0, secrets: 0, sources: [] };
+    }
+    const store = getSecretStore();
+    const result = {
+        skipped: false,
+        settings: 0,
+        secrets: 0,
+        sources: [],
+    };
+    if (hasRunBefore(store)) {
+        result.skipped = true;
+        return result;
+    }
+    const homePath = ctx.homePath ?? homedir();
+    await importFromUserJson(store, homePath, result);
+    await importFromConnectors(store, homePath, result);
+    await importFromWorkspaceJson(store, ctx.workspacePath, result);
+    if (ctx.importFromEnv) {
+        await importFromEnv(store, result);
+    }
+    markImported(store);
+    return result;
+}
+/**
+ * Test seam: clear the `imported_legacy_at` marker so the next call
+ * re-runs the importer. Tests only — production callers should never
+ * unmark a successful import.
+ */
+export function _resetImportedMarker() {
+    if (!hasSecretStore())
+        return;
+    const store = getSecretStore();
+    store.db.prepare("DELETE FROM meta WHERE key='imported_legacy_at'").run();
+}
+/**
+ * Utility for tests + diagnostics — does the store look "fresh"? Used
+ * by the boot path to decide whether to log the importer summary line
+ * vs. silently confirm "already imported".
+ */
+export function importerHasRun() {
+    if (!hasSecretStore())
+        return false;
+    return hasRunBefore(getSecretStore());
+}
+// statSync is imported for parity with other readers that may surface
+// file-mode warnings; keeping the import so future hardening can wire
+// in `seedWorldReadable`-style checks without a separate change.
+void statSync;
+//# sourceMappingURL=importer.js.map

package/dist/core/secrets/importer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"importer.js","sourceRoot":"","sources":["../../../src/core/secrets/importer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAoC,MAAM,eAAe,CAAC;AAC9G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG5D,MAAM,cAAc,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAa9E;;;GAGG;AACH,SAAS,uBAAuB,CAAC,CAAU;IACzC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,IAAY;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAQ,GAAG,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAiB;IACvC,OAAO,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,mBAAmB,CAAC;AAC/D,CAAC;AAyBD;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAwC;IAC5D,MAAM,GAAG,GAAI,KAAa,CAAC,EAAE;SAC1B,OAAO,CAAC,uDAAuD,CAAC;SAChE,GAAG,EAAmC,CAAC;IAC1C,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAwC;IAC3D,KAAa,CAAC,EAAE;SACd,OAAO,CACN,oHAAoH,CACrH;SACA,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAChB,KAAwC,EACxC,GAAW,EACX,QAAiB;IAEjB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAwC,EACxC,GAAW,EACX,KAAc,EACd,MAAsB;IAEtB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO;IAClE,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO;IAE3C,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO;IAElD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO;QACrC,MAAM,KAAK,CAAC,GAAG,CACb,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EACxB,cAAc,CACf,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,CACb,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EACxB,cAAc,CACf,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAwC,EACxC,QAAgB,EAChB,MAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,KAAK,WAAW;YAAE,SAAS;QACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS,CAAC,4CAA4C;QAC/F,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAwC,EACxC,QAAgB,EAChB,MAAsB;IAEtB,2CAA2C;IAC3C,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,uCAAuC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QACpF,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,aAAa,IAAI,OAAO,CAAC;YACrC,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,GAAG;gBAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAChD,IAAI,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,MAAM,GAAG,GAAG,aAAa,IAAI,eAAe,CAAC;YAC7C,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,GAAG;gBAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAwC,EACxC,aAAiC,EACjC,MAAsB;IAEtB,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACpD,IAAI,SAAS;QAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,SAAS;QAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAEnE,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvG,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACnC,IAAI,GAAG;gBAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,KAAK;QAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAwC,EACxC,MAAsB;IAEtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAClD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,IAAI,uBAAuB,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,0DAA0D;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA4B;IACrD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,OAAO,sBAAsB,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,OAAO,uBAAuB,CAAC;QAC9C,KAAK,QAAQ,CAAC,CAAC,OAAO,uBAAuB,CAAC;QAC9C,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EAAE;IAEvB,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC;IAC3C,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC9B,KAAa,CAAC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,KAAK,QAAQ,CAAC"}

package/dist/core/secrets/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Secrets / settings store — barrel export. Phase 1 surface.
+ */
+export { REGISTRY, RECOMMENDED_MODELS, SYSTEM_ALLOWLIST, OPERATIONAL_ALLOWLIST, getKeyDef, getKeyDefByEnvAlias, getKeyConstraint, listWorkspaceSettingsSchema, getAllConsoleUrls, allRegisteredEnvAliases, } from './registry.js';
+export type { Classification, RedactionMode, KeyDef, KeyConstraint, SettingSchemaEntry, SettingRecommendations, } from './registry.js';
+export { encrypt, decrypt, generateMasterKey } from './encryption.js';
+export type { AADInput, EncryptedRow } from './encryption.js';
+export { loadMasterKey, loadPreviousMasterKey } from './master-key.js';
+export type { LoadedMasterKey } from './master-key.js';
+export { SqliteEncryptedStore } from './SqliteEncryptedStore.js';
+export type { SqliteEncryptedStoreOptions } from './SqliteEncryptedStore.js';
+export { AuditLogger } from './audit.js';
+export type { AuditAction, AuditEvent } from './audit.js';
+export { SettingsResolver } from './SettingsResolver.js';
+export type { ResolutionSource, ResolvedValue, ResolverContext, ResolverDeps, } from './SettingsResolver.js';
+export { tryResolve, tryResolveWithSource } from './read-flip.js';
+export type { ActorContext, SecretMetadata, SecretStore, SetSecretInput, } from './SecretStore.js';
+export type { SettingMetadata, SettingsStore, SetSettingInput, } from './SettingsStore.js';
+import type { SqliteEncryptedStore as SqliteEncryptedStoreType } from './SqliteEncryptedStore.js';
+export declare function setSecretStore(store: SqliteEncryptedStoreType | undefined): void;
+/**
+ * Module-level accessor. Throws when the boot path didn't initialize the
+ * store (test harness, early-init code paths). Hard error rather than
+ * silent undefined to surface mis-wired callsites quickly.
+ */
+export declare function getSecretStore(): SqliteEncryptedStoreType;
+export declare function hasSecretStore(): boolean;
+import { SettingsResolver } from './SettingsResolver.js';
+/**
+ * Mutation notification — fires after any successful set/delete on the
+ * store. Consumers subscribe here so they can react to store changes
+ * without polling. Primary use case: the agent pool cache eviction
+ * when a model.* key changes (otherwise running agents keep using the
+ * apiKey they captured at construction time).
+ *
+ * Listener errors are swallowed — never let a stray listener take down
+ * a write path. Listeners must not be slow (we run them synchronously
+ * on the write request's hot path).
+ */
+type SecretMutationListener = (key: string) => void;
+export declare function onSecretMutation(fn: SecretMutationListener): () => void;
+export declare function notifySecretMutation(key: string): void;
+export declare function getSettingsResolver(): SettingsResolver | undefined;
+/**
+ * Reset the cached resolver. Tests call this after swapping the store
+ * out — without it the cached resolver retains the prior `_store`
+ * reference and reads against a closed handle.
+ */
+export declare function _resetCachedResolver(): void;

package/dist/core/secrets/index.js

@@ -0,0 +1,74 @@
+/**
+ * Secrets / settings store — barrel export. Phase 1 surface.
+ */
+export { REGISTRY, RECOMMENDED_MODELS, SYSTEM_ALLOWLIST, OPERATIONAL_ALLOWLIST, getKeyDef, getKeyDefByEnvAlias, getKeyConstraint, listWorkspaceSettingsSchema, getAllConsoleUrls, allRegisteredEnvAliases, } from './registry.js';
+export { encrypt, decrypt, generateMasterKey } from './encryption.js';
+export { loadMasterKey, loadPreviousMasterKey } from './master-key.js';
+export { SqliteEncryptedStore } from './SqliteEncryptedStore.js';
+export { AuditLogger } from './audit.js';
+export { SettingsResolver } from './SettingsResolver.js';
+export { tryResolve, tryResolveWithSource } from './read-flip.js';
+let _store;
+export function setSecretStore(store) {
+    _store = store;
+    // Drop the cached resolver so a freshly-installed store isn't shadowed.
+    _resolver = undefined;
+}
+/**
+ * Module-level accessor. Throws when the boot path didn't initialize the
+ * store (test harness, early-init code paths). Hard error rather than
+ * silent undefined to surface mis-wired callsites quickly.
+ */
+export function getSecretStore() {
+    if (!_store) {
+        throw new Error('Secrets store not initialized. The serve.ts bootstrap should have set this up — call site is running too early or in a test without store wiring.');
+    }
+    return _store;
+}
+export function hasSecretStore() {
+    return _store !== undefined;
+}
+import { SettingsResolver } from './SettingsResolver.js';
+const _mutationListeners = new Set();
+export function onSecretMutation(fn) {
+    _mutationListeners.add(fn);
+    return () => { _mutationListeners.delete(fn); };
+}
+export function notifySecretMutation(key) {
+    for (const fn of _mutationListeners) {
+        try {
+            fn(key);
+        }
+        catch {
+            // Listener bugs must not break the caller's write.
+        }
+    }
+}
+/**
+ * Lazily-instantiated process-wide SettingsResolver. Reads the same
+ * singleton SqliteEncryptedStore that `setSecretStore()` registered. The
+ * resolver is cheap (just a wrapper) — we cache it so callers don't
+ * have to plumb a `SettingsResolver` instance through their call graph.
+ *
+ * Returns undefined when the new-store flag is off / boot didn't
+ * initialize the store — call sites in Phase 6 use
+ * `tryResolveFromStore()` which guards on this.
+ */
+let _resolver;
+export function getSettingsResolver() {
+    if (!_store)
+        return undefined;
+    if (!_resolver) {
+        _resolver = new SettingsResolver({ secrets: _store, settings: _store });
+    }
+    return _resolver;
+}
+/**
+ * Reset the cached resolver. Tests call this after swapping the store
+ * out — without it the cached resolver retains the prior `_store`
+ * reference and reads against a closed handle.
+ */
+export function _resetCachedResolver() {
+    _resolver = undefined;
+}
+//# sourceMappingURL=index.js.map

