"use strict";
/**
 * Per-organization credential payloads, shared between server and UI.
 *
 * A credential row is canonically identified by the
 * `(role, backend, auth_method)` tuple; the schema stores the tuple,
 * not a dotted-string discriminator. The dotted form
 * `<role>.<backend>.<auth-method>` clients see in `type` is a derived
 * label projected from the tuple at DTO-build time. Always 3 segments
 * — even when a backend has a single canonical auth method, it's
 * recorded explicitly so the wire format and the schema stay in
 * lockstep without a per-backend special case.
 *
 * Each row carries `{ secrets, metadata }`. The database enforces the
 * split at the column level: `secrets` is encrypted, `metadata` is
 * plaintext jsonb. The union below forces every new field to pick a
 * side at authoring time — a future column cannot accidentally stuff
 * a secret into `metadata` without the TS compiler flagging it,
 * because the keys in each variant's `metadata` are fixed.
 *
 * The registry (`packages/server/src/db/repository/credential/registry.ts`)
 * owns the matching zod validators, the runtime-plaintext-location
 * pin, and the cardinality (`'singleton' | 'multi' | 'per-user'`).
 * This file only expresses the shape both sides of the wire agree on.
 *
 *  - `provisioning.*` — admin credentials a worker uses to create
 *    per-app logical databases in a customer's cloud.
 *  - `inference.*` — credentials used to call a managed inference API
 *    (Snowflake Cortex REST API, Databricks AI Gateway). Non-singleton
 *    so an org can keep separate dev/prod rows.
 *  - reserved: `authoring.*`, `runtime.*`, `connection.*`, `pat.*`,
 *    `trust.*`, `generator.*`.
 *
 * Trust and generator payload variants don't appear in the union yet —
 * those land in the followup PR alongside their registry entries. The
 * schema (and the CHECK constraint allowing `class IN ('stored', 'trust',
 * 'generator')`) already supports them so the followup is registry-only.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.RUNTIME_PLAINTEXT_LOCATIONS = exports.CREDENTIAL_CLASSES = exports.CREDENTIAL_ROLES = void 0;
exports.formatCredentialType = formatCredentialType;
exports.parseCredentialType = parseCredentialType;
exports.credentialRole = credentialRole;
/**
 * All known `<role>` prefixes. Used by callers to filter credentials by
 * role (e.g. "list all provisioning credentials for this org"). Includes
 * reserved-but-unused roles so adding a new one later is a registry +
 * union change rather than a cross-cutting rename.
 *
 * `trust` and `generator` are reserved for the credential-class taxonomy
 * (see `CredentialClass` below): trust-config rows like
 * `trust.aws.iam-role-assume` will claim `role: 'trust'`, generator rows
 * like `generator.snowflake.keypair-jwt` will claim `role: 'generator'`.
 * They are not yet populated in the registry — these reserved values
 * just keep the `(class, role, backend, auth_method)` tuple consistent
 * so the followup PR's registrations are a code-only change.
 */
exports.CREDENTIAL_ROLES = ['provisioning', 'authoring', 'runtime', 'connection', 'inference', 'pat', 'trust', 'generator'];
/**
 * Three credential classes, recorded on every row of the `credential`
 * table:
 *   - `stored`     — encrypted secret bytes are the credential
 *                    (PATs, RSA private keys held for JWT signing).
 *   - `trust`      — the credential is a trust assertion held in
 *                    `metadata`; `encrypted_secrets` is NULL. The DB's
 *                    `chk_credential_secrets_class` CHECK constraint
 *                    enforces this.
 *   - `generator`  — encrypted bytes are *generator material* (OAuth
 *                    client_id+secret, RSA keypair) used to mint a
 *                    short-lived runtime token. The minted token is
 *                    never persisted; only the cache key tuple
 *                    (orgId, credentialId, fingerprint, derivationKey)
 *                    is.
 *
 * The class is denormalized onto the row so query paths can branch on
 * it without joining the registry, and so the schema CHECK constraint
 * can enforce the secrets-vs-no-secrets invariant. Only `'stored'`
 * entries are registered today; `'trust'` and `'generator'` are
 * reserved by the schema and the type system, awaiting their registry
 * additions in the followup PR.
 */
exports.CREDENTIAL_CLASSES = ['stored', 'trust', 'generator'];
/**
 * The process where a credential's plaintext (or its derived runtime
 * token, for generator credentials) may legitimately exist.
 *
 *   - `server`        — the Superblocks control plane.
 *   - `orchestrator`  — the customer's On-Premise Agent.
 *   - `worker`        — the orchestrator's per-language sandboxed
 *                       worker process (Go/JS/Python).
 *   - `customer-sm`   — held in the customer's own secret manager
 *                       (AWS Secrets Manager, GCP Secret Manager,
 *                       Vault); the Superblocks control plane never
 *                       touches it. Reserved.
 *
 * The repository's `assertProcessCanHandle` guard reads a process-level
 * `PROCESS_LOCATION` constant and rejects with
 * `WrongProcessForCredentialError` if a row's
 * `runtimePlaintextLocation` excludes the current process. Replaces
 * the implicit "this code path lives server-side, so the secret must
 * be decryptable here" convention with a typed check.
 */
exports.RUNTIME_PLAINTEXT_LOCATIONS = ['server', 'orchestrator', 'worker', 'customer-sm'];
/**
 * Format a `(role, backend, authMethod)` tuple into the dotted
 * `CredentialType` label that clients see on the wire. The schema
 * stores the tuple; this is the canonical projection for DTOs and
 * registry-by-label lookups. Always 3 segments.
 */
function formatCredentialType(role, backend, authMethod) {
    return `${role}.${backend}.${authMethod}`;
}
/**
 * Inverse of `formatCredentialType`. Returns `null` when the input
 * doesn't have exactly three dotted segments — the caller decides
 * whether that's a hard error or a soft signal. Backend and auth-method
 * identifiers may contain hyphens but never dots, so a length-3 split
 * is unambiguous.
 */
function parseCredentialType(type) {
    const parts = type.split('.');
    if (parts.length !== 3) {
        return null;
    }
    return { role: parts[0], backend: parts[1], authMethod: parts[2] };
}
/**
 * Convenience: extract the role segment of a `CredentialType`. The
 * full tuple round-trip is `parseCredentialType`.
 */
function credentialRole(type) {
    return type.split('.')[0];
}
//# sourceMappingURL=index.js.map