Public: anyone can read this; the crew can change it.
Secret routes leave api.ts for src/http/api/secrets.ts #6895
Check · Review · Land · Live done — Landed and live in production.
The three `/api/v1/secrets` routes now live in their own file, `src/http/api/secrets.ts`, which exports `secretRoutes(router)`. The routes are `GET /api/v1/secrets/:scope` and `PUT`/`DELETE /api/v1/secrets/:scope/:name`. Their code and comment moved unchanged, so behaviour doesn't change: admin scope is still required, and listing still returns names and timestamps, never a value.
shipped production is serving it deploy e11532c
The three /api/v1/secrets routes now live in their own file, src/http/api/secrets.ts, which exports secretRoutes(router). The routes are GET /api/v1/secrets/:scope and PUT/DELETE /api/v1/secrets/:scope/:name. Their code and comment moved unchanged, so behaviour doesn't change: admin scope is still required, and listing still returns names and timestamps, never a value.
In src/http/api.ts the diff is one removal, one call and one import. The block is gone, secretRoutes(router); sits exactly where it was, the new file is imported next to egressGrantRoutes, and the unused actions/secrets.ts import is dropped. Nothing was copied: the new module imports its helpers from where they already live (respond.ts, route_timing.ts, actions/secrets.ts).
No tests changed. bun x tsc --noEmit is clean, and the secrets and OpenAPI suites pass: secret-store, mcp-secrets, secrets-signins-timing, run-gate-doors, security-floor-routes, openapi, openapi-coverage, openapi-oa-sec and openapi-oa-5242. The OpenAPI tests already scan src/http/api/, so the moved routes are still checked against the spec. Nothing under src/web/ changed, so the design lint was not run.
The issue's last comment says it was parked on 2026-10-26 until the flow alarms in #5930 clear. I worked it because this run asked for it on this branch.
To try it, call GET /api/v1/secrets/forge with an admin token on the preview. It should answer { items, next_cursor: null } exactly as on main.
🤖 Generated with Claude Code
Clean, behaviour-preserving move. The three /api/v1/secrets routes are byte-for-byte the same in src/http/api/secrets.ts, follow the egress_grants.ts pattern, and import the same helpers from respond.ts (body is the stream-counted readBounded cap, str, requireScope admin, respondAccess) — no copies, and the now-unused actions/secrets import is dropped from api.ts. Registration order is unchanged (secretRoutes(router) sits where the block was). Admin-scope check still runs before any read or write; list still returns names and timestamps only. Existing suites (secret-store, mcp-secrets, security-floor-routes, openapi*) already exercise these paths, so no new test is needed for a pure move. Preview: GET /api/v1/secrets/forge and PUT /api/v1/secrets/forge/X without a token both answer 401 unauthorized, as on main. Small, single-purpose, shrinks api.ts's hot-file contention — in line with the pipeline direction.
The three
/api/v1/secretsroutes now live in their own file,src/http/api/secrets.ts, which exportssecretRoutes(router). The routes areGET /api/v1/secrets/:scopeandPUT/DELETE /api/v1/secrets/:scope/:name. Their code and comment moved unchanged, so behaviour doesn't change: admin scope is still required, and listing still returns names and timestamps, never a value.In
src/http/api.tsthe diff is one removal, one call and one import. The block is gone,secretRoutes(router);sits exactly where it was, the new file is imported next toegressGrantRoutes, and the unusedactions/secrets.tsimport is dropped. Nothing was copied: the new module imports its helpers from where they already live (respond.ts,route_timing.ts,actions/secrets.ts).No tests changed.
bun x tsc --noEmitis clean, and the secrets and OpenAPI suites pass:secret-store,mcp-secrets,secrets-signins-timing,run-gate-doors,security-floor-routes,openapi,openapi-coverage,openapi-oa-secandopenapi-oa-5242. The OpenAPI tests already scansrc/http/api/, so the moved routes are still checked against the spec. Nothing undersrc/web/changed, so the design lint was not run.The issue's last comment says it was parked on 2026-10-26 until the flow alarms in #5930 clear. I worked it because this run asked for it on this branch.
To try it, call
GET /api/v1/secrets/forgewith an admin token on the preview. It should answer{ items, next_cursor: null }exactly as on main.🤖 Generated with Claude Code
Closes #6330