package/dist/core/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/secrets/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,mBAAmB,EACnB,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAUvB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGtE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAQzD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAkBlE,IAAI,MAA4C,CAAC;AAEjD,MAAM,UAAU,cAAc,CAAC,KAA2C;IACxE,MAAM,GAAG,KAAK,CAAC;IACf,wEAAwE;IACxE,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,KAAK,SAAS,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAczD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE7D,MAAM,UAAU,gBAAgB,CAAC,EAA0B;IACzD,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,GAAG,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,EAAE,CAAC,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,SAAuC,CAAC;AAC5C,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC"}

package/dist/core/secrets/master-key.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Master-key bootstrap.
+ *
+ * Resolution order:
+ *   1. STUDIOGRAPH_MASTER_KEY env var (base64-encoded 32 bytes).
+ *      Always wins. In production this is the only acceptable source.
+ *   2. ~/.studiograph/master-key file (mode 0600). Local-dev only.
+ *      If absent, a fresh 32-byte key is generated, written, and a one-time
+ *      warning printed to stderr with backup instructions.
+ *
+ * Production gate: when RAILWAY_ENVIRONMENT is set and the env-var is
+ * unset, throw. We do NOT silently generate a key in production — that
+ * would be ephemeral, would invalidate every encrypted row on the next
+ * restart, and would mask a misconfigured deploy.
+ */
+export interface LoadedMasterKey {
+    key: Uint8Array;
+    /** Where it came from; useful for boot logging without leaking the value. */
+    source: 'env' | 'file' | 'generated';
+    /** Path to the on-disk file (only set when source !== 'env'). */
+    filePath?: string;
+}
+/**
+ * Load the master key. Idempotent — safe to call multiple times.
+ *
+ * In a long-running process you should call once at boot and cache the
+ * result. The local-dev side-effect (file generate + warn) only fires if
+ * the file does not exist.
+ */
+export declare function loadMasterKey(opts?: {
+    filePath?: string;
+}): LoadedMasterKey;
+/**
+ * Optional companion: load a previous master key for rotation transitions.
+ * Returns undefined when STUDIOGRAPH_MASTER_KEY_PREVIOUS is unset — that's
+ * the steady state. Caller must tolerate undefined.
+ */
+export declare function loadPreviousMasterKey(): Uint8Array | undefined;

