feat: add @constructive-io/infra-secrets — secret resolution bridge

[pyramation]

Summary

Adds packages/infra-secrets — a TypeScript package that resolves function secrets from constructive_store_private.app_secrets using the infra_public.function_secret_requirements junction table.

Resolution cascade:

1. Org-scoped: Looks up secret with namespace = database_id (per-tenant override)
2. Global fallback: Falls back to namespace = 'default' (platform-wide)
3. Strict mode (default): Throws SecretResolutionError if a required (non-optional) secret is missing
4. Non-strict mode: Returns null for unresolved secrets

API:

• resolveSecrets(client, function_id, database_id) → ResolvedSecret[] (name, value, source)
• resolveSecretsMap(client, function_id, database_id) → Record<string, string> (flat map, omits missing)

Tests simulate 5 real functions from constructive-functions/:

• email:send_verification_link (SMTP_HOST, SMTP_PASSWORD, FROM_EMAIL + optional MAILGUN_*, GRAPHQL_AUTH_TOKEN)
• email:send_email (same profile)
• email:send_email_link (same profile)
• email:simple_email (same profile)
• embed:process_file_embedding (OPENAI_API_KEY)

13 integration tests verify global resolution, org-scoped overrides with fallback, optional secrets, strict/non-strict modes, and database-scoped function definitions.

Review & Testing Checklist for Human

• Verify the resolveOne cascade logic matches how your app_secrets namespaces are used in production (org = database_id as namespace, global = 'default')
• Consider whether this should also handle PGP-encrypted secrets at the TS level, or if the app_secrets_get function handles decryption transparently (current design relies on the SQL function for decryption)
• Check that the infra_public table names (function_secret_requirements, secret_definitions) match what's deployed via packages/infra in constructive-db

Notes

This is the runtime piece for the secret resolution design discussed in constructive-db#1211. The worker (knative-job-worker) would call resolveSecretsMap() before dispatching to a function, injecting resolved secrets into the HTTP request headers/body.

Future work: integrate this into the worker's doWork() method so secrets flow automatically to Knative functions without env vars.

Link to Devin session: https://app.devin.ai/sessions/c0494871633d4beb91f1e16e53c776d1
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring