arc53-machine 667d4bbab0 Encrypt connection credentials with an owner-bound AES-GCM envelope ...

Adds a v2 credential envelope next to the v1 tool-secret helpers:
AES-256-GCM, a master key derived once per process from
ENCRYPTION_SECRET_KEY, and a per-record key from HKDF over the owner's
id, which is also the associated data, so a blob moved onto another
user's row does not decrypt. The envelope names its key, so
ENCRYPTION_SECRET_KEY_PREVIOUS keeps old rows readable during a
rotation.

Log redaction now also covers token_info, tokens and client_info, and
the API warns at startup when the public default key is in use.

2026-09-28 17:03:02 +01:00

..

__init__.py

refactor: rename the application package to docsgpt

2026-09-07 10:20:43 +01:00

encryption.py

Encrypt connection credentials with an owner-bound AES-GCM envelope

2026-09-28 17:03:02 +01:00

safe_url.py

chore(deps): anthropic 1.5, openai 3.13, and the move to httpx2

2026-09-12 17:44:18 +01:00

zip_archive.py

refactor: rename the application package to docsgpt

2026-09-07 10:20:43 +01:00