package/dist/core/secrets/master-key.js

@@ -0,0 +1,122 @@
+/**
+ * Master-key bootstrap.
+ *
+ * Resolution order:
+ *   1. STUDIOGRAPH_MASTER_KEY env var (base64-encoded 32 bytes).
+ *      Always wins. In production this is the only acceptable source.
+ *   2. ~/.studiograph/master-key file (mode 0600). Local-dev only.
+ *      If absent, a fresh 32-byte key is generated, written, and a one-time
+ *      warning printed to stderr with backup instructions.
+ *
+ * Production gate: when RAILWAY_ENVIRONMENT is set and the env-var is
+ * unset, throw. We do NOT silently generate a key in production — that
+ * would be ephemeral, would invalidate every encrypted row on the next
+ * restart, and would mask a misconfigured deploy.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { generateMasterKey } from './encryption.js';
+const MASTER_KEY_ENV = 'STUDIOGRAPH_MASTER_KEY';
+const MASTER_KEY_PREVIOUS_ENV = 'STUDIOGRAPH_MASTER_KEY_PREVIOUS';
+/**
+ * Default location of the local-dev fallback file.
+ */
+function defaultMasterKeyPath() {
+    return join(homedir(), '.studiograph', 'master-key');
+}
+function isProduction() {
+    return Boolean(process.env.RAILWAY_ENVIRONMENT);
+}
+function decodeBase64Key(raw, source) {
+    const trimmed = raw.trim();
+    let bytes;
+    try {
+        bytes = new Uint8Array(Buffer.from(trimmed, 'base64'));
+    }
+    catch {
+        throw new Error(`master-key: ${source} is not valid base64`);
+    }
+    if (bytes.length !== 32) {
+        throw new Error(`master-key: ${source} decoded to ${bytes.length} bytes (need 32)`);
+    }
+    return bytes;
+}
+/**
+ * Load the master key. Idempotent — safe to call multiple times.
+ *
+ * In a long-running process you should call once at boot and cache the
+ * result. The local-dev side-effect (file generate + warn) only fires if
+ * the file does not exist.
+ */
+export function loadMasterKey(opts = {}) {
+    const envValue = process.env[MASTER_KEY_ENV];
+    if (envValue && envValue.trim()) {
+        return {
+            key: decodeBase64Key(envValue, `${MASTER_KEY_ENV} env var`),
+            source: 'env',
+        };
+    }
+    // Production must be env-only. Fall through is misconfiguration.
+    if (isProduction()) {
+        throw new Error(`master-key: ${MASTER_KEY_ENV} is required in production (RAILWAY_ENVIRONMENT is set). ` +
+            `Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+    }
+    // Local-dev: file fallback.
+    const filePath = opts.filePath ?? defaultMasterKeyPath();
+    if (existsSync(filePath)) {
+        const raw = readFileSync(filePath, 'utf-8');
+        return {
+            key: decodeBase64Key(raw, `master-key file at ${filePath}`),
+            source: 'file',
+            filePath,
+        };
+    }
+    // First-run on local dev: generate and persist.
+    const key = generateMasterKey();
+    const b64 = Buffer.from(key).toString('base64');
+    // Make sure the parent directory exists with restrictive mode.
+    mkdirSync(join(filePath, '..'), { recursive: true, mode: 0o700 });
+    // mkdirSync's mode is masked by umask, so retighten.
+    try {
+        chmodSync(join(filePath, '..'), 0o700);
+    }
+    catch { /* non-fatal */ }
+    writeFileSync(filePath, b64, { mode: 0o600 });
+    try {
+        chmodSync(filePath, 0o600);
+    }
+    catch { /* non-fatal */ }
+    // One-time stderr warning. Local-dev UX only; production never lands here.
+    // Stderr because stdout is reserved for app output and could be piped.
+    process.stderr.write([
+        '',
+        '─'.repeat(72),
+        'studiograph: generated a new master key (first run)',
+        `  Location: ${filePath}`,
+        '  Mode:     0600 (owner read/write only)',
+        '',
+        `  This key encrypts the secrets store. If you lose it, every encrypted`,
+        `  row in secrets.db is permanently unrecoverable.`,
+        '',
+        `  Back it up. To export for a different environment:`,
+        `    cat ${filePath}`,
+        `  Then set in the new environment:`,
+        `    ${MASTER_KEY_ENV}=<contents>`,
+        '─'.repeat(72),
+        '',
+    ].join('\n'));
+    return { key, source: 'generated', filePath };
+}
+/**
+ * Optional companion: load a previous master key for rotation transitions.
+ * Returns undefined when STUDIOGRAPH_MASTER_KEY_PREVIOUS is unset — that's
+ * the steady state. Caller must tolerate undefined.
+ */
+export function loadPreviousMasterKey() {
+    const v = process.env[MASTER_KEY_PREVIOUS_ENV];
+    if (!v || !v.trim())
+        return undefined;
+    return decodeBase64Key(v, `${MASTER_KEY_PREVIOUS_ENV} env var`);
+}
+//# sourceMappingURL=master-key.js.map

package/dist/core/secrets/master-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"master-key.js","sourceRoot":"","sources":["../../../src/core/secrets/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAUlE;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAc;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,eAAe,KAAK,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAA8B,EAAE;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,GAAG,cAAc,UAAU,CAAC;YAC3D,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,eAAe,cAAc,2DAA2D;YACxF,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IACzD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO;YACL,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,sBAAsB,QAAQ,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,+DAA+D;IAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,qDAAqD;IACrD,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACzE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,EAAE;QACF,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACd,qDAAqD;QACrD,eAAe,QAAQ,EAAE;QACzB,0CAA0C;QAC1C,EAAE;QACF,wEAAwE;QACxE,mDAAmD;QACnD,EAAE;QACF,sDAAsD;QACtD,WAAW,QAAQ,EAAE;QACrB,oCAAoC;QACpC,OAAO,cAAc,aAAa;QAClC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,uBAAuB,UAAU,CAAC,CAAC;AAClE,CAAC"}