import { Effect, Schema } from "effect"; import type { StorageFailure } from "@executor-js/storage-core"; import { SecretId, ScopeId } from "./ids"; // ---------------------------------------------------------------------------// SecretProvider — what a concrete backend (keychain, 1password, file,// memory, workos-vault, …) implements. Providers are contributed by// plugins via `plugin.secretProviders` and registered in the executor// at startup; there's no runtime registration.//// The `key` field is the provider's identifier in the secret table's// `provider` column and in `executor.secrets.set({ provider, ... })`.// Unique per executor.// --------------------------------------------------------------------------- export interface SecretProvider {  /** Unique key (e.g. "keychain", "env", "1password", "memory"). */  readonly key: string;  /** If false, `set` and `delete` are never called. The executor   *  honours this before routing writes — trying to write to a   *  read-only provider is an error, not a silent drop. */  readonly writable: boolean;  /** Get a secret value. `scope` is the executor scope the lookup is   *  being made on behalf of — providers that partition their storage   *  by scope (memory, keychain via service name, per-vault in   *  1password) use it; providers without tenancy ignore it and fall   *  back to a flat lookup. Failures (provider unreachable, decryption   *  failed, etc.) surface as `StorageFailure` — the executor treats   *  a provider call the same as a DB call; `StorageError` is captured   *  at the HTTP edge to `InternalError`, `UniqueViolationError` dies. */  readonly get: (id: string, scope: string) => Effect.Effect<string | null, StorageFailure>;  /** Check whether a provider has a backing value without returning it.   *  Providers that can answer this cheaply should implement it so   *  stale core routing rows don't appear as selectable secrets. */  readonly has?: (id: string, scope: string) => Effect.Effect<boolean, StorageFailure>;  /** Set a secret value at a named scope. Only called on writable   *  providers. Providers that partition by scope use this arg to   *  decide where to write; flat providers ignore it. */  readonly set?: (id: string, value: string, scope: string) => Effect.Effect<void, StorageFailure>;  /** Delete a secret at a named scope. Only called on writable providers.   *  Returns true if something was deleted. */  readonly delete?: (id: string, scope: string) => Effect.Effect<boolean, StorageFailure>;  /** Enumerate known secret entries. Optional — not all backends can   *  enumerate (env-backed providers, for example). */  readonly list?: () => Effect.Effect<    readonly { readonly id: string; readonly name: string }[],    StorageFailure  >;  /** Whether the provider may be asked during id-only fallback resolution.   *  Providers whose own auth depends on `ctx.secrets.get` should opt out to   *  avoid recursive fallback through themselves. */  readonly allowFallback?: boolean;} // ---------------------------------------------------------------------------// SecretRef — metadata about a stored secret. Returned from// `executor.secrets.list()`. The actual value lives in the provider// and is only reachable via `executor.secrets.get(id)`.// --------------------------------------------------------------------------- export class SecretRef extends Schema.Class<SecretRef>("SecretRef")({  id: SecretId,  scopeId: ScopeId,  /** Human-readable label (e.g. "Cloudflare API Token") */  name: Schema.String,  /** Which provider holds the value */  provider: Schema.String,  createdAt: Schema.Date,}) {} // ---------------------------------------------------------------------------// SetSecretInput — all the metadata to write a secret in one call.// `executor.secrets.set(input)` takes this and writes both the// value (to the provider) and the ref (to the `secret` table).//// `scope` is required — there's no default write target. Callers name// which scope in the executor's stack should own the secret. Typical// pattern: UI wiring up org-level API keys writes to the org scope;// OAuth token exchange writes to the innermost per-user scope.// --------------------------------------------------------------------------- export class SetSecretInput extends Schema.Class<SetSecretInput>("SetSecretInput")({  id: SecretId,  /** Scope id to own this secret. Must be one of the executor's   *  configured scopes. */  scope: ScopeId,  /** Display name shown in secret-list UI. */  name: Schema.String,  /** The secret value itself — never persisted outside the provider. */  value: Schema.String,  /** Optional provider routing. If unset the executor picks the first   *  writable provider in registration order. */  provider: Schema.optional(Schema.String),}) {} export class RemoveSecretInput extends Schema.Class<RemoveSecretInput>("RemoveSecretInput")({  id: SecretId,  /** Scope id whose secret row/value should be removed. Must be one of   *  the executor's configured scopes. */  targetScope: ScopeId,}) {}